Trojan Wimad.e

Question: What is RelevantKnowledge?
Answer: RelevantKnowledge is a market research program. The software is installed with a user's permission and can be uninstalled anytime via the control panel. You can read more about this software at our website http://www.relevantknowledge.com/faq.aspx. The program also offers user rewards for taking part in occasional surveys. In addition, RelevantKnowledge donates a tree for every user's participation. This way the user helps out a good cause. If you have any questions, we encourage you to contact us at https://www.relevantknowledge.com/supportform.aspx
Thank you,
The Relevant Knowledge Support Team

Non, je me m'inquiète pas. Je cherche à comprendre.

par contre, en restaurant, l'infection Lop ( pages CId est de retour présente ).
Suis les indications du message 2 :
http://www.commentcamarche.net/forum/affich 8433826 trojan wimad e#1

A+

non jai utilise le logiciel uniblue registry booster qui a endomage le pc et du coup qand je redemarai mon pc un bip venant du pc retantissait 2/secondes et redamarer lordi a chaque fois par coup de chance jai pu reussir a le demarer correctement en mode sans echec et faire une restauration le seul probleme c est que windows mets du temp(2min) pour seteindre donc rassure toi ca na rien avoir avec les logiciels quon a utilise

alors voila le rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:17:36, on 2008-09-17
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Users\FAMILLE\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\Documents\Téléchargements\HiJackThis (2).exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.comodo.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Itch ford four knob] "C:\ProgramData\mags wma rect.95los"
O4 - HKCU\..\Run: [DEBUGNURB] "C:\ProgramData\logopenopen.8kxtn"
O4 - HKCU\..\Run: [Google Update] "C:\Users\FAMILLE\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: UltimateZip Quick Start.lnk = C:\Program Files\UltimateZip 2007\uzqkst.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://www.neufsecurite.fr/pchc/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: ASWLSVC - Unknown owner - C:\Windows\System32\ASWLSVC.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RelevantKnowledge - TMRG, Inc. - C:\Program Files\RelevantKnowledge\rlservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

Ce n'est pas les manipulations que nous avons fait qui ont endommagé ton PC.
Si j'ai bien compris tu as refais les manips que je t'avais conseilé

Peux-tu me dire quels outils tu as passé ?

Poste moi un rapport Hijackthis.

A+

slt verni jai eu un probleme avec le pc jai du faire une restauration et refaire les etapes et je pense que jai detruit le trojan car je navais pu comme avant un message d'erreur qui manque une dll au demarage car je sais que cetait le trojan voila tout

J'arrive toujours pas à visualisé tes réponses.
Le forum a parfois ce genre de bugs.
Je poste un message.cela me permettra peut-être de visualisé ta réponse.

A+

le forum est en disfonctionnement.
Je poste un message pour visualisé ta réponse.

slt verni29 jai eu un probleme avec le pc(quand je redemarai mon pc il fesait des bips 2/secondes venant de lunite central et il redemarai tt seul)jai reussi a le redemarai et faire une restauration du systeme je ne sais pas si ca va faire revenir les infections de toute facon je navais pas le choix en tous cas je fais refaire les manup depuis le depart et je te tiendrais au courant a+

voila jai fait ce que tu ma dis jattend tes instructions

Supprime la version que tu as téléchargé et recommence la manip, stp.

Si il a tourné pendant deux minutes, il a du supprimé les logiciels.
Si l’écran ne réapparait pas, tape sur les touches Ctrl + Alt + Supp. Ceci ouvre le gestionnaire de taches.
Dans l’onglet Processus, clique sur le menu Fichier, puis Executer et tape Explorer. Valide.

passe à la suite, je t'indiquerais comment supprimé manuellement les outils qu'on a utilisé.

A+

slt verni29 jai essayer toolcleaner mais le probleme c est que le programme ne repond plus apres 2 minutes donc je nai pas pu faire les manips suivantes

1) On va enlever les logiciels qui ont été utilisés..
Télécharge ToolsCleaner .sur le bureau

http://pc-system.fr/
Double-clique sur ToolsCleaner2.exe --> Recherche --> Suppression.
Il est possible que ton bureau disparaisse.

Fais un copier/coller du rapport qui se trouve dans C:\TCleaner.txt

2) Tu vas utiliser CCleaner.
http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

utilise les fonctions nettoyeur et registre.

3) Les points de restauration :
- Panneau de configuation --> Système --> Restauration du sytème
cocher " Désactiver la restauration .... " ( si elle est cochée sinon la décocher -- > valider -- > cocher )
Une fenêtre va s’ouvrir pour t’avertir que les poins de restauration existants seront supprimés.
Accepte.
Décoche ensuite « Désactiver la restauration .... » pour réactiver la restauration système
- Tu vas recréer un point de restauration propre.
Pour recréer un point de restauration :
Démarrer --> Programmes --> Accessoires --> Outils système --> Restauration système
Choisis "Créer un point de restauration". Suis les invites.

Après tout ca, ton PC devrait être propre et protégé.
Si tu as le moindre problème, poste un message.

Pourrais tu dans ce cas mettre le sujet comme résolu ?

A+

slt verni29
alors jai fait ce que tu ma dit a propos de hijack,avec kapersky jai pu faire une analyse intelligente qui a dure 1h quand meme et il ny a trouve aucune infection je ne pouvais pas faire de rapport car il ny avait pas d'icone pour un rapport voila tout

1) Lance Hijackthis ( click droit --> exécuter en tant qu'administrateur ) et tu choisis " Do a system scan only ".
Tu sélectionnes les lignes suivantes :

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

Tu choisis l'option " Fixchecked" en bas de la page.

2) Tu vas sur le site de Kaspersky:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Clique sur Demarrer Online-scanner ( en bas de page à droite ) pour commencer l'analyse.
Il te sera demandé d'installer un logiciel de Kaspersky, accepte.

A la fin de cette analyse, clique sur enregistrer le rapport.
Poste le contenu de ce rapport dans ton prochain message.

A+

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:31, on 2008-09-15
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Users\FAMILLE\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Windows\system32\conime.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wermgr.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\FAMILLE\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.comodo.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] "C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ORAHSSSessionManager] "C:\Program Files\Orange\SessionManager\SessionManager.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\FAMILLE\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - http://www.neufsecurite.fr/pchc/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: ASWLSVC - Unknown owner - C:\Windows\System32\ASWLSVC.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: RelevantKnowledge - TMRG, Inc. - C:\Program Files\RelevantKnowledge\rlservice.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

désolé pour toutes ces manips, mais c'est Vista qui veut ça.
Un conseil pur l'UAC. c'est très pratique car cela évite d'avoir ces alertes à chaque action mais quand tu navigues sur Internet, il ne faut jamais naviguer avec les droits d'administrateur car cela peut permettre plus facilement une intrusion dans ton PC.
Donc, à la fin de ces manpulations, il serait préférable que tu réactives l'UAC.

Poste moi un rapport Hijackthis.

A+

Et re-voila

-----------\\ ToolBar S&D 1.2.0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : FAMILLE ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total : 113 Go Free : 59 Go
D:\ (Local Disk) - NTFS - Total : 112 Go Free : 69 Go
E:\ (CD or DVD) - CDFS - Total : 0 Go Free : 0 Go
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
Option : [2] ( 2008-09-15|21:15 )

[ UAC => 0 ]

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskSBar\bar
Supprime! - C:\Program Files\AskSBar\SrchAstt
Supprime! - C:\Users\FAMILLE\AppData\Roaming\MICROS~1\Windows\Cookies\famille@mysearch[2].txt
Supprime! - C:\Program Files\AskSBar

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.comodo.com/search/"
"SEARCH PAGE"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\FAMILLE\AppData\Roaming\BitTorrent\SolidWorks 2008 SP0 Multilingual Incl Serial and Crack.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\PC.Tools.Internet.Security.Suite.2009.6.0.0 (incl Crack.zip.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Registry Mechanic_7.0.0.1010_Keygen.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Registry Mechanic_7.0.0.1010_Working_Keygen.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\SolidWorks 2008 SP0 Multilingual Incl Serial and Crack.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\SolidWorks 2008 SP0 Multilingual Incl Serial and Crack.torrent.bak
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Spyware Doctor 6.0.0.354 +Crack.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Spyware Doctor 6.0.0.354 +Crack.torrent.bak
C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\famille@crackserialkeygen[1].txt
C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\famille@www.keygen[2].txt
C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Recent\Uniblue RegistryBooster 2009 v2.1.0.0 Crack -ICWT.lnk
C:\Users\FAMILLE\Desktop\Morpheus Shared\Shared\real player crack.zip
C:\Users\FAMILLE\Documents\Morpheus Shared\Downloads\Partials\Nero Burning Rom 7 Ultra Edition Incl Keygen & Serial.zip
C:\Users\FAMILLE\Favorites\Norton crack, Norton serial, Norton keygen, Norton download, Norton warez, Norton nocd, Norton rapidshare.url

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 2008-09-15|20:06 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 2008-09-15|21:16 - Option : [2]

-----------\\ Fin du rapport a 21:16:50,97

je crois que tu t'es trompé et tu as passé LopS&d au lieu toolbarS&D.
Tu es bon pour refaire la manip sur l'UAC et repassé ToolbarS&d ( option 2 )
On va y arriver.

pendant ce temps, je regarde le rapport de ComBoFix.

A+

voila pour combofix

ComboFix 08-09-14.06 - FAMILLE 2008-09-15 20:54:53.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.993 [GMT 2:00]
Lancé depuis: C:\Users\FAMILLE\Desktop\Téléchargements\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\FAMILLE\AppData\Local\Temp\install_flash_player.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-15 au 2008-09-15 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-15 18:54 1,048,576 --sha-w C:\Users\Invité\ntuser.dat
2008-09-15 18:54 1,048,576 --sha-w C:\Users\Invité\ntuser.dat
2008-09-15 18:50 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\OpenOffice.org2
2008-09-15 13:52 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\Malwarebytes
2008-09-15 13:52 --------- dc----w C:\ProgramData\Malwarebytes
2008-09-15 13:52 --------- dc----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-15 11:09 --------- dc----w C:\Program Files\UltimateZip 2007
2008-09-15 06:56 --------- dc----w C:\Program Files\Trend Micro
2008-09-13 20:17 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\Skype
2008-09-13 18:41 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\LimeWire
2008-09-13 10:16 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\Webroot
2008-09-13 10:16 --------- dc----w C:\ProgramData\Webroot
2008-09-13 10:16 --------- dc----w C:\Program Files\Webroot
2008-09-13 09:53 164 -c--a-w C:\install.dat
2008-09-13 09:52 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\GetRightToGo
2008-09-11 05:33 --------- dc----w C:\ProgramData\NVIDIA
2008-09-10 22:19 --------- dc----w C:\ProgramData\comodo
2008-09-10 22:13 249,592 -c--a-w C:\Windows\System32\cssdll32.dll
2008-09-10 22:13 --------- dc----w C:\Program Files\COMODO
2008-09-10 22:13 --------- dc----w C:\Program Files\AskSBar
2008-09-10 22:09 85,008 -c--a-w C:\Windows\system32\drivers\cmdguard.sys
2008-09-10 22:09 25,104 -c--a-w C:\Windows\system32\drivers\cmdhlp.sys
2008-09-10 22:09 143,104 -c--a-w C:\Windows\System32\guard32.dll
2008-09-10 22:09 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\Comodo
2008-09-10 21:59 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-09-10 21:59 --------- dc----w C:\Program Files\epson
2008-09-10 21:39 --------- dc--a-w C:\ProgramData\TEMP
2008-09-10 21:26 --------- dc----w C:\ProgramData\HECKMEALJUMP
2008-09-10 21:26 --------- dc----w C:\Program Files\Spyware Doctor
2008-09-10 21:26 --------- dc----w C:\Program Files\Common Files\PC Tools
2008-09-10 20:58 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\PC Tools
2008-09-10 20:43 --------- dc----w C:\ProgramData\Avira
2008-09-10 20:43 --------- dc----w C:\Program Files\Avira
2008-09-10 20:26 --------- dc----w C:\ProgramData\PC Tools
2008-09-10 18:53 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\PCToolsSpamMonitorPlus
2008-09-10 17:54 --------- dc-h--w C:\ProgramData\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
2008-09-10 17:54 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\Uniblue
2008-09-10 17:54 --------- dc----w C:\Program Files\Uniblue
2008-09-10 17:41 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\BitTorrent
2008-09-10 17:36 7,507,296 -c--a-w C:\Windows\System32\rminstall.exe
2008-09-09 22:04 38,528 -c--a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 -c--a-w C:\Windows\system32\drivers\mbam.sys
2008-09-07 20:19 --------- dc----w C:\Program Files\Lavalys
2008-09-07 15:54 --------- dc----w C:\Program Files\Yamicsoft
2008-09-07 15:43 685,056 -c--a-w C:\Windows\is-0SVVD.exe
2008-09-07 15:42 --------- dc----w C:\Program Files\RelevantKnowledge
2008-09-06 14:46 --------- dc----w C:\ProgramData\WinZip
2008-09-05 13:00 --------- dc----w C:\Program Files\Norton Security Scan
2008-09-03 17:04 --------- dc----w C:\Program Files\PCFriendly
2008-09-03 09:27 174 --sha-w C:\Program Files\desktop.ini
2008-09-03 09:24 --------- dc----w C:\Program Files\Windows Mail
2008-09-03 06:06 --------- dc----w C:\Users\lina\AppData\Roaming\PCToolsFirewallPlus
2008-09-02 19:33 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\PCToolsFirewallPlus
2008-09-02 18:19 --------- dc----w C:\Program Files\Microsoft Silverlight
2008-09-02 18:04 --------- dc----w C:\ProgramData\Symantec
2008-09-02 17:59 --------- dc----w C:\Program Files\Symantec
2008-09-02 17:59 --------- dc----w C:\Program Files\Common Files\Symantec Shared
2008-09-02 17:59 --------- d-----w C:\Program Files\Norton Internet Security
2008-09-02 17:30 --------- dc----w C:\ProgramData\Kaspersky Lab
2008-09-02 00:26 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\DNA
2008-09-01 22:27 --------- dc----w C:\ProgramData\fssg
2008-09-01 08:15 805 -c--a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-09-01 08:15 123,952 -c--a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-09-01 08:15 10,671 -c--a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-09-01 08:04 --------- d-----w C:\Program Files\Orange
2008-09-01 07:59 --------- dc----w C:\Program Files\Securitoo
2008-09-01 00:12 --------- dc----w C:\Users\FAMILLE\AppData\Roaming\SolidWorks
2008-08-25 09:36 81,288 -c--a-w C:\Windows\system32\drivers\iksyssec.sys
2008-08-25 09:36 66,952 -c--a-w C:\Windows\system32\drivers\iksysflt.sys
2008-08-25 09:36 40,840 -c--a-w C:\Windows\system32\drivers\ikfilesec.sys
2008-08-22 20:19 --------- d-----w C:\Program Files\Common Files\France Telecom
2008-08-05 13:58 58,136 -c--a-w C:\Windows\system32\drivers\FWAuthdriver.sys
2008-08-02 08:21 --------- dc----w C:\Users\lina\AppData\Roaming\Leadertech
2008-07-31 03:34 537,600 -c--a-w C:\Windows\AppPatch\AcLayers.dll
2008-07-31 03:34 449,536 -c--a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:34 28,160 -c--a-w C:\Windows\System32\Apphlpdm.dll
2008-07-31 03:34 2,144,256 -c--a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:34 173,056 -c--a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-31 03:34 1,686,528 -c--a-w C:\Windows\System32\gameux.dll
2008-07-30 23:47 4,247,552 -c--a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 23:32 2,560 -c--a-w C:\Windows\AppPatch\AcRes.dll
2008-07-30 15:42 23,888 -c--a-w C:\Windows\system32\drivers\COH_Mon.sys
2008-07-30 15:28 706 -c--a-w C:\Windows\system32\drivers\COH_Mon.inf
2008-07-30 15:28 10,537 -c--a-w C:\Windows\system32\drivers\COH_Mon.cat
2008-07-28 09:29 160,792 -c--a-w C:\Windows\system32\drivers\pctfw2.sys
2008-07-19 05:10 53,448 -c--a-w C:\Windows\System32\wuauclt.exe
2008-07-19 05:10 45,768 -c--a-w C:\Windows\System32\wups2.dll
2008-07-19 05:10 36,552 -c--a-w C:\Windows\System32\wups.dll
2008-07-19 05:09 563,912 -c--a-w C:\Windows\System32\wuapi.dll
2008-07-19 05:09 1,811,656 -c--a-w C:\Windows\System32\wuaueng.dll
2008-07-19 03:44 83,456 -c--a-w C:\Windows\System32\wudriver.dll
2008-07-19 03:44 1,524,736 -c--a-w C:\Windows\System32\wucltux.dll
2008-07-18 20:08 163,904 -c--a-w C:\Windows\System32\wuwebv.dll
2008-07-18 18:44 31,232 -c--a-w C:\Windows\System32\wuapp.exe
2008-07-17 14:53 93,952 -c--a-w C:\Windows\system32\drivers\pctfw.sys
2008-07-15 23:48 2,048 -c--a-w C:\Windows\System32\tzres.dll
2008-06-27 03:54 826,368 -c--a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 -c--a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 -c--a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 -c--a-w C:\Windows\System32\ieUnatt.exe
2007-09-06 15:18 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-09-06 15:18 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-09-06 15:18 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-12 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"Speech Recognition"="C:\Windows\Speech\Common\sapisvr.exe" [2006-11-02 49664]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"Google Update"="C:\Users\FAMILLE\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-09-06 133104]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 115816]
"osCheck"="c:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 22696]
"Acer Empowering Technology Monitor"="C:\Windows\system32\SysMonitor.exe" [2006-11-23 319488]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-08 98304]
"SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 94208]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"AGEIA PhysX SysTray"="C:\Program Files\AGEIA Technologies\TrayIcon.exe" [2006-03-20 331776]
"NeroCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NeroFilterCheck"="C:\Windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-17 180269]
"ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 102400]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"COMODO SafeSurf"="C:\Program Files\COMODO\SafeSurf\cssurf.exe" [2008-09-11 278264]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-09-11 1655552]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-06-20 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-06-20 92704]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 5361464]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 C:\Windows\RtHDVCpl.exe]

C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2006-12-14 528384]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-04-28 415072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{12A45747-2372-4071-AFC2-797A16389BB3}"= UDP:C:\Program Files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{857E81E3-6A25-4038-A976-590002A8FF54}"= TCP:C:\Program Files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{B2690F95-1BA9-42B6-8151-D37A873D97E9}"= UDP:C:\Program Files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{BE8168BD-1587-48C9-B8A9-8DA29EB488A4}"= TCP:C:\Program Files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{97A20D34-D5EB-42F9-8D75-7772B1CAAAB2}"= UDP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{8FFFA071-A90B-466D-AAC6-D07DB72C5A9C}"= TCP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{FBB2CD35-5498-46F4-8829-2DF3885C1C12}"= UDP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{0035BDE0-2E3C-476E-9D74-C9778E365572}"= TCP:C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{2C7749D8-584C-471D-AEFF-C677570CEC98}"= UDP:C:\Program Files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA
"{6C2ADED2-5CD6-425A-A80E-00AA1D08D67B}"= TCP:C:\Program Files\Acer Zone\Acer Zone SoftDMA\SoftDMA.exe:CyberLink SoftDMA
"{0209685F-46EA-4C28-AB6F-C5BABA6CC654}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL
"{59A02A69-075C-4FEA-894F-6E9D4D31B9A4}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL
"{DA64667D-EC24-4F75-88E9-C34E2436B57D}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL
"{A205CDAF-6C32-4EC4-A362-49FB4CBC3C34}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL
"{3BF6D06A-AEE7-4F9D-9070-66C1CD8E3459}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL
"{C821A067-8789-4357-B7CB-2407B1421CB3}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL
"{9E239454-9257-43BA-A996-B34E785476C3}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL
"{7F94E2AD-6828-484C-AABC-B9599ECA6CD6}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL
"{F0F85FAC-B9F7-4684-896D-2BC50C548A64}"= UDP:D:\Shareaza\Shareaza.exe:Shareaza
"{590DEC42-AB91-4012-B06F-98F96F928A23}"= TCP:D:\Shareaza\Shareaza.exe:Shareaza
"{964BAB62-6D3A-423F-AD18-57F4C3B4A77A}"= UDP:D:\LimeWire\LimeWire.exe:LimeWire
"{808D4241-DE51-4BD9-9CE7-6B739F6FFDF8}"= TCP:D:\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{659F5C04-F7EA-4809-8724-FD1EC3935CEF}C:\\program files\\microsoft games\\fs2002\\fs2002.exe"= UDP:C:\program files\microsoft games\fs2002\fs2002.exe:Module de Microsoft Flight Simulator
"UDP Query User{8B83C769-B647-474F-A67D-45CE913B26FE}C:\\program files\\microsoft games\\fs2002\\fs2002.exe"= TCP:C:\program files\microsoft games\fs2002\fs2002.exe:Module de Microsoft Flight Simulator
"TCP Query User{73819418-9668-4C45-81D2-5020A18BC633}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{A707CFDF-0511-4006-B6FA-9552AB1BF05B}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{0E50FF40-ABB5-4266-858C-4FFB818758DE}C:\\program files\\morpheus\\morpheus.exe"= UDP:C:\program files\morpheus\morpheus.exe:Morpheus
"UDP Query User{91F884AB-5A47-4024-BA50-4DB7A776791D}C:\\program files\\morpheus\\morpheus.exe"= TCP:C:\program files\morpheus\morpheus.exe:Morpheus
"{60961DEA-0572-4C8C-B15B-AE62F2AE8A85}"= UDP:D:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{AFEAD35C-337A-4C24-86CC-83A511B136DD}"= TCP:D:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"TCP Query User{1EC226F0-12CB-488A-A266-B6F659A5237B}D:\\limewire\\limewire.exe"= UDP:D:\limewire\limewire.exe:LimeWire
"UDP Query User{ABE4901C-0936-4070-AF42-14BCE918176B}D:\\limewire\\limewire.exe"= TCP:D:\limewire\limewire.exe:LimeWire
"TCP Query User{25E06EC9-99EE-419F-9A2C-BBB92919FD9A}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{01C631DC-50BF-4B8A-AC5F-6CECB5DDCA03}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{C81295BD-39B1-4F29-AA60-90652A032803}"= UDP:C:\Program Files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{796F403D-6765-4D1A-B7DB-A40DBD18EC8F}"= TCP:C:\Program Files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"TCP Query User{2FAFD319-E43B-4E8E-A0C0-BBF712CD248B}C:\\program files\\global star software\\jetfighter v\\game.exe"= UDP:C:\program files\global star software\jetfighter v\game.exe:Game
"UDP Query User{E873A3F3-1895-4BA9-84D0-2A02FDD74292}C:\\program files\\global star software\\jetfighter v\\game.exe"= TCP:C:\program files\global star software\jetfighter v\game.exe:Game
"TCP Query User{0759E5B5-58FB-4DF7-A2F2-83A2061AF0B8}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{90BD0303-13E5-4682-991C-7818A4642625}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{7F810787-1A39-4EE8-8D52-49017D7D11BD}C:\\program files\\ubisoft\\ghost recon advanced warfighter\\graw.exe"= UDP:C:\program files\ubisoft\ghost recon advanced warfighter\graw.exe:GRAW
"UDP Query User{B3FABB77-9DCD-4DB1-9CE8-F1D16EACC6D1}C:\\program files\\ubisoft\\ghost recon advanced warfighter\\graw.exe"= TCP:C:\program files\ubisoft\ghost recon advanced warfighter\graw.exe:GRAW
"{A6319020-3AD2-4E7B-9911-4C92FC65202F}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{8803EA51-56E7-45ED-BC19-F1107B6422E5}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{6C968F82-C40C-4A3F-B0E8-B51D5098B7F5}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{5A362C62-26D4-4041-AFA5-FFED8ADE8EE5}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{76DF1E46-6198-4984-8376-A55C6256272B}"= Disabled:UDP:D:\Morpheus\Morpheus.exe:Morpheus
"{8BBAFA09-5924-4C03-81D7-77C27B127E51}"= Disabled:TCP:D:\Morpheus\Morpheus.exe:Morpheus
"{29F298D5-7F29-4A6B-A526-0BFFB92230E5}"= UDP:C:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{6750B497-2DC6-46F7-B613-F3A81B778BFE}"= TCP:C:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{4E664206-E634-40EA-9E07-4040AF3B4DA1}"= UDP:C:\Program Files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{20226B39-61C1-4443-8264-A6A320AD208B}"= TCP:C:\Program Files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{05BDCA69-E2DB-410D-B819-C398FF0335A5}"= UDP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - En ligne uniquement
"{0D88BE59-32EC-4E4F-8A87-00AE9FEDCF32}"= TCP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - En ligne uniquement
"{2BB78ECF-D92E-43C7-AA8B-866AE0923FA7}"= UDP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Serveur dédié
"{80253B8E-0ED3-4971-A9E7-753F1664554A}"= TCP:C:\Program Files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Serveur dédié
"{C9EB1286-3AD5-4D79-9623-1E2E06798B4D}"= UDP:C:\Program Files\RelevantKnowledge\rlvknlg.exe:rlvknlg.exe
"{30BF0778-F40A-4065-808A-36E73582E1D4}"= TCP:C:\Program Files\RelevantKnowledge\rlvknlg.exe:rlvknlg.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DoNotAllowExceptions"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption
"C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\Windows\system32\Drivers\SSFS0BB8.SYS [2007-07-19 20280]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys [2008-09-11 85008]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys [2008-09-11 25104]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 202872]
R1 pctfw2;pctfw2;C:\Windows\System32\drivers\pctfw2.sys [2008-07-28 160792]
R2 RelevantKnowledge;RelevantKnowledge;C:\Program Files\RelevantKnowledge\rlservice.exe [2008-04-24 45056]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496]
S3 FWAuth;FWAuth Driver;C:\Windows\system32\drivers\FWAuthDriver.sys [2008-08-05 58136]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
S3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 37936]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4086bc9-ccda-11db-ae6e-806e6f6e6963}]
\shell\AutoRun\command - E:\setup.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

.
------- Examen supplémentaire -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.comodo.com/search/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
R0 -: HKLM-Main,Start Page = hxxp://fr.fr.acer.yahoo.com
R1 -: HKCU-SearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
O8 -: &Recherche AOL Toolbar - C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 21:00:15
Windows 6.0.6000 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

PROCESSUS: C:\Windows\system32\winlogon.exe
-> C:\Windows\system32\guard32.dll

PROCESSUS: C:\Windows\system32\lsass.exe
-> C:\Windows\system32\guard32.dll
.
Heure de fin: 2008-09-15 21:03:08
ComboFix-quarantined-files.txt 2008-09-15 19:02:02

Avant-CF: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
AprŠs-CF: 61,954,093,056 octets libres

307 --- E O F --- 2008-09-11 05:38:18

et pour toolbar SD

--------------------\\ Lop S&D 4.2.4-3 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : FAMILLE ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total : 113 Go Free : 21 Go
D:\ (Local Disk) - NTFS - Total : 112 Go Free : 69 Go
E:\ (CD or DVD) - CDFS - Total : 0 Go Free : 0 Go
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\Lop SD" ( MAJ : 14-09-2008|22:40 )
Option : [2] ( 2008-09-15|20:32 )

[ UAC => 0 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans Local

[2007-07-14|12:11] C:\Users\FAMILLE\AppData\Local\Adobe
[2008-03-16|00:58] C:\Users\FAMILLE\AppData\Local\Ahead
[2007-03-07|20:53] C:\Users\FAMILLE\AppData\Local\Application Data
[2008-03-13|18:50] C:\Users\FAMILLE\AppData\Local\Apps
[2008-09-13|10:52] C:\Users\FAMILLE\AppData\Local\d3d9caps.dat
[2008-09-12|00:46] C:\Users\FAMILLE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008-03-13|15:35] C:\Users\FAMILLE\AppData\Local\DNA
[2008-05-23|20:13] C:\Users\FAMILLE\AppData\Local\GDIPFONTCACHEV1.DAT
[2008-09-15|20:30] C:\Users\FAMILLE\AppData\Local\Google
[2007-03-07|20:53] C:\Users\FAMILLE\AppData\Local\Historique
[2008-09-15|20:25] C:\Users\FAMILLE\AppData\Local\IconCache.db
[2008-06-12|23:59] C:\Users\FAMILLE\AppData\Local\Microsoft
[2007-06-08|19:25] C:\Users\FAMILLE\AppData\Local\Microsoft Games
[2007-12-22|20:05] C:\Users\FAMILLE\AppData\Local\Microsoft Help
[2007-07-14|11:45] C:\Users\FAMILLE\AppData\Local\MigWiz
[2007-10-27|15:36] C:\Users\FAMILLE\AppData\Local\Mozilla
[2008-03-12|10:21] C:\Users\FAMILLE\AppData\Local\Nero
[2007-10-27|22:23] C:\Users\FAMILLE\AppData\Local\Netscape
[2007-07-16|11:30] C:\Users\FAMILLE\AppData\Local\Shareaza
[2007-10-17|13:35] C:\Users\FAMILLE\AppData\Local\SupportSoft
[2008-09-15|20:33] C:\Users\FAMILLE\AppData\Local\Temp
[2008-05-10|16:44] C:\Users\FAMILLE\AppData\Local\TempFichierSauvegardeSW
[2007-03-07|20:53] C:\Users\FAMILLE\AppData\Local\Temporary Internet Files
[2007-03-08|14:19] C:\Users\FAMILLE\AppData\Local\VirtualStore
[2008-01-19|17:52] C:\Users\FAMILLE\AppData\Local\World in Conflict

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[2008-09-07 23:18][--a--c---] C:\Windows\tasks\GoogleUpdateTaskUser.job
[2008-09-05 15:00][--a--c---] C:\Windows\tasks\Norton Security Scan.job
[2008-08-29 20:00][--a--c---] C:\Windows\tasks\Norton Internet Security - Analyse systŠme complŠte - FAMILLE.job
[2008-09-15 20:30][--ah-c---] C:\Windows\tasks\SA.DAT
[2008-09-15 20:28][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[2008-09-10|19:54] C:\ProgramData\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
[2007-07-14|10:55] C:\ProgramData\Adobe
[2007-03-10|21:38] C:\ProgramData\AOL
[2006-11-02|15:02] C:\ProgramData\Application Data
[2008-09-10|22:43] C:\ProgramData\Avira
[2007-03-07|20:49] C:\ProgramData\Bureau
[2008-09-11|00:19] C:\ProgramData\comodo
[2006-12-14|15:14] C:\ProgramData\CyberLink
[2006-11-02|15:02] C:\ProgramData\Desktop
[2006-11-02|15:02] C:\ProgramData\Documents
[2008-03-24|13:35] C:\ProgramData\eMule
[2007-03-07|20:49] C:\ProgramData\Favoris
[2006-11-02|15:02] C:\ProgramData\Favorites
[2008-09-02|00:27] C:\ProgramData\fssg
[2008-07-03|23:47] C:\ProgramData\Google
[2008-09-10|23:26] C:\ProgramData\HECKMEALJUMP
[2007-03-07|20:57] C:\ProgramData\InstallShield
[2008-09-02|19:30] C:\ProgramData\Kaspersky Lab
[2008-09-02|19:27] C:\ProgramData\LUUnInstall.LiveUpdate
[2007-03-10|19:53] C:\ProgramData\Macromedia
[2008-09-15|15:52] C:\ProgramData\Malwarebytes
[2008-06-06|01:24] C:\ProgramData\Media Center Programs
[2007-03-07|20:49] C:\ProgramData\Menu D‚marrer
[2008-02-18|22:35] C:\ProgramData\Messenger Plus!
[2008-09-07|22:19] C:\ProgramData\Microsoft
[2008-03-24|13:38] C:\ProgramData\Microsoft Help
[2007-03-07|20:49] C:\ProgramData\ModŠles
[2007-07-30|15:01] C:\ProgramData\Mozilla
[2008-03-24|13:31] C:\ProgramData\Nero
[2007-08-27|14:12] C:\ProgramData\NtiDvdCopy
[2008-09-11|07:33] C:\ProgramData\NVIDIA
[2008-09-10|22:26] C:\ProgramData\PC Tools
[2007-06-08|12:56] C:\ProgramData\QuickTime
[2007-07-30|15:06] C:\ProgramData\Skype
[2008-05-11|20:42] C:\ProgramData\SolidWorks
[2006-11-02|15:02] C:\ProgramData\Start Menu
[2008-09-02|20:04] C:\ProgramData\Symantec
[2008-03-16|05:18] C:\ProgramData\Symantec Temporary Files
[2008-09-10|23:39] C:\ProgramData\TEMP
[2006-11-02|15:02] C:\ProgramData\Templates
[2007-03-10|13:31] C:\ProgramData\UDL
[2008-09-13|12:16] C:\ProgramData\Webroot
[2008-09-06|16:46] C:\ProgramData\WinZip
[2007-03-08|12:22] C:\ProgramData\Yahoo! Companion

--------------------\\ Listing des dossiers dans C:\Program Files

[2008-01-15|17:50] C:\Program Files\3D Kit Builder
[2006-12-14|15:17] C:\Program Files\Acer Zone
[2007-07-14|10:54] C:\Program Files\Adobe
[2008-02-20|17:55] C:\Program Files\AGEIA Technologies
[2008-03-05|20:11] C:\Program Files\Ahead
[2008-09-11|00:13] C:\Program Files\AskSBar
[2008-09-10|22:43] C:\Program Files\Avira
[2008-03-13|15:35] C:\Program Files\BitTorrent
[2008-03-13|20:24] C:\Program Files\Boeing
[2008-09-10|23:26] C:\Program Files\Common Files
[2008-09-11|00:13] C:\Program Files\COMODO
[2006-12-14|15:14] C:\Program Files\CyberLink
[2008-03-13|15:35] C:\Program Files\DNA
[2008-04-02|17:13] C:\Program Files\DWGeditor
[2007-11-27|22:13] C:\Program Files\EA GAMES
[2007-09-21|20:34] C:\Program Files\EA SPORTS
[2008-06-06|01:24] C:\Program Files\Electronic Arts
[2008-09-10|23:59] C:\Program Files\epson
[2007-08-20|17:48] C:\Program Files\Global Star Software
[2008-07-04|14:02] C:\Program Files\Google
[2008-03-16|14:15] C:\Program Files\GoSecure
[2007-11-13|21:42] C:\Program Files\Install Creator
[2008-09-10|23:59] C:\Program Files\InstallShield Installation Information
[2008-09-03|11:24] C:\Program Files\Internet Explorer
[2007-06-18|18:15] C:\Program Files\Inventel
[2008-03-14|04:51] C:\Program Files\Java
[2008-09-07|22:19] C:\Program Files\Lavalys
[2007-03-08|12:23] C:\Program Files\Learn2.com
[2008-09-15|15:52] C:\Program Files\Malwarebytes' Anti-Malware
[2008-02-15|13:00] C:\Program Files\Messenger Plus! Live
[2008-02-22|23:08] C:\Program Files\Microsoft ActiveSync
[2007-10-28|09:51] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2008-03-15|21:27] C:\Program Files\Microsoft Games
[2008-04-02|16:59] C:\Program Files\Microsoft Office
[2008-09-02|20:19] C:\Program Files\Microsoft Silverlight
[2008-02-22|20:19] C:\Program Files\Microsoft Visual Studio
[2008-02-22|20:17] C:\Program Files\Microsoft Works
[2008-02-22|20:17] C:\Program Files\Microsoft.NET
[2006-11-02|14:42] C:\Program Files\Movie Maker
[2007-10-27|15:36] C:\Program Files\Mozilla Firefox
[2008-02-22|20:19] C:\Program Files\MSBuild
[2008-02-22|23:02] C:\Program Files\MSECache
[2006-11-02|14:37] C:\Program Files\MSN
[2008-02-15|12:59] C:\Program Files\MSN Messenger
[2007-06-08|12:27] C:\Program Files\MSXML 4.0
[2008-03-16|15:06] C:\Program Files\MultiProxy
[2008-03-24|13:43] C:\Program Files\Nero
[2007-10-27|18:28] C:\Program Files\Netscape
[2006-12-14|15:09] C:\Program Files\NewTech Infosystems
[2008-09-02|19:59] C:\Program Files\Norton Internet Security
[2008-09-05|15:00] C:\Program Files\Norton Security Scan
[2008-02-22|22:39] C:\Program Files\OpenOffice.org 2.3
[2008-09-01|10:04] C:\Program Files\Orange
[2008-09-03|19:04] C:\Program Files\PCFriendly
[2007-03-08|12:22] C:\Program Files\QuickTime
[2008-06-17|14:33] C:\Program Files\Real
[2006-12-14|14:54] C:\Program Files\Realtek
[2006-11-02|14:37] C:\Program Files\Reference Assemblies
[2008-09-07|17:42] C:\Program Files\RelevantKnowledge
[2008-09-01|09:59] C:\Program Files\Securitoo
[2008-06-06|01:24] C:\Program Files\Sierra Entertainment
[2007-07-30|15:06] C:\Program Files\Skype
[2008-07-03|23:48] C:\Program Files\SolidWorks
[2008-02-13|04:06] C:\Program Files\SolidWorks Viewer
[2008-09-10|23:26] C:\Program Files\Spyware Doctor
[2008-09-02|19:59] C:\Program Files\Symantec
[2008-09-15|08:56] C:\Program Files\Trend Micro
[2008-09-15|13:09] C:\Program Files\UltimateZip 2007
[2008-09-10|19:54] C:\Program Files\Uniblue
[2008-09-13|12:16] C:\Program Files\Webroot
[2007-10-21|13:19] C:\Program Files\Windows Calendar
[2006-11-02|14:42] C:\Program Files\Windows Collaboration
[2007-07-16|09:21] C:\Program Files\Windows Defender
[2006-11-02|14:42] C:\Program Files\Windows Journal
[2008-02-15|12:59] C:\Program Files\Windows Live
[2008-09-03|11:24] C:\Program Files\Windows Mail
[2007-10-21|13:19] C:\Program Files\Windows Media Player
[2007-03-10|21:45] C:\Program Files\Windows NT
[2006-11-02|14:42] C:\Program Files\Windows Photo Gallery
[2008-01-12|17:55] C:\Program Files\Windows Sidebar
[2008-09-06|16:45] C:\Program Files\WinZip
[2007-03-07|20:53] C:\Program Files\Yahoo!
[2008-09-07|17:54] C:\Program Files\Yamicsoft

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[2007-07-14|10:54] C:\Program Files\Common Files\Adobe
[2008-03-24|13:43] C:\Program Files\Common Files\Ahead
[2008-04-02|17:02] C:\Program Files\Common Files\DESIGNER
[2008-04-02|17:10] C:\Program Files\Common Files\eDrawings2007
[2008-08-22|22:19] C:\Program Files\Common Files\France Telecom
[2007-03-07|20:57] C:\Program Files\Common Files\InstallShield
[2007-07-17|16:14] C:\Program Files\Common Files\Java
[2006-12-14|15:09] C:\Program Files\Common Files\LightScribe
[2008-03-24|13:36] C:\Program Files\Common Files\microsoft shared
[2008-03-24|13:31] C:\Program Files\Common Files\Nero
[2006-12-14|15:09] C:\Program Files\Common Files\NewTech Infosystems
[2007-03-08|12:22] C:\Program Files\Common Files\Nullsoft
[2008-09-10|23:26] C:\Program Files\Common Files\PC Tools
[2008-06-17|14:33] C:\Program Files\Common Files\Real
[2006-11-02|13:18] C:\Program Files\Common Files\Services
[2007-07-30|15:06] C:\Program Files\Common Files\Skype
[2008-07-03|23:48] C:\Program Files\Common Files\SolidWorks Shared
[2006-11-02|13:18] C:\Program Files\Common Files\SpeechEngines
[2007-10-17|13:34] C:\Program Files\Common Files\SupportSoft
[2008-09-02|19:59] C:\Program Files\Common Files\Symantec Shared
[2008-02-22|20:16] C:\Program Files\Common Files\System
[2008-02-13|03:35] C:\Program Files\Common Files\Wise Installation Wizard
[2008-06-17|14:33] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 82 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 20:33:49
Windows 6.0.6000 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 1

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\Users\FAMILLE\AppData\Roaming\BitTorrent\SolidWorks 2008 SP0 Multilingual Incl Serial and Crack.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\PC.Tools.Internet.Security.Suite.2009.6.0.0 (incl Crack.zip.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Registry Mechanic_7.0.0.1010_Keygen.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Registry Mechanic_7.0.0.1010_Working_Keygen.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\SolidWorks 2008 SP0 Multilingual Incl Serial and Crack.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\SolidWorks 2008 SP0 Multilingual Incl Serial and Crack.torrent.bak
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Spyware Doctor 6.0.0.354 +Crack.torrent
C:\Users\FAMILLE\AppData\Roaming\LimeWire\.AppSpecialShare\Spyware Doctor 6.0.0.354 +Crack.torrent.bak
C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\famille@crackserialkeygen[1].txt
C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Cookies\Low\famille@www.keygen[2].txt
C:\Users\FAMILLE\AppData\Roaming\Microsoft\Windows\Recent\Uniblue RegistryBooster 2009 v2.1.0.0 Crack -ICWT.lnk
C:\Users\FAMILLE\Desktop\Morpheus Shared\Shared\real player crack.zip
C:\Users\FAMILLE\Documents\Morpheus Shared\Downloads\Partials\Nero Burning Rom 7 Ultra Edition Incl Keygen & Serial.zip
C:\Users\FAMILLE\Favorites\Norton crack, Norton serial, Norton keygen, Norton download, Norton warez, Norton nocd, Norton rapidshare.url

[F:942][D:300]-> C:\Users\FAMILLE\AppData\Local\Temp
[F:2236][D:1]-> C:\Users\FAMILLE\AppData\Roaming\MICROS~1\Windows\Cookies
[F:1247][D:27]-> C:\Users\FAMILLE\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:6009][D:268]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 2008-09-15|12:22 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 2008-09-15|13:22 - Option : [2]
3 - "C:\Lop SD\LopR_3.txt" - 2008-09-15|20:38 - Option : [2]

--------------------\\ Fin du rapport a 20:38:01
[ UAC => 1 ]

Oui, c'est embettant. lorsqu'on passe TollbarS&D et LopS&d, après les avoir passé, ils réactivent automatiquement l'UAC.
Ce sont les seuls.
Donc, après toolbarS&d, il te faudra une dernière fois désactiver l'UAC.

passe combofix évidemment après ToolbarS&d.

A+