Le PC semble infecté [Résolu]

ok il y a une infection qui bloque la mise a jour

alors fais ce qui est indiqué et colles les rapports

a plus

Bonsoir jlpjlp,

Je ne pourrai pas donner suite avant ce WE.
Encore merci, je te tiendrai au courant

ok

Bonsoir jlpjlp
J'ai commencé le nettoyage que tu m'as conseillé

SDFix a fini mais le rapport ne met que ce qui suit :

[b]SDFix: version 1.240 /bRun by TANFIN Patricia on 18/01/2009 at 20:49

Microsoft Windows XP [version 5.1.2600]
Running from C:\SDFix

[b]Checking Services /b :


Restoring Default Security values
Restoring Default Hosts File

Rebooting


Est-ce normal qu'il ne mette qu'aussi peu de choses ?

Là, c'est Malwarebytes' Anti-Malware qui travaille.
Pour le moment, 7 éléments infectés.

Cela suit son cours

Voici les rapports de RSIT :

info.txt logfile of random's system information tool 1.05 2009-01-18 23:21:36

======Uninstall list======

-->"C:\Program Files\Fichiers communs\aolshare\Coach\AolCInUn.exe" -lang="fr-fr"
-->C:\PROGRA~1\FICHIE~1\AOL\ACS\AcsUninstall.exe /c
-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{09B44E78-A988-4BC0-962F-63ECD3333708} /l1036
-->C:\Program Files\Fichiers communs\AOL\Screensaver\uninst_ygpss.exe
-->C:\Program Files\Fichiers communs\aolshare\Aolunins_fr.exe
-->C:\Program Files\Fichiers communs\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Fichiers communs\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Learn2.com\StRunner\stuninst.exe
-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\Modio\SLAMR2KO\Setup.exe /Remove
-->C:\WINDOWS\System32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
-->C:\WINDOWS\System32\nvudisp.exe UninstallGUI
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.EXE" -uninstall
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\SETUP.EXE" -uninstall
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3436EE2-D5CB-4249-840B-3A0140CC34C3}\SETUP.EXE" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5AFA4872-16B2-419E-ADCA-8E96E739115D}\setup.exe" -l0x40c
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\System32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Flash Player ActiveX-->C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 6.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-000000000001}
Analyseur et SDK MSXML 4.0 SP2-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
Aquatic Tycoon-->C:\Program Files\Aquatic Tycoon\uninstall.exe
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Contrôle Parental-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93094D10-9388-11D4-9886-0000B43F396D}\Setup.exe" -l0x40c
Correctif Windows XP - KB842773-->C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q327979-->C:\WINDOWS\$NtUninstallQ327979$\spuninst\spuninst.exe
Correctif Windows XP (SP2) q330512-->C:\WINDOWS\$NtUninstallq330512$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q330909-->C:\WINDOWS\$NtUninstallQ330909$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q331816-->C:\WINDOWS\$NtUninstallQ331816$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q810020-->C:\WINDOWS\$NtUninstallQ810020$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q814545-->C:\WINDOWS\$NtUninstallQ814545$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q815411-->C:\WINDOWS\$NtUninstallQ815411$\spuninst\spuninst.exe
Correctif Windows XP (SP2) Q817589-->C:\WINDOWS\$NtUninstallQ817589$\spuninst\spuninst.exe
Cycling Manager 4-->C:\Program Files\Cyanide\Cycling Manager 4\uninstall.exe
Disney Tarzan, Atelier de Jeux-->C:\WINDOWS\IsUn040c.exe -fC:\PROGRA~1\DISNEY~1\DISNEY~1\DeIsL2.isu
eMule-->"C:\eMule\Uninstall.exe"
Encyclopédie Universelle Larousse-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{666ADC9C-9C34-4B56-8B22-0419F257FB80}\Setup.exe" -l0x40c
Explorateur du corps humain-->C:\Program Files\DK\Become a Human Body Explorer\_uninst\uninstaller.exe
Fort Boyard - le jeu-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11581B7A-E460-4078-894B-978249254D71}\setup.exe" -l0x40c -removeonly
FreshDownload-->"C:\Program Files\FreshDevices\FreshDownload\unins000.exe"
GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
Gestionnaire Internet-->C:\PROGRA~1\Wanadoo\uninstall.exe
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB909394)-->"C:\WINDOWS\$NtUninstallKB909394$\spuninst\spuninst.exe"
Internet Explorer Q831167-->C:\WINDOWS\ieuninst.exe C:\WINDOWS\INF\Q831167.inf
Java 2 Runtime Environment, SE v1.4.2_04-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142040}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
José "drôle de champion !"-->C:\WINDOWS\unvise32.exe c:\deljose.log
La Boîte à Bidules de l'Oncle Ernest-->C:\emme\Boitabidules\Desinst.exe
La Planète au Trésor Mini-Jeux Attaque Explosive-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{21D50AE1-73F5-11D6-B2FB-0002A5E32BEF}\setup.exe" La Planète au Trésor Mini-Jeux Attaque Explosive
Larousse Chambers Français - Anglais-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD61D1CF-4AE4-4459-B351-CFB6C7817632}\Setup.exe" -l0x40c
Larousse Multilingue-->"C:\WINDOWS\MultiUninstall.exe"
Lexmark 2200 Series-->C:\WINDOWS\System32\spool\drivers\w32x86\3\LXBVUN5C.EXE -dLexmark 2200 Series
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Master Rallye-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{906F2AFD-3555-427C-83A2-E95FE3F416A1}\setup.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft ActiveSync 4.0-->MsiExec.exe /I{B208806F-A231-4FA0-AB3F-5C1B8979223E}
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}
Microsoft Word 2002-->MsiExec.exe /I{911B040C-6000-11D3-8CFE-0050048383C9}
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mon Encyclopédie des Sciences-->C:\Program Files\DK\Become a Science Explorer\_uninst\uninstaller.exe
Mon Encyclopédie d'Histoire-->C:\Program Files\DK\Become a History Explorer\_uninst\uninstaller.exe
Mon Premier Explorateur des Merveilles du Monde-->C:\Program Files\DK\Become a World Explorer\_uninst\uninstaller.exe
Navigateur Orange-->C:\PROGRA~1\Wanadoo\Shell.exe inst\uninst_FTBrowser.shl
Online Armor 3.0-->"C:\Program Files\Tall Emu\Online Armor\unins000.exe"
OpenOffice.org 2.2-->MsiExec.exe /I{BF516A44-48E3-4319-BBF6-B4B66E9F76FA}
Outlook Express Q837009-->C:\WINDOWS\oeuninst.exe C:\WINDOWS\INF\Q837009.inf
Package du correctif Windows XP [voir Q331060 pour plus de détails]-->C:\WINDOWS\$NtUninstallQ331060$\spuninst\spuninst.exe
Packard Bell InfoCentre-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{07A1C2E1-76DD-11D6-9922-009027E9C183}\setup.exe"
Packard Bell Toolbar 1.0-->"C:\Program Files\Dynamic Toolbar\unins000.exe"
Panda-->"C:\Program Files\Elektrogames\WWF Panda Junior\Part 1\uninstall.exe"
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
QuickTime-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} /l1036
Roland Garros 2007 2.2.14.200-->"C:\Program Files\Roland Garros 2007\unins000.exe"
SAGEM F@st 800-840-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe" -l0x40c
Shockwave-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Sonic RecordNow!-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
Spybot - Search & Destroy 1.4-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
TomTom HOME-->C:\Program Files\InstallShield Installation Information\{CE325D55-FCAF-4273-BB79-069BB8747270}\setup.exe -runfromtemp -l0x040c -removeonly -removeonly
Uninstall Léa passion vétérinaire-->"C:\Program Files\Braingame\Léa passion vétérinaire\unins000.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Zoo Tycoon 2-->"C:\Program Files\Microsoft Games\Zoo Tycoon 2\UNINSTAL.EXE" /runtemp /uninstall
Zoo Tycoon: Complete Collection-->"C:\Program Files\Microsoft Games\Zoo Tycoon\UNINSTAL.EXE" /runtemp /addremove

======Hosts File======

127.0.0.1 localhost

System event log

Computer Name: SN302165920002
Event Code: 7036
Message: Le service Gestionnaire de connexion automatique d'accès distant est entré dans l'état : en cours d'exécution.

Record Number: 27147
Source Name: Service Control Manager
Time Written: 20081217223959.000000+060
Event Type: Informations
User:

Computer Name: SN302165920002
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Gestionnaire de connexion automatique d'accès distant.

Record Number: 27146
Source Name: Service Control Manager
Time Written: 20081217223959.000000+060
Event Type: Informations
User: SN302165920002\TANFIN Antoine

Computer Name: SN302165920002
Event Code: 20159
Message: La connexion à Orange effectuée par l'utilisateur fti/cza7a4p utilisant le périphérique ISDN13-0 a été déconnectée.

Record Number: 27145
Source Name: RemoteAccess
Time Written: 20081217150431.000000+060
Event Type: Informations
User:

Computer Name: SN302165920002
Event Code: 20158
Message: L'utilisateur fti/cza7a4p a établi une connexion à Orange en utilisant le périphérique ISDN13-0.

Record Number: 27144
Source Name: RemoteAccess
Time Written: 20081217142532.000000+060
Event Type: Informations
User:

Computer Name: SN302165920002
Event Code: 7036
Message: Le service Gestionnaire de connexion automatique d'accès distant est entré dans l'état : arrêté.

Record Number: 27143
Source Name: Service Control Manager
Time Written: 20081217142529.000000+060
Event Type: Informations
User:

Application event log

Computer Name: SN302165920002
Event Code: 454
Message: wuauclt (1408) La récupération/restauration de la base de données a échoué en raison d'une erreur inattendue -543.


Record Number: 26821
Source Name: ESENT
Time Written: 20090106165850.000000+060
Event Type: erreur
User:

Computer Name: SN302165920002
Event Code: 453
Message: wuaueng.dll (1408) SUS20ClientDataStore: La base de données C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb requiert les fichiers journaux 78-79 pour effectuer la récupération. La récupération peut localiser uniquement les fichiers journaux allant jusqu'à 78.


Record Number: 26820
Source Name: ESENT
Time Written: 20090106165850.000000+060
Event Type: erreur
User:

Computer Name: SN302165920002
Event Code: 454
Message: wuauclt (3984) La récupération/restauration de la base de données a échoué en raison d'une erreur inattendue -543.


Record Number: 26819
Source Name: ESENT
Time Written: 20090106162849.000000+060
Event Type: erreur
User:

Computer Name: SN302165920002
Event Code: 453
Message: wuaueng.dll (3984) SUS20ClientDataStore: La base de données C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb requiert les fichiers journaux 78-79 pour effectuer la récupération. La récupération peut localiser uniquement les fichiers journaux allant jusqu'à 78.


Record Number: 26818
Source Name: ESENT
Time Written: 20090106162849.000000+060
Event Type: erreur
User:

Computer Name: SN302165920002
Event Code: 454
Message: wuauclt (3420) La récupération/restauration de la base de données a échoué en raison d'une erreur inattendue -543.


Record Number: 26817
Source Name: ESENT
Time Written: 20090106162849.000000+060
Event Type: erreur
User:

Security event log

Computer Name: SN302165920002
Event Code: 512
Message: Windows démarre.

Record Number: 51941
Source Name: Security
Time Written: 20081226170337.000000+060
Event Type: Succès de l'audit
User: AUTORITE NT\SYSTEM

Computer Name: SN302165920002
Event Code: 513
Message: Windows s'arrête.
Toutes les sessions vont être fermées par cet arrêt.

Record Number: 51940
Source Name: Security
Time Written: 20081226170150.000000+060
Event Type: Succès de l'audit
User: AUTORITE NT\SYSTEM

Computer Name: SN302165920002
Event Code: 551
Message: Fermeture de session initiée par l'utilisateur :

Utilisateur : TANFIN Patricia

Domaine : SN302165920002

Id. d'ouv. de session : (0x0,0x155bc)


Record Number: 51939
Source Name: Security
Time Written: 20081226170120.000000+060
Event Type: Succès de l'audit
User: SN302165920002\TANFIN Patricia

Computer Name: SN302165920002
Event Code: 528
Message: Ouverture de session réseau réussie :

Utilisateur : SERVICE RÉSEAU

Domaine : AUTORITE NT

Id. de la session : (0x0,0x3E4)

Type de session : 5

Processus de session : Advapi

Package d'authentification : Negotiate

Station de travail :

GUID d'ouv. de session : {00000000-0000-0000-0000-000000000000}

Record Number: 51938
Source Name: Security
Time Written: 20081226162059.000000+060
Event Type: Succès de l'audit
User: AUTORITE NT\SERVICE RÉSEAU

Computer Name: SN302165920002
Event Code: 528
Message: Ouverture de session réseau réussie :

Utilisateur : SERVICE LOCAL

Domaine : AUTORITE NT

Id. de la session : (0x0,0x3E5)

Type de session : 5

Processus de session : Advapi

Package d'authentification : Negotiate

Station de travail :

GUID d'ouv. de session : {00000000-0000-0000-0000-000000000000}

Record Number: 51937
Source Name: Security
Time Written: 20081226162059.000000+060
Event Type: Succès de l'audit
User: AUTORITE NT\SERVICE LOCAL

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\FICHIE~1\TVNAVI~1;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0a00
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip

-----------------EOF-----------------


... et ...


Logfile of random's system information tool 1.05 (written by random/random)
Run by TANFIN Patricia at 2009-01-18 23:29:33
Microsoft Windows XP Édition familiale Service Pack 1
System drive C: has 121 GB (82%) free of 147 GB
Total RAM: 511 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:29:36, on 18/01/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Tall Emu\Online Armor\oacat.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Roland Garros 2007\oneclick.exe
C:\Program Files\QuickTime\qttask.exe
C:\APPS\OD2\OD2DLEngine.exe
C:\APPS\OD2\OD2State.exe
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Tall Emu\Online Armor\oahlp.exe
C:\Program Files\Larousse\Encyclopédie Universelle Larousse\Bin\hyperappel.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Documents and Settings\TANFIN Patricia.SN302165920002\Bureau\infection\RSIT.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\TANFIN Patricia.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sweet.tomtom.com/cens/sweet/srv/extra/audible.php?lang=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\FDCatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [rg] C:\Program Files\Roland Garros 2007\oneclick.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DOWNLOAD MANAGER] C:\APPS\OD2\OD2DLEngine.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FreshDownload - {101D7203-AD7D-4954-89E2-738C58718041} - C:\Program Files\FreshDevices\FreshDownload\fd.exe
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O15 - Trusted Zone: *.od2.com
O22 - SharedTaskScheduler: IPC Configuration Utility - IPC Configuration Utility - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oacat.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe