Message démarrage VISTARésolu/Fermé

Question

Bonjour,

Depuis peu j'ai une fenêtre qui s'ouvre au démarrage de ma session m'indiquant ceci :

UNREGISTERED VERSION

This program has been protected by unregistered version ofASProtect Software Protection System

IU'S NOT LICENSES FOR DISTRIBUTION!

This message will not appear on programs protected by a registered version of ASProtect

en image : http://img190.imageshack.us/img190/1816/bugrr.jpg

J'aimerai dans un premier temps comprendre d'où elle provient mais surtout m'en débarrasser.

Merci pour votre aide.
Cordialement.

Utilisateur anonyme · Answer

Bonsoir

1)=> Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac 
* Va dans démarrer puis panneau de configuration 
* Double Clique sur l'icône "Comptes d'utilisateurs" 
* Clique ensuite sur désactiver et valide.

2)1-	Télécharge et installe le logiciel HijackThis : 

  https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe 
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html 

-->Clique sur le setup pour lancer l'installation : laisse toi guider et ne modifie pas les paramètres d'installation . 
A la fin de l’installation, le programme se lance automatiquement : ferme le en cliquant sur la croix rouge. 
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : 
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " . 

(Ne lance pas ce prg pour l'instant et fais la suite ... ) 


2- Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau. 

-> http://images.malwareremoval.com/random/RSIT.exe 

! Déconnecte toi et ferme toutes tes applications en cours ! 

Double-clique sur " RSIT.exe " pour le lancer.
 
 Clic droit sous VISTA (exécuter en tant que…)
 
-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 2 months 

* clique ensuite sur " Continue " pour lancer l'analyse ... 


-> laisse faire le scan et ne touche pas au PC ... 


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-notes). 

Poste le contenu de " log.txt " (c'est celui qui apparaît à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ... 

Important : poste un rapport, puis l'autre dans la réponse suivante ... 
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum ... 
( Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ... ) 

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit ) 

             Merci

Seb1989 · Answer

" log.txt "

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sébastien at 2009-10-08 21:19:11
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 39 GB (26%) free of 148 GB
Total RAM: 3066 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:19:16, on 08/10/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32undll32.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\Spy-Net\server.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\SBASTI~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\Cerberus12\server95.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32
otepad.exe
C:\Users\Sébastien\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Sébastien.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [Spy-Net] C:\Windows\System32\Spy-Net\server.exe
O4 - HKLM\..\Run: [Cerberus45] C:\Windows\System32\Cerberus12\server95.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Spy-Net] C:\Windows\System32\Spy-Net\server.exe
O4 - HKCU\..\Run: [Cerberus45] C:\Windows\System32\Cerberus12\server95.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9d4ccfe26ad22) (gupdate1c9d4ccfe26ad22) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Seb1989 · Answer

" info.txt " 

info.txt logfile of random's system information tool 1.06 2009-10-08 21:07:35

======Uninstall list======

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A450831D-25F6-4F42-9662-D000B25E0D82}\Setup.exe"  -uninstall
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\Setup.exe"  -uninstall
32 Bit HP CIO Components Installer-->MsiExec.exe /I{2614F54E-A828-49FA-93BA-45A3F756BFAA}
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
abgx360 v1.0.1-->"C:\Program Files\abgx360\uninstall.exe"
Acer Arcade Deluxe-->"C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" /z-uninstall
Acer Arcade Deluxe-->"C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" /z-uninstall
Acer Bio Protection

AAU 6.0.00.17-->"C:\Program Files\Acer\Acer Bio Protection\uninstall.exe"
Acer Crystal Eye Webcam 2.0.8-->C:\Program Files\InstallShield Installation Information\{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}\setup.exe -runfromtemp -l0x040c -removeonly
Acer eAudio Management-->"C:\Program Files\InstallShield Installation Information\{57265292-228A-41FA-9AEC-4620CBCC2739}\Setup.exe" -uninstall
Acer eDataSecurity Management-->C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSnstHelper.exe -Operation UNINSTALL
Acer Empowering Technology-->"C:\Program Files\InstallShield Installation Information\{8F1B6239-FEA0-450A-A950-B05276CE177C}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer ePower Management-->"C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer eRecovery Management-->"C:\Program Files\InstallShield Installation Information\{7F811A54-5A09-4579-90E1-C93498E230D9}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer eSettings Management-->"C:\Program Files\InstallShield Installation Information\{13D85C14-2B85-419F-AC41-C7F21E68B25D}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer GridVista-->C:\Windows\GVUni.exe GridV.UNI
Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x40c  -removeonly
Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9  -removeonly
Acer VCM-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}\setup.exe" -l0x40c  -removeonly
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Adobe Color EU Extra Settings CS4-->MsiExec.exe /I{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}
Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
Adobe Color NA Recommended Settings CS4-->MsiExec.exe /I{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}
Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe Drive CS4-->MsiExec.exe /I{16E16F01-2E2D-4248-A42F-76261C147B6C}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
Adobe Linguistics CS4-->MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67}
Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS4 Support-->MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}
Adobe Photoshop CS4-->C:\Program Files\Common Files\Adobe\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe --uninstall=1
Adobe Photoshop CS4-->MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}
Adobe Photoshop CS4-->MsiExec.exe /I{E4848436-0345-47E2-B648-8B522FCDA623}
Adobe Reader 9.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
AdobeColorCommonSetCMYK-->MsiExec.exe /I{68243FF8-83CA-466B-B2B8-9F99DA5479C4}
AdobeColorCommonSetRGB-->MsiExec.exe /I{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}
Ad-Remover By C_XX-->"C:\Program Files\Ad-Remover\Uninstall ADR.exe"
Antidote RX v8-->MsiExec.exe /X{A474EA56-5DBD-4181-8230-806A4762EA7F}
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Program Files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\setup.exe" -runfromtemp -l0x040c -removeonly
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
ConvertHelper 2.2-->"C:\Program Files\ConvertHelper\unins000.exe"
CyberLink PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall
CyberLink PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall
gBurner-->"C:\Program Files\gBurner\uninstall.exe"
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth Plug-in-->MsiExec.exe /X{FE24D361-A3E8-11DE-88F3-005056806466}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDA_HSF\UIU32m.exe -U -IAcrZUn32z.INF
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 8.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B-->C:\Program Files\HP\Digital Imaging\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}\setup\hpzscr01.exe -datfile hposcr19.dat -onestop -showdisconnect -forcereboot
HP Photosmart.All-In-One Driver Software 8.0 .A-->C:\Program Files\HP\Digital Imaging\{282E5AB2-8E47-4571-B6FA-6B512555B557}\setup\hpzscr01.exe -datfile hposcr18.dat -onestop -showdisconnect -forcereboot
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{818ABC3C-635C-4651-8183-D0E9640B7DD1}
HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
ImgBurn 2.3.2.0 Fr-->"C:\Program Files\ImgBurn\unins000.exe"
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel PROSet Wireless-->Intel PROSet Wireless
Intel® Matrix Storage Manager-->C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\imsmudlg.exe -uninstall
Ipulp 1.1-->"C:\Program Files\Ipulp\unins000.exe"
iTunes-->MsiExec.exe /I{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
Launch Manager-->C:\Windows\UnInst32.exe QtZgAcer.UNI
Lecteur CANAL-->MsiExec.exe /X{04DA096D-6236-4A5D-8FB6-3081E67009BA}
Ma Videothèque  V1.5-->"C:\Program Files\MaVideotheque\unins000.exe"
McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe
Megavideo Video Downloader 3.14-->"C:\Program Files\DownloadToolz\Megavideo Video Downloader\unins000.exe"
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Office Word Viewer 2003-->MsiExec.exe /I{90850409-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero 9 Trial-->C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="8M01-20CX-4294-TL10-U4U0-UKE2-MMT7-AHWX"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Nikon Message Center-->MsiExec.exe /X{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}
Nikon Transfer-->MsiExec.exe /X{E9757890-7EC5-46C8-99AB-B00F07B6525C}
NTI Backup Now 5-->C:\Program Files\InstallShield Installation Information\{12EFA1A4-AC3B-443C-8143-237EDE760403}\setup.exe -runfromtemp -l0x040c
NTI Media Maker 8-->C:\Program Files\InstallShield Installation Information\{2413930C-8309-47A6-BC61-5EF27A4222BC}\setup.exe -runfromtemp -l0x040c
NVIDIA Drivers-->C:\Windows\system32
vuninst.exe UninstallGUI
Orion-->MsiExec.exe /X{5B63A470-9334-44D1-AF61-6CE2DB565AE9}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Package de pilotes Windows - MobileTop (sshpmdm) Modem  (01/26/2008 2.6.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\DPInst.exe /u C:\Windows\System32\DriverStore\FileRepository\mbtmdm.inf_afb0631d\mbtmdm.inf
PDF Settings CS4-->MsiExec.exe /I{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}
PhotoNow!-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe"  -uninstall
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
Picture Control Utility-->MsiExec.exe /X{87441A59-5E64-4096-A170-14EFE67200C3}
PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe" -l0x9  -removeonly
RocketDock 1.3.5-->"C:\Program Files\RocketDock\unins000.exe"
SAMSUNG Mobile Composite Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6_old\SSBCUninstall.exe
Samsung Mobile Modem Device Software-->C:\Windows\system32\Samsung_USB_Drivers\7\SSECUninstall.exe
SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung New PC Studio-->"C:\Program Files\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-509A1BDD240A}\setup.exe" -runfromtemp -l0x040c -removeonly
Samsung New PC Studio-->MsiExec.exe /X{F193FC0E-9E18-40FC-A974-509A1BDD240A}
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x040c -removeonly
SAMSUNG SYMBIAN USB Download Driver-->C:\Program Files\SAMSUNG\SYMBIAN USB Download Driver\Uninstall.exe
SAMSUNG USB Mobile Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6\SS_BUninstall.exe
SamsungConnectivityCableDriver-->MsiExec.exe /X{7E84FAC8-C518-40F9-9807-7455301D6D25}
Seagate Manager Installer-->"C:\Program Files\InstallShield Installation Information\{231A1A09-FDF2-45F2-B3D1-964CECE372BC}\setup.exe" -runfromtemp -l0x040c -removeonly
Seagate Manager Installer-->MsiExec.exe /X{231A1A09-FDF2-45F2-B3D1-964CECE372BC}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
SFR - Kit de connexion-->C:\Program Files\SFR\Kit\uninstall.exe
SFR - Media Center-->C:\Program Files\SFR\Media Center\uninstall.exe
SPBA 5.8-->MsiExec.exe /I{ECCD28B2-8798-4D16-8126-625D728294A1}
SpeedyFox-->"C:\Program Files\SpeedyFox\unins000.exe"
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Transcode 360 for Windows Vista-->"C:\Program Files\Transcode360\uninstall.exe"
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
ViewNX-->MsiExec.exe /X{F007CBCE-D714-4C0B-8CE9-9B0D78116468}
VLC media player 1.0.1-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vodafone Mobile Connect Lite-->MsiExec.exe /X{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}
WIDCOMM Bluetooth Software 6.0.1.6400-->MsiExec.exe /X{03D1988F-469F-4843-8E6E-E5FE9D17889D}
Winbond CIR Device Drivers-->MsiExec.exe /I{10F498FF-5392-4DF3-8F73-FE172A9F3800}
Windows 7 Upgrade Advisor Beta-->MsiExec.exe /I{4394DC3A-5DAC-4C80-A86E-FF462D0AD653}
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Zattoo 3.3.4 Beta-->C:\Program Files\Zattoo\uninst.exe

======Hosts File======

127.0.0.1 activate.adobe.com

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: PC-de-Sébastien
Event Code: 134
Message: NtpClient n'a pas pu définir d'homologue manuel à utiliser comme source de temps en raison d'une erreur de résolution DNS sur " time.windows.com,0x1 ". NtpClient réessaiera dans 15 minutes, et à nouveau une fois le double de l'intervalle de nouvelle tentative écoulé. L'erreur était : Hôte inconnu. (0x80072AF9)
Record Number: 65881
Source Name: Microsoft-Windows-Time-Service
Time Written: 20090608071021.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-Sébastien
Event Code: 4001
Message: Le Service d’autoconfiguration WLAN s’est arrêté correctement.

Record Number: 65866
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20090607215351.795836-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Sébastien
Event Code: 10002
Message: Le module d’extensibilité WLAN s’est arrêté.

Chemin d’accès du module : C:\Windows\System32\IWMSSvc.dll

Record Number: 65865
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20090607215351.125036-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Sébastien
Event Code: 7022
Message: Le service Service HP CUE DeviceDiscovery est en attente de démarrage.
Record Number: 65815
Source Name: Service Control Manager
Time Written: 20090607080653.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-Sébastien
Event Code: 7022
Message: Le service Service HP CUE DeviceDiscovery est en attente de démarrage.
Record Number: 65649
Source Name: Service Control Manager
Time Written: 20090606093601.000000-000
Event Type: Erreur
User: 

=====Application event log=====

Computer Name: PC-de-Sébastien
Event Code: 11500
Message: Produit : Java(TM) 6 Update 11 -- Erreur 1500. Une autre installation est en cours. Vous de

Seb1989 · Answer

Cerberus12

 Fichier server95.exe reçu le 2009.10.08 19:45:33 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 5/41 (12.2%)

	
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared	4.5.0.41	2009.10.08	Trojan.Win32.Buzus!IK
AhnLab-V3	5.0.0.2	2009.10.08	-
AntiVir	7.9.1.35	2009.10.08	TR/Dropper.Gen
Antiy-AVL	2.0.3.7	2009.10.05	-
Authentium	5.1.2.4	2009.10.08	-
Avast	4.8.1351.0	2009.10.08	-
AVG	8.5.0.420	2009.10.04	-
BitDefender	7.2	2009.10.08	-
CAT-QuickHeal	10.00	2009.10.08	-
ClamAV	0.94.1	2009.10.08	-
Comodo	2539	2009.10.08	-
DrWeb	5.0.0.12182	2009.10.08	-
eSafe	7.0.17.0	2009.10.08	-
eTrust-Vet	35.1.7057	2009.10.08	-
F-Prot	4.5.1.85	2009.10.08	-
F-Secure	8.0.14470.0	2009.10.08	-
Fortinet	3.120.0.0	2009.10.08	-
GData	19	2009.10.08	-
Ikarus	T3.1.1.72.0	2009.10.08	Trojan.Win32.Buzus
Jiangmin	11.0.800	2009.10.08	-
K7AntiVirus	7.10.865	2009.10.08	-
Kaspersky	7.0.0.125	2009.10.08	-
McAfee	5765	2009.10.08	-
McAfee+Artemis	5765	2009.10.08	-
McAfee-GW-Edition	6.8.5	2009.10.08	Trojan.Dropper.Gen
Microsoft	1.5101	2009.10.08	VirTool:Win32/VBInject.gen!CE
NOD32	4491	2009.10.08	-
Norman	6.01.09	2009.10.08	-
nProtect	2009.1.8.0	2009.10.08	-
Panda	10.0.2.2	2009.10.08	-
PCTools	4.4.2.0	2009.10.08	-
Prevx	3.0	2009.10.08	-
Rising	21.49.22.00	2009.09.30	-
Sophos	4.45.0	2009.10.08	-
Sunbelt	3.2.1858.2	2009.10.08	-
Symantec	1.4.4.12	2009.10.08	-
TheHacker	6.5.0.2.033	2009.10.07	-
TrendMicro	8.950.0.1094	2009.10.08	-
VBA32	3.12.10.11	2009.10.08	-
ViRobot	2009.10.8.1976	2009.10.08	-
VirusBuster	4.6.5.0	2009.10.08	-
Information additionnelle
File size: 167936 bytes
MD5...: 1b322f4558f95c690f42421f32a7e140
SHA1..: f6773f4ec170917673848307c3a8742f49b93ac3
SHA256: 7ee8e83d9d915d09d3b591dc4eb6d0cbd2b22bed8f752594b692201f26a344b1
ssdeep: 3072:3Te4EQ3hZBpTUndB3+AnD8fVIGN3y+c2+uBu4rE+VURbnbLt:3Te4EUBxUn
dBXuCGN35cYrExfLt
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x15b0
timedatestamp.....: 0x4abfbf5c (Sun Sep 27 19:39:08 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xd4c4 0xe000 5.29 4d710721154d5d46cd89820bb3a4a376
.data 0xf000 0x3ec 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x10000 0x1832d 0x19000 7.79 710323400a8b82269195e07408d77a32

( 1 imports )
> MSVBVM60.DLL: __vbaVarSub, _CIcos, _adj_fptan, __vbaVarMove, __vbaVarVargNofree, __vbaFreeVar, __vbaAryMove, __vbaLenBstr, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, -, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, __vbaSetSystemError, __vbaRecDestruct, _adj_fdiv_m32, __vbaAryDestruct, __vbaExitProc, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, -, _CIsin, -, __vbaErase, __vbaVarZero, __vbaChkstk, __vbaFileClose, __vbaStrCmp, __vbaPutOwner3, __vbaAryConstruct2, -, DllFunctionCall, _adj_fpatan, __vbaRedim, __vbaRecUniToAnsi, -, _CIsqrt, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, -, __vbaFPException, -, __vbaInStrVar, __vbaStrVarVal, __vbaUbound, __vbaGetOwner3, __vbaVarCat, -, _CIlog, __vbaFileOpen, -, -, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, -, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, -, __vbaVarTstNe, __vbaI4Var, __vbaVarCmpEq, __vbaAryLock, __vbaStrToAnsi, __vbaVarDup, -, _CIatan, __vbaStrMove, __vbaStrVarCopy, -, _allmul, _CItan, __vbaAryUnlock, _CIexp, __vbaFreeStr, __vbaI4ErrVar

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Microsoft Visual Basic 6 (90.9%)
Win32 Executable Generic (6.1%)
Generic Win/DOS Executable (1.4%)
DOS Executable Generic (1.4%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Realtek Semiconductor Corp.
copyright....: Copyright (c) 2004 Realtek Semiconductor Corp.
product......: Realtek AC97 Audio - Event Monitor
description..: Realtek Azalia Audio - Event Monitor
original name: Alcxmntr.exe
internal name: Alcxmntr
file version.: 1.6.0.2
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned

Seb1989 · Answer

Spy-net j'ai parfois un message au démarrage accompagnant la fenetre dont le post est question où spy-net est mise en cause. Fichier server.exe reçu le 2009.10.08 19:50:44 (UTC) Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE Résultat: 5/41 (12.2%) Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.41 2009.10.08 - AhnLab-V3 5.0.0.2 2009.10.08 - AntiVir 7.9.1.35 2009.10.08 - Antiy-AVL 2.0.3.7 2009.10.05 - Authentium 5.1.2.4 2009.10.08 - Avast 4.8.1351.0 2009.10.08 - AVG 8.5.0.420 2009.10.04 - BitDefender 7.2 2009.10.08 - CAT-QuickHeal 10.00 2009.10.08 Trojan.Buzus.cdnm ClamAV 0.94.1 2009.10.08 - Comodo 2539 2009.10.08 - DrWeb 5.0.0.12182 2009.10.08 - eSafe 7.0.17.0 2009.10.08 - eTrust-Vet 35.1.7057 2009.10.08 - F-Prot 4.5.1.85 2009.10.08 - F-Secure 8.0.14470.0 2009.10.08 Trojan.Win32.Buzus.cdnm Fortinet 3.120.0.0 2009.10.08 - GData 19 2009.10.08 - Ikarus T3.1.1.72.0 2009.10.08 - Jiangmin 11.0.800 2009.10.08 - K7AntiVirus 7.10.865 2009.10.08 - Kaspersky 7.0.0.125 2009.10.08 Trojan.Win32.Buzus.cdnm McAfee 5765 2009.10.08 - McAfee+Artemis 5765 2009.10.08 - McAfee-GW-Edition 6.8.5 2009.10.08 Heuristic.LooksLike.Win32.Suspicious.C Microsoft 1.5101 2009.10.08 - NOD32 4491 2009.10.08 - Norman 6.01.09 2009.10.08 - nProtect 2009.1.8.0 2009.10.08 - Panda 10.0.2.2 2009.10.08 - PCTools 4.4.2.0 2009.10.08 - Prevx 3.0 2009.10.08 High Risk Cloaked Malware Rising 21.49.22.00 2009.09.30 - Sophos 4.45.0 2009.10.08 - Sunbelt 3.2.1858.2 2009.10.08 - Symantec 1.4.4.12 2009.10.08 - TheHacker 6.5.0.2.033 2009.10.07 - TrendMicro 8.950.0.1094 2009.10.08 - VBA32 3.12.10.11 2009.10.08 - ViRobot 2009.10.8.1976 2009.10.08 - VirusBuster 4.6.5.0 2009.10.08 - Information additionnelle File size: 258560 bytes MD5...: b1786e3a0647d77eacc34685ff582baf SHA1..: 6c15483797390c7ee0e2641d70015bf3a0bd1a6d SHA256: 8d992077a878af9bda4bba3b2e1616b6bcd1a522cb7e78f08ba1fd5423eef6c4 ssdeep: 6144:PseZymvhuuC8JlLfaPxnNg65WyvnV+EVRLCcyq+jqGGFVIAVt:EenJuuCoL faXC0V3j/yq+jqGCIUt PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x4aa998db (Fri Sep 11 00:24:59 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 0x1000 0x6000 0x1c00 7.97 c1fb151271211cb7f01d084631c6b964 0x7000 0x1000 0x200 7.55 ffa7c3a2dd03a750db87a328a38fde83 .rsrc 0x8000 0x18000 0x18000 7.98 5f7330dc9b0bcea2605bd8b31bb3c137 .data 0x20000 0x5c000 0x24400 7.84 9581b29acd04a04db0c891f05bbd410a .adata 0x7c000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e ( 4 imports ) > kernel32.dll: GetProcAddress, GetModuleHandleA, LoadLibraryA > msvbvm60.dll: _CIcos > oleaut32.dll: VariantChangeTypeEx > kernel32.dll: RaiseException ( 0 exports ) RDS...: NSRL Reference Data Set - pdfid.: - trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) sigcheck: publisher....: cd copyright....: gh product......: kl description..: ef original name: bong.exe internal name: bong file version.: 1.00 comments.....: ab signers......: - signing date.: - verified.....: Unsigned packers (F-Prot): Aspack http://info.prevx.com/aboutprogramtext.asp?PX5=B6436CD00014EF1FF28603A1F6EA0500929C7ABC

Seb1989 · Answer

complément d'information en image :

http://img198.imageshack.us/img198/1399/bug2xb.jpg

maintenant je fait quoi ?

Seb1989 · Answer

All processes killed
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Spy-Net deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Cerberus45 deleted successfully.
========== FILES ==========
C:\Windows\System32\Cerberus12\server95.exe moved successfully.
C:\Windows\System32\Spy-Net\server.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
 
User: Mcx1
 
User: Mcx1.PC-de-Sébastien
->Temp folder emptied: 0 bytes
 
User: Public
 
User: SÃ©bastien
 
User: Sébastien
->Temp folder emptied: 735680 bytes
->Java cache emptied: 26470782 bytes
->FireFox cache emptied: 78554165 bytes
 
User: SÚbastien
 
%systemdrive% .tmp files removed: 0 bytes
C:\Windows\msdownld.tmp folder deleted successfully.
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 47717 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 100,91 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 10092009_141447

Files moved on Reboot...

Registry entries deleted on Reboot...

Seb1989 · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2928
Windows 6.0.6002 Service Pack 2

09/10/2009 16:40:35
mbam-log-2009-10-09 (16-40-35).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 293956
Temps écoulé: 2 hour(s), 1 minute(s), 27 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{ibg8e86j-se86-n3oi-aeeb-bc6727m553r1} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{q24dw6q2-06i4-ij3c-0xc1-f3kcx17100mj} (Generic.Bot.H) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spy-Net (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spy-Net (Backdoor.Bot) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\System32\Cerberus12\server95.exe (Generic.Bot.H) -> Delete on reboot.
C:\Windows\System32\Spy-Net\server.exe (Generic.Bot.H) -> Delete on reboot.

Seb1989 · Answer

re, comme demandé le RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sébastien at 2009-10-09 21:27:39
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 42 GB (28%) free of 148 GB
Total RAM: 3066 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:28:22, on 09/10/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32undll32.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Users\SBASTI~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\Sébastien\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Sébastien.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [Cerberus45] C:\Windows\System32\Cerberus12\server95.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Cerberus45] C:\Windows\System32\Cerberus12\server95.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix: 
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9d4ccfe26ad22) (gupdate1c9d4ccfe26ad22) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Seb1989 · Answer

Bonjour,

le rapport demandé :

ComboFix 09-10-10.02 - Sébastien 11/10/2009 11:15.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3066.1835 [GMT 2:00]
Lancé depuis: c:\users\Sébastien\Desktop\asdehi.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-811835293-1638113248-1029637537-1001
c:\$recycle.bin\S-1-5-21-811835293-1638113248-1029637537-500
c:\windows\Installer\13da50.msi
c:\windows\Installer\34e063.msi
c:\windows\Installer\34e067.msi
c:\windows\Installer\5e6444.msi
c:\windows\Installer\5e71db.msi
c:\windows\Installer\6a77b3.msi
c:\windows\Installer\6a77b7.msi
c:\windows\Suyin.reg

Une copie infectée de c:\windows\System32\calc.exe a été trouvée et désinfectée 
Copie restaurée à partir de - c:\windows\winsxs\x86_microsoft-windows-calc_31bf3856ad364e35_6.0.6000.16386_none_a7873f3f1dd0e729\calc.exe 

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-11 au 2009-10-11  ))))))))))))))))))))))))))))))))))))
.

2009-10-11 09:35 . 2009-10-11 09:35	--------	d-----w-	c:\users\Default\AppData\Local	emp
2009-10-09 12:29 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 12:29 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-09 12:29 . 2009-10-09 12:29	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-10-09 12:14 . 2009-10-09 12:14	--------	d-----w-	C:\_OTM
2009-10-08 19:07 . 2009-10-08 19:07	--------	d-----w-	C:sit
2009-10-08 19:01 . 2009-10-08 19:01	--------	d-----w-	c:\program files\Trend Micro
2009-10-08 18:07 . 2009-10-08 18:07	--------	d-sh--w-	c:\users\SÚbastien
2009-10-08 18:05 . 2009-10-08 18:08	--------	d-----w-	C:\GenProc
2009-10-07 12:15 . 2009-10-08 06:44	146314	----a-w-	c:\windows\hpoins18.dat
2009-10-07 12:14 . 2007-03-01 00:35	6600	----a-w-	c:\windows\hpomdl18.dat
2009-10-06 09:20 . 2009-10-08 17:35	--------	d-----w-	c:\program files\Ad-Remover
2009-10-04 10:31 . 2009-10-04 10:31	--------	d-----w-	c:\program files\Microsoft
2009-10-04 10:30 . 2009-10-04 10:30	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-10-02 10:39 . 2009-10-02 10:39	--------	d-----w-	c:\windows\system32\URTTEMP
2009-09-28 11:10 . 2009-10-09 14:42	--------	d-----w-	c:\windows\system32\Cerberus12
2009-09-25 15:27 . 2009-09-25 15:27	--------	d-----w-	c:\program files\Druide
2009-09-25 15:21 . 2009-09-25 15:21	--------	d-----w-	c:\program files\7-Zip
2009-09-25 14:08 . 2009-10-09 14:42	--------	d-----w-	c:\windows\system32\Spy-Net
2009-09-24 09:08 . 2009-09-24 09:08	--------	d-----w-	c:\program files\iPod
2009-09-24 09:08 . 2009-09-24 09:10	--------	d-----w-	c:\program files\iTunes
2009-09-23 22:07 . 2009-10-04 18:58	--------	d-----w-	C:\Mes Sites Web
2009-09-17 09:38 . 2009-09-17 09:38	--------	d-----w-	c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-09-14 09:45 . 2009-09-14 10:01	--------	d-----w-	c:\program files\abgx360
2009-09-12 08:48 . 2009-09-12 08:48	--------	d-----w-	c:\programdata\Malwarebytes

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-11 09:38 . 2009-03-13 13:35	28219	----a-w-	c:\programdata
vModes.dat
2009-10-11 09:36 . 2008-09-30 01:30	12	----a-w-	c:\windows\bthservsdp.dat
2009-10-11 08:54 . 2009-05-14 20:00	--------	d-----w-	c:\programdata\Google Updater
2009-10-09 20:00 . 2008-01-21 08:40	679418	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-09 20:00 . 2008-01-21 08:40	128418	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-09 07:24 . 2009-03-13 19:20	--------	d-----w-	c:\program files\MSECache
2009-10-06 12:44 . 2008-09-30 01:43	--------	d-----w-	c:\program files\Launch Manager
2009-10-06 12:19 . 2008-09-30 01:57	--------	d-----w-	c:\programdata\CyberLink
2009-10-06 09:40 . 2009-08-17 20:33	--------	d-----w-	c:\program files\JDownloader 0.6.193
2009-10-04 10:54 . 2009-03-13 12:45	--------	d-----w-	c:\program files\Patch MsnCreative
2009-09-29 15:58 . 2009-03-13 13:14	--------	d-----w-	c:\program files\OpenOffice.org 3
2009-09-29 15:46 . 2009-07-09 16:37	--------	d-----w-	c:\program files\PC Connectivity Solution
2009-09-29 15:44 . 2009-03-13 14:51	--------	d-----w-	c:\program files\Google
2009-09-29 15:44 . 2008-07-25 13:04	--------	d-----w-	c:\program files\Acer GameZone
2009-09-29 15:43 . 2008-07-25 12:37	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-24 09:08 . 2009-06-13 12:35	--------	d-----w-	c:\program files\Common Files\Apple
2009-09-10 08:58 . 2009-03-13 12:42	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-09-10 08:51 . 2009-09-10 08:49	--------	d-----w-	c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-10 08:46 . 2009-09-10 08:45	--------	d-----w-	c:\program files\QuickTime
2009-09-10 08:23 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-09-07 17:50 . 2009-09-07 17:50	89088	----a-w-	c:\windows\system32\atl71.dll
2009-09-07 17:50 . 2009-09-07 17:50	499712	----a-w-	c:\windows\system32\msvcp71.dll
2009-09-07 17:50 . 2009-09-07 17:50	348160	----a-w-	c:\windows\system32\msvcr71.dll
2009-09-07 17:50 . 2009-09-07 17:50	1060864	----a-w-	c:\windows\system32\MFC71.dll
2009-09-07 17:50 . 2009-09-07 17:50	1047552	----a-w-	c:\windows\system32\MFC71u.dll
2009-09-06 20:16 . 2009-09-06 20:16	--------	d-----w-	c:\program files\Ipulp
2009-09-04 11:09 . 2009-09-04 11:09	--------	d-----w-	c:\program files\SpeedyFox
2009-08-29 00:27 . 2009-09-02 20:23	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-02 20:23	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2009-08-28 15:02 . 2009-08-27 12:39	--------	d-----w-	c:\program files\ImgBurn
2009-08-27 12:42 . 2009-08-27 12:42	--------	d-----w-	c:\programdata\WindowsSearch
2009-08-26 11:11 . 2009-08-26 11:11	--------	d-----w-	c:\programdata\Seagate
2009-08-26 11:11 . 2009-08-26 11:11	--------	d-----w-	c:\program files\Seagate
2009-08-25 22:09 . 2009-05-02 10:02	--------	d-----w-	c:\program files\McAfee
2009-08-24 09:11 . 2009-03-18 14:50	164389	----a-w-	c:\windows\hpoins19.dat
2009-08-14 16:27 . 2009-09-09 08:39	904776	----a-w-	c:\windows\system32\drivers	cpip.sys
2009-08-14 15:53 . 2009-09-09 08:39	17920	----a-w-	c:\windows\system32
etevent.dll
2009-08-14 13:49 . 2009-09-09 08:39	9728	----a-w-	c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-09 08:39	17920	----a-w-	c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-09 08:39	11264	----a-w-	c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-09 08:39	27136	----a-w-	c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-09 08:39	19968	----a-w-	c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-09 08:39	8704	----a-w-	c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-09 08:39	10240	----a-w-	c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-09 08:39	30720	----a-w-	c:\windows\system32\drivers	cpipreg.sys
2009-08-14 13:48 . 2009-09-09 08:39	105984	----a-w-	c:\windows\system32
etiohlp.dll
2009-07-26 14:44 . 2009-07-26 14:44	48448	----a-w-	c:\windows\system32\sirenacm.dll
2009-07-25 03:23 . 2009-03-14 12:22	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-21 21:52 . 2009-07-30 08:16	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-30 08:16	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-30 08:16	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-30 08:16	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-17 13:54 . 2009-08-13 07:03	71680	----a-w-	c:\windows\system32\atl.dll
2009-07-16 10:32 . 2009-05-02 10:04	130424	----a-w-	c:\windows\system32\drivers\Mpfp.sys
2009-07-15 12:40 . 2009-08-13 07:03	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-13 07:03	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-13 07:03	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-13 07:03	7680	----a-w-	c:\windows\system32\spwmp.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05	121392	----a-w-	c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-13 68856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-10-04 3883856]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-18 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-18 92704]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-09-30 3676160]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-09-07 152872]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-07 1176808]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-09-07 206120]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-05-21 173288]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-05-07 6139904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\AWinNotifyVitaKey MC3000]
2008-09-30 01:56	3197952	----a-w-	c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\spba]
2008-03-25 13:24	567560	----a-w-	c:\program files\Common Files\SPBA\homefus2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Nikon Monitor.lnk
backup=c:\windows\pss\Nikon Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):28,24,1c,96,ee,e5,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{89799D38-6725-4CE5-9D1E-6E30415FE623}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{D44F326E-3D01-4696-9E32-3ED5D49B0E4B}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{71E00646-63EC-47AC-B284-2EA545130FD0}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{57BDCF60-2235-4679-8101-B9BD26C60ED2}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{A5463B11-BEAF-45EA-83BA-4DF7CBA988E9}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{44132C7C-6906-4ED8-ABA6-2596681E8633}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{30A1F990-1B0B-408D-9385-E83FF29BE07F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2FCDE318-182E-4D8F-9169-FE74FBB301CE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F9B95664-C1B4-4028-9CDC-757525CFF306}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{8BC06121-A75B-42B8-BB02-516D92ECA5ED}"= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM
"{D5FD47F0-B674-4133-AFE0-AEBE4F1F3542}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{21E6A589-2D86-4D77-8514-414F27E90DE2}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{E85E5F47-1A4C-4281-A1F4-F5FFDE3813EA}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{747104A9-A58C-4264-BDB2-3D9DEF32DF3E}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{A574124D-8C8B-4071-9666-3EA3F48E0543}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{F1102A3F-E8B1-440A-8F5F-E996241ADF80}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{58081E78-6D67-44E4-9B37-B2755DDFD2D6}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{B70E3C13-0BF9-4B46-A35B-6671090439B9}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{B6C0D282-FB43-4016-88B2-D983ADB3EE7D}"= UDP:5353:Adobe CSI CS4
"{2232CA97-E53E-4A7C-BE73-30794DA992FF}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{D729BA9F-3C21-4A7A-8A4C-8C2682F2B189}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{3DFC2EBE-4A49-4D48-A095-81800DEB312F}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{3D6B6C19-90E2-4BA1-AFEF-A25B30E3A5DB}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{595BD36C-87B8-4223-AFD9-B74F84C0949F}"= UDP:c:\users\Sébastien\Downloads\utorrent.exe:µTorrent (TCP-In)
"{70EA60D2-47F6-4694-903A-76FDD2D6BBF4}"= TCP:c:\users\Sébastien\Downloads\utorrent.exe:µTorrent (UDP-In)
"{FE9BE8E1-FDFD-4563-A418-BA9D035BBD71}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{FC281911-2EB7-4DA5-A900-19C8F6C61DF5}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{07F3E981-3AC2-48DC-B90B-877B71004FD1}"= UDP:35430:µT 35430
"{7C0375C3-48DB-43EE-A04C-A6A47F1F15F2}"= TCP:35430:35430
"{E8A5C04B-35E7-4740-A36B-BD1D047BFBA0}"= UDP:c:\program files\uTorrent\uTorrent.exe:uTorrent
"{DAB81D34-E5A1-497D-AA8B-367DDB237AA0}"= TCP:c:\program files\uTorrent\uTorrent.exe:uTorrent
"TCP Query User{7A88F352-BFF7-4C4F-A384-0AE9326A4EC4}c:\program files\transcode360\transcode360tray.exe"= UDP:c:\program files	ranscode360	ranscode360tray.exe: 
"UDP Query User{AFA8DCDB-9B95-42DD-998B-8E76CDB0E699}c:\program files\transcode360\transcode360tray.exe"= TCP:c:\program files	ranscode360	ranscode360tray.exe: 
"{7D7E9280-BEF5-48EB-8BA3-59527C87798A}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{025B3AD4-AB85-4D2F-BB15-F7F5F38BB959}"= UDP:c:\program files\Transcode360\Transcode360.exe:Transcode 360
"{0D7D3184-0965-4C4C-BB4C-6CDC77404C33}"= TCP:c:\program files\Transcode360\Transcode360.exe:Transcode 360
"{D677B84E-08CC-4F75-A302-952B91B961C8}"= TCP:1041:Transcode 360
"{3C04E86C-E85C-40E6-8165-F441F57452B7}"= TCP:10244:Transcode 360
"{05D59994-4E96-4224-BC26-35A8CEDEEF22}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B20D2C1D-5181-4B47-B2F5-CCD6250F545D}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{A2118446-3593-4E56-B577-E2A7926590DD}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{1B6C5B99-6E1D-4457-B589-82992710C55D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{093296A4-9BEE-40F8-970F-26D698A052E9}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{11419E0C-FF18-415D-9273-0F1C6C86207A}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{FF58D495-9620-4AC7-8021-F219B82E2107}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{14AED605-58A9-495F-8CEE-7653A19E3E9C}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{9A55B352-63C2-467B-AE22-B5872CD8FC12}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{604050F3-FB6E-4A41-9E6B-CDFB32E8FBCA}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{D8127E1B-7717-4838-80F0-B7995264CCB7}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{9147E7F4-5707-4575-9B5E-AFA877D24744}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{7F18A312-B532-4A06-8F73-09C228508C27}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{60714ECD-E57A-4C0C-BCC3-874C27DA7132}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{8905B12F-D465-47B3-B380-E5954A39BF98}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{92CEF1AC-3F53-4967-9D3B-1414DC6F1361}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
"{4DDD3242-6133-41FB-86DD-1ED97337BF67}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
"{3AD12867-F1B6-4C88-98A7-DFA95368E90A}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
"{E8A0E8C7-1B2E-43F9-A85F-A8B3EFE012EF}"= UDP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{83A08EF7-F3FB-46B4-A738-247104885DB7}"= TCP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\System32\drivers\AlfaFF.sys [30/09/2008 03:56 42608]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/10/06 14:21];c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [06/10/2009 14:20 87536]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 13:11 16384]
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [05/02/2009 15:38 188416]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [30/09/2008 04:04 75048]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [25/07/2008 14:51 24576]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 14:35 181544]
R2 FsUsbExService;FsUsbExService;c:\windows\System32\FsUsbExService.Exe [09/07/2009 18:39 233472]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [09/10/2009 14:29 269648]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [02/05/2009 12:08 206112]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [25/04/2008 21:36 45056]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [30/09/2008 04:04 122368]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [30/09/2008 04:19 233472]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [22/09/2008 13:40 14336]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\System32\FsUsbExDisk.Sys [09/07/2009 18:39 36608]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\System32\drivers\L1E60x86.sys [20/05/2009 06:02 48640]
R3 MBAMProtector;MBAMProtector;c:\windows\System32\drivers\mbam.sys [09/10/2009 14:29 19160]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 08:40 3668480]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers
vhda32v.sys [25/06/2008 07:05 44064]
R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28/03/2007 07:51 43008]
S2 gupdate1c9d4ccfe26ad22;Google Update Service (gupdate1c9d4ccfe26ad22);c:\program files\Google\Update\GoogleUpdate.exe [14/05/2009 21:48 133104]
S2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [30/09/2008 03:56 3602432]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [25/04/2008 21:36 131072]
S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [13/03/2009 16:51 24064]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\System32\drivers\massfilter.sys [15/09/2008 14:26 7168]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [09/10/2009 14:29 38224]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\System32\drivers\ss_bbus.sys [30/07/2009 16:01 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\System32\drivers\ss_bmdfl.sys [30/07/2009 16:01 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\System32\drivers\ss_bmdm.sys [30/07/2009 16:01 121856]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\System32\drivers\ZTEusbnet.sys [06/07/2009 22:26 110080]
S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\System32\drivers\zteusbvoice.sys [06/07/2009 22:26 104960]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - FSUSBEXDISK

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2009-10-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-13 20:00]

2009-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-14 19:48]

2009-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-14 19:48]

2009-05-02 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 19:26]

2009-05-02 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 19:26]

2009-10-03 c:\windows\Tasks\NeroLiveEpgUpdate-PC-de-Sébastien_Sébastien.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-10-27 07:59]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\Sébastien\AppData\Roaming\Mozilla\Firefox\Profiles\wfb5fe5d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Canal\Canal Widget\VOD
pCpVod.dll
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-Cerberus45 - c:\windows\System32\Cerberus12\server95.exe
HKCU-Run-AdobeBridge - (no file)
HKLM-Run-Cerberus45 - c:\windows\System32\Cerberus12\server95.exe
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-NPSStartup - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-11 11:38
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3024)
c:\program files\RocketDock\RocketDock.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
c:\windows\system32\btncopy.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
c:\progra~1\mcafee\VIRUSS~1\scriptsn.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
c:\windows\system32\BtwNamespaceExt.dll
c:\windows\system32\BtwNeLib.dll
c:\windows\system32\btwapi.dll
c:\windows\system32\btosif.dll
c:\windows\system32\btwpimif.dll
.
------------------------ Autres processus actifs ------------------------
.
SystemRoot\System32\smss.exe [544]
c:\windows\system32\csrss.exe [612]
c:\windows\system32\wininit.exe [664]
c:\windows\system32\csrss.exe [672]
c:\windows\system32\services.exe [712]
c:\windows\system32\lsass.exe [724]
c:\windows\system32\lsm.exe [732]
c:\windows\system32\svchost.exe [892]
c:\windows\system32
vvsvc.exe [936]
c:\windows\system32\svchost.exe [964]
c:\windows\System32\svchost.exe [1060]
c:\windows\System32\svchost.exe [1092]
c:\windows\system32\svchost.exe [1104]
c:\windows\system32\svchost.exe [1200]
c:\windows\system32\SLsvc.exe [1216]
c:\windows\system32\winlogon.exe [1252]
c:\windows\system32\svchost.exe [1300]
c:\windows\system32\svchost.exe [1420]
c:\windows\system32\WLANExt.exe [1556]
c:\windows\System32\spoolsv.exe [1616]
c:\windows\system32\svchost.exe [1660]
c:\windows\system32undll32.exe [1832]
c:\program files\Common Files\SPBA\upeksvr.exe [1896]
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe [572]
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [364]
c:\program files\Bonjour\mDNSResponder.exe [532]
c:\windows\system32\svchost.exe [616]
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [960]
c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [1856]
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2064]
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2116]
c:\program files\Acer\Empowering Technology\Service\ETService.exe [2140]
c:\program files\Intel\WiFi\bin\EvtEng.exe [2232]
c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2276]
c:\windows\system32\FsUsbExService.Exe [2340]
c:\windows\system32\svchost.exe [2520]
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2560]
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe [2620]
c:\program files\Common Files\LightScribe\LSSrvc.exe [2684]
c:\program files\McAfee\SiteAdvisor\McSACore.exe [2696]
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2748]
c:\windows\system32undll32.exe [2792]
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe [2816]
c:\acer\Mobility Center\MobilityService.exe [2924]
c:\program files\McAfee\MPF\MPFSrv.exe [3160]
c:\program files\McAfee\MSK\MskSrver.exe [3180]
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [3220]
c:\windows\System32\svchost.exe [3364]
c:\program files\CDBurnerXP\NMSAccessU.exe [3412]
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [3428]
c:\windows\system32\Dwm.exe [3660]
c:\windows\System32\svchost.exe [3692]
c:\windows\system32\PnkBstrA.exe [3720]
c:\windows\system32\svchost.exe [3760]
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe [3812]
c:\program files\Cyberlink\Shared files\RichVideo.exe [3864]
c:\program files\Acer\Acer VCM\RS_Service.exe [3888]
c:\windows\system32\svchost.exe [3944]
c:\windows\System32\svchost.exe [4016]
c:\windows\system32\SearchIndexer.exe [4056]
c:\windows\system32\DRIVERS\xaudio.exe [1944]
c:\windows\system32	askeng.exe [2476]
c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2452]
c:\windows\system32\wbem\wmiprvse.exe [2596]
c:\windows\system32\CF6725.exe [4328]
c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [4456]
c:\windows\RtHDVCpl.exe [4464]
c:\program files\Synaptics\SynTP\SynTPEnh.exe [4472]
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe [4480]
c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe [4520]
c:\windows\System32undll32.exe [4628]
c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe [4648]
c:\program files\Acer\Acer Bio Protection\PdtWzd.exe [4656]
c:\program files\HP\HP Software Update\hpwuSchd2.exe [4708]
c:\program files\Launch Manager\QtZgAcer.EXE [4724]
c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [4768]
c:\program files\Java\jre6\bin\jusched.exe [4832]
c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [4856]
c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [4864]
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [4872]
c:\windows\ehome\ehtray.exe [4884]
c:\program files\RocketDock\RocketDock.exe [4928]
c:\program files\Windows Sidebar\sidebar.exe [4984]
c:\windows\ehome\ehmsas.exe [5192]
c:\users\SBASTI~1\AppData\Local\Temp\RtkBtMnt.exe [5380]
c:\windows\system32\wbem\unsecapp.exe [6128]
c:\windows\system32\wbem\wmiprvse.exe [4092]
c:\progra~1\McAfee\MSC\mcmscsvc.exe [5988]
c:\progra~1\mcafee.com\agent\mcagent.exe [1280]
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe [5228]
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe [1088]
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2368]
c:\program files\Windows Media Player\wmpnetwk.exe [2740]
c:\progra~1\mcafee\msc\mcupdmgr.exe [2772]
c:\windows\Explorer.exe [3024]
c:\windows\system32\DllHost.exe [5156]
c:\windows\system32\NOTEPAD.EXE [3124]
c:\asdehi\catchme.cfxxe [3684]
.
**************************************************************************
.
Heure de fin: 2009-10-11 11:47 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-10-11 09:47

Avant-CF: 43 326 074 880 octets libres
Après-CF: 43 140 534 272 octets libres

516	--- E O F ---	2009-10-04 10:30

Seb1989 · Answer

re,

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2928
Windows 6.0.6002 Service Pack 2

11/10/2009 15:59:27
mbam-log-2009-10-11 (15-59-27).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 299877
Temps écoulé: 2 hour(s), 11 minute(s), 20 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

Re

1)Reposte un RSIT stp

2)Lance une analyse complète avec ton antivirus;et poste moi le rapport

Merci et @+

Seb1989 · Answer

1)

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sébastien at 2009-10-11 16:18:02
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 41 GB (28%) free of 148 GB
Total RAM: 3066 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:18:42, on 11/10/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32undll32.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\SBASTI~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\wbem\unsecapp.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\Explorer.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\mobsync.exe
C:\Windows\System32
otepad.exe
C:\Users\Sébastien\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Sébastien.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O20 - Winlogon Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c9d4ccfe26ad22) (gupdate1c9d4ccfe26ad22) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Seb1989 · Answer

Je fait la manipe dès que McAfee aura finit son analyse complète.

Merci pour cette aide précieuse.

Seb1989 · Answer

c'est tout ce dont je dispose comme rapport McAfee :

Analyse terminée.

Date de début : 11/10/2009 16:22:23
Date de fin : 11/10/2009 20:23:20

nbr total de fichier analysés : 172058
nbr total de fichier détectés : 0
nbr total des fichiers mis en quarantaine : 0

Cookies analysés : 1
Cookie de suivi détectés : 0
Entrées de base de registre analysées : 142410
Entrées de base de registre détectées : 0
Processus analysés : 102
Processus détectés : 0

Version du moteur : 5301.4018
DAT version : 5767.0000

Seb1989 · Answer

ComboFix 09-10-10.02 - Sébastien 11/10/2009 20:40.2.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3066.1511 [GMT 2:00]
Lancé depuis: c:\users\Sébastien\Desktop\asdehi.exe
Commutateurs utilisés :: c:\users\Sébastien\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\system32\Cerberus12\server95.exe"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\bdcore.dll
c:\windows\Downloaded Program Files\libfn.dll
E:\Autorun.inf

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-11 au 2009-10-11  ))))))))))))))))))))))))))))))))))))
.

2009-10-11 18:53 . 2009-10-11 18:53	--------	d-----w-	c:\users\Public\AppData\Local	emp
2009-10-11 18:53 . 2009-10-11 18:53	--------	d-----w-	c:\users\Mcx1\AppData\Local	emp
2009-10-11 18:53 . 2009-10-11 18:53	--------	d-----w-	c:\users\Default\AppData\Local	emp
2009-10-11 16:42 . 2009-10-11 16:42	--------	d-----w-	c:\windows\BDOSCAN8
2009-10-09 12:29 . 2009-09-10 12:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 12:29 . 2009-09-10 12:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-09 12:29 . 2009-10-09 12:29	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-10-09 12:14 . 2009-10-09 12:14	--------	d-----w-	C:\_OTM
2009-10-08 19:07 . 2009-10-08 19:07	--------	d-----w-	C:sit
2009-10-08 19:01 . 2009-10-08 19:01	--------	d-----w-	c:\program files\Trend Micro
2009-10-08 18:07 . 2009-10-08 18:07	--------	d-sh--w-	c:\users\SÚbastien
2009-10-08 18:05 . 2009-10-08 18:08	--------	d-----w-	C:\GenProc
2009-10-07 12:15 . 2009-10-08 06:44	146314	----a-w-	c:\windows\hpoins18.dat
2009-10-07 12:14 . 2007-03-01 00:35	6600	----a-w-	c:\windows\hpomdl18.dat
2009-10-06 09:20 . 2009-10-08 17:35	--------	d-----w-	c:\program files\Ad-Remover
2009-10-04 10:31 . 2009-10-04 10:31	--------	d-----w-	c:\program files\Microsoft
2009-10-04 10:30 . 2009-10-04 10:30	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-10-02 10:39 . 2009-10-02 10:39	--------	d-----w-	c:\windows\system32\URTTEMP
2009-09-28 11:10 . 2009-10-09 14:42	--------	d-----w-	c:\windows\system32\Cerberus12
2009-09-25 15:27 . 2009-09-25 15:27	--------	d-----w-	c:\program files\Druide
2009-09-25 15:21 . 2009-09-25 15:21	--------	d-----w-	c:\program files\7-Zip
2009-09-25 14:08 . 2009-10-09 14:42	--------	d-----w-	c:\windows\system32\Spy-Net
2009-09-24 09:08 . 2009-09-24 09:08	--------	d-----w-	c:\program files\iPod
2009-09-24 09:08 . 2009-09-24 09:10	--------	d-----w-	c:\program files\iTunes
2009-09-23 22:07 . 2009-10-04 18:58	--------	d-----w-	C:\Mes Sites Web
2009-09-17 09:38 . 2009-09-17 09:38	--------	d-----w-	c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-09-14 09:45 . 2009-09-14 10:01	--------	d-----w-	c:\program files\abgx360
2009-09-12 08:48 . 2009-09-12 08:48	--------	d-----w-	c:\programdata\Malwarebytes

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-11 18:56 . 2009-03-13 13:35	28219	----a-w-	c:\programdata
vModes.dat
2009-10-11 18:53 . 2008-09-30 01:30	12	----a-w-	c:\windows\bthservsdp.dat
2009-10-11 18:12 . 2008-01-21 08:40	679418	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-11 18:12 . 2008-01-21 08:40	128418	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-11 08:54 . 2009-05-14 20:00	--------	d-----w-	c:\programdata\Google Updater
2009-10-09 07:24 . 2009-03-13 19:20	--------	d-----w-	c:\program files\MSECache
2009-10-06 12:44 . 2008-09-30 01:43	--------	d-----w-	c:\program files\Launch Manager
2009-10-06 12:19 . 2008-09-30 01:57	--------	d-----w-	c:\programdata\CyberLink
2009-10-06 09:40 . 2009-08-17 20:33	--------	d-----w-	c:\program files\JDownloader 0.6.193
2009-10-04 10:54 . 2009-03-13 12:45	--------	d-----w-	c:\program files\Patch MsnCreative
2009-09-29 15:58 . 2009-03-13 13:14	--------	d-----w-	c:\program files\OpenOffice.org 3
2009-09-29 15:46 . 2009-07-09 16:37	--------	d-----w-	c:\program files\PC Connectivity Solution
2009-09-29 15:44 . 2009-03-13 14:51	--------	d-----w-	c:\program files\Google
2009-09-29 15:44 . 2008-07-25 13:04	--------	d-----w-	c:\program files\Acer GameZone
2009-09-29 15:43 . 2008-07-25 12:37	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-24 09:08 . 2009-06-13 12:35	--------	d-----w-	c:\program files\Common Files\Apple
2009-09-10 08:58 . 2009-03-13 12:42	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-09-10 08:51 . 2009-09-10 08:49	--------	d-----w-	c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-10 08:46 . 2009-09-10 08:45	--------	d-----w-	c:\program files\QuickTime
2009-09-10 08:23 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-09-07 17:50 . 2009-09-07 17:50	89088	----a-w-	c:\windows\system32\atl71.dll
2009-09-07 17:50 . 2009-09-07 17:50	499712	----a-w-	c:\windows\system32\msvcp71.dll
2009-09-07 17:50 . 2009-09-07 17:50	348160	----a-w-	c:\windows\system32\msvcr71.dll
2009-09-07 17:50 . 2009-09-07 17:50	1060864	----a-w-	c:\windows\system32\MFC71.dll
2009-09-07 17:50 . 2009-09-07 17:50	1047552	----a-w-	c:\windows\system32\MFC71u.dll
2009-09-06 20:16 . 2009-09-06 20:16	--------	d-----w-	c:\program files\Ipulp
2009-09-04 11:09 . 2009-09-04 11:09	--------	d-----w-	c:\program files\SpeedyFox
2009-08-29 00:27 . 2009-09-02 20:23	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-02 20:23	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2009-08-28 15:02 . 2009-08-27 12:39	--------	d-----w-	c:\program files\ImgBurn
2009-08-27 12:42 . 2009-08-27 12:42	--------	d-----w-	c:\programdata\WindowsSearch
2009-08-26 11:11 . 2009-08-26 11:11	--------	d-----w-	c:\programdata\Seagate
2009-08-26 11:11 . 2009-08-26 11:11	--------	d-----w-	c:\program files\Seagate
2009-08-25 22:09 . 2009-05-02 10:02	--------	d-----w-	c:\program files\McAfee
2009-08-24 09:11 . 2009-03-18 14:50	164389	----a-w-	c:\windows\hpoins19.dat
2009-08-14 16:27 . 2009-09-09 08:39	904776	----a-w-	c:\windows\system32\drivers	cpip.sys
2009-08-14 15:53 . 2009-09-09 08:39	17920	----a-w-	c:\windows\system32
etevent.dll
2009-08-14 13:49 . 2009-09-09 08:39	9728	----a-w-	c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-09 08:39	17920	----a-w-	c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-09 08:39	11264	----a-w-	c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-09 08:39	27136	----a-w-	c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-09 08:39	19968	----a-w-	c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-09 08:39	8704	----a-w-	c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-09 08:39	10240	----a-w-	c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-09 08:39	30720	----a-w-	c:\windows\system32\drivers	cpipreg.sys
2009-08-14 13:48 . 2009-09-09 08:39	105984	----a-w-	c:\windows\system32
etiohlp.dll
2009-07-26 14:44 . 2009-07-26 14:44	48448	----a-w-	c:\windows\system32\sirenacm.dll
2009-07-25 03:23 . 2009-03-14 12:22	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-07-21 21:52 . 2009-07-30 08:16	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-30 08:16	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-30 08:16	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-30 08:16	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-17 13:54 . 2009-08-13 07:03	71680	----a-w-	c:\windows\system32\atl.dll
2009-07-16 10:32 . 2009-05-02 10:04	130424	----a-w-	c:\windows\system32\drivers\Mpfp.sys
2009-07-15 12:40 . 2009-08-13 07:03	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2009-07-15 12:39 . 2009-08-13 07:03	313344	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-15 12:39 . 2009-08-13 07:03	4096	----a-w-	c:\windows\system32\dxmasf.dll
2009-07-15 12:39 . 2009-08-13 07:03	7680	----a-w-	c:\windows\system32\spwmp.dll
.

(((((((((((((((((((((((((((((   SnapShot@2009-10-11_09.39.23   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-10-11 18:58	84394              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-11 18:58	98838              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-03-13 14:52 . 2009-10-11 18:58	13676              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-811835293-1638113248-1029637537-1000_UserData.bin
+ 2009-03-13 14:46 . 2009-10-11 14:32	32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-03-13 14:46 . 2009-10-11 09:08	32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-03-13 14:46 . 2009-10-11 14:32	65536              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-03-13 14:46 . 2009-10-11 09:08	65536              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-03-13 14:46 . 2009-10-11 09:08	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-03-13 14:46 . 2009-10-11 14:32	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2006-05-24 23:21 . 2006-05-24 23:21	53248              c:\windows\Downloaded Program Files\ipsupd.dll
+ 2006-05-24 23:22 . 2006-05-24 23:22	53248              c:\windows\bdoscandel.exe
+ 2006-05-24 23:21 . 2006-05-24 23:21	53248              c:\windows\BDOSCAN8\ipsupd.dll
+ 2009-10-11 18:07 . 2009-10-11 18:07	6790              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\youtube.com\youtube.com\Data.dat
- 2009-10-09 21:23 . 2009-10-09 21:23	6790              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\youtube.com\youtube.com\Data.dat
- 2009-10-10 08:07 . 2009-10-10 08:07	5476              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\youporn.com\youporn.com\Data.dat
+ 2009-10-11 18:17 . 2009-10-11 18:17	5476              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\youporn.com\youporn.com\Data.dat
+ 2009-10-11 16:11 . 2009-10-11 16:11	6330              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\yimg.com\yimg.com\Data.dat
- 2009-10-09 06:26 . 2009-10-09 06:26	6548              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\wikipedia.org\wikipedia.org\Data.dat
+ 2009-10-11 13:24 . 2009-10-11 13:24	6548              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\wikipedia.org\wikipedia.org\Data.dat
+ 2009-10-11 15:28 . 2009-10-11 15:28	3550              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\verre%2Dlyris.com\verre%2Dlyris.com\Data.dat
- 2009-10-09 19:33 . 2009-10-09 19:33	4242              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\u%2Dclermont1.fr\u%2Dclermont1.fr\Data.dat
+ 2009-10-11 18:19 . 2009-10-11 18:19	4242              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\u%2Dclermont1.fr\u%2Dclermont1.fr\Data.dat
- 2009-10-11 08:57 . 2009-10-11 08:57	4692              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache	otalgaz.fr	otalgaz.fr\Data.dat
+ 2009-10-11 18:09 . 2009-10-11 18:09	4692              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache	otalgaz.fr	otalgaz.fr\Data.dat
+ 2009-10-11 16:10 . 2009-10-11 16:10	5568              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\sunglassesitaly.com\sunglassesitaly.com\Data.dat
+ 2009-10-11 16:07 . 2009-10-11 16:07	4818              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\solaris%2Dsunglass.com\solaris%2Dsunglass.com\Data.dat
- 2009-10-09 11:02 . 2009-10-09 11:02	6434              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\societegenerale.fr\societegenerale.fr\Data.dat
+ 2009-10-11 09:53 . 2009-10-11 09:53	6434              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\societegenerale.fr\societegenerale.fr\Data.dat
+ 2009-10-11 16:07 . 2009-10-11 16:07	5912              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\snowreef.com\snowreef.com\Data.dat
+ 2009-10-11 18:16 . 2009-10-11 18:16	6416              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\skype.com\skype.com\Data.dat
- 2009-10-09 21:33 . 2009-10-09 21:33	5852              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\sharethis.com\sharethis.com\Data.dat
+ 2009-10-11 16:05 . 2009-10-11 16:05	5852              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\sharethis.com\sharethis.com\Data.dat
+ 2009-10-11 12:39 . 2009-10-11 12:39	6350              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\scribd.com\scribd.com\Data.dat
+ 2009-10-11 16:08 . 2009-10-11 16:08	6050              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\scene7.com\scene7.com\Data.dat
+ 2009-10-11 14:27 . 2009-10-11 14:27	4722              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cacheocheblave.comocheblave.com\Data.dat
+ 2009-10-11 17:26 . 2009-10-11 17:26	5580              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cacheay%2Dban.comay%2Dban.com\Data.dat
+ 2009-10-11 15:00 . 2009-10-11 15:00	6346              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\proximedia.com\proximedia.com\Data.dat
+ 2009-10-11 11:40 . 2009-10-11 11:40	6362              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\piriform.com\piriform.com\Data.dat
+ 2009-10-11 11:22 . 2009-10-11 11:22	5490              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\passport.com\passport.com\Data.dat
- 2009-10-10 10:41 . 2009-10-10 10:41	5490              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\passport.com\passport.com\Data.dat
+ 2009-10-11 11:53 . 2009-10-11 11:53	7098              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\pagesperso%2Dorange.fr\pagesperso%2Dorange.fr\Data.dat
+ 2009-10-11 14:41 . 2009-10-11 14:41	4896              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\over%2Dblog.com\over%2Dblog.com\Data.dat
+ 2009-10-11 14:42 . 2009-10-11 14:42	3752              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\over%2Dblog.com\avocatravail.over%2Dblog.com\Data.dat
+ 2009-10-11 17:26 . 2009-10-11 17:26	5536              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\optique%2Dsergent.com\optique%2Dsergent.com\Data.dat
- 2009-10-10 08:06 . 2009-10-10 08:06	5496              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\optical%2Dcenter.fr\optical%2Dcenter.fr\Data.dat
+ 2009-10-11 18:09 . 2009-10-11 18:09	5496              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\optical%2Dcenter.fr\optical%2Dcenter.fr\Data.dat
+ 2009-10-11 10:32 . 2009-10-11 10:32	5496              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\optical%2Dcenter.eu\optical%2Dcenter.eu\Data.dat
- 2009-10-08 09:03 . 2009-10-08 09:03	4990              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\optic2000.fr\optic2000.fr\Data.dat
+ 2009-10-11 10:36 . 2009-10-11 10:36	4990              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\optic2000.fr\optic2000.fr\Data.dat
+ 2009-10-11 14:42 . 2009-10-11 14:42	5434              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\oboulo.com\oboulo.com\Data.dat
- 2009-10-08 18:11 . 2009-10-08 18:11	5434              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\oboulo.com\oboulo.com\Data.dat
+ 2009-10-11 16:41 . 2009-10-11 16:41	6704              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\msn.com\msn.com\Data.dat
- 2009-10-10 10:41 . 2009-10-10 10:41	6704              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\msn.com\msn.com\Data.dat
+ 2009-10-11 16:11 . 2009-10-11 16:11	5490              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\mbstores.com\mbstores.com\Data.dat
+ 2009-10-11 15:35 . 2009-10-11 15:35	5396              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\mabul.org\mabul.org\Data.dat
- 2009-10-10 10:41 . 2009-10-10 10:41	7146              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\live.com\live.com\Data.dat
+ 2009-10-11 11:23 . 2009-10-11 11:23	7146              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\live.com\live.com\Data.dat
+ 2009-10-11 14:47 . 2009-10-11 14:47	5442              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\lexinter.net\lexinter.net\Data.dat
+ 2009-10-11 18:18 . 2009-10-11 18:18	6322              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\lequipe.fr\lequipe.fr\Data.dat
- 2009-10-09 19:40 . 2009-10-09 19:40	6322              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\lequipe.fr\lequipe.fr\Data.dat
+ 2009-10-11 14:27 . 2009-10-11 14:27	3578              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\lepetitjuriste.fr\lepetitjuriste.fr\Data.dat
+ 2009-10-11 10:08 . 2009-10-11 10:08	5428              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\leboost.com\leboost.com\Data.dat
- 2009-10-08 09:03 . 2009-10-08 09:03	4202              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\krys.com\krys.com\Data.dat
+ 2009-10-11 10:38 . 2009-10-11 10:38	4202              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\krys.com\krys.com\Data.dat
- 2009-10-09 21:33 . 2009-10-09 21:33	7150              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\korben.info\korben.info\Data.dat
+ 2009-10-11 16:05 . 2009-10-11 16:05	7150              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\korben.info\korben.info\Data.dat
+ 2009-10-11 18:26 . 2009-10-11 18:26	6426              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\infos%2Ddu%2Dnet.com\infos%2Ddu%2Dnet.com\Data.dat
- 2009-10-08 08:39 . 2009-10-08 08:39	6336              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\hardware.fr\hardware.fr\Data.dat
+ 2009-10-11 15:19 . 2009-10-11 15:19	6336              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\hardware.fr\hardware.fr\Data.dat
+ 2009-10-11 16:40 . 2009-10-11 16:40	6496              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\google.fr\google.fr\Data.dat
- 2009-10-11 08:57 . 2009-10-11 08:57	6496              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\google.fr\google.fr\Data.dat
+ 2009-10-11 16:40 . 2009-10-11 16:40	6970              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\google.com\google.com\Data.dat
- 2009-10-10 10:41 . 2009-10-10 10:41	6970              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\google.com\google.com\Data.dat
+ 2009-10-11 18:07 . 2009-10-11 18:07	6334              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\facebook.com\facebook.com\Data.dat
- 2009-10-11 08:54 . 2009-10-11 08:54	6334              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\facebook.com\facebook.com\Data.dat
+ 2009-10-11 15:26 . 2009-10-11 15:26	4994              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\essilor.fr\essilor.fr\Data.dat
+ 2009-10-11 10:17 . 2009-10-11 10:17	5878              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\diesel.com\diesel.com\Data.dat
+ 2009-10-11 12:38 . 2009-10-11 12:38	5048              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\crous%2Dclermont.fr\crous%2Dclermont.fr\Data.dat
+ 2009-10-11 12:35 . 2009-10-11 12:35	4794              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\courdecassation.fr\courdecassation.fr\Data.dat
- 2009-10-11 08:56 . 2009-10-11 08:56	5560              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\commentcamarche.net\commentcamarche.net\Data.dat
+ 2009-10-11 18:08 . 2009-10-11 18:08	5560              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\commentcamarche.net\commentcamarche.net\Data.dat
+ 2009-10-11 15:03 . 2009-10-11 15:03	5396              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\ciao.fr\ciao.fr\Data.dat
+ 2009-10-11 14:38 . 2009-10-11 14:38	5442              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\blogemploi.com\blogemploi.com\Data.dat
+ 2009-10-11 14:47 . 2009-10-11 14:47	5404              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\blogdroitadministratif.net\blogdroitadministratif.net\Data.dat
+ 2009-10-11 16:40 . 2009-10-11 16:40	6410              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\bitdefender.fr\bitdefender.fr\Data.dat
+ 2009-10-11 16:41 . 2009-10-11 16:41	6428              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\bitdefender.com\bitdefender.com\Data.dat
+ 2009-10-11 14:42 . 2009-10-11 14:42	4918              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\avocats.fr\avocats.fr\Data.dat
+ 2009-10-11 10:37 . 2009-10-11 10:37	3564              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\alainafflelou.fr\alainafflelou.fr\Data.dat
+ 2009-10-11 10:37 . 2009-10-11 10:37	5036              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\alainafflelou.com\alainafflelou.com\Data.dat
+ 2009-10-11 10:10 . 2009-10-11 10:10	3452              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\adrea.fr\adrea.fr\Data.dat
- 2009-10-08 08:40 . 2009-10-08 08:40	3452              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\adrea.fr\adrea.fr\Data.dat
+ 2009-10-11 17:26 . 2009-10-11 17:26	3802              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\adrea%2Dmutuelle%2Dcentre%2Dauvergne.fr\adrea%2Dmutuelle%2Dcentre%2Dauvergne.fr\Data.dat
- 2009-10-08 08:40 . 2009-10-08 08:40	3802              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\adrea%2Dmutuelle%2Dcentre%2Dauvergne.fr\adrea%2Dmutuelle%2Dcentre%2Dauvergne.fr\Data.dat
- 2009-10-10 08:06 . 2009-10-10 08:06	5462              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\20minutes.fr\20minutes.fr\Data.dat
+ 2009-10-11 16:05 . 2009-10-11 16:05	5462              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\20minutes.fr\20minutes.fr\Data.dat
+ 2009-10-11 12:36 . 2009-10-11 12:36	4662              c:\windows\System32\config\systemprofile\AppData\Roaming\SACore\Cache\1901.org\1901.org\Data.dat
+ 2009-10-11 18:54 . 2009-10-11 18:54	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-10-11 09:37 . 2009-10-11 09:37	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-10-11 18:54 . 2009-10-11 18:54	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-10-11 09:37 . 2009-10-11 09:37	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-10-11 18:12	595946              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-10-09 20:00	595946              c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-10-11 18:12	105276              c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-10-09 20:00	105276              c:\windows\System32\perfc009.dat
- 2009-04-19 08:35 . 2009-10-11 09:08	245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-04-19 08:35 . 2009-10-11 09:48	245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2006-05-24 23:21 . 2006-05-24 23:21	118784              c:\windows\Downloaded Program Files\bdupd.dll
+ 2006-05-24 23:21 . 2006-05-24 23:21	118784              c:\windows\BDOSCAN8\bdupd.dll
.
-- Instantané actualisé --
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05	121392	----a-w-	c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-13 68856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-10-04 3883856]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-18 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-18 92704]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 405504]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-09-30 3676160]
"WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-09-07 152872]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-07 1176808]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-09-07 206120]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-05-21 173288]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-05-07 6139904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\AWinNotifyVitaKey MC3000]
2008-09-30 01:56	3197952	----a-w-	c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\spba]
2008-03-25 13:24	567560	----a-w-	c:\program files\Common Files\SPBA\homefus2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Nikon Monitor.lnk
backup=c:\windows\pss\Nikon Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):28,24,1c,96,ee,e5,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{89799D38-6725-4CE5-9D1E-6E30415FE623}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{D44F326E-3D01-4696-9E32-3ED5D49B0E4B}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{71E00646-63EC-47AC-B284-2EA545130FD0}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{57BDCF60-2235-4679-8101-B9BD26C60ED2}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{A5463B11-BEAF-45EA-83BA-4DF7CBA988E9}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{44132C7C-6906-4ED8-ABA6-2596681E8633}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{30A1F990-1B0B-408D-9385-E83FF29BE07F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2FCDE318-182E-4D8F-9169-FE74FBB301CE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F9B95664-C1B4-4028-9CDC-757525CFF306}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{8BC06121-A75B-42B8-BB02-516D92ECA5ED}"= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM
"{D5FD47F0-B674-4133-AFE0-AEBE4F1F3542}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{21E6A589-2D86-4D77-8514-414F27E90DE2}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{E85E5F47-1A4C-4281-A1F4-F5FFDE3813EA}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{747104A9-A58C-4264-BDB2-3D9DEF32DF3E}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{A574124D-8C8B-4071-9666-3EA3F48E0543}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{F1102A3F-E8B1-440A-8F5F-E996241ADF80}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{58081E78-6D67-44E4-9B37-B2755DDFD2D6}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{B70E3C13-0BF9-4B46-A35B-6671090439B9}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{B6C0D282-FB43-4016-88B2-D983ADB3EE7D}"= UDP:5353:Adobe CSI CS4
"{2232CA97-E53E-4A7C-BE73-30794DA992FF}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{D729BA9F-3C21-4A7A-8A4C-8C2682F2B189}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{3DFC2EBE-4A49-4D48-A095-81800DEB312F}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{3D6B6C19-90E2-4BA1-AFEF-A25B30E3A5DB}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{595BD36C-87B8-4223-AFD9-B74F84C0949F}"= UDP:c:\users\Sébastien\Downloads\utorrent.exe:µTorrent (TCP-In)
"{70EA60D2-47F6-4694-903A-76FDD2D6BBF4}"= TCP:c:\users\Sébastien\Downloads\utorrent.exe:µTorrent (UDP-In)
"{FE9BE8E1-FDFD-4563-A418-BA9D035BBD71}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{FC281911-2EB7-4DA5-A900-19C8F6C61DF5}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{07F3E981-3AC2-48DC-B90B-877B71004FD1}"= UDP:35430:µT 35430
"{7C0375C3-48DB-43EE-A04C-A6A47F1F15F2}"= TCP:35430:35430
"{E8A5C04B-35E7-4740-A36B-BD1D047BFBA0}"= UDP:c:\program files\uTorrent\uTorrent.exe:uTorrent
"{DAB81D34-E5A1-497D-AA8B-367DDB237AA0}"= TCP:c:\program files\uTorrent\uTorrent.exe:uTorrent
"TCP Query User{7A88F352-BFF7-4C4F-A384-0AE9326A4EC4}c:\program files\transcode360\transcode360tray.exe"= UDP:c:\program files	ranscode360	ranscode360tray.exe: 
"UDP Query User{AFA8DCDB-9B95-42DD-998B-8E76CDB0E699}c:\program files\transcode360\transcode360tray.exe"= TCP:c:\program files	ranscode360	ranscode360tray.exe: 
"{7D7E9280-BEF5-48EB-8BA3-59527C87798A}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{025B3AD4-AB85-4D2F-BB15-F7F5F38BB959}"= UDP:c:\program files\Transcode360\Transcode360.exe:Transcode 360
"{0D7D3184-0965-4C4C-BB4C-6CDC77404C33}"= TCP:c:\program files\Transcode360\Transcode360.exe:Transcode 360
"{D677B84E-08CC-4F75-A302-952B91B961C8}"= TCP:1041:Transcode 360
"{3C04E86C-E85C-40E6-8165-F441F57452B7}"= TCP:10244:Transcode 360
"{05D59994-4E96-4224-BC26-35A8CEDEEF22}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B20D2C1D-5181-4B47-B2F5-CCD6250F545D}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{A2118446-3593-4E56-B577-E2A7926590DD}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{1B6C5B99-6E1D-4457-B589-82992710C55D}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{093296A4-9BEE-40F8-970F-26D698A052E9}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{11419E0C-FF18-415D-9273-0F1C6C86207A}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{FF58D495-9620-4AC7-8021-F219B82E2107}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{14AED605-58A9-495F-8CEE-7653A19E3E9C}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{9A55B352-63C2-467B-AE22-B5872CD8FC12}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{604050F3-FB6E-4A41-9E6B-CDFB32E8FBCA}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psasvr.exe:KTF MUSIC AoD Server
"{D8127E1B-7717-4838-80F0-B7995264CCB7}"= UDP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{9147E7F4-5707-4575-9B5E-AFA877D24744}"= TCP:c:\program files\Samsung\Samsung New PC Studio
psvsvr.exe:KTF MUSIC VoD Server
"{7F18A312-B532-4A06-8F73-09C228508C27}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{60714ECD-E57A-4C0C-BCC3-874C27DA7132}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{8905B12F-D465-47B3-B380-E5954A39BF98}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{92CEF1AC-3F53-4967-9D3B-1414DC6F1361}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
"{4DDD3242-6133-41FB-86DD-1ED97337BF67}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
"{3AD12867-F1B6-4C88-98A7-DFA95368E90A}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
"{E8A0E8C7-1B2E-43F9-A85F-A8B3EFE012EF}"= UDP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)
"{83A08EF7-F3FB-46B4-A738-247104885DB7}"= TCP:c:\program files\SFR\Media Center\httpd\httpd.exe:Serveur de partage Media Center (Player SFR)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\System32\drivers\AlfaFF.sys [30/09/2008 03:56 42608]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/10/06 14:21];c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [06/10/2009 14:20 87536]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 13:11 16384]
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [05/02/2009 15:38 188416]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [30/09/2008 04:04 75048]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [25/07/2008 14:51 24576]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 14:35 181544]
R2 FsUsbExService;FsUsbExService;c:\windows\System32\FsUsbExService.Exe [09/07/2009 18:39 233472]
R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [30/09/2008 03:56 3602432]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [09/10/2009 14:29 269648]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [02/05/2009 12:08 206112]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [25/04/2008 21:36 45056]
R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [30/09/2008 04:04 122368]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [25/04/2008 21:36 131072]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [30/09/2008 04:19 233472]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [22/09/2008 13:40 14336]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\System32\FsUsbExDisk.Sys [09/07/2009 18:39 36608]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\System32\drivers\L1E60x86.sys [20/05/2009 06:02 48640]
R3 MBAMProtector;MBAMProtector;c:\windows\System32\drivers\mbam.sys [09/10/2009 14:29 19160]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 08:40 3668480]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers
vhda32v.sys [25/06/2008 07:05 44064]
R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28/03/2007 07:51 43008]
S2 gupdate1c9d4ccfe26ad22;Google Update Service (gupdate1c9d4ccfe26ad22);c:\program files\Google\Update\GoogleUpdate.exe [14/05/2009 21:48 133104]
S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [13/03/2009 16:51 24064]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\System32\drivers\massfilter.sys [15/09/2008 14:26 7168]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\System32\drivers\ss_bbus.sys [30/07/2009 16:01 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\System32\drivers\ss_bmdfl.sys [30/07/2009 16:01 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\System32\drivers\ss_bmdm.sys [30/07/2009 16:01 121856]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\System32\drivers\ZTEusbnet.sys [06/07/2009 22:26 110080]
S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\System32\drivers\zteusbvoice.sys [06/07/2009 22:26 104960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Contenu du dossier 'Tâches planifiées'

2009-10-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-13 20:00]

2009-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-14 19:48]

2009-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-14 19:48]

2009-05-02 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 19:26]

2009-05-02 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 19:26]

2009-10-03 c:\windows\Tasks\NeroLiveEpgUpdate-PC-de-Sébastien_Sébastien.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-10-27 07:59]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\Sébastien\AppData\Roaming\Mozilla\Firefox\Profiles\wfb5fe5d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Canal\Canal Widget\VOD
pCpVod.dll
FF - plugin: c:\program files\Google\Google Earth\plugin
pgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7
pGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-11 20:56
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(4944)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
c:\windows\system32\btncopy.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
c:\progra~1\mcafee\VIRUSS~1\scriptsn.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
c:\windows\system32\BtwNamespaceExt.dll
c:\windows\system32\BtwNeLib.dll
c:\windows\system32\btwapi.dll
c:\windows\system32\btosif.dll
c:\windows\system32\btwpimif.dll
.
------------------------ Autres processus actifs ------------------------
.
SystemRoot\System32\smss.exe [548]
c:\windows\system32\csrss.exe [616]
c:\windows\system32\wininit.exe [668]
c:\windows\system32\csrss.exe [680]
c:\windows\system32\services.exe [716]
c:\windows\system32\lsass.exe [728]
c:\windows\system32\lsm.exe [736]
c:\windows\system32\svchost.exe [900]
c:\windows\system32
vvsvc.exe [944]
c:\windows\system32\svchost.exe [968]
c:\windows\System32\svchost.exe [1064]
c:\windows\System32\svchost.exe [1096]
c:\windows\system32\svchost.exe [1108]
c:\windows\system32\svchost.exe [1212]
c:\windows\system32\SLsvc.exe [1228]
c:\windows\system32\svchost.exe [1272]
c:\windows\system32\winlogon.exe [1372]
c:\windows\system32\svchost.exe [1440]
c:\windows\system32\WLANExt.exe [1572]
c:\windows\System32\spoolsv.exe [1636]
c:\windows\system32\svchost.exe [1672]
c:\windows\system32undll32.exe [1856]
c:\program files\Common Files\SPBA\upeksvr.exe [1968]
c:\program files\Acer\Acer Bio Protection\CompPtcVUI.exe [880]
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [464]
c:\program files\Bonjour\mDNSResponder.exe [596]
c:\windows\system32\svchost.exe [604]
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [1448]
c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [1952]
c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2064]
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2096]
c:\program files\Acer\Empowering Technology\Service\ETService.exe [2116]
c:\program files\Intel\WiFi\bin\EvtEng.exe [2228]
c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2260]
c:\windows\system32\FsUsbExService.Exe [2384]
c:\windows\system32\svchost.exe [2492]
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2544]
c:\program files\Acer\Acer Bio Protection\BASVC.exe [2568]
c:\program files\Common Files\LightScribe\LSSrvc.exe [2612]
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe [2640]
c:\program files\McAfee\SiteAdvisor\McSACore.exe [2664]
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2680]
c:\windows\system32undll32.exe [2688]
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe [2744]
c:\acer\Mobility Center\MobilityService.exe [2836]
c:\program files\McAfee\MPF\MPFSrv.exe [2956]
c:\program files\McAfee\MSK\MskSrver.exe [3052]
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe [3064]
c:\windows\System32\svchost.exe [3228]
c:\program files\CDBurnerXP\NMSAccessU.exe [3284]
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [3320]
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [3392]
c:\windows\System32\svchost.exe [3416]
c:\windows\system32\PnkBstrA.exe [3428]
c:\windows\system32\svchost.exe [3460]
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe [3484]
c:\program files\Cyberlink\Shared files\RichVideo.exe [3512]
c:\program files\Acer\Acer VCM\RS_Service.exe [3532]
c:\windows\system32\svchost.exe [3568]
c:\windows\System32\svchost.exe [3620]
c:\windows\system32\SearchIndexer.exe [3648]
c:\windows\system32\DRIVERS\xaudio.exe [3712]
c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [3792]
c:\windows\system32\wbem\wmiprvse.exe [4004]
c:\windows\system32\Dwm.exe [4112]
c:\windows\system32	askeng.exe [4236]
c:\windows\system32\CF4630.exe [4756]
c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [4888]
c:\windows\RtHDVCpl.exe [4900]
c:\program files\Synaptics\SynTP\SynTPEnh.exe [4928]
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe [4964]
c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe [4984]
c:\windows\System32undll32.exe [5128]
c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe [5208]
c:\program files\Acer\Acer Bio Protection\PdtWzd.exe [5240]
c:\program files\HP\HP Software Update\hpwuSchd2.exe [5340]
c:\program files\Launch Manager\QtZgAcer.EXE [5356]
c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [5376]
c:\program files\Java\jre6\bin\jusched.exe [5436]
c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [5608]
c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [5628]
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [5664]
c:\windows\ehome\ehtray.exe [5676]
c:\program files\Windows Live\Messenger\msnmsgr.exe [5712]
c:\program files\Windows Sidebar\sidebar.exe [5728]
c:\windows\ehome\ehmsas.exe [5920]
c:\progra~1\McAfee\MSC\mcmscsvc.exe [5120]
c:\windows\system32\wbem\wmiprvse.exe [5532]
c:\progra~1\mcafee.com\agent\mcagent.exe [4268]
c:\windows\system32\wbem\unsecapp.exe [1244]
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe [3028]
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe [4432]
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5520]
c:\program files\Windows Media Player\wmpnetwk.exe [5804]
c:\windows\servicing\TrustedInstaller.exe [4716]
c:\windows\Explorer.exe [4944]
c:\windows\system32\NOTEPAD.EXE [860]
c:\windows\system32\SearchProtocolHost.exe [1400]
c:\windows\system32\SearchFilterHost.exe [5140]
c:\asdehi\catchme.cfxxe [4556]
.
**************************************************************************
.
Heure de fin: 2009-10-11 21:05 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-10-11 19:05
ComboFix2.txt  2009-10-11 09:47

Avant-CF: 43 131 076 608 octets libres
Après-CF: 43 016 433 664 octets libres

620	--- E O F ---	2009-10-04 10:30

Seb1989 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6002 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     T5800  @ 2.00GHz )
   BIOS : ZK2 v0.3121 3A21
   USER : Sébastien ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:40 Go)
   D:\ (Local Disk) - NTFS - Total:140 Go (Free:16 Go)
   F:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 12/10/2009|22:04 )

   [ UAC => 0 ]
 
   --------------------\  Listing des dossiers dans Local

   [06/07/2009|22:23] C:\Users\SBASTI~1\AppData\Local\{BAD7C248-517D-4CE1-B65A-829C01BEFDB1}
   [13/03/2009|16:14] C:\Users\SBASTI~1\AppData\Local\Acer Arcade Deluxe
   [01/06/2009|21:25] C:\Users\SBASTI~1\AppData\Local\Adobe
   [14/03/2009|21:44] C:\Users\SBASTI~1\AppData\Local\Anand_Prakash
   [13/06/2009|14:37] C:\Users\SBASTI~1\AppData\Local\Apple
   [13/06/2009|14:41] C:\Users\SBASTI~1\AppData\Local\Apple Computer
   [13/03/2009|16:50] C:\Users\SBASTI~1\AppData\Local\Application Data 
   [02/06/2009|03:14] C:\Users\SBASTI~1\AppData\Local\Cooliris
   [13/03/2009|16:15] C:\Users\SBASTI~1\AppData\Local\CyberLink
   [02/10/2009|14:09] C:\Users\SBASTI~1\AppData\Local\d3d9caps.dat
   [05/10/2009|18:15] C:\Users\SBASTI~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [06/07/2009|22:26] C:\Users\SBASTI~1\AppData\Local\desktop.ini
   [26/08/2009|13:07] C:\Users\SBASTI~1\AppData\Local\Downloaded Installations
   [31/07/2009|16:31] C:\Users\SBASTI~1\AppData\Local\Films
   [29/09/2009|17:44] C:\Users\SBASTI~1\AppData\Local\Google
   [13/03/2009|16:50] C:\Users\SBASTI~1\AppData\Local\Historique 
   [12/10/2009|19:59] C:\Users\SBASTI~1\AppData\Local\IconCache.db
   [24/05/2009|22:44] C:\Users\SBASTI~1\AppData\Local\Microsoft
   [17/09/2009|11:40] C:\Users\SBASTI~1\AppData\Local\Microsoft Corporation
   [08/05/2009|21:13] C:\Users\SBASTI~1\AppData\Local\Microsoft Games
   [13/03/2009|16:13] C:\Users\SBASTI~1\AppData\Local\Microsoft Help
   [13/03/2009|14:51] C:\Users\SBASTI~1\AppData\Local\Mozilla
   [17/05/2009|15:17] C:\Users\SBASTI~1\AppData\Local\Nero
   [30/07/2009|11:44] C:\Users\SBASTI~1\AppData\Local\Neuf
   [13/03/2009|16:23] C:\Users\SBASTI~1\AppData\Local\PowerCinema
   [18/03/2009|22:54] C:\Users\SBASTI~1\AppData\Local\PunkBuster
   [01/05/2009|23:27] C:\Users\SBASTI~1\AppData\Local\Seven Zip
   [24/03/2009|13:34] C:\Users\SBASTI~1\AppData\Local\SoftDMA
   [12/10/2009|22:02] C:\Users\SBASTI~1\AppData\Local	emp
   [13/03/2009|16:50] C:\Users\SBASTI~1\AppData\Local\Temporary Internet Files 
   [13/03/2009|16:53] C:\Users\SBASTI~1\AppData\Local\VirtualStore
   [24/09/2009|10:48] C:\Users\SBASTI~1\AppData\Local\Zattoo
   [14/03/2009|16:56] C:\Users\SBASTI~1\AppData\Local\ZattooPlayer
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [12/10/2009 19:17][--a------] C:\Windows	asks\GoogleUpdateTaskMachineUA.job
   [12/10/2009 21:22][--a------] C:\Windows	asks\GoogleUpdateTaskMachineCore.job
   [12/10/2009 21:25][--a------] C:\Windows	asks\Google Software Updater.job
   [12/10/2009 00:00][--a------] C:\Windows	asks\NeroLiveEpgUpdate-PC-de-S‚bastien_S‚bastien.job
   [02/05/2009 20:40][--a------] C:\Windows	asks\McDefragTask.job
   [02/05/2009 20:40][--a------] C:\Windows	asks\McQcTask.job
   [12/10/2009 21:21][--ah-----] C:\Windows	asks\SA.DAT
   [12/10/2009 19:59][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [10/09/2009|10:51] C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [13/06/2009|14:41] C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [11/09/2009|14:05] C:\ProgramData\Adobe
   [11/09/2009|14:05] C:\ProgramData\afl.log
   [13/06/2009|14:35] C:\ProgramData\Apple
   [13/06/2009|14:40] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [06/10/2009|14:24] C:\ProgramData\ArcadeDeluxe2.log
   [21/03/2009|20:16] C:\ProgramData\Azureus
   [13/03/2009|16:45] C:\ProgramData\Bureau 
   [06/10/2009|14:19] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [15/09/2008|14:28] C:\ProgramData\DeviceInstaller.xml
   [22/09/2008|11:15] C:\ProgramData\DeviceManager.xml.rc4
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [10/04/2009|18:50] C:\ProgramData\EnterNHelp
   [13/03/2009|23:09] C:\ProgramData\eSobi
   [13/03/2009|16:45] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [16/04/2009|16:51] C:\ProgramData\FLEXnet
   [25/07/2008|15:05] C:\ProgramData\FloodLightGames
   [29/09/2009|17:44] C:\ProgramData\Google
   [12/10/2009|12:51] C:\ProgramData\Google Updater
   [23/07/2009|10:30] C:\ProgramData\Hewlett-Packard
   [18/03/2009|19:20] C:\ProgramData\HP
   [19/03/2009|19:49] C:\ProgramData\HP Product Assistant
   [18/03/2009|16:58] C:\ProgramData\HPSSUPPLY
   [08/10/2009|08:44] C:\ProgramData\hpzinstall.log
   [06/07/2009|22:26] C:\ProgramData\InstallShield
   [13/03/2009|22:38] C:\ProgramData\Intel
   [02/05/2009|14:12] C:\ProgramData\LightScribe
   [12/09/2009|10:48] C:\ProgramData\Malwarebytes
   [10/07/2009|17:48] C:\ProgramData\McAfee
   [13/03/2009|16:45] C:\ProgramData\Menu D‚marrer 
   [14/03/2009|15:29] C:\ProgramData\Messenger Plus!
   [19/03/2009|12:06] C:\ProgramData\Microsoft
   [25/07/2009|14:30] C:\ProgramData\Microsoft Help
   [13/03/2009|16:45] C:\ProgramData\ModŠles 
   [02/05/2009|13:34] C:\ProgramData\Nero
   [10/04/2009|18:39] C:\ProgramData\Nikon
   [24/09/2009|14:34] C:\ProgramData
tuser.pol
   [05/06/2009|17:14] C:\ProgramData\NVIDIA
   [12/10/2009|21:24] C:\ProgramData
vModes.001
   [12/10/2009|21:22] C:\ProgramData
vModes.dat
   [09/07/2009|18:45] C:\ProgramData\PC Suite
   [16/04/2009|16:21] C:\ProgramData\PKP_DLdu.DAT
   [02/05/2009|11:56] C:\ProgramData\PKP_DLdw.DAT
   [10/04/2009|18:38] C:\ProgramData\Pop Kit
   [10/04/2009|18:50] C:\ProgramData\Printer Icons
   [10/04/2009|18:38] C:\ProgramData\Profiles
   [10/04/2009|18:50] C:\ProgramData\Receipts
   [13/03/2009|22:39] C:\ProgramData\Roaming
   [26/08/2009|13:11] C:\ProgramData\Seagate
   [15/03/2009|10:24] C:\ProgramData\SiteAdvisor
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [21/03/2009|18:51] C:\ProgramData\Temp
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [30/09/2008|03:55] C:\ProgramData\UIB
   [10/04/2009|18:50] C:\ProgramData\Ultima_T15
   [27/07/2009|16:11] C:\ProgramData\Vodafone
   [18/03/2009|16:59] C:\ProgramData\WEBREG
   [27/08/2009|14:42] C:\ProgramData\WindowsSearch

   --------------------\  Listing des dossiers dans C:\Program Files

   [25/09/2009|17:21] C:\Program Files\7-Zip
   [14/09/2009|12:01] C:\Program Files\abgx360
   [13/03/2009|16:51] C:\Program Files\Acer
   [30/09/2008|04:05] C:\Program Files\Acer Arcade Deluxe
   [29/09/2009|17:44] C:\Program Files\Acer GameZone
   [30/09/2008|03:44] C:\Program Files\Acer Inc
   [30/09/2008|04:20] C:\Program Files\Acer Incorporated
   [23/06/2009|22:13] C:\Program Files\Adobe
   [16/04/2009|16:39] C:\Program Files\Adobe Media Player
   [08/10/2009|19:35] C:\Program Files\Ad-Remover
   [13/06/2009|14:37] C:\Program Files\Apple Software Update
   [25/07/2008|15:14] C:\Program Files\Big Kahuna Reef
   [02/06/2009|19:37] C:\Program Files\bobyte
   [13/06/2009|14:40] C:\Program Files\Bonjour
   [13/03/2009|21:23] C:\Program Files\Canal
   [13/03/2009|15:12] C:\Program Files\CCleaner
   [16/04/2009|17:38] C:\Program Files\CDBurnerXP
   [13/03/2009|22:38] C:\Program Files\Cisco
   [11/10/2009|20:47] C:\Program Files\Common Files
   [25/07/2008|14:42] C:\Program Files\CONEXANT
   [30/07/2009|17:05] C:\Program Files\ConvertHelper
   [25/07/2008|15:18] C:\Program Files\Convesoft
   [30/09/2008|04:19] C:\Program Files\Cyberlink
   [09/07/2009|18:44] C:\Program Files\DIFX
   [02/06/2009|02:58] C:\Program Files\DownloadToolz
   [25/09/2009|17:27] C:\Program Files\Druide
   [26/05/2009|20:31] C:\Program Files\eSobi
   [13/03/2009|16:45] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [13/05/2009|14:18] C:\Program Files\gBurner
   [29/09/2009|17:44] C:\Program Files\Google
   [18/03/2009|16:56] C:\Program Files\Hewlett-Packard
   [18/03/2009|16:58] C:\Program Files\HP
   [28/08/2009|17:02] C:\Program Files\ImgBurn
   [29/09/2009|17:43] C:\Program Files\InstallShield Installation Information
   [13/03/2009|22:38] C:\Program Files\Intel
   [03/10/2009|20:43] C:\Program Files\Internet Explorer
   [24/09/2009|11:08] C:\Program Files\iPod
   [06/09/2009|22:16] C:\Program Files\Ipulp
   [24/09/2009|11:10] C:\Program Files\iTunes
   [05/08/2009|18:01] C:\Program Files\Java
   [11/10/2009|21:24] C:\Program Files\JDownloader 0.6.193
   [06/10/2009|14:44] C:\Program Files\Launch Manager
   [09/10/2009|14:29] C:\Program Files\Malwarebytes' Anti-Malware
   [30/07/2009|15:58] C:\Program Files\MarkAny
   [31/07/2009|16:31] C:\Program Files\MaVideotheque
   [26/08/2009|00:09] C:\Program Files\McAfee
   [02/05/2009|12:03] C:\Program Files\McAfee.com
   [10/07/2009|17:43] C:\Program Files\Messenger Plus! Live
   [04/10/2009|12:31] C:\Program Files\Microsoft
   [02/11/2006|14:37] C:\Program Files\Microsoft Games
   [13/03/2009|21:20] C:\Program Files\Microsoft Office
   [10/09/2009|10:58] C:\Program Files\Microsoft Silverlight
   [17/09/2009|11:38] C:\Program Files\Microsoft Windows 7 Upgrade Advisor
   [11/06/2009|00:51] C:\Program Files\Microsoft Works
   [25/07/2008|15:20] C:\Program Files\Microsoft.NET
   [26/05/2009|20:27] C:\Program Files\Morgan
   [05/06/2009|16:53] C:\Program Files\Movie Maker
   [12/10/2009|22:02] C:\Program Files\Mozilla Firefox
   [02/11/2006|14:37] C:\Program Files\MSBuild
   [09/10/2009|09:24] C:\Program Files\MSECache
   [13/03/2009|15:53] C:\Program Files\MSXML 4.0
   [02/05/2009|13:46] C:\Program Files\Nero
   [25/07/2008|15:16] C:\Program Files\NewTech Infosystems
   [10/04/2009|18:52] C:\Program Files\Nikon
   [29/09/2009|17:58] C:\Program Files\OpenOffice.org 3
   [04/10/2009|12:54] C:\Program Files\Patch MsnCreative
   [29/09/2009|17:46] C:\Program Files\PC Connectivity Solution
   [17/04/2009|21:46] C:\Program Files\PFConfig
   [10/09/2009|10:46] C:\Program Files\QuickTime
   [25/07/2008|14:40] C:\Program Files\Realtek
   [02/11/2006|14:37] C:\Program Files\Reference Assemblies
   [17/03/2009|17:40] C:\Program Files\RocketDock
   [30/07/2009|16:02] C:\Program Files\Samsung
   [26/08/2009|13:11] C:\Program Files\Seagate
   [30/07/2009|11:43] C:\Program Files\SFR
   [17/05/2009|19:57] C:\Program Files\SiteAdvisor
   [04/09/2009|13:09] C:\Program Files\SpeedyFox
   [25/07/2008|14:44] C:\Program Files\Synaptics
   [29/07/2009|17:47] C:\Program Files\Transcode360
   [08/10/2009|21:01] C:\Program Files\Trend Micro
   [02/11/2006|15:01] C:\Program Files\Uninstall Information
   [16/04/2009|17:38] C:\Program Files\uTorrent
   [21/03/2009|17:03] C:\Program Files\VideoLAN
   [27/07/2009|16:11] C:\Program Files\Vodafone
   [07/05/2009|18:39] C:\Program Files\Vuze
   [30/09/2008|03:38] C:\Program Files\WIDCOMM
   [25/07/2008|14:44] C:\Program Files\Winbond Electronics Corporation
   [05/06/2009|16:53] C:\Program Files\Windows Calendar
   [05/06/2009|16:53] C:\Program Files\Windows Collaboration
   [05/06/2009|16:53] C:\Program Files\Windows Defender
   [05/06/2009|16:53] C:\Program Files\Windows Journal
   [13/03/2009|14:41] C:\Program Files\Windows Live
   [04/10/2009|12:30] C:\Program Files\Windows Live SkyDrive
   [10/09/2009|10:23] C:\Program Files\Windows Mail
   [14/08/2009|11:58] C:\Program Files\Windows Media Player
   [13/03/2009|16:45] C:\Program Files\Windows NT
   [05/06/2009|16:53] C:\Program Files\Windows Photo Gallery
   [05/06/2009|16:53] C:\Program Files\Windows Sidebar
   [02/05/2009|11:52] C:\Program Files\WinRAR
   [14/03/2009|16:55] C:\Program Files\Zattoo

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [09/07/2009|18:25] C:\Program Files\Common Files\Adobe
   [13/03/2009|21:23] C:\Program Files\Common Files\Adobe AIR
   [24/09/2009|11:08] C:\Program Files\Common Files\Apple
   [25/07/2008|15:20] C:\Program Files\Common Files\DESIGNER
   [18/03/2009|16:56] C:\Program Files\Common Files\Hewlett-Packard
   [18/03/2009|16:58] C:\Program Files\Common Files\HP
   [06/07/2009|22:25] C:\Program Files\Common Files\InstallShield
   [13/03/2009|22:38] C:\Program Files\Common Files\Intel
   [13/03/2009|15:13] C:\Program Files\Common Files\Java
   [25/07/2008|15:16] C:\Program Files\Common Files\LightScribe
   [16/04/2009|16:32] C:\Program Files\Common Files\Macrovision Shared
   [02/05/2009|12:04] C:\Program Files\Common Files\McAfee
   [02/05/2009|23:12] C:\Program Files\Common Files\microsoft shared
   [10/04/2009|18:39] C:\Program Files\Common Files\muvee Technologies
   [02/05/2009|14:10] C:\Program Files\Common Files\Nero
   [10/04/2009|23:39] C:\Program Files\Common Files\Nikon
   [02/11/2006|13:18] C:\Program Files\Common Files\Services
   [30/09/2008|03:56] C:\Program Files\Common Files\SPBA
   [02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
   [13/03/2009|17:15] C:\Program Files\Common Files\SWF Studio
   [05/06/2009|16:53] C:\Program Files\Common Files\System
   [13/03/2009|14:32] C:\Program Files\Common Files\Windows Live

   --------------------\  Process

   ( 111 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-10-12 22:04:40
   Windows 6.0.6002 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:17][D:4]-> C:\Users\SBASTI~1\AppData\Local\Temp
   [F:3][D:1]-> C:\Users\SBASTI~1\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:2][D:1]-> C:\Users\SBASTI~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:2][D:2]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 12/10/2009|22:06 - Option : [1]

   --------------------\  Fin du rapport a 22:06:49
   [ UAC => 1 ]

Seb1989 · Answer

mon pc tourne bien, plus de message au démarrage ce qui est une bonne chose, j'ai envie de dire RAS ! ^^
merci pour ton aide

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\_OTM: trouvé !
C:\Rsit: trouvé !
C:\GenProc\Genproc.exe: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\Mcx1.PC-de-Sébastien\Desktop\HijackThis.lnk: trouvé !
C:\Users\Sébastien\Desktop\HijackThis.lnk: trouvé !
C:\Users\Sébastien\Desktop\Rsit.exe: trouvé !
C:\Users\Sébastien\Downloads\LopSD.exe: trouvé !
C:\Users\Sébastien\Downloads\OTM.exe: trouvé !
C:\Users\Sébastien\Downloads\HJTInstall.exe: trouvé !
C:\Users\Sébastien\Downloads\Ad-R.exe: trouvé !
C:\Users\Sébastien\Downloads\Genproc.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Lop SD\catchme.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\Users\Mcx1.PC-de-Sébastien\Desktop\HijackThis.lnk: supprimé !
C:\Users\Sébastien\Desktop\HijackThis.lnk: supprimé !
C:\Users\Sébastien\Downloads\LopSD.exe: supprimé !
C:\Users\Sébastien\Downloads\OTM.exe: supprimé !
C:\Users\Sébastien\Downloads\HJTInstall.exe: supprimé !
C:\Users\Sébastien\Downloads\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\GenProc\Genproc.exe: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Lop SD\catchme.log: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Users\Sébastien\Desktop\Rsit.exe: supprimé !
C:\Users\Sébastien\Downloads\Genproc.exe: supprimé !
C:\Lop SD: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\_OTM: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !

Fichiers temporaires nettoyés !

Seb1989 · Answer

merci beaucoup

Bonne soirée.

Message démarrage VISTA

19 réponses

Discussions similaires

Newsletters