Bonsoir

Télécharge FindyKill de Chiquitine29 :

http://sd-1.archive-host.com/membres/up/116615172019703188/F­indyKill.exe

->Enregistre-le sur ton bureau et pas ailleurs !

!! Déconnecte toi et ferme toutes les applications en cours !!

( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

-> Clique sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.

Tuto : http://www.malekal.com/tutorial_FindyKill.php



--> Double-clique sur le raccourci " FindyKill " qui est sur ton bureau .

-->choisis l'option 1 ( recherche ). Puis laisse travailler l'outil sans rien toucher ...

Une fois terminé, poste le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

PS : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

  

Tout d'abord, merci pour ta réponce.

voici donc le log:


############################## [ FindyKill V4.721 ]

# User : PHL (Utilisateurs) # PHL-STATION
# Update on 29/03/09 by Chiquitine29
# Start at: 22:22:19 | 01/04/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Intel(R) Core(TM)2 Duo CPU E6850 @ 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : Avira AntiVir PersonalEdition Classic 8.0.1.30 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 232,88 Go (105,62 Go free) # NTFS
# D:\ # Disque fixe local # 298,09 Go (130,31 Go free) [Programmes] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque CD-ROM
# J:\ # Disque amovible
# K:\ # Disque fixe local # 298,09 Go (90,79 Go free) [USB 1 DD Masse] # NTFS
# O:\ # Disque fixe local # 152,66 Go (117,68 Go free) [USB 3 DD interne] # NTFS

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\OPTENET\bin\optproxy.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\PROGRA~1\OPTENET\bin\OPTGui.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe­
C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Documents and Settings\Pierre-Henri\Application Data\m\flec006.exe
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe" (3148)
"C:\Documents and Settings\Pierre-Henri\Application Data\m\flec006.exe" (5556)
"C:\WINDOWS\system32\wintems.exe" (4516)

################## [ Fichiers / Dossiers infectieux C:\ ]


################## [ C:\WINDOWS & C:\WINDOWS\Prefetch ]

Found ! - C:\WINDOWS\prefetch\212953.EXE-307673F2.pf
Found ! - C:\WINDOWS\prefetch\225640.EXE-00198D73.pf
Found ! - C:\WINDOWS\prefetch\397453.EXE-097F9281.pf
Found ! - C:\WINDOWS\prefetch\404640.EXE-36594597.pf
Found ! - C:\WINDOWS\prefetch\417453.EXE-317D38AC.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-03E1C02C.pf
Found ! - C:\WINDOWS\prefetch\INSTALL_PATCH.EXE-07156563.pf

################## [ C:\WINDOWS\system32 ]

Found ! - C:\WINDOWS\system32\mdelk.exe
Found ! - C:\WINDOWS\system32\wintems.exe
Found ! - C:\WINDOWS\system32\ban_list.txt

################## [ C:\WINDOWS\system32\drivers ]

Found ! - "C:\WINDOWS\system32\drivers\down"

################## [ C:\.. Application Data ... ]

Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\flec006.exe"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\list.oct"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\data.oct"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\srvlist.oct"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\shared"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\srosa2.sys"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\wfsintwq.sys"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe"
Found ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\downld"

################## [ C:\Users...\Temp Files... ]

Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64[2].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_2[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_3[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_1[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_2[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_3[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_6[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\ieps[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\b64_2[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\b64_3[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\ftpps[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_1[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_1[2].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_2[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_6[1].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_6[2].jpg
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\file[1].txt
Found ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\mxd[1].jpg
Found ! - C:\DOCUME~1\PIERRE~1\LOCALS~1\Temp\Rar$EX00.282\install_patch.exe

################## [ Registre / Clés infectieuses ]

Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\Local AppWizard-Generated Applications\install_patch
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]


# Contenu de l'autorun : K:\autorun.inf

[autorun]
ICON=AUTORUN\WDLOGOO.ICO


# Contenu de l'autorun : O:\autorun.inf

[autorun]
ICON=AUTORUN\WDLOGO.ICO

# Présence des fichiers :

Found ! [03/03/2009 17:09][--a------] - K:\autorun.inf
Found ! [22/01/2004 16:47][--a------] - O:\autorun.inf

################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.721 ! ]

Important :

Branche toutes tes unités externes au PC ( DD externes, clé USB, lecteur mp3, ect...) mais sans les ouvrir !
Tu les retireras après la manip ...


Ferme toutes les applications en cours !

Relance FindyKill :

-> choisis cette fois-ci l'option 2 (suppression).

/!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil jusqu' à l'apparition du message :
"nettoyage terminé" .

Note : lors du message d'avertissement , clique sur " Ok " .

--> Poste le nouveau rapport FindyKill.txt qui est généré.

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )


PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
tapes explorer.exe et valide .
  

Merci, voilà, c'est fait:

############################## [ FindyKill V4.721 ]

# User : PHL (Utilisateurs) # PHL-STATION
# Update on 29/03/09 by Chiquitine29
# Start at: 10:10:01 | 02/04/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Intel(R) Core(TM)2 Duo CPU E6850 @ 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : Avira AntiVir PersonalEdition Classic 8.0.1.30 [ Enabled | Updated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 232,88 Go (106,05 Go free) # NTFS
# D:\ # Disque fixe local # 298,09 Go (130,31 Go free) [Programmes] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque CD-ROM
# J:\ # Disque amovible
# K:\ # Disque fixe local # 298,09 Go (90,79 Go free) [USB 1 DD Masse] # NTFS
# L:\ # Disque fixe local # 698,64 Go (393,76 Go free) [USB 2 DD Media WE750] # NTFS
# M:\ # Disque amovible # 7,55 Go (29,43 Mo free) # FAT32
# O:\ # Disque fixe local # 152,66 Go (117,68 Go free) [USB 3 DD interne] # NTFS

############################## [ Active Processes ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\OPTENET\bin\optproxy.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\vssvc.exe
C:\PROGRA~1\OPTENET\bin\OPTGui.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Pierre-Henri\Application Data\m\flec006.exe
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected processes stopped ]

"C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe" (1628)
"C:\Documents and Settings\Pierre-Henri\Application Data\m\flec006.exe" (3512)
"C:\WINDOWS\system32\wintems.exe" (2944)

################## [ Infected Files / Folders C:\ ]

Deleted ! - "C:\Muestras"
Deleted ! - C:\InfoSat.txt

################## [ C:\WINDOWS & C:\WINDOWS\prefetch ]

Deleted ! - C:\WINDOWS\prefetch\190984.EXE-1815662A.pf
Deleted ! - C:\WINDOWS\prefetch\195890.EXE-2EE904A1.pf
Deleted ! - C:\WINDOWS\prefetch\263546.EXE-3022827B.pf
Deleted ! - C:\WINDOWS\prefetch\267218.EXE-19841683.pf
Deleted ! - C:\WINDOWS\prefetch\307828.EXE-16895165.pf
Deleted ! - C:\WINDOWS\prefetch\309359.EXE-15310933.pf
Deleted ! - C:\WINDOWS\prefetch\312015.EXE-1CFBE8FC.pf
Deleted ! - C:\WINDOWS\prefetch\314140.EXE-331EBB03.pf
Deleted ! - C:\WINDOWS\prefetch\512328.EXE-0A6FCE55.pf
Deleted ! - C:\WINDOWS\prefetch\513328.EXE-3280948F.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-03E1C02C.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-17681AA8.pf
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-3A36745F.pf

################## [ C:\WINDOWS\System32 ]

Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt

################## [ C:\WINDOWS\System32\drivers ]


################## [ C:\.. Application Data ... ]

Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\flec006.exe"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\list.oct"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\data.oct"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\srvlist.oct"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\m"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\srosa2.sys"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\wfsintwq.sys"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\Pierre-Henri\Application Data\drivers"

################## [ C:\Documents and Settings\Pierre-Henri\.....\Temp Files... ]

Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\924DUDYN\file[1].txt
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_2[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\b64_6[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\DXRGZUCZ\ieps[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\b64[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\O1UKHHR6\ftpps[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_1[3].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_6[1].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_6[2].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\b64_6[3].jpg
Deleted ! - C:\Documents and Settings\Pierre-Henri\Local Settings\Temporary Internet Files\Content.IE5\QN5HVGXA\mxd[1].jpg

################## [ Registry / Infected keys ]

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-1606980848-1177238915-839522115-1003\Software\MuleAppData
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

################## [ Cleaning Removable drives ]

# Deleting Files :

Deleted ! - K:\autorun.inf
Deleted ! - L:\autorun.inf
Deleted ! - M:\autorun.inf
Deleted ! - O:\autorun.inf

################## [ Registry / Mountpoint2 ]

# -> Not found !

################## [ States / Restarting of services ]

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3
# EapHost -> # Type of startup =2
# Ip6Fw -> # Type of startup =2
# SharedAccess -> # Type of startup =2
# wuauserv -> # Type of startup =2
# wscsvc -> # Type of startup =2
# Safe boot mode restored !

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\Pierre-Henri\Application Data\drivers\winupgro.exe
CRC32 .. : 99faae80
MD5 .... : e35bb8bd00b8b2b49e0e61d1e66ffa63

# -> Nothing found.

################## [ PEH Corrupted ]

C:\Documents and Settings\Pierre-Henri\Bureau\Comblous.exe
C:\Documents and Settings\Pierre-Henri\Bureau\Eden.exe
C:\Downloads\HiJackThis.exe
C:\Program Files\ASUS\ASUSUpdate\Update.exe
C:\Program Files\Microsoft Visual Studio\COMMON\Tools\SPYXX.EXE
C:\WINDOWS\$hf_mig$\KB873339\update\update.exe
C:\WINDOWS\$hf_mig$\KB885835\update\update.exe
C:\WINDOWS\$hf_mig$\KB885836\update\update.exe
C:\WINDOWS\$hf_mig$\KB886185\update\update.exe
C:\WINDOWS\$hf_mig$\KB887472\update\update.exe
C:\WINDOWS\$hf_mig$\KB888302\update\update.exe
C:\WINDOWS\$hf_mig$\KB890046\update\update.exe
C:\WINDOWS\$hf_mig$\KB890859\update\update.exe
C:\WINDOWS\$hf_mig$\KB891781\update\update.exe
C:\WINDOWS\$hf_mig$\KB893756\update\update.exe
C:\WINDOWS\$hf_mig$\KB894391\update\update.exe
C:\WINDOWS\$hf_mig$\KB896358\update\update.exe
C:\WINDOWS\$hf_mig$\KB896423\update\update.exe
C:\WINDOWS\$hf_mig$\KB896428\update\update.exe
C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
C:\WINDOWS\$hf_mig$\KB899587\update\update.exe
C:\WINDOWS\$hf_mig$\KB899591\update\update.exe
C:\WINDOWS\$hf_mig$\KB900485\update\update.exe
C:\WINDOWS\$hf_mig$\KB900725\update\update.exe
C:\WINDOWS\$hf_mig$\KB901017\update\update.exe
C:\WINDOWS\$hf_mig$\KB901214\update\update.exe
C:\WINDOWS\$hf_mig$\KB902400\update\update.exe
C:\WINDOWS\$hf_mig$\KB905414\update\update.exe
C:\WINDOWS\$hf_mig$\KB905749\update\update.exe
C:\WINDOWS\$hf_mig$\KB908519\update\update.exe
C:\WINDOWS\$hf_mig$\KB908531\update\update.exe
C:\WINDOWS\$hf_mig$\KB910437\update\update.exe
C:\WINDOWS\$hf_mig$\KB911164\update\update.exe
C:\WINDOWS\$hf_mig$\KB911280\update\update.exe
C:\WINDOWS\$hf_mig$\KB911562\update\update.exe
C:\WINDOWS\$hf_mig$\KB911927\update\update.exe
C:\WINDOWS\$hf_mig$\KB913580\update\update.exe
C:\WINDOWS\$hf_mig$\KB914388\update\update.exe
C:\WINDOWS\$hf_mig$\KB914389\update\update.exe
C:\WINDOWS\$hf_mig$\KB915865\update\update.exe
C:\WINDOWS\$hf_mig$\KB916595\update\update.exe
C:\WINDOWS\$hf_mig$\KB918118\update\update.exe
C:\WINDOWS\$hf_mig$\KB918439\update\update.exe
C:\WINDOWS\$hf_mig$\KB919007\update\update.exe
C:\WINDOWS\$hf_mig$\KB920213\update\update.exe
C:\WINDOWS\$hf_mig$\KB920670\update\update.exe
C:\WINDOWS\$hf_mig$\KB920683\update\update.exe
C:\WINDOWS\$hf_mig$\KB920685\update\update.exe
C:\WINDOWS\$hf_mig$\KB920872\update\update.exe
C:\WINDOWS\$hf_mig$\KB922582\update\update.exe
C:\WINDOWS\$hf_mig$\KB922819\update\update.exe
C:\WINDOWS\$hf_mig$\KB923414\update\update.exe
C:\WINDOWS\$hf_mig$\KB923980\update\update.exe
C:\WINDOWS\$hf_mig$\KB924270\update\update.exe
C:\WINDOWS\$hf_mig$\KB925902\update\update.exe
C:\WINDOWS\$hf_mig$\KB926255\update\update.exe
C:\WINDOWS\$hf_mig$\KB926436\update\update.exe
C:\WINDOWS\$hf_mig$\KB927779\update\update.exe
C:\WINDOWS\$hf_mig$\KB927802\update\update.exe
C:\WINDOWS\$hf_mig$\KB927891\update\update.exe
C:\WINDOWS\$hf_mig$\KB928255\update\update.exe
C:\WINDOWS\$hf_mig$\KB928843\update\update.exe
C:\WINDOWS\$hf_mig$\KB929123\update\update.exe
C:\WINDOWS\$hf_mig$\KB930178\update\update.exe
C:\WINDOWS\$hf_mig$\KB930916\update\update.exe
C:\WINDOWS\$hf_mig$\KB931261\update\update.exe
C:\WINDOWS\$hf_mig$\KB931784\update\update.exe
C:\WINDOWS\$hf_mig$\KB932168\update\update.exe
C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe
C:\WINDOWS\$hf_mig$\KB933729\update\update.exe
C:\WINDOWS\$hf_mig$\KB935448\update\update.exe
C:\WINDOWS\$hf_mig$\KB935839\update\update.exe
C:\WINDOWS\$hf_mig$\KB935840\update\update.exe
C:\WINDOWS\$hf_mig$\KB936021\update\update.exe
C:\WINDOWS\$hf_mig$\KB936357\update\update.exe
C:\WINDOWS\$hf_mig$\KB937894\update\update.exe
C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB938828\update\update.exe
C:\WINDOWS\$hf_mig$\KB938829\update\update.exe
C:\WINDOWS\$hf_mig$\KB941202\update\update.exe
C:\WINDOWS\$hf_mig$\KB941568\update\update.exe
C:\WINDOWS\$hf_mig$\KB941644\update\update.exe
C:\WINDOWS\$hf_mig$\KB941693\update\update.exe
C:\WINDOWS\$hf_mig$\KB942763\update\update.exe
C:\WINDOWS\$hf_mig$\KB943055\update\update.exe
C:\WINDOWS\$hf_mig$\KB943460\update\update.exe
C:\WINDOWS\$hf_mig$\KB943485\update\update.exe
C:\WINDOWS\$hf_mig$\KB944533-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB944653\update\update.exe
C:\WINDOWS\$hf_mig$\KB945553\update\update.exe
C:\WINDOWS\$hf_mig$\KB946026\update\update.exe
C:\WINDOWS\$hf_mig$\KB946648\update\update.exe
C:\WINDOWS\$hf_mig$\KB947864-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB948590\update\update.exe
C:\WINDOWS\$hf_mig$\KB948881\update\update.exe
C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
C:\WINDOWS\$hf_mig$\KB950759-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB950760\update\update.exe
C:\WINDOWS\$hf_mig$\KB950762\update\update.exe
C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
C:\WINDOWS\$hf_mig$\KB951066\update\update.exe
C:\WINDOWS\$hf_mig$\KB951072-v2\update\update.exe
C:\WINDOWS\$hf_mig$\KB951376\update\update.exe
C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe
C:\WINDOWS\$hf_mig$\KB951698\update\update.exe
C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
C:\WINDOWS\$hf_mig$\KB951978\update\update.exe
C:\WINDOWS\$hf_mig$\KB952287\update\update.exe
C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
C:\WINDOWS\$hf_mig$\KB953838-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB953839\update\update.exe
C:\WINDOWS\$hf_mig$\KB954211\update\update.exe
C:\WINDOWS\$hf_mig$\KB954459\update\update.exe
C:\WINDOWS\$hf_mig$\KB954600\update\update.exe
C:\WINDOWS\$hf_mig$\KB955069\update\update.exe
C:\WINDOWS\$hf_mig$\KB955839\update\update.exe
C:\WINDOWS\$hf_mig$\KB956390-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB956391\update\update.exe
C:\WINDOWS\$hf_mig$\KB956802\update\update.exe
C:\WINDOWS\$hf_mig$\KB956803\update\update.exe
C:\WINDOWS\$hf_mig$\KB956841\update\update.exe
C:\WINDOWS\$hf_mig$\KB957095\update\update.exe
C:\WINDOWS\$hf_mig$\KB957097\update\update.exe
C:\WINDOWS\$hf_mig$\KB958215-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB958644\update\update.exe
C:\WINDOWS\$hf_mig$\KB958687\update\update.exe
C:\WINDOWS\$hf_mig$\KB958690\update\update.exe
C:\WINDOWS\$hf_mig$\KB960225\update\update.exe
C:\WINDOWS\$hf_mig$\KB960714-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB960715\update\update.exe
C:\WINDOWS\$hf_mig$\KB961260-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB967715\update\update.exe
C:\WINDOWS\ie7updates\KB938127-IE7\update.exe
C:\WINDOWS\ie7updates\KB950759-IE7\update.exe
C:\WINDOWS\ServicePackFiles\i386\sysinfo.exe
C:\WINDOWS\SoftwareDistribution\Download\ad9c4c2a779933f83b51a49a2c88838d\update\update.exe
C:\WINDOWS\SoftwareDistribution\Download\c3587308140154cec843541eb3824fc8\update\update.exe
C:\WINDOWS\system32\dllcache\register.exe
D:\Avira\AntiVir PersonalEdition Classic\avcenter.exe
D:\Avira\AntiVir PersonalEdition Classic\avconfig.exe
D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Avira\AntiVir PersonalEdition Classic\avscan.exe
D:\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\Ascaron Entertainment\Sacred\Update.exe
D:\Program Files\Auslogics\AusLogics BoostSpeed\Update.exe
D:\Program Files\Dark Basic Professional\Launch.exe

################## [ ! End of Report # FindyKill V4.721 ! ]

Bien.
Cela devrait déjà aller un peu mieux.
Essaie de relancer ton antivirus, si cela pose des problèmes, il faudra peut-être le réinstaller.

Ensuite :

• Télécharge Random's System Information Tool (RSIT) de Random / Random et sauvegarde-le sur ton Bureau,

-> http://images.malwareremoval.com/random/RSIT.exe

• Double-clique sur RSIT.exe pour lancer le programme,
• Clique sur continuer sur l'écran Disclaimer,
• Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
  

OK, tout semble rentrer dans l'ordre. j'ai du désinstaller antivir et le réinstaller. c'est bon, il fonctionne et il est actif. le pare feu, qui avait été désactivé est de nouveau actif. voici donc le log RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by PHL at 2009-04-02 11:04:02
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 109 GB (46%) free of 238 GB
Total RAM: 2047 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:02, on 02/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
D:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\OPTENET\bin\optproxy.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\OPTENET\bin\OPTGui.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe­
C:\Documents and Settings\Pierre-Henri\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Downloads\RSIT.exe
C:\Program Files\trend micro\Pierre-Henri.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netvibes.com/#General
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Tunebite_WebRipPlugin Class - {AA102584-3B97-47e7-B9BC-75D54C110A7D} - D:\Program Files\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dl­l
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Babylon - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - C:\Program Files\Babylon\Babylon Toolbar\BabylonIEToolBar.dll
O3 - Toolbar: SYSTRAN Toolbar - {95daa571-4def-4a6d-97d8-98a346672a24} - mscoree.dll (file missing)
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\OPTENET\bin\OPTGui.exe
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Pierre-Henri\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://D:\Program Files\SYSTRAN\6\\GUIres.dll/lookup.js
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Traduire (SYSTRAN) - res://D:\Program Files\SYSTRAN\6\\GUIres.dll/translate.js
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm (HKCU)
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} (DASWebDownload Class) - http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Folder Size (FolderSize) - Brio - D:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: OPTENET Content Filter (OPTENET_FILTER) - Optenet - C:\Program Files\OPTENET\bin\optproxy.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
End of file - 13836 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1606980848-1177238915-839522115-1003.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - C:\Program Files\Orbitdownloader\orbitcth.dll [2008-11-24 134344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-10 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA102584-3B97-47e7-B9BC-75D54C110A7D}]
Tunebite_WebRipPlugin Class - D:\Program Files\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dll [2009-01-16 144688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-16 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-24 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-11-18 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-01-16 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-10 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
SearchSettings Class - C:\Program Files\Search Settings\kb127\SearchSettings.dll [2008-06-12 1111904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{965B54B0-71E0-4611-8DE7-F73FA0B20E26} - Babylon - C:\Program Files\Babylon\Babylon Toolbar\BabylonIEToolBar.dll [2008-03-06 267488]
{95daa571-4def-4a6d-97d8-98a346672a24} - SYSTRAN Toolbar - C:\WINDOWS\system32\mscoree.dll [2008-07-25 282112]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} - Grab Pro - C:\Program Files\Orbitdownloader\GrabPro.dll [2008-11-24 445560]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-11-18 806912]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-16 251504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"OPTENET_GUI"=C:\PROGRA~1\OPTENET\bin\OPTGui.exe [2007-01-19 322864]
"VX1000"=C:\WINDOWS\vVX1000.exe [2006-10-13 707376]
"Babylon Client"=C:\Program Files\Babylon\Babylon-Pro\Babylon.exe [2008-03-06 3551456]
"SPAMfighter Agent"=C:\Program Files\SPAMfighter\SFAgent.exe [2009-01-16 325768]
"QuickTime Task"=D:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
"WinSys2"=C:\WINDOWS\system32\winsys2.exe [2008-10-21 208896]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-18 13680640]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-02-18 86016]
"SearchSettings"=C:\Program Files\Search Settings\SearchSettings.exe [2008-06-12 991584]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"=C:\WINDOWS\system32\sti_ci.dll [2008-04-13 138240]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"SuperCopier2.exe"=D:\Program Files\SuperCopier2\SuperCopier2.exe [2005-06-27 876544]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-03-15 68856]
"Google Update"=C:\Documents and Settings\Pierre-Henri\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-04 133104]
"NVIDIA nTune"=C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe [2007-09-04 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe [2008-03-06 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe [2008-02-26 2289664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
C:\WINDOWS\system32\oodtray.exe [2007-05-11 2512392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-03-15 68856]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe
Wireless Configuration Utility HW.14.lnk - C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-06 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableStatusMessages"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoUserNameInStartMenu"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0
"NoInternetIcon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Program Files\eMule\emule.exe"="D:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Sid Meier's Civilization 4 Complete\Civilization4.exe"="C:\Program Files\Sid Meier's Civilization 4 Complete\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 Complete"
"C:\Program Files\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe"="C:\Program Files\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4: Warlords"
"C:\Program Files\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe"="C:\Program Files\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:*:Enabled:Sid Meier's Civilization 4: Beyond the Sword"
"C:\Program Files\Orbitdownloader\orbitdm.exe"="C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"C:\Program Files\Orbitdownloader\orbitnet.exe"="C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"
"C:\Program Files\EA GAMES\MOHDA\MOHAA.exe"="C:\Program Files\EA GAMES\MOHDA\MOHAA.exe:*:Enabled:Medal of Honor Allied Assault(tm)"
"C:\Sierra\Empire Earth\Empire Earth.exe"="C:\Sierra\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Metin2_France\metin2.bin"="C:\Program Files\Metin2_France\metin2.bin:*:Disabled:metin2"
"D:\Program Files\Joost\xulrunner\tvprunner.exe"="D:\Program Files\Joost\xulrunner\tvprunner.exe:*:Enabled:tvprunner"
"C:\forte4j\bin\forte4j.exe"="C:\forte4j\bin\forte4j.exe:*:Enabled:forte4j"
"C:\Program Files\Java\jdk1.6.0_07\jre\bin\java.exe"="C:\Program Files\Java\jdk1.6.0_07\jre\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"D:\Program Files\FrostWire\FrostWire.exe"="D:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire"
"C:\Program Files\Sierra\FEAR\FEARServer.exe"="C:\Program Files\Sierra\FEAR\FEARServer.exe:*:Enabled:F.E.A.R. Stand-Alone Server"
"D:\Program Files\Hoyle Casino 2009\Hoyle Casino.exe"="D:\Program Files\Hoyle Casino 2009\Hoyle Casino.exe:*:Disabled:Hoyle Casino"
"D:\Program Files\Hoyle Card Games 2009\Hoyle Card Games.exe"="D:\Program Files\Hoyle Card Games 2009\Hoyle Card Games.exe:*:Disabled:Hoyle Card Games"
"D:\Program Files\Autodesk\Maya2008\bin\maya.exe"="D:\Program Files\Autodesk\Maya2008\bin\maya.exe:*:Disabled:Maya"
"C:\Documents and Settings\Aymeric\Bureau\freezer.exe"="C:\Documents and Settings\Aymeric\Bureau\freezer.exe:*:Enabled:freezer"
"C:\Program Files\Sierra\FEAR\fpupdate.exe"="C:\Program Files\Sierra\FEAR\fpupdate.exe:*:Enabled:fpupdate"
"C:\Program Files\Sierra\FEAR\FEAR.exe"="C:\Program Files\Sierra\FEAR\FEAR.exe:*:Enabled:FEAR"
"C:\Program Files\Sierra\FEAR\FEARMP.exe"="C:\Program Files\Sierra\FEAR\FEARMP.exe:*:Enabled:FEAR"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"D:\Program Files\Caplio Software\RGateLXP.exe"="D:\Program Files\Caplio Software\RGateLXP.exe:*:Disabled:RICOH Gate La for DSC"
"C:\WINDOWS\system32\javaw.exe"="C:\WINDOWS\system32\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\Program Files\Sacred 2 - Fallen Angel\system\sacred2.exe"="D:\Program Files\Sacred 2 - Fallen Angel\system\sacred2.exe:*:Enabled:Sacred 2 - Fallen Angel"
"D:\Program Files\Mass Effect\Binaries\MassEffect.exe"="D:\Program Files\Mass Effect\Binaries\MassEffect.exe:*:Enabled:Mass Effect"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"D:\Program Files\The Witcher Enhanced Edition\launcher.exe"="D:\Program Files\The Witcher Enhanced Edition\launcher.exe:*:Enabled:The Witcher Enhanced Edition"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"D:\Program Files\Titan Quest Immortal Throne\Titan Quest Immortal Throne\Tqit.exe"="D:\Program Files\Titan Quest Immortal Throne\Titan Quest Immortal Throne\Tqit.exe:*:Enabled:Tqit"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2877cba3-f6a4-11dc-802c-0014d140869c}]
shell\AutoRun\command - M:\LaunchU3.exe -a


======File associations======

.txt - open -

======List of files/folders created in the last 1 months======

2009-04-02 11:02:52 ----D---- C:\rsit
2009-04-02 10:57:16 ----D---- C:\Program Files\Avira
2009-04-02 10:57:16 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-04-02 10:53:56 ----HD---- C:\Documents and Settings\Pierre-Henri\Application Data\drivers
2009-04-02 10:09:59 ----A---- C:\FindyKill.txt
2009-04-01 22:21:58 ----D---- C:\FindyKill
2009-03-31 12:29:12 ----D---- C:\Program Files\NVIDIA Corporation
2009-03-31 12:28:06 ----D---- C:\Program Files\NVIDIA nTune Performance Application
2009-03-29 11:20:27 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-03-29 11:20:26 ----D---- C:\Program Files\NOS
2009-03-25 23:50:39 ----D---- C:\WINDOWS\.jagex_cache_32
2009-03-24 15:07:26 ----D---- C:\Program Files\Freezerware
2009-03-24 10:00:57 ----A---- C:\WINDOWS\system32\viscomdvdimg.dll
2009-03-23 19:02:06 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\System
2009-03-23 13:43:14 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-03-22 12:58:47 ----D---- C:\Program Files\DVD Decrypter
2009-03-22 00:23:36 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\DxO_Labs
2009-03-22 00:23:12 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\DxO Labs
2009-03-22 00:22:48 ----D---- C:\Program Files\Fichiers communs\PACE Anti-Piracy
2009-03-22 00:22:48 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\PACE Anti-Piracy
2009-03-22 00:22:48 ----D---- C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy
2009-03-21 14:52:33 ----D---- C:\Documents and Settings\All Users\Application Data\DxO_Labs
2009-03-21 11:27:30 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-03-21 11:27:21 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-03-21 11:24:40 ----D---- C:\WINDOWS\system32\XPSViewer
2009-03-21 11:24:36 ----D---- C:\Program Files\MSBuild
2009-03-21 11:24:34 ----D---- C:\WINDOWS\system32\en-US
2009-03-21 11:24:29 ----D---- C:\Program Files\Reference Assemblies
2009-03-21 11:23:36 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-03-21 11:23:36 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-03-21 11:23:36 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-03-21 11:23:16 ----D---- C:\WINDOWS\SxsCaPendDel
2009-03-21 08:16:58 ----D---- C:\Program Files\DxO Labs
2009-03-20 22:43:02 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\PureBasic
2009-03-17 20:43:09 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\Search Settings
2009-03-17 20:42:49 ----A---- C:\WINDOWS\system32\decdll.dll
2009-03-17 20:42:48 ----D---- C:\Program Files\Free Video Converter
2009-03-17 20:42:27 ----D---- C:\Program Files\Search Settings
2009-03-17 20:40:58 ----A---- C:\WINDOWS\system32\TubeFinder.exe
2009-03-17 20:40:55 ----D---- C:\Program Files\Free FLV Converter
2009-03-17 20:36:15 ----D---- C:\Program Files\IVCsoft
2009-03-17 20:00:37 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-03-17 20:00:37 ----A---- C:\WINDOWS\system32\i420vfw.dll
2009-03-17 20:00:37 ----A---- C:\WINDOWS\system32\AVSredirect.dll
2009-03-17 20:00:18 ----RSH---- C:\WINDOWS\system32\nbDX.dll
2009-03-17 20:00:18 ----RSH---- C:\WINDOWS\system32\msfDX.dll
2009-03-17 20:00:18 ----RSH---- C:\WINDOWS\system32\flvDX.dll
2009-03-17 09:55:31 ----D---- C:\WINDOWS\nview
2009-03-17 09:55:31 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-03-17 09:54:39 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-03-17 09:53:18 ----D---- C:\NVIDIA
2009-03-17 09:46:33 ----D---- C:\Program Files\SystemRequirementsLab
2009-03-17 09:34:10 ----D---- C:\WINDOWS\NV23963044.TMP
2009-03-16 18:16:11 ----A---- C:\WINDOWS\msicpl.ini
2009-03-16 17:49:49 ----RA---- C:\WINDOWS\system32\MadCHook.dll
2009-03-16 17:49:48 ----RA---- C:\WINDOWS\system32\smdll.dll
2009-03-16 17:49:44 ----RA---- C:\WINDOWS\system32\msvcr80.dll
2009-03-16 17:49:43 ----RA---- C:\WINDOWS\system32\HookShield.dll
2009-03-16 17:49:43 ----RA---- C:\WINDOWS\system32\HookMAp.dll
2009-03-16 17:49:43 ----RA---- C:\WINDOWS\system32\Auxiliary.dll
2009-03-16 17:49:42 ----RA---- C:\WINDOWS\system32\WinSys2.exe
2009-03-16 17:49:41 ----RA---- C:\WINDOWS\system32\msicpl.dll
2009-03-16 12:04:48 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-03-16 12:04:43 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-03-16 12:03:50 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-03-16 12:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-03-06 11:54:59 ----D---- C:\Documents and Settings\All Users\Application Data\Tages
2009-03-03 10:23:42 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\Dr. DivX 2.0 OSS
2009-03-03 10:14:47 ----A---- C:\WINDOWS\system32\wmv8dmod.dll
2009-03-03 10:14:46 ----A---- C:\WINDOWS\system32\mpg4c32.dll

======List of files/folders modified in the last 1 months======

2009-04-02 11:04:02 ----D---- C:\Program Files\trend micro
2009-04-02 11:03:06 ----D---- C:\WINDOWS\Prefetch
2009-04-02 11:00:13 ----D---- C:\WINDOWS\Temp
2009-04-02 10:57:20 ----HD---- C:\WINDOWS\system32\drivers
2009-04-02 10:57:16 ----D---- C:\Program Files
2009-04-02 10:54:50 ----D---- C:\Program Files\SPAMfighter
2009-04-02 10:54:34 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\Orbit
2009-04-02 10:54:25 ----D---- C:\Documents and Settings\All Users\Application Data\Babylon
2009-04-02 10:54:11 ----A---- C:\WINDOWS\RTacDbg.txt
2009-04-02 10:53:57 ----D---- C:\WINDOWS
2009-04-02 10:53:41 ----SD---- C:\WINDOWS\Tasks
2009-04-02 10:52:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-04-02 10:50:12 ----D---- C:\Downloads
2009-04-02 10:16:38 ----D---- C:\WINDOWS\system32
2009-04-02 09:14:11 ----D---- C:\WINDOWS\system32\CatRoot2
2009-04-02 01:52:13 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2009-03-31 13:55:30 ----D---- C:\WINDOWS\Minidump
2009-03-31 12:29:33 ----SHD---- C:\WINDOWS\Installer
2009-03-31 10:14:18 ----A---- C:\WINDOWS\NeroDigital.ini
2009-03-29 19:32:08 ----D---- C:\temp
2009-03-29 11:26:03 ----D---- C:\Program Files\Fichiers communs\Adobe
2009-03-29 11:25:53 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-03-27 14:44:45 ----D---- C:\WINDOWS\system
2009-03-27 00:01:44 ----A---- C:\WINDOWS\win.ini
2009-03-26 16:31:17 ----D---- C:\Program Files\Orbitdownloader
2009-03-24 11:53:38 ----D---- C:\Program Files\CDVista 1.46a
2009-03-23 14:16:25 ----HD---- C:\WINDOWS\inf
2009-03-23 13:44:49 ----D---- C:\WINDOWS\system32\CatRoot
2009-03-23 13:43:21 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-03-22 13:12:17 ----D---- C:\Program Files\7-Zip
2009-03-22 12:46:55 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\Vso
2009-03-22 10:57:24 ----ASD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-03-22 00:22:49 ----HD---- C:\Program Files\WindowsUpdate
2009-03-22 00:22:49 ----D---- C:\Program Files\Outlook Express
2009-03-22 00:22:49 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-03-22 00:22:48 ----D---- C:\Program Files\Fichiers communs
2009-03-21 14:47:44 ----SHD---- C:\RECYCLER
2009-03-21 14:13:50 ----D---- C:\WINDOWS\Microsoft.NET
2009-03-21 14:13:49 ----RSD---- C:\WINDOWS\assembly
2009-03-21 11:27:34 ----A---- C:\WINDOWS\imsins.BAK
2009-03-21 11:27:04 ----D---- C:\WINDOWS\system32\fr-fr
2009-03-21 11:25:11 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-03-21 11:24:33 ----RSD---- C:\WINDOWS\Fonts
2009-03-21 11:24:07 ----D---- C:\WINDOWS\system32\spool
2009-03-21 11:22:22 ----D---- C:\WINDOWS\WinSxS
2009-03-20 23:11:28 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-20 23:11:15 ----SD---- C:\Documents and Settings\Pierre-Henri\Application Data\Microsoft
2009-03-20 22:57:45 ----D---- C:\WINDOWS\Debug
2009-03-20 08:44:30 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\FrostWire
2009-03-19 00:16:11 ----D---- C:\Documents and Settings\Pierre-Henri\Application Data\dvdcss
2009-03-17 11:03:52 ----D---- C:\Program Files\dominions3
2009-03-17 09:56:42 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
2009-03-17 09:56:34 ----D---- C:\Program Files\AGEIA Technologies
2009-03-17 09:55:40 ----D---- C:\WINDOWS\Help
2009-03-17 09:46:28 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-03-17 09:33:25 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-03-16 17:30:07 ----D---- C:\WINDOWS\security
2009-03-16 12:03:30 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-03-11 09:11:40 ----HD---- C:\WINDOWS\$hf_mig$
2009-03-07 18:21:09 ----D---- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2009-03-06 10:52:04 ----D---- C:\WINDOWS\system32\DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-10-30 75072]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-11-02 56572]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-03-15 21035]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-03-06 278984]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-02-06 55152]
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; \??\C:\WINDOWS\system32\drivers\Haspnt.sys []
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-03-06 25416]
R2 PCLinkBridge;USB-USB Network Bridge; C:\WINDOWS\system32\DRIVERS\pro2000.sys [2001-11-05 6566]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2001-06-21 73728]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 CLEDX;Team H2O CLEDX service; C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-10-23 33792]
R3 DELTAII;Service for M-Audio Delta Driver (WDM); C:\WINDOWS\system32\DRIVERS\deltaII.sys [2007-12-03 297992]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-06-02 4752384]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NIC2000;USB-USB Network Bridge Adapter; C:\WINDOWS\system32\DRIVERS\NIC2000.sys [2001-11-05 5766]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-18 6308224]
R3 NVR0Dev;NVR0Dev; \??\C:\WINDOWS\nvoclock.sys []
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2008-03-17 47360]
R3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle; C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-05-04 215040]
R3 SjyPkt;SjyPkt; \??\C:\WINDOWS\System32\Drivers\SjyPkt.sys []
R3 tbhsd;Tunebite High-Speed Dubbing; C:\WINDOWS\system32\drivers\tbhsd.sys [2009-01-15 43168]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VX1000;VX-1000; C:\WINDOWS\system32\DRIVERS\VX1000.sys [2006-10-13 1966000]
S2 DS1410D;DS1410D; \??\C:\WINDOWS\system32\drivers\ds1410d.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 LoopBeMidi1;nerds.de LoopBe1 - Internal Midi Port SvcDesc(WDM); C:\WINDOWS\system32\drivers\loopbe1.sys [2008-01-27 10880]
S3 mbr;mbr; \??\C:\DOCUME~1\PIERRE~1\LOCALS~1\Temp\mbr.sys []
S3 MSICPL;MSICPL; \??\E:\install4\MSICPL.sys []
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\E:\NTGLM7X.sys []
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 Sntnlusb;Rainbow USB SuperPro; C:\WINDOWS\system32\DRIVERS\SNTNLUSB.SYS [2001-06-21 20032]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-02-18 30464]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Planificateur Avira AntiVir Personal - Free Antivirus; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 EPSONStatusAgent2;EPSON Printer Status Agent2; C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe [2001-08-09 90112]
R2 FolderSize;Folder Size; D:\Program Files\FolderSize\FolderSizeSvc.exe [2007-11-14 131072]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-10 152984]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2008-02-26 73728]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2006-10-13 207664]
R2 nTuneService;nTune Service; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [2007-09-04 131072]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-18 163908]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-05-11 1050120]
R2 OPTENET_FILTER;OPTENET Content Filter; C:\Program Files\OPTENET\bin\optproxy.exe [2007-01-19 585664]
R2 SPAMfighter Update Service;SPAMfighter Update Service; C:\Program Files\SPAMfighter\sfus.exe [2009-01-16 184968]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-03-22 72704]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-03-23 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 fsssvc;Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;Service de l'iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-02-19 504104]
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR; D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe [2002-12-17 7520337]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR; D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE [2002-12-17 311872]
S3 Visual Studio Analyzer RPC bridge;Visual Studio Analyzer RPC bridge; C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe [1998-06-06 34036]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe [2003-03-19 335872]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Tu as des barres d'outils infectées

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

http://eric.71.mespages.googlepages.com/ToolBarSD.exe

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
  

Fait, voici le rapport de ToolBar S&D


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E6850 @ 3.00GHz )
BIOS : BIOS Date: 10/30/07 20:44:12 Ver: 08.00.12
USER : Pierre-Henri ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:232 Go (Free:106 Go)
D:\ (Local Disk) - NTFS - Total:298 Go (Free:130 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (USB)
K:\ (Local Disk) - NTFS - Total:298 Go (Free:90 Go)
L:\ (Local Disk) - NTFS - Total:698 Go (Free:393 Go)
M:\ (USB) - FAT32 - Total:7728 Mo (Free:0 Go)
O:\ (Local Disk) - NTFS - Total:152 Go (Free:117 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 02/04/2009|11:38 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\PIERRE~1\Cookies\pierre-henri@dealio[2].txt
C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-253CB611.pf
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127\temp\ws-14332.log
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127\temp\ws-14333.log
C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127\temp\ws-14335.log
C:\DOCUME~1\Emeline\APPLIC~1\Search Settings
C:\DOCUME~1\Emeline\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\Emeline\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\Emeline\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\Emeline\APPLIC~1\Search Settings\kb127\temp\ws-14332.log
C:\DOCUME~1\Emeline\APPLIC~1\Search Settings\kb127\temp\ws-14335.log
C:\DOCUME~1\Nicole\APPLIC~1\Search Settings
C:\DOCUME~1\Nicole\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\Nicole\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\Nicole\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\Nicole\APPLIC~1\Search Settings\kb127\temp\ws-14334.log
C:\DOCUME~1\Nicole\APPLIC~1\Search Settings\kb127\temp\ws-14335.log
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127\temp\ws-14334.log
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127\temp\ws-14335.log
C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127\temp\ws-14336.log
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.netvibes.com/#General"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"SearchMigratedDefaultURL"="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Search Bar"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"


--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\PIERRE~1\Mes documents\eMule Downloads\Incoming\Dark Basic Professional - Crack.zip
C:\DOCUME~1\PIERRE~1\Mes documents\eMule Downloads\Incoming\Realdvd Keygen.rar



1 - "C:\ToolBar SD\TB_1.txt" - 02/04/2009|11:38 - Option : [1]

-----------\\ Fin du rapport a 11:38:51,37

Supprime tes cracks :

C:\DOCUME~1\PIERRE~1\Mes documents\eMule Downloads\Incoming\Dark Basic Professional - Crack.zip
C:\DOCUME~1\PIERRE~1\Mes documents\eMule Downloads\Incoming\Realdvd Keygen.rar

Ce sont eux qui t'ont amené l'infection par bagle....

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".

! Ne ferme pas la fenêtre lors de la suppression !

Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.
  

Voilà, c'est fait, voici le rapport après re-passage de Toolbar-S&D, option 2:


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E6850 @ 3.00GHz )
BIOS : BIOS Date: 10/30/07 20:44:12 Ver: 08.00.12
USER : Pierre-Henri ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:232 Go (Free:106 Go)
D:\ (Local Disk) - NTFS - Total:298 Go (Free:130 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (USB)
K:\ (Local Disk) - NTFS - Total:298 Go (Free:90 Go)
L:\ (Local Disk) - NTFS - Total:698 Go (Free:393 Go)
M:\ (USB) - FAT32 - Total:7728 Mo (Free:0 Go)
O:\ (Local Disk) - NTFS - Total:152 Go (Free:117 Go)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 02/04/2009|11:50 )

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\PIERRE~1\Cookies\pierre-henri@dealio[2].txt
Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-253CB611.pf
Supprime! - C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings\kb127
Supprime! - C:\DOCUME~1\Emeline\APPLIC~1\Search Settings\kb127
Supprime! - C:\DOCUME~1\Nicole\APPLIC~1\Search Settings\kb127
Supprime! - C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\DOCUME~1\Aymeric\APPLIC~1\Search Settings
Supprime! - C:\DOCUME~1\Emeline\APPLIC~1\Search Settings
Supprime! - C:\DOCUME~1\Nicole\APPLIC~1\Search Settings
Supprime! - C:\DOCUME~1\PIERRE~1\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.netvibes.com/#General"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"SearchMigratedDefaultURL"="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.msn.com/"
"Search Bar"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 02/04/2009|11:38 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 02/04/2009|11:51 - Option : [2]

-----------\\ Fin du rapport a 11:51:37,78

Bien

Un nettoyage général maintenant :

Imprime ces instructions ou sauvegarde les sur ton Bureau car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton bureau à partir de ce lien :

http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_­4-10804572.html

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

Dans l'onglet analyse, vérifie que "Exécuter un examen rapide" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain teps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse. Ferme le bloc-note. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport sur le forum.




  

On continue avec MBAM dont voici le rapport final:
Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1904
Windows 5.1.2600 Service Pack 3

02/04/2009 12:21:36
mbam-log-2009-04-02 (12-21-36).txt

Type de recherche: Examen rapide
Eléments examinés: 110624
Temps écoulé: 12 minute(s), 42 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\poof (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

OK, ne reste plus qu'à nettoyer le registre :

* Télécharge CCleaner.
(attention à l'installation penser à DECOCHER l'installation de Yahoo toolbar discrètement proposé en plus de CCleaner).

http://www.pcastuces.com/logitheque/ccleaner.htm
http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

Installe le dans un répertoire dédié.

Décoche pendant l'installation

--- les deux cases "Ajouter l'option ... "
--- Contrôler les mises à jour

* Lance Ccleaner pour un nettoyage complet :

Déconnecte-toi et ferme toutes les applications en cours
* va dans "nettoyeur" : fait analyse puis nettoyage
* va dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

Tutorial ici :
http://kerio.probb.fr/...
http://www.malekal.com/tutorial_CCleaner.html
ET
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm
  

OK, opérations réalisées sans problème

Si tout fonctionne bien :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :

Télécharge toolscleaner sur ton Bureau :
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
* Double-clique sur ToolsCleaner2.exe et laisse le travailler
* Clique sur Recherche et laisse le scan se terminer.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter, pour que le rapport puisse se créer.
* Le rapport (TCleaner.txt) se trouve à la racine de ton disque dur (C:\)...colle le dans ta réponse