Probleme virus systeme volume information [Résolu]

Bonjour et merci pour le coup de main..
J'ai telechargé toolbar SD comme tu me l'as indiqué et j'ai obtenu un rapport que je colle ici:


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : BIOS Date: 08/28/03 18:50:07 Ver: 08.00.09
USER : krazy ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:38 Go (Free:12 Go)
D:\ (Local Disk) - NTFS - Total:115 Go (Free:90 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (Local Disk) - NTFS - Total:186 Go (Free:77 Go)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 20/02/2009|17:30 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\krazy\APPLIC~1\Dealio
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\chevron-small.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\DealioSearch.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\deal_report.jpg
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\err_toolbar.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\global_scripts.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\highlight-bg.png
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\logo.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\logo_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbar.css
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbar.html
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbar.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\scripts.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\scroller.js
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\search-chevron.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\separator.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\settings.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\settings_over.gif
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\res\yahoo-search.png
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\index.76.35
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dealio-14291.log
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dealio-14293.log
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dealio-14294.log
C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127\temp\dod_cache.xml
C:\Program Files\Dealio
C:\Program Files\Dealio\DealioAU.exe
C:\Program Files\Dealio\kb124
C:\Program Files\Dealio\kb127
C:\Program Files\Dealio\SearchSettingsKit.exe
C:\Program Files\Dealio\kb127\Dealio Deskbar.exe
C:\Program Files\Dealio\kb127\Dealio.dll
C:\Program Files\Dealio\kb127\DealioRes409.dll
C:\Program Files\Dealio\kb127\res
C:\Program Files\Dealio\kb127\resDN
C:\Program Files\Dealio\kb127\rules
C:\Program Files\Dealio\kb127\temp
C:\Program Files\Dealio\kb127\res\alerts.gif
C:\Program Files\Dealio\kb127\res\alerts_over.gif
C:\Program Files\Dealio\kb127\res\alerts_rec.gif
C:\Program Files\Dealio\kb127\res\alerts_rec_over.gif
C:\Program Files\Dealio\kb127\res\chevron-small.gif
C:\Program Files\Dealio\kb127\res\DealioSearch.html
C:\Program Files\Dealio\kb127\res\deals-leftcap.gif
C:\Program Files\Dealio\kb127\res\deal_report.jpg
C:\Program Files\Dealio\kb127\res\ebay_login.jpg
C:\Program Files\Dealio\kb127\res\err_mainwindow.html
C:\Program Files\Dealio\kb127\res\err_toolbar.html
C:\Program Files\Dealio\kb127\res\global_scripts.js
C:\Program Files\Dealio\kb127\res\headerbgthin.jpg
C:\Program Files\Dealio\kb127\res\highlight-bg.png
C:\Program Files\Dealio\kb127\res\logo.gif
C:\Program Files\Dealio\kb127\res\logo_over.gif
C:\Program Files\Dealio\kb127\res\man_toolbar.css
C:\Program Files\Dealio\kb127\res\man_toolbar.html
C:\Program Files\Dealio\kb127\res\man_toolbar.js
C:\Program Files\Dealio\kb127\res\man_toolbarl.js
C:\Program Files\Dealio\kb127\res\post-this-deal.gif
C:\Program Files\Dealio\kb127\res\post-this-deal_over.gif
C:\Program Files\Dealio\kb127\res\scripts.js
C:\Program Files\Dealio\kb127\res\scroller.js
C:\Program Files\Dealio\kb127\res\search-chevron.gif
C:\Program Files\Dealio\kb127\res\search-chevron_over.gif
C:\Program Files\Dealio\kb127\res\search_bg_blink.gif
C:\Program Files\Dealio\kb127\res\separator.gif
C:\Program Files\Dealio\kb127\res\settings.gif
C:\Program Files\Dealio\kb127\res\settings_over.gif
C:\Program Files\Dealio\kb127\res\yahoo-search.png
C:\Program Files\Dealio\kb127\resDN\bottom.gif
C:\Program Files\Dealio\kb127\resDN\chevron_down.gif
C:\Program Files\Dealio\kb127\resDN\chevron_up.gif
C:\Program Files\Dealio\kb127\resDN\close.gif
C:\Program Files\Dealio\kb127\resDN\deskbar.css
C:\Program Files\Dealio\kb127\resDN\deskbar.js
C:\Program Files\Dealio\kb127\resDN\dispatch_helper.js
C:\Program Files\Dealio\kb127\resDN\ebay_compatible.jpg
C:\Program Files\Dealio\kb127\resDN\logo.gif
C:\Program Files\Dealio\kb127\resDN\logo_chevron_bkg.gif
C:\Program Files\Dealio\kb127\resDN\losing.gif
C:\Program Files\Dealio\kb127\resDN\lost.gif
C:\Program Files\Dealio\kb127\resDN\man_deskbar.html
C:\Program Files\Dealio\kb127\resDN\menu_arrow.gif
C:\Program Files\Dealio\kb127\resDN\menu_check.gif
C:\Program Files\Dealio\kb127\resDN\no_image.gif
C:\Program Files\Dealio\kb127\resDN\prod_img.gif
C:\Program Files\Dealio\kb127\resDN\search_chevron.gif
C:\Program Files\Dealio\kb127\resDN\spacer.gif
C:\Program Files\Dealio\kb127\resDN\textfield_bkg.gif
C:\Program Files\Dealio\kb127\resDN\top.gif
C:\Program Files\Dealio\kb127\resDN\unknown.gif
C:\Program Files\Dealio\kb127\resDN\winning.gif
C:\Program Files\Dealio\kb127\resDN\won.gif
C:\Program Files\Dealio\kb127\rules\index.76.35
C:\Program Files\Dealio\kb127\rules\rules.1.10.76
C:\Program Files\Dealio\kb127\rules\rules.1.109.43
C:\Program Files\Dealio\kb127\rules\rules.1.110.43
C:\Program Files\Dealio\kb127\rules\rules.1.12.52
C:\Program Files\Dealio\kb127\rules\rules.1.13.58
C:\Program Files\Dealio\kb127\rules\rules.1.130.58
C:\Program Files\Dealio\kb127\rules\rules.1.135.50
C:\Program Files\Dealio\kb127\rules\rules.1.153.44
C:\Program Files\Dealio\kb127\rules\rules.1.155.43
C:\Program Files\Dealio\kb127\rules\rules.1.156.49
C:\Program Files\Dealio\kb127\rules\rules.1.16.60
C:\Program Files\Dealio\kb127\rules\rules.1.161.52
C:\Program Files\Dealio\kb127\rules\rules.1.178.66
C:\Program Files\Dealio\kb127\rules\rules.1.184.55
C:\Program Files\Dealio\kb127\rules\rules.1.188.52
C:\Program Files\Dealio\kb127\rules\rules.1.189.45
C:\Program Files\Dealio\kb127\rules\rules.1.196.43
C:\Program Files\Dealio\kb127\rules\rules.1.198.56
C:\Program Files\Dealio\kb127\rules\rules.1.199.43
C:\Program Files\Dealio\kb127\rules\rules.1.200.53
C:\Program Files\Dealio\kb127\rules\rules.1.201.43
C:\Program Files\Dealio\kb127\rules\rules.1.202.43
C:\Program Files\Dealio\kb127\rules\rules.1.203.71
C:\Program Files\Dealio\kb127\rules\rules.1.205.62
C:\Program Files\Dealio\kb127\rules\rules.1.213.71
C:\Program Files\Dealio\kb127\rules\rules.1.214.49
C:\Program Files\Dealio\kb127\rules\rules.1.215.43
C:\Program Files\Dealio\kb127\rules\rules.1.216.67
C:\Program Files\Dealio\kb127\rules\rules.1.217.67
C:\Program Files\Dealio\kb127\rules\rules.1.218.52
C:\Program Files\Dealio\kb127\rules\rules.1.219.43
C:\Program Files\Dealio\kb127\rules\rules.1.220.43
C:\Program Files\Dealio\kb127\rules\rules.1.221.57
C:\Program Files\Dealio\kb127\rules\rules.1.222.43
C:\Program Files\Dealio\kb127\rules\rules.1.223.68
C:\Program Files\Dealio\kb127\rules\rules.1.226.68
C:\Program Files\Dealio\kb127\rules\rules.1.227.43
C:\Program Files\Dealio\kb127\rules\rules.1.228.62
C:\Program Files\Dealio\kb127\rules\rules.1.229.76
C:\Program Files\Dealio\kb127\rules\rules.1.23.63
C:\Program Files\Dealio\kb127\rules\rules.1.239.43
C:\Program Files\Dealio\kb127\rules\rules.1.24.43
C:\Program Files\Dealio\kb127\rules\rules.1.240.43
C:\Program Files\Dealio\kb127\rules\rules.1.241.43
C:\Program Files\Dealio\kb127\rules\rules.1.242.43
C:\Program Files\Dealio\kb127\rules\rules.1.243.43
C:\Program Files\Dealio\kb127\rules\rules.1.244.63
C:\Program Files\Dealio\kb127\rules\rules.1.245.43
C:\Program Files\Dealio\kb127\rules\rules.1.247.43
C:\Program Files\Dealio\kb127\rules\rules.1.248.43
C:\Program Files\Dealio\kb127\rules\rules.1.249.43
C:\Program Files\Dealio\kb127\rules\rules.1.250.43
C:\Program Files\Dealio\kb127\rules\rules.1.251.43
C:\Program Files\Dealio\kb127\rules\rules.1.252.43
C:\Program Files\Dealio\kb127\rules\rules.1.253.43
C:\Program Files\Dealio\kb127\rules\rules.1.254.43
C:\Program Files\Dealio\kb127\rules\rules.1.255.43
C:\Program Files\Dealio\kb127\rules\rules.1.256.43
C:\Program Files\Dealio\kb127\rules\rules.1.257.43
C:\Program Files\Dealio\kb127\rules\rules.1.279.43
C:\Program Files\Dealio\kb127\rules\rules.1.28.58
C:\Program Files\Dealio\kb127\rules\rules.1.282.75
C:\Program Files\Dealio\kb127\rules\rules.1.283.43
C:\Program Files\Dealio\kb127\rules\rules.1.284.43
C:\Program Files\Dealio\kb127\rules\rules.1.289.67
C:\Program Files\Dealio\kb127\rules\rules.1.290.62
C:\Program Files\Dealio\kb127\rules\rules.1.291.61
C:\Program Files\Dealio\kb127\rules\rules.1.296.43
C:\Program Files\Dealio\kb127\rules\rules.1.297.43
C:\Program Files\Dealio\kb127\rules\rules.1.304.43
C:\Program Files\Dealio\kb127\rules\rules.1.307.43
C:\Program Files\Dealio\kb127\rules\rules.1.308.75
C:\Program Files\Dealio\kb127\rules\rules.1.31.47
C:\Program Files\Dealio\kb127\rules\rules.1.310.46
C:\Program Files\Dealio\kb127\rules\rules.1.311.43
C:\Program Files\Dealio\kb127\rules\rules.1.315.43
C:\Program Files\Dealio\kb127\rules\rules.1.316.43
C:\Program Files\Dealio\kb127\rules\rules.1.317.43
C:\Program Files\Dealio\kb127\rules\rules.1.318.43
C:\Program Files\Dealio\kb127\rules\rules.1.319.49
C:\Program Files\Dealio\kb127\rules\rules.1.32.48
C:\Program Files\Dealio\kb127\rules\rules.1.334.44
C:\Program Files\Dealio\kb127\rules\rules.1.335.60
C:\Program Files\Dealio\kb127\rules\rules.1.336.44
C:\Program Files\Dealio\kb127\rules\rules.1.337.44
C:\Program Files\Dealio\kb127\rules\rules.1.338.75
C:\Program Files\Dealio\kb127\rules\rules.1.339.47
C:\Program Files\Dealio\kb127\rules\rules.1.34.43
C:\Program Files\Dealio\kb127\rules\rules.1.340.47
C:\Program Files\Dealio\kb127\rules\rules.1.341.47
C:\Program Files\Dealio\kb127\rules\rules.1.349.50
C:\Program Files\Dealio\kb127\rules\rules.1.35.48
C:\Program Files\Dealio\kb127\rules\rules.1.350.50
C:\Program Files\Dealio\kb127\rules\rules.1.351.51
C:\Program Files\Dealio\kb127\rules\rules.1.352.54
C:\Program Files\Dealio\kb127\rules\rules.1.353.51
C:\Program Files\Dealio\kb127\rules\rules.1.354.51
C:\Program Files\Dealio\kb127\rules\rules.1.357.62
C:\Program Files\Dealio\kb127\rules\rules.1.358.52
C:\Program Files\Dealio\kb127\rules\rules.1.359.52
C:\Program Files\Dealio\kb127\rules\rules.1.360.53
C:\Program Files\Dealio\kb127\rules\rules.1.361.54
C:\Program Files\Dealio\kb127\rules\rules.1.362.68
C:\Program Files\Dealio\kb127\rules\rules.1.363.58
C:\Program Files\Dealio\kb127\rules\rules.1.364.54
C:\Program Files\Dealio\kb127\rules\rules.1.365.53
C:\Program Files\Dealio\kb127\rules\rules.1.367.56
C:\Program Files\Dealio\kb127\rules\rules.1.368.58
C:\Program Files\Dealio\kb127\rules\rules.1.369.55
C:\Program Files\Dealio\kb127\rules\rules.1.370.56
C:\Program Files\Dealio\kb127\rules\rules.1.371.56
C:\Program Files\Dealio\kb127\rules\rules.1.372.57
C:\Program Files\Dealio\kb127\rules\rules.1.373.55
C:\Program Files\Dealio\kb127\rules\rules.1.375.56
C:\Program Files\Dealio\kb127\rules\rules.1.376.57
C:\Program Files\Dealio\kb127\rules\rules.1.377.55
C:\Program Files\Dealio\kb127\rules\rules.1.378.65
C:\Program Files\Dealio\kb127\rules\rules.1.384.58
C:\Program Files\Dealio\kb127\rules\rules.1.386.71
C:\Program Files\Dealio\kb127\rules\rules.1.387.59
C:\Program Files\Dealio\kb127\rules\rules.1.388.59
C:\Program Files\Dealio\kb127\rules\rules.1.389.59
C:\Program Files\Dealio\kb127\rules\rules.1.390.60
C:\Program Files\Dealio\kb127\rules\rules.1.391.60
C:\Program Files\Dealio\kb127\rules\rules.1.392.60
C:\Program Files\Dealio\kb127\rules\rules.1.393.60
C:\Program Files\Dealio\kb127\rules\rules.1.394.60
C:\Program Files\Dealio\kb127\rules\rules.1.396.61
C:\Program Files\Dealio\kb127\rules\rules.1.397.61
C:\Program Files\Dealio\kb127\rules\rules.1.398.60
C:\Program Files\Dealio\kb127\rules\rules.1.399.60
C:\Program Files\Dealio\kb127\rules\rules.1.403.61
C:\Program Files\Dealio\kb127\rules\rules.1.404.63
C:\Program Files\Dealio\kb127\rules\rules.1.405.61
C:\Program Files\Dealio\kb127\rules\rules.1.406.61
C:\Program Files\Dealio\kb127\rules\rules.1.407.76
C:\Program Files\Dealio\kb127\rules\rules.1.408.63
C:\Program Files\Dealio\kb127\rules\rules.1.409.61
C:\Program Files\Dealio\kb127\rules\rules.1.412.62
C:\Program Files\Dealio\kb127\rules\rules.1.413.62
C:\Program Files\Dealio\kb127\rules\rules.1.414.62
C:\Program Files\Dealio\kb127\rules\rules.1.415.62
C:\Program Files\Dealio\kb127\rules\rules.1.416.62
C:\Program Files\Dealio\kb127\rules\rules.1.417.62
C:\Program Files\Dealio\kb127\rules\rules.1.418.62
C:\Program Files\Dealio\kb127\rules\rules.1.419.62
C:\Program Files\Dealio\kb127\rules\rules.1.420.62
C:\Program Files\Dealio\kb127\rules\rules.1.421.62
C:\Program Files\Dealio\kb127\rules\rules.1.423.63
C:\Program Files\Dealio\kb127\rules\rules.1.424.63
C:\Program Files\Dealio\kb127\rules\rules.1.425.63
C:\Program Files\Dealio\kb127\rules\rules.1.426.63
C:\Program Files\Dealio\kb127\rules\rules.1.427.63
C:\Program Files\Dealio\kb127\rules\rules.1.428.65
C:\Program Files\Dealio\kb127\rules\rules.1.429.63
C:\Program Files\Dealio\kb127\rules\rules.1.430.63
C:\Program Files\Dealio\kb127\rules\rules.1.432.65
C:\Program Files\Dealio\kb127\rules\rules.1.433.64
C:\Program Files\Dealio\kb127\rules\rules.1.434.65
C:\Program Files\Dealio\kb127\rules\rules.1.435.64
C:\Program Files\Dealio\kb127\rules\rules.1.436.76
C:\Program Files\Dealio\kb127\rules\rules.1.437.64
C:\Program Files\Dealio\kb127\rules\rules.1.438.71
C:\Program Files\Dealio\kb127\rules\rules.1.439.71
C:\Program Files\Dealio\kb127\rules\rules.1.440.75
C:\Program Files\Dealio\kb127\rules\rules.1.442.73
C:\Program Files\Dealio\kb127\rules\rules.1.443.73
C:\Program Files\Dealio\kb127\rules\rules.1.444.73
C:\Program Files\Dealio\kb127\rules\rules.1.445.68
C:\Program Files\Dealio\kb127\rules\rules.1.446.69
C:\Program Files\Dealio\kb127\rules\rules.1.450.67
C:\Program Files\Dealio\kb127\rules\rules.1.451.67
C:\Program Files\Dealio\kb127\rules\rules.1.452.68
C:\Program Files\Dealio\kb127\rules\rules.1.453.68
C:\Program Files\Dealio\kb127\rules\rules.1.454.69
C:\Program Files\Dealio\kb127\rules\rules.1.456.69
C:\Program Files\Dealio\kb127\rules\rules.1.457.75
C:\Program Files\Dealio\kb127\rules\rules.1.458.70
C:\Program Files\Dealio\kb127\rules\rules.1.459.70
C:\Program Files\Dealio\kb127\rules\rules.1.460.69
C:\Program Files\Dealio\kb127\rules\rules.1.462.74
C:\Program Files\Dealio\kb127\rules\rules.1.463.69
C:\Program Files\Dealio\kb127\rules\rules.1.464.70
C:\Program Files\Dealio\kb127\rules\rules.1.465.68
C:\Program Files\Dealio\kb127\rules\rules.1.468.70
C:\Program Files\Dealio\kb127\rules\rules.1.469.70
C:\Program Files\Dealio\kb127\rules\rules.1.470.70
C:\Program Files\Dealio\kb127\rules\rules.1.471.73
C:\Program Files\Dealio\kb127\rules\rules.1.472.70
C:\Program Files\Dealio\kb127\rules\rules.1.478.74
C:\Program Files\Dealio\kb127\rules\rules.1.479.73
C:\Program Files\Dealio\kb127\rules\rules.1.480.68
C:\Program Files\Dealio\kb127\rules\rules.1.481.71
C:\Program Files\Dealio\kb127\rules\rules.1.482.74
C:\Program Files\Dealio\kb127\rules\rules.1.49.67
C:\Program Files\Dealio\kb127\rules\rules.1.50.43
C:\Program Files\Dealio\kb127\rules\rules.1.500.71
C:\Program Files\Dealio\kb127\rules\rules.1.501.74
C:\Program Files\Dealio\kb127\rules\rules.1.502.71
C:\Program Files\Dealio\kb127\rules\rules.1.51.69
C:\Program Files\Dealio\kb127\rules\rules.1.52.72
C:\Program Files\Dealio\kb127\rules\rules.1.520.76
C:\Program Files\Dealio\kb127\rules\rules.1.521.76
C:\Program Files\Dealio\kb127\rules\rules.1.522.76
C:\Program Files\Dealio\kb127\rules\rules.1.53.51
C:\Program Files\Dealio\kb127\rules\rules.1.531.76
C:\Program Files\Dealio\kb127\rules\rules.1.532.75
C:\Program Files\Dealio\kb127\rules\rules.1.534.75
C:\Program Files\Dealio\kb127\rules\rules.1.54.47
C:\Program Files\Dealio\kb127\rules\rules.1.55.45
C:\Program Files\Dealio\kb127\rules\rules.1.56.69
C:\Program Files\Dealio\kb127\rules\rules.1.57.43
C:\Program Files\Dealio\kb127\rules\rules.1.58.47
C:\Program Files\Dealio\kb127\rules\rules.1.593.76
C:\Program Files\Dealio\kb127\rules\rules.1.595.76
C:\Program Files\Dealio\kb127\rules\rules.1.63.57
C:\Program Files\Dealio\kb127\rules\rules.1.66.47
C:\Program Files\Dealio\kb127\rules\rules.1.70.75
C:\Program Files\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio
C:\DOCUME~1\krazy\APPLIC~1\Search Settings
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127\temp\ws-14293.log
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp
C:\DOCUME~1\krazy\Favoris\France Torrent Search 2007 - ici Tous les liens torrent fr 2007 sur un seul site !.url

-----------\\ Extensions

(krazy) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.fr/"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.43f2c32d.ini
C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.aca77363.ini



1 - "C:\ToolBar SD\TB_1.txt" - 20/02/2009|17:31 - Option : [1]

-----------\\ Fin du rapport a 17:31:46,59

J'au aussi passé CCLEANER mais je ne pense pas que ce soit suffisant...!

voici le rapport...


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : BIOS Date: 08/28/03 18:50:07 Ver: 08.00.09
USER : krazy ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:38 Go (Free:15 Go)
D:\ (Local Disk) - NTFS - Total:115 Go (Free:92 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (Local Disk) - NTFS - Total:186 Go (Free:79 Go)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 20/02/2009|20:00 )

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Dealio\kb127
Supprime! - C:\Program Files\Dealio\DealioAU.exe
Supprime! - C:\Program Files\Dealio\kb124
Supprime! - C:\Program Files\Dealio\kb127
Supprime! - C:\Program Files\Dealio\SearchSettingsKit.exe
Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Dealio
Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\DOCUME~1\krazy\Favoris\France Torrent Search 2007 - ici Tous les liens torrent fr 2007 sur un seul site !.url
Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Dealio
Supprime! - C:\Program Files\Dealio
Supprime! - C:\DOCUME~1\krazy\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(krazy) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.fr/"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.msn.com/"
"Search Bar"="http://home.microsoft.com/search/lobby/search.asp"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.43f2c32d.ini
C:\DOCUME~1\krazy\Local Settings\Application Data\ApplicationHistory\KeygenAntidotePrismeV6.exe.aca77363.ini



1 - "C:\ToolBar SD\TB_1.txt" - 20/02/2009|17:31 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 20/02/2009|20:02 - Option : [2]

-----------\\ Fin du rapport a 20:02:18,89

Marie a dit : Ta version HT est obsolète
ca veut dire quoi exactement ...?

voila..c'est fait j'ai passé CCLEANER et je mets le log HICKJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:18:58, on 20/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Update] dllcon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Features] ms32cfg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Bonjour,
voici le rapport...
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1782
Windows 5.1.2600 Service Pack 3

21/02/2009 08:33:16
mbam-log-2009-02-21 (08-33-16).txt

Type de recherche: Examen complet (C:\|D:\|I:\|)
Eléments examinés: 218570
Temps écoulé: 11 hour(s), 26 minute(s), 22 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\Windows\System32\wsaupdater.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

En ce qui concerne steganos c'est un programme que j'avais installé il y a un certain temps mais que j'ai desinstallé depuis...j'ai fais une recherche et je n'ai rien trouvé sur mon disque C par contre il reste des traces dans le registre...que dois en faire...???

voici le rapport...


------- LOGFILE OF AD-REMOVER 1.1.1.3 | ONLY XP/VISTA -------

Updated by C_XX on 15/02/2009 at 10:20

Start at: 10:59:43 | 21/02/2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
Computer Name: KRAZY-PCSSD3UIO
Current User: krazy - Administrator
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: NTFS)
- I:\ (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 43

+-----------------| Boonty/Boonty Games Elements Found:

.
.

+-----------------| Eorezo Elements Found:

.

+-----------------| Infected Poker Softwares Elements Found:

.

+-----------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Found:

.
.

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

.

+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.6 ----

ProfilePath: vsgi8iiw.default
.
Prefs.js: Browser.Search.DefaultEngineName: "Search the web"
Prefs.js: Browser.Search.SelectedEngine: "Babylon"
Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
.
.
.
.
.

---- Internet Explorer Version 7.0.5730.11 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://home.microsoft.com/search/lobby/search.asp
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.google.fr/

+-[HKEY_USERS\S-1-5-21-484763869-602162358-725345543-1004\..\Internet Explorer\Main]

Search bar: hxxp://home.microsoft.com/search/lobby/search.asp
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.google.fr/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search bar: hxxp://home.microsoft.com/search/lobby/search.asp
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start page: hxxp://www.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~2401 Bytes] - "C:\Ad-Report-Scan-21.02.2009.log"
-

End at: 11:01:12 | 21/02/2009
.
+-----------------| E.O.F - 59 Lines
.

je ne suis pas sur que mon dernier message soit passé...je le renvoi donc...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:33, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Update] dllcon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Features] ms32cfg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

....? plus de reponse...peut-etre en W-E...?

J'ai installé regcleaner mais quand je double clique sur le raccourcis la pendule de la souris se met en route quelques secondes mais aucunes fenetres ne s'ouvre...pourtant quand je fait ctrl alt supr le programme tourne ...!? je choisi donc de terminer le programme...j'ai essayé plusieur foir mais pas de changement...j'ai desisntallé et reinstalle...meme probleme...!

apres un ultime essais ca a fonctionné...mais j'ai reessayé ensuite et ca recommence...mystere...enfin...j'ai fais le nettoyage comme tu me l'as indiqué...voici le rapport hickjackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:33, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Update] dllcon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Features] ms32cfg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

voici le rapport combofix:
ComboFix 09-02-19.01 - krazy 2009-02-21 15:39:00.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1535.1040 [GMT 1:00]
Lancé depuis: c:\documents and settings\krazy\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\fxavx.ini
c:\windows\patch.exe
c:\windows\SW_Win2000X48.DLL
c:\windows\system32\d3d8caps.dat
c:\windows\system32\ftpupd.exe
c:\windows\system32\Ultra.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-01-21 au 2009-02-21 ))))))))))))))))))))))))))))))))))))
.

2009-02-21 15:26 . 2009-02-21 15:26 <REP> d-------- c:\windows\LastGood
2009-02-21 11:52 . 2009-02-21 11:59 <REP> d-------- c:\program files\RegCleaner
2009-02-21 10:58 . 2009-02-21 10:59 <REP> d-------- c:\program files\Ad-remover
2009-02-20 20:42 . 2009-02-20 20:42 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-20 20:42 . 2009-02-20 20:42 <REP> d-------- c:\documents and settings\krazy\Application Data\Malwarebytes
2009-02-20 20:42 . 2009-02-20 20:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-20 20:42 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-20 20:42 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-20 17:29 . 2009-02-20 20:02 <REP> d-------- C:\ToolBar SD
2009-02-19 00:13 . 2009-02-19 17:28 54,156 --ah----- c:\windows\QTFont.qfn
2009-02-19 00:13 . 2009-02-19 00:13 1,409 --a------ c:\windows\QTFont.for
2009-02-15 09:40 . 2009-02-15 09:40 <REP> d-------- c:\program files\VirtualDubMOD
2009-02-11 16:17 . 2009-02-21 12:21 <REP> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2009-02-06 19:39 . 2009-02-06 19:39 308,600 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll
2009-02-01 16:45 . 2009-02-01 16:45 <REP> d-------- c:\program files\Windows Journal Viewer
2009-02-01 16:20 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-01 16:12 . 2009-02-01 16:20 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-01 16:12 . 2009-02-01 16:12 <REP> d-------- c:\program files\Reference Assemblies
2009-02-01 16:12 . 2009-02-01 16:12 <REP> d-------- c:\program files\MSBuild
2009-02-01 16:12 . 2009-02-01 16:12 212 --a------ c:\windows\system32\spupdsvc.inf
2009-02-01 16:11 . 2009-02-01 16:25 <REP> d-------- c:\windows\SxsCaPendDel
2009-02-01 16:11 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-01 16:11 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 16:11 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 16:11 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-01 16:11 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-01 16:11 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-01 16:11 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-30 21:55 . 2009-02-21 08:41 <REP> d-------- c:\documents and settings\krazy\.homeplayer
2009-01-30 21:54 . 2009-01-30 21:55 <REP> d-------- c:\program files\HomePlayer
2009-01-23 18:24 . 2009-02-21 15:29 <REP> d-------- c:\documents and settings\krazy\Tracing
2009-01-23 18:19 . 2009-01-23 18:19 <REP> d-------- c:\program files\Microsoft Silverlight
2009-01-23 18:18 . 2008-12-08 17:01 55,136 --a------ c:\windows\system32\drivers\fssfltr_tdi.sys
2009-01-23 18:17 . 2009-01-23 18:17 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2009-01-23 18:17 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-01-23 18:14 . 2009-01-23 18:14 <REP> d-------- c:\program files\Windows Live SkyDrive
2009-01-23 18:14 . 2009-01-23 18:18 <REP> d-------- c:\program files\Microsoft
2009-01-23 17:43 . 2009-01-23 17:43 <REP> d-------- c:\program files\Fichiers communs\Windows Live

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 14:32 34,944 ----a-w c:\documents and settings\krazy\Application Data\GDIPFONTCACHEV1.DAT
2009-02-21 14:27 --------- d-----w c:\program files\Windows Live
2009-02-15 08:35 --------- d-----w c:\documents and settings\krazy\Application Data\MiniLyrics
2009-02-13 11:58 --------- d-----w c:\program files\Google
2009-02-06 18:43 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-11 15:45 3,532 ----a-w C:\drmHeader.bin
2009-01-10 11:25 --------- d-----w c:\program files\Winamp3
2009-01-10 11:13 --------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2009-01-10 10:58 --------- d-----w c:\documents and settings\Administrateur\Application Data\EAST Technologies
2009-01-09 15:06 --------- d-----w c:\documents and settings\krazy\Application Data\Babylon
2009-01-09 13:35 --------- d-----w c:\documents and settings\krazy\Application Data\DivX
2009-01-09 13:34 --------- d-----w c:\program files\divx
2009-01-09 12:21 --------- d-----w c:\program files\XnView
2009-01-09 12:19 --------- d-----w c:\program files\My-Tool
2009-01-09 12:19 --------- d-----w c:\program files\Conduit
2009-01-05 20:24 10,886,008 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-01-05 20:16 --------- d-----w c:\program files\Free Audio Pack
2009-01-04 13:48 --------- d-----w c:\program files\Minilyrics
2009-01-04 13:02 --------- d-----w c:\program files\Illustrate
2009-01-04 13:02 --------- d-----w c:\documents and settings\krazy\Application Data\AccurateRip
2009-01-03 14:17 --------- d-----w c:\documents and settings\krazy\Application Data\XnView
2009-01-02 10:16 --------- d-----w c:\program files\Babylon
2009-01-01 22:08 --------- d-----w c:\program files\PhotoFiltre
2008-12-26 10:34 --------- d-----w c:\program files\The Weather Channel Toolbar
2008-12-26 10:27 --------- d-----w c:\program files\The Weather Channel FW
2008-12-24 23:48 --------- d-----w c:\program files\AVIConverter
2008-12-23 10:44 1,555 ---ha-w C:\hpothb07.dat
2008-12-22 12:47 --------- d-----w c:\program files\EasySearch
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-06-27 20:55 2,585,872 ----a-w c:\program files\WindowsInstaller-KB893803-v2-x86.exe
2007-11-09 17:35 5,837,392 ----a-w c:\program files\mozilla-firefox_mozilla_firefox_2.0.0.9_francais_11003.exe
2007-05-12 08:03 685,056 ----a-w c:\program files\FLV PlayerRCSetup.exe
2006-12-04 19:54 4,558,086 ----a-w c:\program files\Installation de FreeGo 3.exe
2006-11-10 18:07 824 ----a-w c:\program files\mpc5.reg
2006-11-10 18:07 778 ----a-w c:\program files\ffdsasetts.reg
2006-11-10 18:07 1,446 ----a-w c:\program files\ffdssetts.reg
2006-11-10 18:06 4,704 ----a-w c:\program files\satsukidecodersettings.ini
2006-09-05 15:44 4,264,176 ----a-w c:\program files\CI.EXE
2006-08-16 18:35 13,736,064 ----a-w c:\program files\GoogleEarthWin.exe
2006-07-24 07:56 1,458,008 ----a-w c:\program files\ccsetup131.exe
2005-09-09 18:55 35 ----a-w c:\program files\SCSSDist.ini
2006-05-29 14:40 7,296,000 ----a-w c:\program files\mozilla firefox\plugins\libvlc.dll
2008-10-19 09:58 49,152 ----a-w c:\program files\mozilla firefox\components\SiteVacuumXPCOM.dll
2006-10-25 15:51 37,664 --sha-w c:\windows\fidbox.dat
2005-01-31 21:55 56 -csh--r c:\windows\system32\D0978C548B.sys
2008-09-19 11:35 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008091920080920\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 335872]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"BtcMaestro"="c:\program files\KMaestro\KMaestro.exe" [2003-01-08 163840]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"atwtusb"="atwtusb.exe" [2005-09-21 c:\windows\system32\ATWTUSB.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\krazy\Menu D‚marrer\Programmes\D‚marrage\
HomePlayer.lnk - c:\program files\HomePlayer\HomePlayer.exe [2007-11-06 294912]
Raccourci vers YzDock.lnk - c:\program files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe [2006-10-29 386560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.imc"= imc32.acm
"VIDC.JPGL"= jpgl.dll
"vidc.X264"= x264vfw.dll
"VIDC.PIM1"= PCLEPIM1.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/uSsiEfr.exe

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.exe.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^krazy^Menu Démarrer^Programmes^Démarrage^Anti-Pub.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^krazy^Menu Démarrer^Programmes^Démarrage^BitTorrent.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^krazy^Menu Démarrer^Programmes^Démarrage^Pika Backup.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiware
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDNewsAgent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDOESRV
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDSwitchAgent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gah95on6
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Heri
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IW_Drop_Icon
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Pass
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mzlzkik
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\salm
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows SA

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 16:05 81920 c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
--a------ 2008-10-06 09:41 793712 c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2006-11-13 13:07 1289000 c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock]
--a------ 2007-03-18 23:05 630784 c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
--a--c--- 2002-04-11 03:19 69632 c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteVacuum]
--a------ 2008-12-22 13:47 421965 c:\program files\EasySearch\SiteVacuumClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
-----c--- 2004-06-03 21:05 32881 c:\program files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VSSERV"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe"
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PinnacleDriverCheck"=c:\windows\system32\PSDrvCheck.exe
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" -lang 1033
"SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray
"Share-to-Web Namespace Daemon"=c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"WinampAgent"="c:\program files\Winamp3\winampa.exe"
"SearchSettings"=c:\program files\Search Settings\SearchSettings.exe
"au"=c:\program files\Dealio\DealioAU.exe
"Babylon Client"=c:\program files\Babylon\Babylon-Pro\Babylon.exe -AutoStart

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"=
"c:\\Program Files\\eMule 0.47a MorphXT v8.14 [Par Ratiatum.com]\\eMule.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\sandra.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule 0.47a MorphXT v8.14 [Par Ratiatum.com]\\eMule0.47c\\emule.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\Win32\\RpcDataSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2007.SP1\\RpcSandraSrv.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\HomePlayer\\HomePlayer.exe"=
"c:\\Program Files\\HomePlayer\\VLC\\vlc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14671:UDP"= 14671:UDP:emuleM
"8080:TCP"= 8080:TCP:freebrowser
"1234:TCP"= 1234:TCP:freebrowser
"990:TCP"= 990:TCP:N560
"999:TCP"= 999:TCP:N560
"5678:TCP"= 5678:TCP:N560
"5679:UDP"= 5679:UDP:N560
"5721:TCP"= 5721:TCP:N560
"10422:TCP"= 10422:TCP:BitComet 10422 TCP
"10422:UDP"= 10422:UDP:BitComet 10422 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aiptektp;HyperPen;c:\windows\system32\drivers\aiptektp.sys [2007-01-29 22272]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-01-23 55136]
R3 DCamUSBNW812;NW812 USB PC Camera;c:\windows\system32\drivers\pcam812.sys [2007-02-26 182380]
R3 Lower812;812 audio lower filter;c:\windows\system32\drivers\lower812.sys [2007-02-26 9808]
S0 ElbyVCD;ElbyVCD;c:\windows\system32\DRIVERS\ElbyVCD.sys --> c:\windows\system32\DRIVERS\ElbyVCD.sys [?]
S2 Ca533av;Icatch(IV) Video Camera Device;c:\windows\system32\drivers\Ca533av.sys [2008-09-06 515803]
S2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S2 gupdate1c98c5c3233d0ca;Google Update Service (gupdate1c98c5c3233d0ca);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 133104]
S2 SLEE_503_DRIVER;Steganos Live Encryption Engine (Version 503) [Driver];\??\c:\windows\system32\drivers\SLEE503.sys --> c:\windows\system32\drivers\SLEE503.sys [?]
S2 SLEE_81_DRIVER;Steganos Live Encryption Engine 8.1 [Driver];\??\c:\windows\system32\drivers\SLEE81.sys --> c:\windows\system32\drivers\SLEE81.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2006-05-09 34944]
S3 pctvvbi;PCTVVBI;c:\windows\system32\drivers\pctvvbi.sys [2004-07-27 6400]
S4 CleanService;CleanService;c:\program files\StompSoft\Digital File Shredder Pro\CleanService.exe --> c:\program files\StompSoft\Digital File Shredder Pro\CleanService.exe [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18ff1866-4fa9-11db-bee3-000cf18e0c6a}]
\Shell\AutoRun\command - K:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18ff1867-4fa9-11db-bee3-000cf18e0c6a}]
\Shell\AutoRun\command - L:\start.exe
\Shell\FramaKey\command - L:\start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ac6e8ce-50a2-11db-bee4-000cf18e0c6a}]
\Shell\AutoRun\command - G:\LaunchU3.exe
.
Contenu du dossier 'Tâches planifiées'

2009-02-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-11 16:17]

2009-02-21 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 16:19]

2009-02-21 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:23]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKU-Default-Run-Windows Guard - waumgrd.exe
HKU-Default-Run-win update - wupfyny.exe
HKU-Default-Run-MSN Update - dllcon.exe
HKU-Default-Run-Microsoft Features - ms32cfg.exe
MSConfigStartUp-CloneCDElbyCDFL - c:\program files\Elaborate Bytes\CloneCD\ElbyCheck.exe
MSConfigStartUp-Gestionnaire Antidote - c:\program files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
MSConfigStartUp-RamBoostXp - c:\program files\RamBoost XP\rambxpfr.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
MSConfigStartUp-Microsoft Features - ms32cfg.exe
MSConfigStartUp-Windows Guard - waumgrd.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
Trusted Zone: secuser.com\www
FF - ProfilePath - c:\documents and settings\krazy\Application Data\Mozilla\Firefox\Profiles\vsgi8iiw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.search.selectedEngine - Babylon
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\program files\Mozilla Firefox\components\SiteVacuumXPCOM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 15:40:40
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,eb,90,21,59,c0,
11,32,72,c8,28,51,af,b0,29,a3,98,8f,34,da,fa,9f,de,81,1e,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,e4,6b,15,2c,9f,
19,96,96,71,3b,04,66,8b,46,0d,96,28,1c,02,db,15,36,3b,c5,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,6c,f0,d5,da,a0,
a0,56,77,25,da,ec,7e,55,20,c9,26,a8,8c,71,6a,c1,93,7b,e5,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,8e,0f,4f,df,f9,
47,be,27,3e,1e,9e,e0,57,5a,93,61,d8,56,24,9f,c4,86,58,7b,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,dd,47,a3,a2,a5,
24,f0,67,cd,44,cd,b9,a6,33,6c,cd,54,fb,83,75,98,1c,fe,76,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,13,65,1b,54,95,
0f,46,fd,b0,18,ed,a7,3f,8d,37,a4,a9,53,2e,06,7f,34,db,29,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,37,55,0a,cc,b8,
51,61,3c,31,77,e1,ba,b1,f8,68,02,31,9b,6b,96,ab,c6,ec,06,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,27,95,bd,69,04,
f7,4d,58,83,6c,56,8b,a0,85,96,ab,7e,ca,ea,8e,3a,05,5c,66,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,11,43,20,16,f6,
29,1c,81,51,fa,6e,91,28,9e,14,cc,9c,30,49,d5,bb,75,72,51,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,17,96,47,2a,b6,
68,4d,63,b1,cd,45,5a,a8,c4,f8,b9,0c,1c,45,99,e2,70,e4,9a,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:f8,31,0f,a9,5f,a0,ec,fb,ca,01,a0,a7,25,
4d,4e,35,e3,0e,66,d5,eb,bc,2f,6b,07,33,de,9c,73,5d,71,9e,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,1d,80,0d,27,41,
77,48,88,fa,ea,66,7f,d4,3b,6b,70,f9,d7,c3,68,d9,41,72,15,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\EPSON Printer and Utilities\PrinterDrivers]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information\{A8BB9906-E618-406A-B161-7383AFF46C39}]
@DACL=(02 0000)
"LogFile"="c:\\Program Files\\InstallShield Installation Information\\{A8BB9906-E618-406A-B161-7383AFF46C39}\\Setup.ilg"
"StatusText"="L'installation EasyRecovery Professional prépare InstallShield Wizard, lequel vous guidera pour l'installation du logiciel. Veuillez patienter."

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\Windows SR 2.0\-]
@DACL=(02 0000)
"-"="-"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Heure de fin: 2009-02-21 15:50:09
ComboFix-quarantined-files.txt 2009-02-21 14:50:07

Avant-CF: 15 974 588 416 octets libres
Après-CF: 16,056,209,408 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP �dition familiale" /fastdetect /noguiboot /NoExecute=OptIn

Current=2 Default=2 Failed=3 LastKnownGood=1 Sets=,1,2,3,4,5,6,7,8,9
402 --- E O F --- 2009-02-11 15:56:09

et le rapport hickjackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:53:12, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: Steganos Live Encryption Engine 8.1 [Service] (SLEE_81_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Bonjour,

J'ai appliqué ce que tu m'as indiqué...je n'ai plus eu le message de l'antivirus du depart par contre hier j'ai eu presque le meme mais localisé dans le disque dur "I" --> I\systeme volume information\_restore\...
d'autre part je suis allé dans le registre et j'ai vu qu'il restait des traces de steganos...que dois-je en faire..les supprimer...?

j'ai essayé de virer les valeurs "steganos" dans le registre mais certaines valeurs refusent de se barrer...!

celles la entre autre...
DeviceDesc REG_SZ Steganos Live Encryption Engine (version 503) [service]
DeviceDesc REG_SZ Steganos Live Encryption Engine 8.1 [driver]
DeviceDesc REG_SZ Steganos Live Encryption Engine 8.1 [service]
DeviceDesc REG_SZ Steganos antiteft Encryption Engine 13 [driver]

il doit y en avoir une 20aine en tout environs...je ne sais pas si c'est important...
a part ca apparemment plus de probleme...

non j'ai juste essayé en mode normal...dois je le faire en mode sans echec...?

J'ai essayé mais rien a faire...impossible a virer...!

je l'ai deja passe...j'ai aussi tune up utility...mais rien a faire...!

c'est a dire...?

oui je l'ai fait plusieurs fois...mais pas en mode sans echec...

bonjour,

voila le rapport...:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:37:17, on 23/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\KMaestro\KMaestro.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
C:\Program Files\HomePlayer\HomePlayer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [BtcMaestro] C:\Program Files\KMaestro\KMaestro.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: HomePlayer.lnk = C:\Program Files\HomePlayer\HomePlayer.exe
O4 - Startup: Raccourci vers YzDock.lnk = C:\Program Files\yz dock 0.8.3 French English Japan German Spanish + 37 Docklets\YzDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Correcteur - {F7C8E5F6-B6D1-45db-8D91-2BCFA5DF11A9} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote K - IE 7.htm (HKCU)
O9 - Extra button: Dictionnaires - {F9B969E8-58D0-4dd9-AC8A-EE2336FF8F65} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote D - IE 7.htm (HKCU)
O9 - Extra button: Guides - {FA089E36-3F1B-4c51-9A1A-C4E7012483AF} - C:\PROGRA~1\Druide\Antidote\Internet Explorer\7\Antidote G - IE 7.htm (HKCU)
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c98c5c3233d0ca) (gupdate1c98c5c3233d0ca) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: SLEE_503_SERVICE - Unknown owner - C:\WINDOWS\system32\SLEE503.exe (file missing)
O23 - Service: SLEE_81_SERVICE - Unknown owner - C:\WINDOWS\system32\SLEE81.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

mis a part les valeurs "steganos" du registre que je n'arrive pas a eliminer ça a l'air d'aller...

ca y est j'ai appliqué tout ce que tu m'as indiqué...
voici le rapport:

[ Rapport ToolsCleaner version 2.3.2 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\krazy\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\krazy\Bureau\ToolBarSD.exe: trouvé !
C:\Program Files\HijackThis: trouvé !
C:\Program Files\HiJackThis\HijackThis.exe: trouvé !
C:\Program Files\HiJackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\krazy\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\krazy\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files\HiJackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\TB.txt: supprimé !
C:\Program Files\HiJackThis\hijackthis.log: supprimé !
C:\Combofix: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Program Files\HijackThis: supprimé !

Fichiers temporaires nettoyés !

Je pensais que steganos ameliorait la securité pendant la navigation sur le net....je ne savais pas que c'etait en plus un anti virus sinon je ne l'aurais pas installé...!!!

en tout cas je te remercie pour l'aide que tu m'as apporté...pour mettre le post en "resolu" je n'ai pas tout compris...je dois etre un peu fatigué...ou nul...!!! je vais trouver...!