Seekservice114

Question

Bonjour,
Voilà, j'ai eu l'autre jour une requête de seekservice 114 qui demandait à se connecter à internet, heureusement "zone alarm" m'a averti, j'ai refusé...
Ensuite pour supprimer cet "exe" j'ai dû employer "file assassin" car il me fallait une autorisation pour le virer !
Si je l'ai supprimé c'est que j'ai lu sur d'autres forums que c'était un virus, mais il fallait faire des analyses "hijackis" et envoyer le rapport etc.
J'ai préféré le virer moi-même ...
Est-ce que quelqu'un sait vraiment ce que c'est que ce truc qui cherche à se connecter à internet et revient puisqu'en une semaine je l'ai viré deux fois ! Et d'où il peut provenir ...

merci d'avance

Strictmaximum

geoffrey5 · Answer

Bonsoir,

si il revient c'est que tu n'as pas supprimé toute l'infection...

&#x25B6; Télécharge Random's System Information Tool (RSIT).

&#x25B6; Un tutoriel sera à ta disposition sur mon site web pour l'installer et l'utiliser correctement.

&#x25B6; Double clique sur RSIT.exe pour lancer l'outil.

&#x25B6; Clique sur 'Continue' à l'écran Disclaimer.

&#x25B6; Si l'outil Hijackthis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

&#x25B6; Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.

( C:\RSIT\log.txt et C:\RSIT\info.txt )

CTRL A pour sélectionner tout, CTRL C pour copier et puis CTRL V pour coller

Comment héberger les rapports trop longs de RSIT ??

strictmaximum · Answer

Merci mais tu ne m'a pas dit si c'était un virus ?
ni d'où ça peut provenir  ...

geoffrey5 · Answer

dire d'où il peut provenir, ça je ne saurais pas te le dire, je n'ai aucune information sur ce service...

Peut-être qu'avec le rapport de RSIT je pourrai faire quelque chose  ;-)

strictmaximum · Answer

ah oui j'oubliais, dans le dossier seekservice il y avait un "exe", une icône en forme de loupe et un "uninstall" ....?!

Je ferai un rapport, mais demain, là il est 1h54 et je ne vais pas tarder à aller me coucher ...

Merci encore de l'intérêt que tu porte à mon problème.

geoffrey5 · Answer

Ok pas de problème  ;-)

@+

strictmaximum · Answer

Bon je l'ai quand même fait là ....

rapport log
Logfile of random's system information tool 1.06 (written by random/random)
Run by Pc de wam at 2009-08-15 01:57:10
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 21 GB (11%) free of 185 GB
Total RAM: 3070 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:57:30, on 15/08/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\mobsync.exe
c:\program files\windows defender\MpCmdRun.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Pc de wam\Downloads\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files	rend micro\Pc de wam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ww12.cherche.us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe" /d=60
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate1c9a430e71f83c9) (gupdate1c9a430e71f83c9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SeekService Service - Unknown owner - C:\ProgramData\SeekService\seekservice114.exe (file missing)
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

strictmaximum · Answer

tu vois tout ?

strictmaximum · Answer

info 
je reposte

info.txt logfile of random's system information tool 1.06 2009-08-15 01:57:34

======Uninstall list======

-->C:\WINDOWS\UNIN040C.EXE -f"C:\Program Files\PhotoDeluxe EE 1.1\DeIsL1.isu"
-->MsiExec.exe /I{2EA870FA-585F-4187-903D-CB9FFD21E2E0}
Ad-Aware SE Personal-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.6 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
Adobe Type Manager 4.0-->C:\Windows\unin040c.exe -f"C:\Program Files\Adobe Type Manager\DeIsL1.isu" -c"C:\Program Files\Adobe Type Manager\UNINST.DLL"
AIDA32 v3.93-->"C:\Program Files\AIDA32 - Personal System Information\unins000.exe"
Airbus A340-300 Olympic Airlines FSX-->C:\Program Files\Microsoft Games\Microsoft Flight Simulator X\Désinstaller Airbus A340-300 Olympic Airlines FSX.exe
AIRBUS_A380-800-->C:\Program Files\Microsoft Games\Microsoft Flight Simulator X\AIRBUS A380-800.exe
aMSN 0.97.2-->C:\Program Files\aMSN\uninstall.exe
Analyseur et SDK MSXML 4.0 SP2-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
a-squared Anti-Dialer 3.0-->"C:\Program Files\a-squared Anti-Dialer\unins000.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManger\unins000.exe"
AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Brother MFL-Pro Suite-->"C:\Program Files\InstallShield Installation Information\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}\Setup.exe"  -runfromtemp -l0x040c Brunin03.dll -removeonly
CamStudio 2.0 Fr-->"C:\Program Files\CamStudio\unins000.exe"
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Clean Virus MSN-->"C:\Program Files\AxBx\Clean Virus MSN\unins000.exe"
Command & Conquer 3-->MsiExec.exe /I{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}
Command & Conquer Alerte Rouge 2-->C:\Westwood\AR2\Uninstll.EXE
Command & Conquer(tm) 3 : La Fureur de Kane-->MsiExec.exe /I{CC2422C9-F7B5-4175-B295-5EC2283AA674}
Command & Conquer™ Alerte Rouge 3-->MsiExec.exe /X{296D8550-CB06-48E4-9A8B-E5034FB64715}
Composants Internet Partagés de Westwood-->C:\Westwood\Internet\UnstllAP.EXE
CompuApps SwissKnife V3-->C:\WINDOWS\ISUNINST.EXE -fC:\SWISNIFE\SKUninst.ISU -cC:\SWISNIFE\SKUNINST.DLL
Corel Painter IX-->MsiExec.exe /I{A0383B7D-81A2-49D3-BE06-C0FD9EFB9DFC}
Crawler Toolbar with Web Security Guard-->C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe uninst
CULTIX 2.0-->c:\Program Files\cultix\Uninstal.exe
Data Lifeguard Diagnostic for Windows-->MsiExec.exe /X{E40CE517-0D42-4198-96B4-C8232B257EB5}
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EA Download Manager-->C:\Program Files\Electronic Arts\EADM\Uninstall.exe
e-anim701-->C:\Program Files\e-anim701\uninstall.exe
Easy Video Downloader v. 2.1-->"C:\Program Files\Easy Video Downloader\unins000.exe"
Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\unwise.exe
Free Easy Burner V 3.8-->"C:\Program Files\Free Easy Burner\unins000.exe"
Galerie de photos Windows Live-->MsiExec.exe /X{44E54A81-9D91-4AA1-9417-80AFF134F5FF}
Garmin Communicator Plugin-->MsiExec.exe /X{86B879A5-927E-4536-B5FC-17CA96B60078}
Garmin POI Loader-->MsiExec.exe /X{D9DA2DF6-8CB6-4E3C-A29E-FAECFBA3E9A7}
Garmin USB Drivers-->MsiExec.exe /X{B1102A25-3AA3-446B-AA0F-A699B07A02FD}
Gestionnaire pour appareils Windows Mobile-->MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917}
GIMP 2.6.6-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Glary Undelete 1.3-->"C:\Program Files\Glary Undelete\unins000.exe"
Glary Utilities 2.12.0.658-->"C:\Program Files\Glary Utilities\unins000.exe"
Glarysoft Process Manager 1.0-->"C:\Program Files\Glarysoft Process Manager\unins000.exe"
Google Apps-->MsiExec.exe /I{89173CE2-0EC2-47D7-8F1A-8471AD9661F4}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_E582EA556D8DE101.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
Grand Theft Auto IV-->"C:\Program Files\InstallShield Installation Information\{579BA58C-F33D-4970-9953-B94B43768AC3}\setup.exe" -runfromtemp -l0x040c -removeonly
GTA4 Mod Installer 0.2.0-->C:\Program Files\GTA4MODS.com\GTA4 Mod Installer\Uninstall.exe
Hercules WebCam Station-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D208F4A7-6B73-4C2A-8B1E-8756FCBA831E}\Setup.exe" -l0x40c 
Hercules Webcam-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A250D351-A07F-4D5D-AB6C-693C69B9BFAF}\Setup.exe" -l0x40c 
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Innovative Music Systems intelliScore v5.0-->C:\PROGRA~1\INTELL~1\UNWISE.EXE C:\PROGRA~1\INTELL~1\INSTALL.LOG
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
ISO Recorder-->MsiExec.exe /I{39600969-41C3-4658-876E-16F108FC5C92}
iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
IziSpot 4-->MsiExec.exe /X{117F577F-E35E-458A-87C5-FBF96879C5CE}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Jewel Quest Solitaire-->"C:\Program Files\Acer GameZone\Jewel Quest Solitaire\Uninstall.exe" "C:\Program Files\Acer GameZone\Jewel Quest Solitaire\install.log"
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
Kick N Rush-->"C:\Program Files\Acer GameZone\Kick N Rush\Uninstall.exe" "C:\Program Files\Acer GameZone\Kick N Rush\install.log"
L'Atelier d'astrologie-->C:\Program Files\emme\Astro_FR\Desinst.exe
Lauyan TOWeb V2-->"C:\Program Files\Lauyan\TOWeb V2\unins000.exe"
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\setup.exe" -runfromtemp -l0x040c -removeonly
Logic Fun 4.8-->C:\Windows\unvise32.exe C:\Program Files\emagic\Logic Fun 4.8\uninstal.log
Macromedia Extension Manager-->MsiExec.exe /I{3C8C9FB3-5FDF-40B4-B314-EAD722728C76}
Macromedia Flash 8 Video Encoder-->MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
Macromedia Flash 8-->MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
MagicDisc 2.7.106-->C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG
MAGIX Goya burnR 1.3.1.3 (F)-->C:\Program Files\MAGIX\Goya_burnR\unwise.exe
MAGIX Screenshare 4.3.6.1987 (F)-->C:\Program Files\MAGIX\PCVisit\unwise.exe
Mahjong Escape Ancient China-->"C:\Program Files\Acer GameZone\Mahjong Escape Ancient China\Uninstall.exe" "C:\Program Files\Acer GameZone\Mahjong Escape Ancient China\install.log"
Mahjongg Artifacts-->"C:\Program Files\Acer GameZone\Mahjongg Artifacts\Uninstall.exe" "C:\Program Files\Acer GameZone\Mahjongg Artifacts\install.log"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Micro Application - Astrologie-->C:\Windows\IsUn040c.exe -f"C:\Program Files\Micro Application\Astrologie\Uninst.isu"
Micro Application - Tests de culture générale-->C:\Windows\IsUn040c.exe -f"C:\Program Files\Micro Application\JeuDeCultureG\Uninst.isu"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Flight Simulator X Service Pack 1-->C:\Windows\system32\msiexec.exe /qb /l*vx "%TEMP%\FlightSimPatchUninstall.log" /uninstall {4576CB22-DC03-48A0-B74C-6C0A7F23E0A8} /package {9527A496-5DF9-412A-ADC7-168BA5379CA6}
Microsoft Flight Simulator X-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{9527A496-5DF9-412A-ADC7-168BA5379CA6} 
Microsoft Flight Simulator X-->MsiExec.exe /X{9527A496-5DF9-412A-ADC7-168BA5379CA6}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{B578C85A-A84C-4230-A177-C5B2AF565B8C}
Microsoft Games for Windows - LIVE-->MsiExec.exe /X{B45FABE7-D101-4D99-A671-E16DA40AF7F0}
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}
Microsoft Research AutoCollage 2008 version 1.1-->MsiExec.exe /I{423D8FBE-EC52-40FD-B2A0-8C9C8F973FD7}
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Mise à jour de l'affichage des décors photo de Flight Simulator X de Microsoft-->MsiExec.exe /I{1AC91509-E17B-46F7-A032-B54DCCA6E8BB}
Mise à jour du pilote du Gestionnaire pour appareils Windows Mobile-->MsiExec.exe /X{E7044E25-3038-4A76-9064-344AC038043E}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.5.2)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSNFix 1.749-->"C:\Program Files\MSNFix\unins000.exe"
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Nikon FotoShare-->C:\Program Files\Nikon\FotoShare\Uninstal.exe C:\PROGRA~1\Nikon\FOTOSH~1\INSTALL.LOG
Nikon Message Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\Setup.exe" -l0x40c UNINSTALL
NTI Media Maker 8-->C:\Program Files\InstallShield Installation Information\{2413930C-8309-47A6-BC61-5EF27A4222BC}\setup.exe -runfromtemp -l0x040c
Nvu 1.0-->"C:\Program Files\Nvu\unins000.exe"
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Opera 9.63-->MsiExec.exe /X{1BC4026B-1957-4514-9058-2B542557F143}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
OXAD-->C:\Program Files\OXAD\uninstall.exe
PaperPort Image Printer-->MsiExec.exe /X{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
pdfforge Toolbar v1.0-->MsiExec.exe /X{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Picasa 3-->"C:\Program Files\Picasa2\Uninstall.exe"
PictureProject-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF3999BE-1A7B-4738-88AA-97BF14094A4A}\Setup.exe" -l0x40c UNINSTALL
PowerArchiver-->C:\Program Files\PowerArchiver\UNINST.EXE
ProtectDisc Driver, Version 11-->C:\Program Files\ProtectDisc Driver Installer\uninstall_v11.exe
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Realtek USB 2.0 Card Reader-->C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe -runfromtemp -l0x040c -removeonly
Retouchez vos Photos-->MsiExec.exe /I{30EB024E-9FD0-45E6-849D-30CC6F1AF2F1}
Rockstar Games Social Club-->"C:\Program Files\InstallShield Installation Information\{08B3869E-D282-424C-9AFC-870E04A4BA14}\setup.exe" -runfromtemp -l0x040c -removeonly
Safari-->MsiExec.exe /I{C5C649A8-1D21-4C83-9B08-7B3752E580F4}
Samplitude Music Studio 15 15.0.0.0 (F)-->C:\Program Files\MAGIX\SamplitudeMusicStudio15\unwise.exe
SBK®08-->"C:\Program Files\InstallShield Installation Information\{F76A0D31-7144-447C-9CC7-8F0C2FE932A7}\setup.exe" -runfromtemp -l0x0009 -removeonly
ScanSoft PaperPort 11-->MsiExec.exe /I{B6C89654-A6A2-477C-873B-724EC1C56407}
Search Settings 1.2-->MsiExec.exe /X{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}
SeekService 1.0 build 114-->C:\Program Files\SeekService\uninstall.exe
Service Pack 2 de Flight Simulator X de Microsoft-->MsiExec.exe /X{CBB2A905-9FF1-4215-BDA2-0DF694F1D023}
SFR - Kit de connexion-->C:\Program Files\Neuf\Kit\uninstall.exe
SFR - Media Center-->C:\Program Files\SFR\Media Center\uninstall.exe
SimpleOCR 3.1-->C:\PROGRA~1\SIMPLE~1\UNWISE.EXE C:\PROGRA~1\SIMPLE~1\INSTALL.LOG
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Smart Defrag 1.20-->"C:\Program Files\IObit\IObit SmartDefrag\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
SUPER © Version 2009.bld.35 (Jan 5, 2009)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
Tests Histoire de France-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{037E4A7D-A914-4CEE-8605-F80E2C0658C1}\Setup.exe" -l0x40c 
Tetris-->"C:\Program Files\Tetris\unins000.exe"
TmNationsForever-->"C:\Program Files\TmNationsForever\unins000.exe"
Tom Clancy's H.A.W.X-->"C:\Program Files\InstallShield Installation Information\{6E36A172-06FB-4BC8-B7FC-D30D219E6776}\setup.exe" -runfromtemp -l0x040c -removeonly
Ultra Defragmenter-->"C:\Windows\UltraDefrag\uninstall.exe"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
USB MODEM Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{042E2C9D-6647-4C5F-9CEF-387D72023128}\Setup.exe" -l0x9 UNINSTALL
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VDownloader  0.76-->"C:\Program Files\VDOWNLOADER\unins000.exe"
VeloMaster Lite CW-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9E34B40D-CFF3-11D3-8302-00A024A89C17}\setup.exe" 
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Web Studio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EA7E6911-A891-4D49-A897-F727C3F45886}\setup.exe" 
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (03/08/2007 2.2.1.0)-->rundll32.exe C:\PROGRA~1\DIFX\15B7F172FC21855D\DIFxAppA.dll, DIFxARPUninstallDriverPackage C:\Windows\System32\DriverStore\FileRepository\grmnusb.inf_6b094708\grmnusb.inf
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D6A2DDE3-9D7C-412C-932A-756580D29919}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sync-->MsiExec.exe /X{9C5EB781-0D37-44B8-9A58-77B3E4BF5F5E}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}
Windows Media Encoder 9 Series-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
ZoneAlarm-->C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

FW: ZoneAlarm Firewall
AS: Spybot - Search and Destroy (disabled) (outdated)
AS: Windows Defender

======System event log======

geoffrey5 · Answer

Ton PC est quand même bien infecté... Commence par faire ceci stp :

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

&#x25B6; Clique sur Démarrer puis sur panneau de configuration 
&#x25B6; Double Clique sur l'icône "Comptes d'utilisateurs" 
&#x25B6; Clique ensuite sur désactiver et valide.
&#x25B6; Redémarre le PC  


ensuite :

Tu as des toolbars infectées installée sur ton PC => Search Setting et Crawler

Lorsque tu télécharges des logiciels, il faut faire attention de ne pas installer les toolbars qu'ils te proposent lors de l'installation des logiciels... Il faut bien regarder et ne pas cliquer tout le temps sur Suivant sans lire ce qu'il est écrit... 

&#x25B6; Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau
  
&#x25B6; Lance l'installation du programme en exécutant le fichier téléchargé. 

&#x25B6; Sous XP : Double-clique sur le raccourci de Toolbar-S&D. 

&#x25B6; Sous Vista : Fais un clic droit sur ToolbarSD et sélectionne "Exécuter en tant qu'administrateur".

&#x25B6; Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 

&#x25B6; Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 

&#x25B6; Poste le rapport généré. (C:\TB.txt)

geoffrey5 · Answer

tout le rapport n'est pas affiché mais ça me suffit  ;-)

strictmaximum · Answer

il ne se passe rien aprés avoir fait le choix 1 (même en administrateur)

geoffrey5 · Answer

As-tu désactivé le contrôle des comptes administrateurs et redémarré le PC ??

strictmaximum · Answer

oui oui mais quand je fait entrée après le choix 1 la fenêtre disparait

geoffrey5 · Answer

Ouvre le gestionnaire des tâches et vérifie si ToolbarSD n'est pas en exécution...

Pour ouvrir le gestionnaire des tâches : Ctrl+Alt+Suppr

strictmaximum · Answer

non et même dans les processus il n'apparait pas non plus

geoffrey5 · Answer

Bizarre...

Essaye en l'exécutant normalement (pas en admin)

strictmaximum · Answer

pareil ....

strictmaximum · Answer

je ne vois toujours rien dans le gestionnaire des taches

il es t compatible vista ?

strictmaximum · Answer

et même en compatibilité xp !

geoffrey5 · Answer

As-tu déjà utiliser Malwarebytes ?? Si non, fais ceci stp :

&#x25B6; Télécharge malwarebyte's anti-malware 

&#x25B6; Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.
 
&#x25B6; Fais la mise à jour du logiciel (elle se fait normalement à l'installation) 

&#x25B6; Lance une analyse complète en cliquant sur "Exécuter un examen complet"

&#x25B6; Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

&#x25B6; L'analyse peut durer un bon moment.....

&#x25B6; Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

&#x25B6; Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

&#x25B6; Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum


* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... 
Faites le en cliquant sur "oui" à la question posée

geoffrey5 · Answer

Oui il est bien compatible Vista

strictmaximum · Answer

ok ça je l'ai et je connais bien malwarbyte je vais le faire, mais demain là dodo ! je te tiens au courant via le forum ...
Encore merci de te soucier de mes problème à cette heure tardive  !

cïao

geoffrey5 · Answer

Ok  ;-)

A demain

strictmaximum · Answer

Geoffrey5 bonjour, le seul scan qui a marché c'est avec combofix voilà le rapport ...

ComboFix 09-08-10.06 - Pc de wam 15/08/2009 11:47.1.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3070.1828 [GMT 2:00]
Running from: c:\users\Pc de wam\Desktop\ComboFix.exe
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\pdfforge Toolbar\SearchSettings.dll
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettings.dll
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\windows\Installer\WMEncoder.msi
c:\windows\system32\Ijl11.dll


.
(((((((((((((((((((((((((   Files Created from 2009-07-15 to 2009-08-15  )))))))))))))))))))))))))))))))
.

2009-08-15 09:14 . 2008-06-05 16:18	5737	----a-w-	c:\users\Valerie\AppData\Local\gnc.exe
2009-08-15 09:14 . 2008-06-05 16:18	5737	----a-w-	c:\users\Administrateur\AppData\Local\gnc.exe
2009-08-15 09:01 . 2009-08-15 09:22	--------	d-----w-	c:\program files\Navilog1
2009-08-14 23:57 . 2009-08-14 23:57	--------	d-----w-	c:\program files	rend micro
2009-08-14 23:57 . 2009-08-14 23:57	--------	d-----w-	C:sit
2009-08-13 17:25 . 2009-08-13 17:25	--------	d-----w-	c:\users\Valerie\AppData\Roaming\Malwarebytes
2009-08-13 15:02 . 2009-08-13 15:02	--------	d-----w-	c:\program files\Windows Media Components
2009-08-13 08:40 . 2009-08-13 08:40	--------	d-----w-	c:\program files\Maïdo Production
2009-08-12 19:24 . 2009-08-12 19:24	--------	d-----w-	c:\program files\Common Files\EasyInfo
2009-08-09 18:27 . 2009-08-09 18:27	--------	d-----w-	c:\programdata\Apowersoft
2009-08-08 14:30 . 2009-08-08 14:30	--------	d-----w-	c:\program files\PCPitstop
2009-08-08 07:08 . 2009-08-08 07:08	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\IObit
2009-08-08 07:08 . 2009-08-08 07:08	--------	d-----w-	c:\program files\IObit
2009-08-06 11:48 . 2009-08-06 11:56	--------	d-----w-	c:\program files\PhotoFiltre
2009-08-06 09:48 . 2009-03-19 14:32	23400	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-06 09:48 . 2008-04-17 10:12	107368	----a-w-	c:\windows\system32\GEARAspi.dll
2009-08-06 09:48 . 2009-08-06 09:48	--------	d-----w-	c:\program files\iPod
2009-08-06 09:48 . 2009-08-06 09:48	--------	d-----w-	c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-06 09:48 . 2009-08-06 09:48	--------	d-----w-	c:\program files\iTunes
2009-08-06 09:47 . 2009-08-06 09:47	--------	d-----w-	c:\program files\Bonjour
2009-08-06 09:34 . 2009-08-06 09:34	--------	d-----w-	c:\program files\Easy Video Downloader
2009-08-04 06:49 . 2009-08-04 06:49	--------	d-----w-	c:\users\Pc de wam\AppData\Local\Exalead
2009-07-30 18:40 . 2009-07-30 18:40	--------	d-----w-	c:\program files\MSN Messenger
2009-07-30 17:07 . 2009-02-06 16:08	55280	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2009-07-30 15:14 . 2009-07-30 15:14	--------	d-----w-	c:\program files\Microsoft Sync Framework
2009-07-30 15:12 . 2009-07-30 15:12	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2009-07-26 14:27 . 2009-07-26 14:31	--------	dcsh--w-	c:\program files\Common Files\WindowsLiveInstaller
2009-07-26 14:27 . 2009-07-30 17:05	--------	d-----w-	c:\program files\Windows Live
2009-07-26 14:13 . 2009-07-26 14:13	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-07-26 14:08 . 2009-07-26 14:08	86576	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
2009-07-26 14:07 . 2009-07-26 14:07	392728	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Services Windows Live\Services Windows Live.dll
2009-07-26 14:07 . 2009-07-26 14:07	135680	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
2009-07-26 14:07 . 2009-07-26 14:07	132672	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-15 09:54 . 2009-02-24 12:15	--------	d-----w-	c:\program files\pdfforge Toolbar
2009-08-15 09:36 . 2009-01-26 16:27	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-08-15 09:36 . 2009-01-26 16:27	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2009-08-15 09:35 . 2008-12-11 15:59	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-15 09:34 . 2009-01-05 15:47	3942048	----a-w-	c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-15 09:01 . 2008-01-21 08:40	713304	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-15 09:01 . 2008-01-21 08:40	143336	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-15 08:57 . 2009-01-13 10:55	352615	---ha-w-	c:\windows\system32\drivers\vsconfig.xml
2009-08-15 08:55 . 2009-01-07 14:00	12	----a-w-	c:\windows\bthservsdp.dat
2009-08-14 19:52 . 2009-02-04 16:04	--------	d-----w-	c:\programdata\Google Updater
2009-08-14 15:15 . 2008-12-11 13:47	1	----a-w-	c:\users\Pc de wam\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-08-13 17:43 . 2009-01-12 21:56	--------	d-----w-	c:\program files\Micro Application
2009-08-13 17:43 . 2008-03-15 22:43	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-08-13 08:40 . 2009-08-13 08:40	--------	d-----w-	c:\program files\Maïdo Production
2009-08-12 19:20 . 2009-02-21 21:01	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\Command & Conquer(tm) 3  La Fureur de Kane
2009-08-12 08:06 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-08-11 16:54 . 2008-12-11 16:58	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\Skype
2009-08-11 16:51 . 2008-12-11 16:59	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\skypePM
2009-08-06 10:12 . 2008-12-22 03:53	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\dvdcss
2009-08-06 10:00 . 2009-01-11 15:33	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\Apple Computer
2009-08-06 09:48 . 2008-12-14 19:23	--------	d-----w-	c:\program files\Common Files\Apple
2009-08-06 09:48 . 2008-12-14 19:22	--------	d-----w-	c:\programdata\Apple Computer
2009-08-06 09:47 . 2009-01-16 07:23	--------	d-----w-	c:\program files\QuickTime
2009-08-03 20:26 . 2008-12-11 18:57	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-08-03 11:36 . 2008-12-11 15:59	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2008-12-11 15:59	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-07-30 18:27 . 2009-06-15 11:27	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\vlc
2009-07-30 18:27 . 2009-03-10 08:33	--------	d-----w-	c:\program files\Glary Utilities
2009-07-30 10:38 . 2009-01-13 10:55	352615	---ha-w-	c:\windows\system32\drivers\vsconfig(91).xml
2009-07-26 14:27 . 2009-02-18 22:47	--------	d-----w-	c:\programdata\WLInstaller
2009-07-25 09:02 . 2009-06-16 23:04	--------	d-----w-	c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-07-22 05:35 . 2009-06-10 05:57	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\gtk-2.0
2009-07-21 21:52 . 2009-07-29 18:10	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 18:10	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 18:10	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 18:10	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-19 15:23 . 2009-03-03 20:14	--------	d-----w-	c:\programdata\Electronic Arts
2009-07-18 10:56 . 2009-02-05 16:14	--------	d-----w-	c:\program files\Crawler
2009-07-18 10:53 . 2008-12-11 20:14	--------	d-----w-	c:\program files\Electronic Arts
2009-07-18 10:53 . 2009-07-19 10:47	2701312	----a-w-	c:\windows\Internet Logs\xDB80A3.tmp
2009-07-17 13:54 . 2009-08-12 08:02	71680	----a-w-	c:\windows\system32\atl.dll
2009-07-15 12:40 . 2009-08-12 08:02 8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-12 08:02	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-12 08:02	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-12 08:02	7680	----a-w-	c:\windows\system32\spwmp.dll
2009-07-14 16:16 . 2008-12-29 18:22	1	----a-w-	c:\users\Valerie\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-14 15:17 . 2009-07-14 15:17	15308440	----a-w-	c:\windows\system32\xlive.dll
2009-07-14 15:17 . 2009-07-14 15:17	13642888	----a-w-	c:\windows\system32\xlivefnt.dll
2009-07-13 12:22 . 2009-07-13 12:22	75048	----a-w-	c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-08 13:08 . 2008-12-11 17:25	848	--sha-w-	c:\windows\system32\KGyGaAvL.sys
2009-07-06 17:18 . 2008-12-11 14:52	116104	----a-w-	c:\users\Valerie\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-04 07:25 . 2009-04-19 20:41	172920	---ha-w-	c:\windows\system32\mlfcache.dat
2009-07-04 07:09 . 2009-03-16 16:12	--------	d-----w-	c:\program files\Safari
2009-07-03 08:42 . 2009-07-03 08:41	31834577	----a-w-	c:\windows\Internet Logs\vsmon_on_demand_2009_07_03_10_35_10_full.dmp.zip
2009-07-03 08:17 . 2009-07-01 16:17	--------	d-----w-	c:\program files\MagicDisc
2009-06-30 18:37 . 2008-12-11 21:47	--------	d-----w-	c:\programdata\TrackMania
2009-06-27 07:53 . 2008-12-11 12:37	116104	----a-w-	c:\users\Pc de wam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-27 07:43 . 2009-01-27 22:44	--------	d-----w-	c:\program files\Finale 2002
2009-06-27 07:42 . 2009-03-16 16:18	--------	d-----w-	c:\program files\Food Force - Version Française
2009-06-27 07:41 . 2009-04-16 12:58	--------	d-----w-	c:\programdata\Media Center Programs
2009-06-25 12:46 . 2009-06-25 12:46	10134	----a-r-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-25 12:46 . 2009-06-25 12:46	--------	d-----w-	c:\program files\Microsoft WSE
2009-06-21 14:30 . 2009-03-27 07:05 6031786	----a-w-	c:\windows\Internet Logs	vDebug.zip
2009-06-18 10:02 . 2009-06-18 10:01	2665	----a-w-	c:\users\Pc de wam\errorlog.tmp
2009-06-16 23:41 . 2009-06-16 23:41	--------	d-----w-	c:\program files\DivX
2009-06-16 23:41 . 2009-06-16 23:41	--------	d-----w-	c:\program files\Common Files\DivX Shared
2009-06-15 23:15 . 2009-08-12 08:02	439864	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2009-06-15 14:54 . 2009-08-12 08:02	175104	----a-w-	c:\windows\system32\wdigest.dll
2009-06-15 14:53 . 2009-07-15 10:58	156672	----a-w-	c:\windows\system32	2embed.dll
2009-06-15 14:53 . 2009-08-12 08:02	72704	----a-w-	c:\windows\system32\secur32.dll
2009-06-15 14:53 . 2009-08-12 08:02	270848	----a-w-	c:\windows\system32\schannel.dll
2009-06-15 14:53 . 2009-08-12 08:02	218624	----a-w-	c:\windows\system32\msv1_0.dll
2009-06-15 14:52 . 2009-08-12 08:02 1259008	----a-w-	c:\windows\system32\lsasrv.dll
2009-06-15 14:52 . 2009-07-15 10:58	23552	----a-w-	c:\windows\system32\lpk.dll
2009-06-15 14:52 . 2009-08-12 08:02	499712	----a-w-	c:\windows\system32\kerberos.dll
2009-06-15 14:52 . 2009-07-15 10:58	72704	----a-w-	c:\windows\system32\fontsub.dll
2009-06-15 14:51 . 2009-07-15 10:58	10240	----a-w-	c:\windows\system32\dciman32.dll
2009-06-15 12:48 . 2009-08-12 08:02	9728	----a-w-	c:\windows\system32\lsass.exe
2009-06-15 12:42 . 2009-07-15 10:58	289792	----a-w-	c:\windows\system32\atmfd.dll
2009-06-10 11:42 . 2009-08-12 08:02	160256	----a-w-	c:\windows\system32\wkssvc.dll
2009-06-10 11:38 . 2009-08-12 08:02	91136	----a-w-	c:\windows\system32\avifil32.dll
2009-06-08 13:12 . 2009-06-08 13:12	69632	----a-w-	c:\programdata\Apple Computer\Installer Cache\Safari 4.30.17.0\SetupAdmin.exe
2009-06-07 15:24 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2009-06-07 14:51 . 2006-11-02 12:37	37665	----a-w-	c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-06-04 12:07 . 2009-08-12 08:02 2066432	----a-w-	c:\windows\system32\mstscax.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480	----a-w-	c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\opera\program\plugins\ssldivx.dll
2009-03-18 14:21 . 2009-03-18 14:21	61	--sh--w-	c:\windows\cnerolf.dat
2006-05-03 10:06 . 2009-02-25 22:02	163328	--sh--r-	c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2009-02-25 22:02	31232	--sh--r-	c:\windows\System32\msfDX.dll
2008-03-16 13:30 . 2009-02-25 22:02	216064	--sh--r-	c:\windows\System32
bDX.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-01-30 14:12	650752	----a-w-	c:\program files\pdfforge Toolbar\WidgiToolbarIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Google Update"="c:\users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-02-26 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"USBDetector"="c:\usbstorage\USBDetector.exe" [2004-01-07 53248]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-05 68592]
"a-squared"="c:\program files\a-squared Anti-Dialer\a2adguard.exe" [2008-06-03 1497744]
"a-squared Anti-Dialer"="c:\program files\a-squared Anti-Dialer\a2adguard.exe" [2008-06-03 1497744]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-29 4911104]

c:\users\Valerie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\users\Pc de wam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Notification de cadeaux MSN.lnk - c:\users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-7-26 135680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2009-5-6 118784]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2008-12-11 663552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Pc de wam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DesktopEarth AutoStart.lnk]
backup=c:\windows\pss\DesktopEarth AutoStart.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Pc de wam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper

[HKEY_CURRENT_USER\software\microsoft\windows\currentversionun-]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):9b,9f,e2,e5,84,e7,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3401825297-215223651-1193373890-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{01FF3703-8975-429B-875A-AB12919BCBC8}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect
"{2FB1E4DC-655B-4D66-BC5F-35F864C3CAF8}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{4801CD5B-F558-4808-9CD9-4DFB2F24AC55}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{616AABAB-E816-4AAD-8898-F38B1255D749}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{FD0915E6-9BAD-4C0E-98F8-71A181A5E87C}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{EAC16019-5FFD-4479-9BD1-FF44C6A1B94C}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{41BD57FF-08B7-4BBF-9C4D-841047B98225}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{A1BD7223-D5C0-41CC-8383-CC548B9377A0}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A94CAEAB-F114-4E1A-B80D-1855BE3D0118}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{77A91AC7-5ED4-464C-BDC3-29578898AD7C}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"TCP Query User{B06C7328-753A-4252-9464-BBEDC74C7C4B}c:\program files\tmnationsforever\tmforever.exe"= UDP:c:\program files	mnationsforever	mforever.exe:TmForever
"UDP Query User{F4940668-C5EE-4DA9-A6CE-53E8112DD88F}c:\program files\tmnationsforever\tmforever.exe"= TCP:c:\program files	mnationsforever	mforever.exe:TmForever
"TCP Query User{1B23C882-A377-4834-9E5B-568A515FF910}c:\program files\tmnationsforever\tmforever.exe"= UDP:c:\program files	mnationsforever	mforever.exe:TmForever
"UDP Query User{B135110A-46B4-4180-8EBA-1E4B30C14504}c:\program files\tmnationsforever\tmforever.exe"= TCP:c:\program files	mnationsforever	mforever.exe:TmForever
"{FC819692-5277-4BBA-8859-CB3093D2AA21}"= UDP:c:\program files\Neuf\Kit\9mail.exe:Assistant de messagerie
"{56942CA2-83C8-4E42-AC84-54A46DF28ABB}"= TCP:c:\program files\Neuf\Kit\9mail.exe:Assistant de messagerie
"{51BFACC5-1079-4DE9-A489-8C58084B67E8}"= UDP:c:\program files\Neuf\Kit\9props.exe:Etat de votre connexion
"{A37D0CC8-CCC9-4083-91A9-9DF688103CB3}"= TCP:c:\program files\Neuf\Kit\9props.exe:Etat de votre connexion
"{42E3FABF-BC0E-4012-A2DC-B67E604D1FB7}"= UDP:c:\program files\Neuf\Kit\9conf.exe:Reconfigurer votre connexion
"{FDB7C274-84A1-4F42-8D73-E4BB6BE6D9B5}"= TCP:c:\program files\Neuf\Kit\9conf.exe:Reconfigurer votre connexion
"{F643AC2E-E611-4A12-B8F3-75AEF3A71C8F}"= UDP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{1875B86A-5D43-488D-98A0-7E64F27C58F1}"= TCP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{2DEA0FF4-D6BA-4D94-8314-35565FE0F447}"= UDP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{77870088-DCF7-43F6-92CA-B52F9F4FFA00}"= TCP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"TCP Query User{C1868309-C67A-4FC8-A349-826DAEA40696}c:\program files\rockstar games\grand theft auto iv\gtaiv.exe"= UDP:c:\program filesockstar games\grand theft auto iv\gtaiv.exe:Grand Theft Auto IV
"UDP Query User{4F3CAA27-96FC-4F01-8306-D676D104D266}c:\program files\rockstar games\grand theft auto iv\gtaiv.exe"= TCP:c:\program filesockstar games\grand theft auto iv\gtaiv.exe:Grand Theft Auto IV
"{E8122EC5-604A-49BC-8FB5-1D03A4EFAD4A}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{9BF118AC-D5ED-4856-B3A3-B9C1383CD72F}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{9520839C-2B82-4FB6-A277-B31B873F44AE}"= Disabled:UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne
"{E89CC638-5CB7-4DE1-9CBB-57DD2B14E6BB}"= Disabled:TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne
"{1D5AB5DF-8845-44DA-895A-03F9D639A7E1}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{6A40A4A9-0D74-4D42-8037-1A1D8123BA35}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C9300A55-5492-434F-8FF8-DCBD36416884}"= UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{14E388DC-F378-4E20-95F7-DE6099A82E37}"= TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{34336C4A-3B38-4FAD-B87C-E11AC2C70850}"= UDP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{7096149B-37C6-4724-80B4-09A3D7121727}"= TCP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{C5758B98-3D78-4987-80AC-AD3C96806BC6}"= UDP:c:\program files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander
"{CFA04BE6-97A8-4B17-9172-CD5822535567}"= TCP:c:\program files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander
"{0238ACDC-14A8-4540-B2E8-857D78E6BDBE}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{A432CC13-1204-4079-9150-38F1FE167D70}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{1443CD08-6DDC-42C0-BF5E-3040E4F1D58E}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X
"{736F815B-4BF8-4B13-A4B4-12083442AA0E}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X
"{C4CD8915-428B-412E-9C89-4C497017F04A}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{2EE92D32-1E08-406E-9D63-6C71E05347E5}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E72EA533-DA3E-4176-A507-39B93B70D51D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F68D65FC-421C-4D8F-A56B-ABDA79723021}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F505B036-785B-4EF7-923C-33D6BE181F26}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{ACC63375-3331-4DBA-B66A-E4769412E4BD}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{C676C503-F333-4C43-8479-5D948214054B}"= UDP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{14D294CD-52A7-4C5D-8D20-6ED4B991FB01}"= TCP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [05/05/2009 19:27 130936]
R1 ATMhelpr;ATMhelpr;c:\windows\System32\drivers\ATMHELPR.SYS [11/12/2008 19:21 4064]
R2 a2AntiDialer;a-squared Anti-Dialer Service;c:\program files\a-squared Anti-Dialer\a2service.exe [05/05/2009 21:45 425080]
R2 acedrv11;acedrv11;c:\windows\System32\drivers\ACEDRV11.sys [23/01/2008 10:19 501560]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [08/06/2009 14:04 108289]
R2 SBKUPNT;SBKUPNT;c:\windows\System32\drivers\SBKUPNT.SYS [11/02/2009 21:41 14976]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [31/03/2009 17:02 1153368]
S2 gupdate1c9a430e71f83c9;Google Update Service (gupdate1c9a430e71f83c9);c:\program files\Google\Update\GoogleUpdate.exe [17/02/2009 01:44 133104]
S2 SeekService Service;SeekService Service;"c:\programdata\SeekService\seekservice114.exe" "c:\program files\SeekService\seekservice.dll" Service --> c:\programdata\SeekService\seekservice114.exe [?]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [10/01/2009 17:10 1527900]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [30/07/2009 19:07 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ovt530;Webcam Classic;c:\windows\System32\drivers\ov530vid.sys [11/12/2008 19:09 161792]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [05/05/2009 19:27 348752]
S3 ultradfg;ultradfg;c:\windows\System32\drivers\ultradfg.sys [18/02/2009 10:41 30720]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [10/01/2009 17:10 544768]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2009-08-15 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-03-27 08:49]

2009-08-15 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-04 20:20]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-16 23:44]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-16 23:44]

2009-08-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3401825297-215223651-1193373890-1000Core.job
- c:\users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-26 14:36]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3401825297-215223651-1193373890-1000UA.job
- c:\users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-26 14:36]

2009-08-09 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-08-08 07:22]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{53BCF99A-B7BE-4D6D-B65D-EA2FD115B83F} - (no file)


.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://fr.fr.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Crawler Search - tbr:iemenu
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: chat-land.org
Trusted Zone: localhost
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\Pc de wam\AppData\Roaming\Mozilla\Firefox\Profiles\7vvd3hdt.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins
pdivx32.dll
FF - plugin: c:\program files\Picasa2
pPicasa2.dll
FF - plugin: c:\program files\Picasa2
pPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Pc de wam\AppData\Local\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota",      5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",     true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",    true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",     true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",       true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",    true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",               false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",               true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",                   true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",             false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",            false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",    false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-15 11:55
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services
pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3401825297-215223651-1193373890-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:57,52,a0,0d,d0,fe,84,11,33,92,cb,01,78,d9,ba,c9,8b,b2,09,f6,a8,c8,34,
   bf,78,49,aa,c4,a6,e0,5f,21,cf,0b,99,1a,2f,94,91,7d,07,19,8e,98,8e,01,ae,ae,\
"??"=hex:11,f0,60,db,37,28,f5,a2,92,4d,28,5e,99,c6,56,4b

[HKEY_USERS\S-1-5-21-3401825297-215223651-1193373890-1000\Software\SecuROM\License information*]
"datasecu"=hex:ca,35,73,a4,bb,5a,71,17,df,28,7b,46,3c,3b,0d,fd,08,32,06,e8,3e,
   e9,74,33,47,69,04,b2,2b,e0,81,f7,12,db,12,f0,01,48,bb,7f,b5,09,63,89,94,57,\
"rkeysecu"=hex:f4,a0,52,ce,91,d6,c9,59,5b,71,4b,1c,82,f4,1f,c9

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{21f135ff-0279-49c8-ad5a-4d13124e7244}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:10020054
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{29491500-32a1-4a81-98b9-c9518aec5484}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0d00016c
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{2b14e14f-230c-4346-8dab-1d681809389b}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:10001e2a
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{92ac5daa-a1aa-486b-967b-802804a599ef}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0c001e2a
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:07001422
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ba32a50a-3d27-4fae-8591-5916311409be}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0c001422
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{d532b358-133f-43c0-b4c3-125eaacd384d}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:10001e2a
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:06001422
"Dhcpv6State"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f70a361f-6437-4fcc-91a4-cd88d468d91b}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0e001422
"Dhcpv6State"=dword:00000000
.
Completion time: 2009-08-15 12:00
ComboFix-quarantined-files.txt  2009-08-15 10:00

Pre-Run: 21 449 842 688 octets libres
Post-Run: 21 423 202 304 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=12 Sets=1,2,3,4,5,6,7,8,9,10,11,12,14,15,16,17,18
449	--- E O F ---	2009-08-14 06:39

geoffrey5 · Answer

Bonjour,

Malwarebytes ne marche pas ??!!

strictmaximum · Answer

en cours depuis 35 minutes  ...

strictmaximum · Answer

encours dpuis 36 minutes ....

et le scan de combofix ça te parle pas ?

geoffrey5 · Answer

Ok... ComboFix a supprimé une partie des tollbars infectées  ;-)

strictmaximum · Answer

malwarbyte resultat du scan negatif....
(J'étais parti faire une sieste, je suis pas loin d'agen, aujourd'hui la ville la plus chaude de france 38° sous abri, 45 ou 50 dehors !)

Je vais faire un scan avec spybot !

geoffrey5 · Answer

&#x25B6; Dans la barre des tâches, clique sur Démarrer puis sur Exécuter

&#x25B6; Tape Msconfig puis clique sur OK

&#x25B6; Clique sur l'onglet "services" et décoche la case SeekService

&#x25B6; Ensuite clique sur Appliquer ==> OK

Ensuite refais un nouveau rapport avec RSIT stp

strictmaximum · Answer

En attendand jai fait un scan malwarbyte, avira anti virus et spybot, rien ! Résultats négatifs !

strictmaximum · Answer

J'ai regardé sur mon disque C: plus de seekservice et j'ai fait msconfig pas de seekservice dans les services non-plus !
dernier log de RSIT
Logfile of random's system information tool 1.06 (written by random/random)
Run by Pc de wam at 2009-08-15 22:20:47
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 20 GB (11%) free of 185 GB
Total RAM: 3070 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:21:14, on 15/08/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Pc de wam\Downloads\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files	rend micro\Pc de wam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe" /d=60
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate1c9a430e71f83c9) (gupdate1c9a430e71f83c9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SeekService Service - Unknown owner - C:\ProgramData\SeekService\seekservice114.exe (file missing)
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

strictmaximum · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Pc de wam at 2009-08-15 22:20:47
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 20 GB (11%) free of 185 GB
Total RAM: 3070 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:21:14, on 15/08/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Pc de wam\Downloads\RSIT.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files	rend micro\Pc de wam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [a-squared Anti-Dialer] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe" /d=60
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldfr-fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate1c9a430e71f83c9) (gupdate1c9a430e71f83c9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SeekService Service - Unknown owner - C:\ProgramData\SeekService\seekservice114.exe (file missing)
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

strictmaximum · Answer

tu vois ? parce que c'est en gris clair !

geoffrey5 · Answer

Pourrais-tu réessayer ToobarSD stp ??

strictmaximum · Answer

Se passe toujours rien la fenêtre disparait et puis rien ... !

geoffrey5 · Answer

Supprime-le et réinstalle pour voir...

Si l'option 1 ne va pas, fais directement l'option 2

strictmaximum · Answer

j'avais déja supprimé et réinstallé deux minutes je fais l'option 2
(encore merci de passer du temps)

strictmaximum · Answer

Pareil ! Rien ne se passe !

strictmaximum · Answer

je peux faire un autre combofix si tu veux ?

strictmaximum · Answer

dernier combofix

ComboFix 09-08-10.06 - Pc de wam 15/08/2009 22:58.2.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3070.2008 [GMT 2:00]
Running from: c:\users\Pc de wam\Desktop\ComboFix.exe
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((   Files Created from 2009-07-15 to 2009-08-15  )))))))))))))))))))))))))))))))
.

2009-08-15 21:06 . 2009-08-15 21:06	--------	d-----w-	c:\windows\system32\config\systemprofile\AppData\Local	emp
2009-08-15 21:06 . 2009-08-15 21:06	--------	d-----w-	c:\users\Valerie\AppData\Local	emp
2009-08-15 21:06 . 2009-08-15 21:06	--------	d-----w-	c:\users\TEMP\AppData\Local	emp
2009-08-15 21:06 . 2009-08-15 21:06	--------	d-----w-	c:\users\Public\AppData\Local	emp
2009-08-15 21:06 . 2009-08-15 21:06	--------	d-----w-	c:\users\Default\AppData\Local	emp
2009-08-15 21:06 . 2009-08-15 21:06	--------	d-----w-	c:\users\Administrateur\AppData\Local	emp
2009-08-15 09:14 . 2008-06-05 16:18	5737	----a-w-	c:\users\Valerie\AppData\Local\gnc.exe
2009-08-15 09:14 . 2008-06-05 16:18	5737	----a-w-	c:\users\Administrateur\AppData\Local\gnc.exe
2009-08-15 09:01 . 2009-08-15 09:22	--------	d-----w-	c:\program files\Navilog1
2009-08-14 23:57 . 2009-08-15 20:52	--------	d-----w-	c:\program files	rend micro
2009-08-14 23:57 . 2009-08-14 23:57	--------	d-----w-	C:sit
2009-08-13 17:25 . 2009-08-13 17:25	--------	d-----w-	c:\users\Valerie\AppData\Roaming\Malwarebytes
2009-08-13 15:02 . 2009-08-13 15:02	--------	d-----w-	c:\program files\Windows Media Components
2009-08-13 08:40 . 2009-08-13 08:40	--------	d-----w-	c:\program files\Maïdo Production
2009-08-12 19:24 . 2009-08-12 19:24	--------	d-----w-	c:\program files\Common Files\EasyInfo
2009-08-09 18:27 . 2009-08-09 18:27	--------	d-----w-	c:\programdata\Apowersoft
2009-08-08 14:30 . 2009-08-08 14:30	--------	d-----w-	c:\program files\PCPitstop
2009-08-08 07:08 . 2009-08-08 07:08	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\IObit
2009-08-08 07:08 . 2009-08-08 07:08	--------	d-----w-	c:\program files\IObit
2009-08-06 11:48 . 2009-08-06 11:56	--------	d-----w-	c:\program files\PhotoFiltre
2009-08-06 09:48 . 2009-03-19 14:32	23400	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-06 09:48 . 2008-04-17 10:12	107368	----a-w-	c:\windows\system32\GEARAspi.dll
2009-08-06 09:48 . 2009-08-06 09:48	--------	d-----w-	c:\program files\iPod
2009-08-06 09:48 . 2009-08-06 09:48	--------	d-----w-	c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-06 09:48 . 2009-08-06 09:48	--------	d-----w-	c:\program files\iTunes
2009-08-06 09:47 . 2009-08-06 09:47	--------	d-----w-	c:\program files\Bonjour
2009-08-06 09:34 . 2009-08-06 09:34	--------	d-----w-	c:\program files\Easy Video Downloader
2009-08-04 06:49 . 2009-08-04 06:49	--------	d-----w-	c:\users\Pc de wam\AppData\Local\Exalead
2009-07-30 18:40 . 2009-07-30 18:40	--------	d-----w-	c:\program files\MSN Messenger
2009-07-30 17:07 . 2009-02-06 16:08	55280	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2009-07-30 15:14 . 2009-07-30 15:14	--------	d-----w-	c:\program files\Microsoft Sync Framework
2009-07-30 15:12 . 2009-07-30 15:12	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition
2009-07-26 14:27 . 2009-07-26 14:31	--------	dcsh--w-	c:\program files\Common Files\WindowsLiveInstaller
2009-07-26 14:27 . 2009-07-30 17:05	--------	d-----w-	c:\program files\Windows Live
2009-07-26 14:13 . 2009-07-26 14:13	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-07-26 14:08 . 2009-07-26 14:08	86576	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
2009-07-26 14:07 . 2009-07-26 14:07	392728	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Services Windows Live\Services Windows Live.dll
2009-07-26 14:07 . 2009-07-26 14:07	135680	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
2009-07-26 14:07 . 2009-07-26 14:07	132672	----a-w-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-15 20:53 . 2009-02-04 16:04	--------	d-----w-	c:\programdata\Google Updater
2009-08-15 20:24 . 2008-01-21 08:40	713304	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-15 20:24 . 2008-01-21 08:40	143336	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-15 20:20 . 2009-01-13 10:55	352615	---ha-w-	c:\windows\system32\drivers\vsconfig.xml
2009-08-15 20:18 . 2009-01-07 14:00	12	----a-w-	c:\windows\bthservsdp.dat
2009-08-15 20:11 . 2009-01-26 16:27	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2009-08-15 10:29 . 2008-12-11 13:47	1	----a-w-	c:\users\Pc de wam\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-08-15 09:54 . 2009-02-24 12:15	--------	d-----w-	c:\program files\pdfforge Toolbar
2009-08-15 09:36 . 2009-01-26 16:27	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-08-15 09:35 . 2008-12-11 15:59	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-15 09:34 . 2009-01-05 15:47	3942048	----a-w-	c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-13 17:43 . 2009-01-12 21:56	--------	d-----w-	c:\program files\Micro Application
2009-08-13 17:43 . 2008-03-15 22:43	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-08-13 08:40 . 2009-08-13 08:40	--------	d-----w-	c:\program files\Maïdo Production
2009-08-12 19:20 . 2009-02-21 21:01	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\Command & Conquer(tm) 3  La Fureur de Kane
2009-08-12 08:06 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-08-11 16:54 . 2008-12-11 16:58	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\Skype
2009-08-11 16:51 . 2008-12-11 16:59	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\skypePM
2009-08-06 10:12 . 2008-12-22 03:53	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\dvdcss
2009-08-06 10:00 . 2009-01-11 15:33	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\Apple Computer
2009-08-06 09:48 . 2008-12-14 19:23	--------	d-----w-	c:\program files\Common Files\Apple
2009-08-06 09:48 . 2008-12-14 19:22	--------	d-----w-	c:\programdata\Apple Computer
2009-08-06 09:47 . 2009-01-16 07:23	--------	d-----w-	c:\program files\QuickTime
2009-08-03 20:26 . 2008-12-11 18:57	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-08-03 11:36 . 2008-12-11 15:59	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2008-12-11 15:59	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-07-30 18:27 . 2009-06-15 11:27	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\vlc
2009-07-30 18:27 . 2009-03-10 08:33	--------	d-----w-	c:\program files\Glary Utilities
2009-07-30 10:38 . 2009-01-13 10:55	352615	---ha-w-	c:\windows\system32\drivers\vsconfig(91).xml
2009-07-26 14:27 . 2009-02-18 22:47	--------	d-----w-	c:\programdata\WLInstaller
2009-07-25 09:02 . 2009-06-16 23:04	--------	d-----w-	c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-07-22 05:35 . 2009-06-10 05:57	--------	d-----w-	c:\users\Pc de wam\AppData\Roaming\gtk-2.0
2009-07-21 21:52 . 2009-07-29 18:10	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 18:10	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 18:10	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 18:10	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-19 15:23 . 2009-03-03 20:14	--------	d-----w-	c:\programdata\Electronic Arts
2009-07-18 10:56 . 2009-02-05 16:14	--------	d-----w-	c:\program files\Crawler
2009-07-18 10:53 . 2008-12-11 20:14	--------	d-----w-	c:\program files\Electronic Arts
2009-07-18 10:53 . 2009-07-19 10:47	2701312	----a-w-	c:\windows\Internet Logs\xDB80A3.tmp
2009-07-17 13:54 . 2009-08-12 08:02	71680	----a-w-	c:\windows\system32\atl.dll
2009-07-15 12:40 . 2009-08-12 08:02	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-12 08:02	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-12 08:02	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-12 08:02	7680	----a-w-	c:\windows\system32\spwmp.dll
2009-07-14 16:16 . 2008-12-29 18:22	1	----a-w-	c:\users\Valerie\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-14 15:17 . 2009-07-14 15:17	15308440	----a-w-	c:\windows\system32\xlive.dll
2009-07-14 15:17 . 2009-07-14 15:17	13642888	----a-w-	c:\windows\system32\xlivefnt.dll
2009-07-13 12:22 . 2009-07-13 12:22	75048	----a-w-	c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-08 13:08 . 2008-12-11 17:25	848	--sha-w-	c:\windows\system32\KGyGaAvL.sys
2009-07-06 17:18 . 2008-12-11 14:52	116104	----a-w-	c:\users\Valerie\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-04 07:25 . 2009-04-19 20:41	172920	---ha-w-	c:\windows\system32\mlfcache.dat
2009-07-04 07:09 . 2009-03-16 16:12	--------	d-----w-	c:\program files\Safari
2009-07-03 08:42 . 2009-07-03 08:41	31834577	----a-w-	c:\windows\Internet Logs\vsmon_on_demand_2009_07_03_10_35_10_full.dmp.zip
2009-07-03 08:17 . 2009-07-01 16:17	--------	d-----w-	c:\program files\MagicDisc
2009-06-30 18:37 . 2008-12-11 21:47	--------	d-----w-	c:\programdata\TrackMania
2009-06-27 07:53 . 2008-12-11 12:37	116104	----a-w-	c:\users\Pc de wam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-27 07:43 . 2009-01-27 22:44	--------	d-----w-	c:\program files\Finale 2002
2009-06-27 07:42 . 2009-03-16 16:18	--------	d-----w-	c:\program files\Food Force - Version Française
2009-06-27 07:41 . 2009-04-16 12:58	--------	d-----w-	c:\programdata\Media Center Programs
2009-06-25 12:46 . 2009-06-25 12:46	10134	----a-r-	c:\users\Pc de wam\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-25 12:46 . 2009-06-25 12:46	--------	d-----w-	c:\program files\Microsoft WSE
2009-06-21 14:30 . 2009-03-27 07:05	6031786	----a-w-	c:\windows\Internet Logs	vDebug.zip
2009-06-18 10:02 . 2009-06-18 10:01	2665	----a-w-	c:\users\Pc de wam\errorlog.tmp
2009-06-16 23:41 . 2009-06-16 23:41	--------	d-----w-	c:\program files\DivX
2009-06-16 23:41 . 2009-06-16 23:41	--------	d-----w-	c:\program files\Common Files\DivX Shared
2009-06-15 23:15 . 2009-08-12 08:02	439864	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2009-06-15 14:54 . 2009-08-12 08:02	175104	----a-w-	c:\windows\system32\wdigest.dll
2009-06-15 14:53 . 2009-07-15 10:58	156672	----a-w-	c:\windows\system32	2embed.dll
2009-06-15 14:53 . 2009-08-12 08:02	72704	----a-w-	c:\windows\system32\secur32.dll
2009-06-15 14:53 . 2009-08-12 08:02	270848	----a-w-	c:\windows\system32\schannel.dll
2009-06-15 14:53 . 2009-08-12 08:02	218624	----a-w-	c:\windows\system32\msv1_0.dll
2009-06-15 14:52 . 2009-08-12 08:02	1259008	----a-w-	c:\windows\system32\lsasrv.dll
2009-06-15 14:52 . 2009-07-15 10:58	23552	----a-w-	c:\windows\system32\lpk.dll
2009-06-15 14:52 . 2009-08-12 08:02	499712	----a-w-	c:\windows\system32\kerberos.dll
2009-06-15 14:52 . 2009-07-15 10:58	72704	----a-w-	c:\windows\system32\fontsub.dll
2009-06-15 14:51 . 2009-07-15 10:58	10240	----a-w-	c:\windows\system32\dciman32.dll
2009-06-15 12:48 . 2009-08-12 08:02	9728	----a-w-	c:\windows\system32\lsass.exe
2009-06-15 12:42 . 2009-07-15 10:58	289792	----a-w-	c:\windows\system32\atmfd.dll
2009-06-10 11:42 . 2009-08-12 08:02	160256	----a-w-	c:\windows\system32\wkssvc.dll
2009-06-10 11:38 . 2009-08-12 08:02	91136	----a-w-	c:\windows\system32\avifil32.dll
2009-06-08 13:12 . 2009-06-08 13:12	69632	----a-w-	c:\programdata\Apple Computer\Installer Cache\Safari 4.30.17.0\SetupAdmin.exe
2009-06-07 15:24 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2009-06-07 14:51 . 2006-11-02 12:37	37665	----a-w-	c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-06-04 12:07 . 2009-08-12 08:02	2066432	----a-w-	c:\windows\system32\mstscax.dll
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\opera\program\plugins\ssldivx.dll
2009-03-18 14:21 . 2009-03-18 14:21	61	--sh--w-	c:\windows\cnerolf.dat
2006-05-03 10:06 . 2009-02-25 22:02	163328	--sh--r-	c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2009-02-25 22:02	31232	--sh--r-	c:\windows\System32\msfDX.dll
2008-03-16 13:30 . 2009-02-25 22:02	216064	--sh--r-	c:\windows\System32
bDX.dll
.

(((((((((((((((((((((((((((((   SnapShot@2009-08-15_09.56.00   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-08-15 20:21	80054              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-01-21 01:58 . 2009-08-15 08:58	80054              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-08-15 20:21	95150              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-12-11 12:38 . 2009-08-15 20:21	13518              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3401825297-215223651-1193373890-1000_UserData.bin
- 2008-12-11 12:38 . 2009-08-15 08:58	13518              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3401825297-215223651-1193373890-1000_UserData.bin
- 2008-12-11 12:33 . 2009-08-15 09:13	32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-12-11 12:33 . 2009-08-15 20:56	32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-12-11 12:33 . 2009-08-15 09:13	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-11 12:33 . 2009-08-15 20:56	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-11 12:33 . 2009-08-15 20:56	16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-12-11 12:33 . 2009-08-15 09:13	16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-08-15 20:20 . 2009-08-15 20:20	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-08-15 08:56 . 2009-08-15 08:56	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-08-15 08:56 . 2009-08-15 08:56	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-08-15 20:20 . 2009-08-15 20:20	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-08-15 20:24	625384              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-15 09:01	625384              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-15 09:01	116946              c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-08-15 20:24	116946              c:\windows\System32\perfc009.dat
+ 2009-04-11 08:59 . 2009-08-15 20:46	245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-04-11 08:59 . 2009-08-15 08:56	245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-01-30 14:12	650752	----a-w-	c:\program files\pdfforge Toolbar\WidgiToolbarIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Google Update"="c:\users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-02-26 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"USBDetector"="c:\usbstorage\USBDetector.exe" [2004-01-07 53248]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-05 68592]
"a-squared"="c:\program files\a-squared Anti-Dialer\a2adguard.exe" [2008-06-03 1497744]
"a-squared Anti-Dialer"="c:\program files\a-squared Anti-Dialer\a2adguard.exe" [2008-06-03 1497744]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-29 4911104]

c:\users\Valerie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\users\Pc de wam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Notification de cadeaux MSN.lnk - c:\users\Pc de wam\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-7-26 135680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2009-5-6 118784]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2008-12-11 663552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^Pc de wam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DesktopEarth AutoStart.lnk]
backup=c:\windows\pss\DesktopEarth AutoStart.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Pc de wam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversionun-]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):9b,9f,e2,e5,84,e7,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3401825297-215223651-1193373890-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{01FF3703-8975-429B-875A-AB12919BCBC8}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect
"{2FB1E4DC-655B-4D66-BC5F-35F864C3CAF8}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{4801CD5B-F558-4808-9CD9-4DFB2F24AC55}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{616AABAB-E816-4AAD-8898-F38B1255D749}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{FD0915E6-9BAD-4C0E-98F8-71A181A5E87C}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{EAC16019-5FFD-4479-9BD1-FF44C6A1B94C}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{41BD57FF-08B7-4BBF-9C4D-841047B98225}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{A1BD7223-D5C0-41CC-8383-CC548B9377A0}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A94CAEAB-F114-4E1A-B80D-1855BE3D0118}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{77A91AC7-5ED4-464C-BDC3-29578898AD7C}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"TCP Query User{B06C7328-753A-4252-9464-BBEDC74C7C4B}c:\program files\tmnationsforever\tmforever.exe"= UDP:c:\program files	mnationsforever	mforever.exe:TmForever
"UDP Query User{F4940668-C5EE-4DA9-A6CE-53E8112DD88F}c:\program files\tmnationsforever\tmforever.exe"= TCP:c:\program files	mnationsforever	mforever.exe:TmForever
"TCP Query User{1B23C882-A377-4834-9E5B-568A515FF910}c:\program files\tmnationsforever\tmforever.exe"= UDP:c:\program files	mnationsforever	mforever.exe:TmForever
"UDP Query User{B135110A-46B4-4180-8EBA-1E4B30C14504}c:\program files\tmnationsforever\tmforever.exe"= TCP:c:\program files	mnationsforever	mforever.exe:TmForever
"{FC819692-5277-4BBA-8859-CB3093D2AA21}"= UDP:c:\program files\Neuf\Kit\9mail.exe:Assistant de messagerie
"{56942CA2-83C8-4E42-AC84-54A46DF28ABB}"= TCP:c:\program files\Neuf\Kit\9mail.exe:Assistant de messagerie
"{51BFACC5-1079-4DE9-A489-8C58084B67E8}"= UDP:c:\program files\Neuf\Kit\9props.exe:Etat de votre connexion
"{A37D0CC8-CCC9-4083-91A9-9DF688103CB3}"= TCP:c:\program files\Neuf\Kit\9props.exe:Etat de votre connexion
"{42E3FABF-BC0E-4012-A2DC-B67E604D1FB7}"= UDP:c:\program files\Neuf\Kit\9conf.exe:Reconfigurer votre connexion
"{FDB7C274-84A1-4F42-8D73-E4BB6BE6D9B5}"= TCP:c:\program files\Neuf\Kit\9conf.exe:Reconfigurer votre connexion
"{F643AC2E-E611-4A12-B8F3-75AEF3A71C8F}"= UDP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{1875B86A-5D43-488D-98A0-7E64F27C58F1}"= TCP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{2DEA0FF4-D6BA-4D94-8314-35565FE0F447}"= UDP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{77870088-DCF7-43F6-92CA-B52F9F4FFA00}"= TCP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"TCP Query User{C1868309-C67A-4FC8-A349-826DAEA40696}c:\program files\rockstar games\grand theft auto iv\gtaiv.exe"= UDP:c:\program filesockstar games\grand theft auto iv\gtaiv.exe:Grand Theft Auto IV
"UDP Query User{4F3CAA27-96FC-4F01-8306-D676D104D266}c:\program files\rockstar games\grand theft auto iv\gtaiv.exe"= TCP:c:\program filesockstar games\grand theft auto iv\gtaiv.exe:Grand Theft Auto IV
"{E8122EC5-604A-49BC-8FB5-1D03A4EFAD4A}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{9BF118AC-D5ED-4856-B3A3-B9C1383CD72F}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{9520839C-2B82-4FB6-A277-B31B873F44AE}"= Disabled:UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne
"{E89CC638-5CB7-4DE1-9CBB-57DD2B14E6BB}"= Disabled:TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Achat de mise à niveau en ligne
"{1D5AB5DF-8845-44DA-895A-03F9D639A7E1}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{6A40A4A9-0D74-4D42-8037-1A1D8123BA35}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C9300A55-5492-434F-8FF8-DCBD36416884}"= UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{14E388DC-F378-4E20-95F7-DE6099A82E37}"= TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{34336C4A-3B38-4FAD-B87C-E11AC2C70850}"= UDP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{7096149B-37C6-4724-80B4-09A3D7121727}"= TCP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{C5758B98-3D78-4987-80AC-AD3C96806BC6}"= UDP:c:\program files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander
"{CFA04BE6-97A8-4B17-9172-CD5822535567}"= TCP:c:\program files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander
"{0238ACDC-14A8-4540-B2E8-857D78E6BDBE}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{A432CC13-1204-4079-9150-38F1FE167D70}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:Tom Clancy's H.A.W.X
"{1443CD08-6DDC-42C0-BF5E-3040E4F1D58E}"= UDP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X
"{736F815B-4BF8-4B13-A4B4-12083442AA0E}"= TCP:c:\program files\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe:Tom Clancy's H.A.W.X
"{C4CD8915-428B-412E-9C89-4C497017F04A}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{2EE92D32-1E08-406E-9D63-6C71E05347E5}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E72EA533-DA3E-4176-A507-39B93B70D51D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F68D65FC-421C-4D8F-A56B-ABDA79723021}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F505B036-785B-4EF7-923C-33D6BE181F26}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{ACC63375-3331-4DBA-B66A-E4769412E4BD}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{C676C503-F333-4C43-8479-5D948214054B}"= UDP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{14D294CD-52A7-4C5D-8D20-6ED4B991FB01}"= TCP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [05/05/2009 19:27 130936]
R1 ATMhelpr;ATMhelpr;c:\windows\System32\drivers\ATMHELPR.SYS [11/12/2008 19:21 4064]
R2 a2AntiDialer;a-squared Anti-Dialer Service;c:\program files\a-squared Anti-Dialer\a2service.exe [05/05/2009 21:45 425080]
R2 acedrv11;acedrv11;c:\windows\System32\drivers\ACEDRV11.sys [23/01/2008 10:19 501560]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [08/06/2009 14:04 108289]
R2 SBKUPNT;SBKUPNT;c:\windows\System32\drivers\SBKUPNT.SYS [11/02/2009 21:41 14976]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [31/03/2009 17:02 1153368]
S2 gupdate1c9a430e71f83c9;Google Update Service (gupdate1c9a430e71f83c9);c:\program files\Google\Update\GoogleUpdate.exe [17/02/2009 01:44 133104]
S2 SeekService Service;SeekService Service;"c:\programdata\SeekService\seekservice114.exe" "c:\program files\SeekService\seekservice.dll" Service --> c:\programdata\SeekService\seekservice114.exe [?]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [10/01/2009 17:10 1527900]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [30/07/2009 19:07 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 ovt530;Webcam Classic;c:\windows\System32\drivers\ov530vid.sys [11/12/2008 19:09 161792]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [05/05/2009 19:27 348752]
S3 ultradfg;ultradfg;c:\windows\System32\drivers\ultradfg.sys [18/02/2009 10:41 30720]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [10/01/2009 17:10 544768]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder

2009-08-15 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-03-27 08:49]

2009-08-15 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-04 20:20]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-16 23:44]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-16 23:44]

2009-08-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3401825297-215223651-1193373890-1000Core.job
- c:\users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-26 14:36]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3401825297-215223651-1193373890-1000UA.job
- c:\users\Pc de wam\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-26 14:36]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://fr.fr.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Crawler Search - tbr:iemenu
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: chat-land.org
Trusted Zone: localhost
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\Pc de wam\AppData\Roaming\Mozilla\Firefox\Profiles\7vvd3hdt.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins
pdivx32.dll
FF - plugin: c:\program files\Picasa2
pPicasa2.dll
FF - plugin: c:\program files\Picasa2
pPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Pc de wam\AppData\Local\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota",      5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",     true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",    true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",     true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",       true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",    true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",               false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",               true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",                   true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",             false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",            false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",    false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-15 23:06
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services
pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3401825297-215223651-1193373890-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:57,52,a0,0d,d0,fe,84,11,33,92,cb,01,78,d9,ba,c9,8b,b2,09,f6,a8,c8,34,
   bf,78,49,aa,c4,a6,e0,5f,21,cf,0b,99,1a,2f,94,91,7d,07,19,8e,98,8e,01,ae,ae,\
"??"=hex:11,f0,60,db,37,28,f5,a2,92,4d,28,5e,99,c6,56,4b

[HKEY_USERS\S-1-5-21-3401825297-215223651-1193373890-1000\Software\SecuROM\License information*]
"datasecu"=hex:ca,35,73,a4,bb,5a,71,17,df,28,7b,46,3c,3b,0d,fd,08,32,06,e8,3e,
   e9,74,33,47,69,04,b2,2b,e0,81,f7,12,db,12,f0,01,48,bb,7f,b5,09,63,89,94,57,\
"rkeysecu"=hex:f4,a0,52,ce,91,d6,c9,59,5b,71,4b,1c,82,f4,1f,c9
.
Completion time: 2009-08-15 23:10
ComboFix-quarantined-files.txt  2009-08-15 21:10
ComboFix2.txt  2009-08-15 10:00

Pre-Run: 21 328 158 720 octets libres
Post-Run: 21 207 732 224 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=12 Sets=1,2,3,4,5,6,7,8,9,10,11,12,14,15,16,17,18
429	--- E O F ---	2009-08-14 06:39

strictmaximum · Answer

pourquoi mon message est revenu au début sur la troisième page ?

geoffrey5 · Answer

Bonsoir,

tu n'as pas peur d'utiliser ComboFix inutilement à ce que je vois...

Le message initial est automatiquement affiché sur chaque début de page  ;-)

refais un nouveau rapport RSIT stp

Seekservice114

43 réponses

Newsletters