Bonjour,

fichier log.txt :

Logfile of random's system information tool 1.06 (written by random/random)
Run by ribenmalek at 2009-08-07 10:27:49
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 6 GB (19%) free of 31 GB
Total RAM: 1013 MB (36% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:51, on 07/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$ONDSQL\Binn\sqlservr.exe
C:\Program Files\Symantec\Ghost\ngserver.exe
C:\Program Files\OCS Inventory Agent\ocsservice.exe
c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Symantec\Ghost\bin\dbserv.exe
C:\Program Files\Symantec\Ghost\bin\rteng7.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe­
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ribenmalek\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\ribenmalek\Bureau\ribenmalek.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.54.25:8888
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NGServer] C:\Program Files\Symantec\Ghost\ngserver.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE"
O4 - HKLM\..\Run: [RegGenie Scheduler] C:\Program Files\RegGenie\RegGenieScheduler.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=about:blank
O15 - Trusted Zone: http://*.crossknowledge.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = galaxie.tp
O17 - HKLM\Software\..\Telephony: DomainName = galaxie.tp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = galaxie.tp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = galaxie.tp
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Service Google Update (gupdate1ca0eaef0a79f6b) (gupdate1ca0eaef0a79f6b) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kaspersky Network Agent (klnagent) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe
O23 - Service: Service de base de données Symantec Ghost (ngdbserv) - Symantec Corporation - C:\Program Files\Symantec\Ghost\bin\dbserv.exe
O23 - Service: Serveur de configuration Symantec Ghost (NGServer) - Symantec Corporation - C:\Program Files\Symantec\Ghost\ngserver.exe
O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://www.ocsinventory-ng.org - C:\Program Files\OCS Inventory Agent\ocsservice.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
O24 - Desktop Component 0: (no name) - http://www.rustletheleaf.com/media/rustle/wallpapers/EarthDayGlobe_1024x768.jpg
End of file - 11372 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-610352017-519196251-3825893388-11851Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-610352017-519196251-3825893388-11851UA.job
C:\WINDOWS\tasks\NSSstub.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-07-03 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2009-01-08 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [2009-07-30 669168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2009-05-04 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2009-01-08 2436160]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2009-05-04 806912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-05 208952]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-05 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-05 455168]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-11-30 16858624]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-09-05 141848]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-09-05 166424]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-09-05 137752]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe [2009-03-05 231952]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"Synchronization Manager"=C:\WINDOWS\system32\mobsync.exe [2008-04-13 143872]
"NGServer"=C:\Program Files\Symantec\Ghost\ngserver.exe [2001-12-04 1318444]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-07-03 198160]
"QuickFinder Scheduler"=c:\Program Files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE [2008-03-21 83232]
"RegGenie Scheduler"=C:\Program Files\RegGenie\RegGenieScheduler.exe []
"AppleSyncNotifier"=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-05-20 177472]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-25 149280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"NSSInstallation"=C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe [2009-05-22 181624]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-01-15 68856]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"Uniblue RegistryBooster 2009"=C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S []
"googletalk"=C:\Program Files\Google\Google Talk\googletalk.exe [2007-11-21 3297280]
"Google Update"=C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-18 133104]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
AutoCAD Startup Accelerator.lnk - C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-08-24 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2007-11-19 219664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Documents and Settings\ribenmalek\Bureau\GhostSrv.exe"="C:\Documents and Settings\ribenmalek\Bureau\GhostSrv.exe:*:Enabled:Symantec GhostCast Server for Windows"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\Program Files\UltraVnc\vncviewer.exe"="C:\Program Files\UltraVnc\vncviewer.exe:*:Enabled:vncviewer.exe"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll"="C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
"C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\ribenmalek\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67638dee-3589-11de-948b-001c25cfd6d6}]
shell\AutoRun\command - 0bcobed.exe
shell\open\command - 0bcobed.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90136019-81e5-11de-94a4-001c25cfd6d6}]
shell\AutoRun\command - F:\LaunchU3.exe -a


======File associations======

.js - open -
.reg - edit -
.reg - open - c:\Winnt\Regedit.exe %1
.scr - open - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-08-07 10:27:49 ----D---- C:\rsit
2009-08-07 09:48:47 ----A---- C:\WINDOWS\system32\javaws.exe
2009-08-07 09:48:47 ----A---- C:\WINDOWS\system32\javaw.exe
2009-08-07 09:48:46 ----A---- C:\WINDOWS\system32\java.exe
2009-08-07 09:38:14 ----D---- C:\WINDOWS\Prefetch
2009-08-06 11:01:37 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-08-06 11:01:36 ----HD---- C:\WINDOWS\$hf_mig$
2009-08-06 11:01:25 ----D---- C:\WINDOWS\LastGood.Tmp
2009-08-06 10:16:10 ----A---- C:\KidoKiller.exe
2009-08-05 19:37:21 ----A---- C:\WINDOWS\setuplog.txt
2009-08-05 19:35:15 ----N---- C:\WINDOWS\system32\smtpapi.dll
2009-08-05 19:35:15 ----N---- C:\WINDOWS\system32\rwnh.dll
2009-08-05 19:35:15 ----N---- C:\WINDOWS\system32\comsdupd.exe
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ativvaxx.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ativtmxx.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ati3duag.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ati3d1ag.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ati2dvag.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ati2dvaa.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\ati2cqag.dll
2009-08-05 19:35:11 ----N---- C:\WINDOWS\system32\aaclient.dll
2009-08-05 19:35:10 ----N---- C:\WINDOWS\system32\dimsroam.dll
2009-08-05 19:35:10 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2009-08-05 19:35:10 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2009-08-05 19:35:10 ----N---- C:\WINDOWS\system32\credssp.dll
2009-08-05 19:35:10 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eapsvc.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eapqec.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eappprxy.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eapphost.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eappgnui.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eappcfg.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\eapolqec.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3ui.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3svc.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3msm.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2009-08-05 19:35:09 ----N---- C:\WINDOWS\system32\dot3api.dll
2009-08-05 19:35:07 ----N---- C:\WINDOWS\system32\hsfcisp2.dll
2009-08-05 19:35:06 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2009-08-05 19:35:05 ----N---- C:\WINDOWS\system32\kbdpash.dll
2009-08-05 19:35:05 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2009-08-05 19:35:05 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\mmcperf.exe
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\mmcex.dll
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\mdmxsdk.dll
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2009-08-05 19:35:04 ----N---- C:\WINDOWS\system32\kmsvc.dll
2009-08-05 19:35:03 ----N---- C:\WINDOWS\system32\napstat.exe
2009-08-05 19:35:03 ----N---- C:\WINDOWS\system32\napmontr.dll
2009-08-05 19:35:03 ----N---- C:\WINDOWS\system32\napipsec.dll
2009-08-05 19:35:03 ----N---- C:\WINDOWS\system32\mtxparhd.dll
2009-08-05 19:35:03 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2009-08-05 19:35:03 ----N---- C:\WINDOWS\system32\mssha.dll
2009-08-05 19:35:02 ----N---- C:\WINDOWS\system32\onex.dll
2009-08-05 19:35:02 ----N---- C:\WINDOWS\system32\nv4_disp.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\setupn.exe
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\s3gnb.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\rasqec.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\qutil.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\qcliprov.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\qagentrt.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\qagent.dll
2009-08-05 19:35:01 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2009-08-05 19:35:00 ----N---- C:\WINDOWS\system32\slserv.exe
2009-08-05 19:35:00 ----N---- C:\WINDOWS\system32\slrundll.exe
2009-08-05 19:35:00 ----N---- C:\WINDOWS\system32\slgen.dll
2009-08-05 19:35:00 ----N---- C:\WINDOWS\system32\slextspk.dll
2009-08-05 19:35:00 ----N---- C:\WINDOWS\system32\slcoinst.dll
2009-08-05 19:34:59 ----N---- C:\WINDOWS\system32\xpsp3res.dll
2009-08-05 19:34:59 ----N---- C:\WINDOWS\system32\tzchange.exe
2009-08-05 19:34:59 ----N---- C:\WINDOWS\system32\tspkg.dll
2009-08-05 19:34:59 ----N---- C:\WINDOWS\system32\tsgqec.dll
2009-08-05 19:34:58 ----N---- C:\WINDOWS\system32\wlanapi.dll
2009-08-05 19:34:58 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2009-08-05 19:34:58 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2009-08-05 19:34:58 ----N---- C:\WINDOWS\system32\verclsid.exe
2009-08-05 19:34:57 ----N---- C:\WINDOWS\system32\xmllite.dll
2009-08-05 19:34:57 ----N---- C:\WINDOWS\system32\wmphoto.dll
2009-08-05 19:34:56 ----N---- C:\WINDOWS\slrundll.exe
2009-08-05 19:34:55 ----D---- C:\WINDOWS\system32\fr-fr
2009-08-05 19:34:53 ----D---- C:\WINDOWS\l2schemas
2009-08-05 19:34:52 ----D---- C:\WINDOWS\system32\fr
2009-08-05 19:34:52 ----D---- C:\WINDOWS\system32\bits
2009-08-05 19:30:54 ----D---- C:\WINDOWS\ServicePackFiles
2009-08-05 19:25:47 ----D---- C:\WINDOWS\network diagnostic
2009-08-05 19:22:26 ----D---- C:\Program Files\001Micron MSI to EXE Creator Demo
2009-08-05 19:21:56 ----A---- C:\WINDOWS\002649_.tmp
2009-08-05 19:14:52 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-08-05 19:14:52 ----D---- C:\Program Files\Myncos
2009-08-05 18:58:17 ----D---- C:\Program Files\Setup Generator
2009-08-05 18:56:49 ----D---- C:\Program Files\NSIS
2009-07-29 08:52:25 ----D---- C:\Documents and Settings\ribenmalek\Application Data\VMware
2009-07-29 08:52:25 ----D---- C:\Documents and Settings\All Users\Application Data\VMware
2009-07-27 13:36:52 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2009-07-27 09:48:23 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-07-27 09:46:54 ----RHD---- C:\MSOCache
2009-07-27 09:31:33 ----D---- C:\Documents and Settings\All Users\Application Data\KaDonk
2009-07-27 09:31:31 ----D---- C:\Documents and Settings\ribenmalek\Application Data\KaDonk
2009-07-27 09:29:06 ----D---- C:\Program Files\KaDonk
2009-07-27 09:22:32 ----D---- C:\Program Files\Seavus
2009-07-22 18:35:09 ----A---- C:\logger.txt
2009-07-21 10:49:57 ----D---- C:\Program Files\Safari
2009-07-21 10:42:58 ----D---- C:\Program Files\iPod
2009-07-21 10:42:31 ----D---- C:\Program Files\iTunes
2009-07-20 19:57:29 ----A---- C:\WINDOWS\RegGenie.ini
2009-07-20 19:46:24 ----A---- C:\WINDOWS\RegGenieOnUninstall.exe
2009-07-20 19:46:14 ----D---- C:\Program Files\RegGenie
2009-07-16 16:58:29 ----D---- C:\Program Files\Fusion
2009-07-16 14:07:23 ----A---- C:\Documents and Settings\ribenmalek\Application Data\QuickZip45.ini
2009-07-16 14:07:15 ----D---- C:\Program Files\QuickZip4
2009-07-16 14:05:59 ----D---- C:\Program Files\Driver Checker
2009-07-11 14:39:40 ----D---- C:\Documents and Settings\ribenmalek\Application Data\gtk-2.0
2009-07-11 14:33:50 ----D---- C:\Program Files\GIMP-2.0
2009-07-10 10:16:08 ----D---- C:\Documents and Settings\ribenmalek\Application Data\Blumentals
2009-07-09 17:45:54 ----D---- C:\Program Files\3D Screen Creator
2009-07-09 13:22:57 ----A---- C:\WINDOWS\system32\RC5AE140.DLL
2009-07-09 13:22:57 ----A---- C:\WINDOWS\system32\MP500dat.dll
2009-07-08 10:05:32 ----D---- C:\Documents and Settings\ribenmalek\Application Data\Corel
2009-07-08 09:31:35 ----D---- C:\Program Files\Fichiers communs\Protexis
2009-07-08 09:31:35 ----D---- C:\Documents and Settings\All Users\Application Data\Corel
2009-07-08 09:30:17 ----D---- C:\Documents and Settings\ribenmalek\Application Data\PlayFirst
2009-07-08 09:30:17 ----D---- C:\Documents and Settings\All Users\Application Data\PlayFirst
2009-07-08 09:29:27 ----D---- C:\Program Files\Fichiers communs\Borland Shared
2009-07-08 09:29:27 ----D---- C:\Documents and Settings\All Users\Application Data\Borland
2009-07-08 09:28:37 ----D---- C:\Program Files\Fichiers communs\Corel
2009-07-08 09:24:30 ----D---- C:\Program Files\Corel

======List of files/folders modified in the last 1 months======

2009-08-07 10:23:10 ----SD---- C:\WINDOWS\Tasks
2009-08-07 10:15:59 ----D---- C:\WINDOWS\system32
2009-08-07 10:07:09 ----D---- C:\Program Files\Mozilla Firefox
2009-08-07 09:49:03 ----SHD---- C:\WINDOWS\Installer
2009-08-07 09:48:51 ----SHD---- C:\Config.Msi
2009-08-07 09:48:49 ----D---- C:\WINDOWS\Temp
2009-08-07 09:48:43 ----D---- C:\Program Files\Java
2009-08-07 09:47:50 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-07 09:41:55 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-07 09:41:53 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-08-07 09:41:35 ----A---- C:\WINDOWS\OEWABLog.txt
2009-08-07 09:39:20 ----D---- C:\WINDOWS\Debug
2009-08-07 09:39:18 ----D---- C:\windows
2009-08-07 09:37:46 ----D---- C:\WINDOWS\system32\Setup
2009-08-07 09:37:46 ----D---- C:\WINDOWS\AppPatch
2009-08-07 09:37:46 ----D---- C:\Program Files\Messenger
2009-08-07 09:37:46 ----D---- C:\Program Files\Internet Explorer
2009-08-07 09:37:45 ----D---- C:\WINDOWS\system32\wbem
2009-08-07 09:37:45 ----D---- C:\Program Files\Fichiers communs\System
2009-08-07 09:37:44 ----SD---- C:\WINDOWS\Fonts
2009-08-07 09:37:39 ----D---- C:\WINDOWS\system32\drivers
2009-08-07 09:36:29 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-07 08:28:53 ----HD---- C:\WINDOWS\inf
2009-08-07 08:28:34 ----D---- C:\WINDOWS\system32\CatRoot
2009-08-07 04:37:18 ----D---- C:\WINDOWS\security
2009-08-07 03:50:52 ----D---- C:\Program Files\OCS Inventory Agent
2009-08-06 11:03:08 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-08-06 10:15:43 ----A---- C:\WINDOWS\imsins.BAK
2009-08-05 19:36:04 ----D---- C:\WINDOWS\WinSxS
2009-08-05 19:35:36 ----D---- C:\Program Files\Windows Media Player
2009-08-05 19:35:35 ----D---- C:\WINDOWS\Help
2009-08-05 19:35:17 ----D---- C:\WINDOWS\ehome
2009-08-05 19:35:14 ----D---- C:\WINDOWS\system32\inetsrv
2009-08-05 19:35:14 ----D---- C:\WINDOWS\ime
2009-08-05 19:34:55 ----D---- C:\WINDOWS\system32\usmt
2009-08-05 19:34:52 ----D---- C:\WINDOWS\PeerNet
2009-08-05 19:34:52 ----D---- C:\Program Files\Movie Maker
2009-08-05 19:30:38 ----D---- C:\WINDOWS\system32\Restore
2009-08-05 19:30:38 ----D---- C:\WINDOWS\system32\npp
2009-08-05 19:30:35 ----D---- C:\WINDOWS\msagent
2009-08-05 19:30:33 ----D---- C:\WINDOWS\srchasst
2009-08-05 19:30:28 ----D---- C:\Program Files\NetMeeting
2009-08-05 19:30:26 ----D---- C:\WINDOWS\system32\Com
2009-08-05 19:30:23 ----D---- C:\Program Files\Windows NT
2009-08-05 19:30:23 ----D---- C:\Program Files\Outlook Express
2009-08-05 19:29:44 ----D---- C:\WINDOWS\system32\oobe
2009-08-05 19:29:40 ----D---- C:\WINDOWS\system
2009-08-05 19:22:26 ----RD---- C:\Program Files
2009-08-05 19:21:47 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-08-05 19:14:54 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-08-05 18:50:05 ----D---- C:\Program Files\Inno Setup 5
2009-08-05 18:23:46 ----D---- C:\Discover.wrk
2009-08-03 10:44:58 ----A---- C:\WINDOWS\IE4 Error Log.txt
2009-07-31 15:58:27 ----SHD---- C:\WINDOWS\CSC
2009-07-30 13:01:16 ----D---- C:\Program Files\Eye On Network
2009-07-27 16:09:40 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2009-07-27 13:41:44 ----D---- C:\Documents and Settings\ribenmalek\Application Data\Google
2009-07-27 13:40:36 ----D---- C:\Program Files\Google
2009-07-27 10:10:03 ----D---- C:\Program Files\NOS
2009-07-27 10:10:02 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-07-27 09:52:43 ----RSD---- C:\WINDOWS\assembly
2009-07-27 09:52:37 ----D---- C:\WINDOWS\system32\config
2009-07-27 09:52:20 ----D---- C:\Program Files\Microsoft Works
2009-07-27 09:52:05 ----D---- C:\Program Files\Microsoft Office
2009-07-25 05:23:00 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-07-21 10:42:56 ----D---- C:\Program Files\Fichiers communs\Apple
2009-07-10 14:26:32 ----D---- C:\Documents and Settings\ribenmalek\Application Data\Mozilla
2009-07-10 12:11:26 ----D---- C:\Documents and Settings
2009-07-10 10:14:43 ----D---- C:\wamp
2009-07-09 17:07:12 ----D---- C:\Documents and Settings\ribenmalek\Application Data\DameWare Development
2009-07-09 13:22:59 ----A---- C:\WINDOWS\system32\RPCS.ini
2009-07-09 13:22:57 ----HD---- C:\_rpcs
2009-07-09 13:22:57 ----A---- C:\WINDOWS\ricdb.ini
2009-07-08 10:06:46 ----D---- C:\WINDOWS\system32\FxsTmp
2009-07-08 09:31:35 ----D---- C:\Program Files\Fichiers communs
2009-07-08 09:30:45 ----D---- C:\WINDOWS\SHELLNEW

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 dwvkbd;DameWare Virtual Keyboard 32 bit Driver; C:\WINDOWS\system32\DRIVERS\dwvkbd.sys [2007-02-15 26624]
R1 FileDisk;FileDisk; C:\WINDOWS\system32\drivers\FileDisk.sys [2005-10-16 12928]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
R1 KLIF;Klif; \??\C:\WINDOWS\system32\drivers\klif.sys []
R1 vmm;Virtual Machine Monitor; \??\C:\WINDOWS\system32\Drivers\vmm.sys []
R2 vnccom;vnccom; C:\WINDOWS\System32\Drivers\vnccom.SYS [2004-06-26 6016]
R3 DwMirror;DwMirror; C:\WINDOWS\system32\DRIVERS\DamewareMini.sys [2007-02-07 2944]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-08-24 5776928]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-12-05 4632576]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-05-30 24344]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-10-03 102656]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vncdrv;vncdrv; C:\WINDOWS\system32\DRIVERS\vncdrv.sys [2004-06-26 4736]
R3 vncmirror;vncmirror; C:\WINDOWS\system32\DRIVERS\vncmirror.sys [2007-08-15 3072]
R3 VPCNetS2;Virtual Machine Network Services Driver; C:\WINDOWS\system32\DRIVERS\VMNetSrv.sys [2007-01-29 59280]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\RIBENM~1\LOCALS~1\Temp\mc212.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
R2 AVP;Kaspersky Anti-Virus 6.0; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe [2009-03-05 231952]
R2 DWMRCS;DameWare Mini Remote Control; C:\WINDOWS\SYSTEM32\DWRCS.EXE [2006-05-31 199168]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-25 153376]
R2 klnagent;Kaspersky Network Agent; C:\Program Files\Kaspersky Lab\NetworkAgent\klnagent.exe [2007-11-14 95120]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 MSSQL$ONDSQL;MSSQL$ONDSQL; C:\Program Files\Microsoft SQL Server\MSSQL$ONDSQL\Binn\sqlservr.exe [2002-12-17 7520337]
R2 NGServer;Serveur de configuration Symantec Ghost; C:\Program Files\Symantec\Ghost\ngserver.exe [2001-12-04 1318444]
R2 OCS INVENTORY;OCS INVENTORY SERVICE; C:\Program Files\OCS Inventory Agent\ocsservice.exe [2008-10-10 69632]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
R2 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2006-05-12 439248]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
R3 ngdbserv;Service de base de données Symantec Ghost; C:\Program Files\Symantec\Ghost\bin\dbserv.exe [2001-11-30 45056]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 268800]
S2 gupdate1ca0eaef0a79f6b;Service Google Update (gupdate1ca0eaef0a79f6b); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-27 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-27 190448]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2009-05-20 77944]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe []
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLAgent$ONDSQL;SQLAgent$ONDSQL; C:\Program Files\Microsoft SQL Server\MSSQL$ONDSQL\Binn\sqlagent.EXE [2002-12-17 311872]

-----------------EOF-----------------

Bonjour,

fichier info.txt :

info.txt logfile of random's system information tool 1.06 2009-08-07 10:27:56

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
001Micron MSI to EXE Creator Demo-->"C:\Program Files\001Micron MSI to EXE Creator Demo\Uninstall.exe"
1.0-->"C:\Program Files\File Audit\unins000.exe"
3D Screen Creator 0.3.5-->"C:\Program Files\3D Screen Creator\unins000.exe"
7-Zip 4.32-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
Advanced IP Address Calculator v1.1-->C:\Program Files\Advanced IP Address Calculator\uninstal.exe
AppDeploy Repackager-->MsiExec.exe /I{7EB06EA7-915F-4261-849A-B58D1A6E509F}
Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
AutoCAD 2007 - English-->MsiExec.exe /I{5783F2D7-5001-0409-0002-0060B0CE6BBA}
Autodesk DWF Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove /q0
Avaya CMS Supervisor R14-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F81ACFA5-1F96-470C-A923-195FF7730B92}\Setup.exe"
AVI-MPG-WMV Screensaver Trial-->"C:\Program Files\AVI-MPG-WMV Screensaver Trial\unins000.exe"
CutePDF Writer 2.7-->C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe
DameWare NT Utilities-->MsiExec.exe /I{0A558EA7-50CE-48CC-8FBF-D42C843B5BEF}
DameWare NT Utilities-->MsiExec.exe /I{0E5765EE-35A4-4715-AC95-090F1A2FECDA}
Documalis Free Scanner 1.0-->"C:\WINDOWS\Documalis Free Scanner 1.0\uninstall.exe" "/U:C:\Program Files\Documalis Free\FreeScanner\Uninstall\uninstall.xml"
DWG TrueView 2007-->MsiExec.exe /I{2CD6BBA0-17C8-4789-9B9B-B36F7E815F6A}
Eye On Network (désinstallation)-->"C:\Program Files\Eye On Network\uninst-Eye On Network.exe"
FileAudit-->MsiExec.exe /I{BB04AFEE-2BF2-4F75-9650-C825F63F2BBC}
Free PDF to Word Doc Converter v1.1-->"C:\Program Files\Free PDF to Word Doc Converter\unins000.exe"
FUSION WOL v1.0-->"C:\Program Files\Fusion\FUSION WOL\unins000.exe"
Ghost AI Snapshot-->C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\Ghost\AUTOIN~1\INSTAL~1\~0000.exe cfg="C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\Ghost\AUTOIN~1\INSTAL~1\{83AE8~1\UNINST~1.CFG" /all
GIMP 2.6.6-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Google Talk (remove only)-->"C:\Program Files\Google\Google Talk\uninstall.exe"
Google Talk Plugin-->MsiExec.exe /I{F6B1D53B-2A68-377D-AC39-C8FD359FF6F1}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HijackThis 2.0.2-->"C:\Documents and Settings\ribenmalek\Bureau\HijackThis.exe" /uninstall
Hotfix for Windows Media Format SDK (KB942423)-->"C:\WINDOWS\$NtUninstallKB942423$\spuninst\spuninst.exe"
HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9 anything
Inno Setup version 5.2.3-->"C:\Program Files\Inno Setup 5\unins000.exe"
Intel(R) Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall
IP Calculator-->MsiExec.exe /I{56B09FD6-8D5A-4C8D-BA28-B0B7FF9F4E8F}
iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
Japanese Fonts Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5760-0000-900000000003}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Kaspersky Administration Kit-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{12C259B1-8E8C-498D-927D-60040190BF79}
Kaspersky Anti-Virus 5.0 for Windows File Servers Console Plugin-->MsiExec.exe /X{91607FF0-D28A-48CC-9E39-E0882716A88B}
Kaspersky Anti-Virus 6.0 Console Plugin-->MsiExec.exe /X{F80373B5-40DD-46E9-8D56-EEA1AE6DB63E}
Kaspersky Anti-Virus 6.0 for Windows Workstations-->MsiExec.exe /I{79B986AD-54D8-4498-AA06-89808829ACC0}
Kaspersky Anti-Virus 6.0 for Windows Workstations-->MsiExec.exe /I{79B986AD-54D8-4498-AA06-89808829ACC0}
Kaspersky Network Agent-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{7C72AAB5-8A7D-4882-950C-A1F26A949DA3}
La boite a couleurs version 1.6.14-->"C:\Program Files\LaBoiteACouleurs\unins000.exe"
LiveProject-->MsiExec.exe /I{8E82BF91-3044-44F0-A0AB-57A1F466C17D}
LiveUpdate 1.6 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Project MUI (French) 2007-->MsiExec.exe /X{90120000-00B4-040C-0000-0000000FF1CE}
Microsoft Office Project Standard 2007 Trial-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJSTDR /dll OSETUP.DLL
Microsoft Office Project Standard 2007-->MsiExec.exe /X{91120000-003A-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Visio Professional 2003-->MsiExec.exe /I{9051040C-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server Desktop Engine (ONDSQL)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft Virtual PC 2007-->MsiExec.exe /X{8A7CAA24-7B23-410B-A7C3-F994B0944160}
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
MobileMe Control Panel-->MsiExec.exe /I{CADBCBBA-6CDD-4119-B5ED-4AE075B153E7}
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSIBuilder-->MsiExec.exe /I{03F39E93-14B1-4590-879F-EDCB52AFB44F}
MSXML 6.0 Parser (KB927977)-->MsiExec.exe /I{5A710547-B58E-488B-828D-CA9A25A0533C}
Net Profiles-->C:\Program Files\Net Profiles\uninstall.exe
Nullsoft Install System-->"C:\Program Files\NSIS\uninst-nsis.exe"
OCS Inventory Agent 4.0.5.0-->C:\Program Files\OCS Inventory Agent\uninst.exe
OpenOffice.org 3.1-->MsiExec.exe /I{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Packet Tracer 4.01-->"C:\Program Files\Packet Tracer 4.01\unins000.exe"
PDFCreator Toolbar-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_7687.exe" _?=C:\Program Files\PDFCreator Toolbar
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
PingPlotter Pro-->C:\PROGRA~1\PINGPL~1\UNWISE.EXE C:\PROGRA~1\PINGPL~1\INSTALL.LOG
Product Key Explorer 2.1.6-->"C:\Program Files\Nsasoft\ProductKeyExplorer\unins000.exe"
Quick Zip 4.60.019-->"C:\Program Files\QuickZip4\unins000.exe"
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
RealArcade-->C:\Program Files\Real\RealArcade\Update\rnuninst.exe RealNetworks|RealArcade|1.2
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
Safari-->MsiExec.exe /I{2D6ED011-055B-4041-B198-BB903827EBFB}
Scalable WinINSTALL LE-->MsiExec.exe /X{072704A7-00D6-4751-ADB6-BC8DD02EA356}
Seavus Project Viewer 4.0.0 Trial-->MsiExec.exe /X{5AA7A269-BAC3-4FB7-8D4C-764984C41B53}
Setup Generator-->C:\Program Files\Setup Generator\uninstall.exe
SimpleOCR 3.1-->C:\PROGRA~1\SIMPLE~1\UNWISE.EXE C:\PROGRA~1\SIMPLE~1\INSTALL.LOG
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
Symantec Ghost-->MsiExec.exe /I{4FFDE761-5EA2-4196-0B2F-A758F13F1088}
UltraVnc v1.0.3-->"C:\Program Files\UltraVnc\unins000.exe"
Unreal Tournament 2004-->C:\UT2004\System\Setup.exe uninstall "UT2004"
VideoLAN VLC media player 0.8.6a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VMware Infrastructure Update-->MsiExec.exe /X{D93B70D2-4DA4-4F6F-9DC8-72D08F74A386}
VNC Free Edition 4.1.2-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
Web Screen Saver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8ECD0514-CA61-4DD5-BE9B-6EE66C142885}\setup.exe" -l0x9 -uninst -removeonly
Windows Installer Wrapper Wizard 0.2.0-->MsiExec.exe /X{D91A8849-B8DF-4934-901D-4C0E498482CC}
Windows Media Encoder Studio Edition-->"C:\WINDOWS\$NtUninstallWMESE$\spuninst\spuninst.exe"
Windows Server 2003 Service Pack 1 Administration Tools Pack-->MsiExec.exe /I{27B3563C-561C-4924-8C0E-EA102264873F}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinImage-->"C:\Program Files\WinImage\winimage.exe" /uninstall
WinRAR Archiveur-->C:\Program Files\WinRAR\uninstall.exe
WinSCP 4.0.4-->"C:\Program Files\WinSCP\unins000.exe"
WordPerfect Office X4 - Common-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529010}
WordPerfect Office X4 - Content-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529014}
WordPerfect Office X4 - Filters-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529017}
WordPerfect Office X4 - FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529300}
WordPerfect Office X4 - Graphics FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529018}
WordPerfect Office X4 - ICA-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529005}
WordPerfect Office X4 - IPM FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529040}
WordPerfect Office X4 - IPM T FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529047}
WordPerfect Office X4 - Migration Manager-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529032}
WordPerfect Office X4 - PerfectExperts-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529054}
WordPerfect Office X4 - PR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529013}
WordPerfect Office X4 - QP-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529012}
WordPerfect Office X4 - Skins FR-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529016}
WordPerfect Office X4 - System-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529023}
WordPerfect Office X4 - WP-->MsiExec.exe /I{DCDAB2ED-5741-4C30-A1A4-0FCB8A529011}
WordPerfect Office X4-->c:\Program Files\Corel\WordPerfect Office X4\Setup\SetupARP.exe /arp
WordPerfect Office X4-->MsiExec.exe /I{000AB2ED-5741-4C30-A1A4-0FCB8A529000}

======Security center information======

AV: Kaspersky Anti-Virus
FW: Kaspersky Anti-Virus (disabled)

======System event log======

Computer Name: YOUR-5072A47D58
Event Code: 5788
Message: La tentative de mise à jour des noms principaux de service (SPN) HOST de l'objet
ordinateur dans Active Directory a échoué. Les valeurs mises à jour étaient 'HOST/YOUR-5072A47D58' et 'HOST/YOUR-5072A47D58'.
L'erreur suivante s'est produite :
Accès refusé.


Record Number: 5
Source Name: NETLOGON
Time Written: 20090108172934.000000+060
Event Type: erreur
User:

Computer Name: YOUR-5072A47D58
Event Code: 5789
Message: La tentative de mise à jour du nom d'hôte DNS de l'ordinateur
dans Active Directory a échoué. La valeur mise à jour était 'YOUR-5072A47D58'.
L'erreur suivante s'est produite :
Accès refusé.


Record Number: 4
Source Name: NETLOGON
Time Written: 20090108172934.000000+060
Event Type: erreur
User:

Computer Name: YOUR-5072A47D58
Event Code: 40961
Message: Le système de sécurité n'a pas pu établir une connexion sécurisée avec le serveur LDAP/srv2_kp.galaxie.tp. Aucun protocole n'était disponible.

Record Number: 3
Source Name: LSASRV
Time Written: 20090108172934.000000+060
Event Type: Avertissement
User:

Computer Name: YOUR-5072A47D58
Event Code: 3260
Message: Cet ordinateur a correctement été joint au domain 'galaxie.tp'.

Record Number: 2
Source Name: Workstation
Time Written: 20090108172931.000000+060
Event Type: Informations
User:

Computer Name: YOUR-5072A47D58
Event Code: 115
Message: Le suivi de la Restauration système a été activé sur tous les lecteurs.

Record Number: 1
Source Name: SRService
Time Written: 20090108172244.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: RIHAB_KP
Event Code: 4660
Message: La mise à jour a réussi

Record Number: 538
Source Name: Kaspersky Anti-Virus
Time Written: 20090131021420.000000+060
Event Type: Informations
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: La mise à jour a réussi

Record Number: 537
Source Name: Kaspersky Anti-Virus
Time Written: 20090130203329.000000+060
Event Type: Informations
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: Le fichier F:\.Autorun\835694854683549385398626893468946\Autorun.exe a été supprimé.

Record Number: 536
Source Name: Kaspersky Anti-Virus
Time Written: 20090130155405.000000+060
Event Type: Informations
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: Des objets dangereux ont été découverts. Il est conseillé de les neutraliser immédiatement.

Record Number: 535
Source Name: Kaspersky Anti-Virus
Time Written: 20090130155405.000000+060
Event Type: Avertissement
User:

Computer Name: RIHAB_KP
Event Code: 4660
Message: Le fichier F:\.Autorun\835694854683549385398626893468946\Autorun.exe, découvert : cheval de Troie 'Trojan.Win32.Agent.avtj'.

Record Number: 534
Source Name: Kaspersky Anti-Virus
Time Written: 20090130155405.000000+060
Event Type: Avertissement
User:

=====Security event log=====

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 4348

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229194
Source Name: Security
Time Written: 20090807030843.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 4348

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229193
Source Name: Security
Time Written: 20090807030842.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 5252

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229192
Source Name: Security
Time Written: 20090807030841.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 5252

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229191
Source Name: Security
Time Written: 20090807030840.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

Computer Name: RIHAB_KP
Event Code: 578
Message: Opération sur objet privilégié :

Serveur objet : Security

Handle d'objet : 5252

Id. de processus : 4060

Utilisateur principal : ribenmalek

Domaine principal : GALAXIE

Id. de session principale : (0x0,0x57797)

Utilisateur client : -

Domaine client : -

Id. de la session cliente : -

Privilèges : SeTakeOwnershipPrivilege

Record Number: 17229190
Source Name: Security
Time Written: 20090807030839.000000+120
Event Type: Succès de l'audit
User: GALAXIE\ribenmalek

======Environment variables======

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"GS_LIB"=C:\Program Files\gs\gs8.14\lib
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\Autodesk\DWG TrueView\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=0f0d
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"windir"=%SystemRoot%

-----------------EOF-----------------