virus pcRésolu/Fermé

Question

Bonjour,A tous
Si Je suis la c'est que j'ai un gros gros  problème mon année 2010 commencé par un virus le Malware defense que faire?

Utilisateur anonyme · Answer

Bonjour

1)Télécharge Rkill sur le bureau ; à partir d’un de ces liens
http://download.bleepingcomputer.com/grinler/rkill.pif
https://download.bleepingcomputer.com/grinler/rkill.scr
https://download.bleepingcomputer.com/grinler/rkill.com
https://download.bleepingcomputer.com/grinler/rkill.exe

Double clic pour le lancer.
Une fenêtre (très rapide) indiquera que tout s'est bien déroulé.
Pour Vista ou Seven, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil. 

2)Télécharge Malwarebytes anti malware ici  
http://www.malwarebytes.org/mbam.php
 
* Installe le (choisis bien "français" ; ne modifie pas les paramètres d'installe ) et mets le à jour . 

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ 

* Potasse le tuto pour te familiariser avec le prg : 

https://forum.pcastuces.com/sujet.asp?f=31&s=3 

(cela dis, il est très simple d’utilisation). 

relance malwarebytes en suivant scrupuleusement ces consignes : 

! Déconnecte toi et ferme toutes applications en cours ! 

* Lance Malwarebyte's . 

Fais un examen dit "Complet" . 

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ). 
--> à la fin tu cliques sur "résultat" . 
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " . 

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le ! 


Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

3)Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Ou ici : https://forospyware.com 
>Renomme le pour l’enregistrer sur ton bureau en  asdehi (tout simplement pour que l’infection ne le contre pas)
-> Double clique combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

 Avant d'utiliser ComboFix :  

->  Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.  

->  Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

- Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur 

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

/!\  Ne touche à rien tant que le scan n'est pas terminé.  /!\ : risque de figer l'ordinateur (plantage complet) 


::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes


poste les rapports au fur et à mesure ;merci

@+

gambite2 · Answer

salut et merci pour ta rapidité.J'allais oublié bonne année.
voila après 4h30 de patience cela donne 
Malwarebytes' Anti-Malware 1.43
Version de la base de données: 3477
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

02/01/2010 19:05:10
mbam-log-2010-01-02 (19-05-10).txt

Type de recherche: Examen complet (C:\|D:\|K:\|)
Eléments examinés: 395025
Temps écoulé: 3 hour(s), 1 minute(s), 8 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 25

Processus mémoire infecté(s):
C:\WINDOWS\msb.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\c.exe (Trojan.Downloader) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
\?\globalroot\systemroot\system32\H8SRTubrettkvfy.dll (Rootkit.TDSS) -> Delete on reboot.
c:\WINDOWS\system32\sshnas.dll (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\All Users\Documents\Settings\cbss.dll (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sshnas (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbssreg (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PUT2VIDQLG (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\B1RQJ7YJ0U (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	askman (Trojan.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\put2vidqlg (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\RXToolBar (Adware.RXToolbar) -> Quarantined and deleted successfully.
C:\Program Files\malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
\?\globalroot\systemroot\system32\H8SRTubrettkvfy.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sshnas.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\msb.exe (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\c.exe (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\a.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\b.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\d.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\e.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\f.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\g.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\h.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\i.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\Installer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\sshnas.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\wbemperf.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\B6ZQNGC2\288-new[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-0712678946-3257261276-080464426-6373\mwau.exe (Worm.Autorun.B) -> Delete on reboot.
C:\WINDOWS\msa.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\krl32mainweq.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Menu Démarrer\Programmes\Démarrage\9635938.lnk (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Documents\Settings\cbss.dll (Trojan.Agent) -> Delete on reboot.
C:\bvnidya.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
Que dois je faire ,j'installe ComboFix  ou j'attend tes consigne?
Mais je continue quand même vue que mon ordi est très lent en se moment à 23h je pense etre encore la dessus merci à toi et je continue.

gambite2 · Answer

J'ai trouvé merci 
voila la suite
ComboFix 10-01-02.01 - HP_Administrateur 02/01/2010  22:28:01.2.1 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.1022.492 [GMT 1:00]
Lancé depuis: c:\documents and settings\HP_Administrateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\HP_Administrateur\Bureau\CFScript.txt
AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Bitdefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\windows\system32\drivers\bucyg.sys"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\bucyg.sys

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_bucyg
-------\Service_bucyg


(((((((((((((((((((((((((((((   Fichiers créés du 2009-12-02 au 2010-01-02  ))))))))))))))))))))))))))))))))))))
.

2010-01-02 14:02 . 2010-01-02 14:02	5061520	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-02 14:01 . 2010-01-02 14:01	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\Malwarebytes
2010-01-02 14:01 . 2009-12-30 13:55	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 14:01 . 2010-01-02 14:05	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-01-02 14:01 . 2010-01-02 14:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 14:01 . 2009-12-30 13:54	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-01-02 13:39 . 2010-01-02 13:39	--------	d-----w-	c:\program files\ZHPDiag
2010-01-01 21:57 . 2010-01-01 21:57	--------	d-----w-	c:\program files	rend micro
2010-01-01 21:57 . 2010-01-01 21:57	--------	d-----w-	C:sit
2009-12-31 10:17 . 2009-10-16 14:50	2520888	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins
pTVUAx.dll
2009-12-31 10:17 . 2008-03-04 17:52	286720	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll
2009-12-31 10:17 . 2007-10-31 08:39	59904	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll
2009-12-31 10:17 . 2007-05-17 12:58	143360	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll
2009-12-31 10:17 . 2006-10-18 16:32	499712	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll
2009-12-31 10:17 . 2006-10-18 16:32	348160	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll
2009-12-31 10:17 . 2006-10-16 17:44	196608	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll
2009-12-31 10:17 . 2006-10-16 17:44	1028096	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll
2009-12-30 20:34 . 2009-12-31 09:47	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\vlc
2009-12-28 21:19 . 2009-12-28 21:19	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\gtk-2.0
2009-12-28 21:19 . 2009-12-28 21:19	--------	d-----w-	c:\documents and settings\HP_Administrateur\.thumbnails
2009-12-26 22:35 . 2009-12-26 22:35	--------	d-----w-	c:\documents and settings\LocalService\Application Data\Roxio
2009-12-26 22:35 . 2009-12-26 22:35	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\Roxio
2009-12-26 22:29 . 2009-12-30 19:54	256	----a-w-	c:\windows\system32\pool.bin
2009-12-26 22:28 . 2009-12-26 22:28	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\Research In Motion
2009-12-26 22:12 . 2009-12-26 22:18	--------	d-----w-	c:\documents and settings\All Users\Application Data\Roxio
2009-12-26 22:12 . 2009-12-26 22:13	--------	d-----w-	c:\program files\Roxio
2009-12-26 22:12 . 2009-12-26 22:14	--------	d-----w-	c:\program files\Fichiers communs\Roxio Shared
2009-12-26 22:05 . 2007-01-18 09:24	26496	----a-r-	c:\windows\system32\drivers\RimSerial.sys
2009-12-26 22:03 . 2009-12-26 22:04	--------	d-----w-	c:\program files\Fichiers communs\Research In Motion
2009-12-26 22:03 . 2009-12-26 22:03	--------	d-----w-	c:\program files\Research In Motion
2009-12-22 19:02 . 2009-12-22 19:03	--------	d-----w-	c:\program files\CCleaner
2009-12-22 18:27 . 2009-12-22 18:27	--------	d-----w-	c:\program files\Lavalys
2009-12-19 11:28 . 2008-11-01 15:23	70656	----a-w-	C:\Keygen.exe
2009-12-17 19:15 . 2009-12-28 21:22	--------	d-----w-	c:\documents and settings\HP_Administrateur\.gimp-2.6
2009-12-17 18:59 . 2009-12-17 19:01	--------	d-----w-	c:\program files\GIMP-2.0
2009-12-10 17:16 . 2009-12-10 17:16	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\Zylom
2009-12-10 17:16 . 2006-09-26 11:03	98304	----a-w-	c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
2009-12-10 17:16 . 2006-09-26 11:03	161976	----a-w-	c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylomgamesplayer.dll
2009-12-10 17:16 . 2009-12-10 17:17	--------	d-----w-	c:\program files\Zylom Games
2009-12-04 09:03 . 2009-12-04 09:03	251376	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Mozilla\plugins
pgoogletalk.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-02 21:35 . 2008-06-24 11:04	81984	----a-w-	c:\windows\system32\bdod.bin
2010-01-01 22:39 . 2009-08-12 07:36	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\BitTorrent
2010-01-01 15:03 . 2006-01-02 20:12	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-12-27 01:51 . 2006-07-07 14:53	78544	-c--a-w-	c:\documents and settings\HP_Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-26 22:20 . 2009-10-10 08:52	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\InstallShield
2009-12-26 22:19 . 2006-01-02 19:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\Sonic
2009-12-24 22:51 . 2008-12-22 22:07	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\uTorrent
2009-12-24 13:58 . 2009-10-17 10:53	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\Audacity
2009-12-22 23:14 . 2006-01-02 19:52	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-12-20 14:33 . 2008-09-23 17:52	--------	d-----w-	c:\program files\Tom et Lisa
2009-12-20 14:26 . 2008-03-09 15:52	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg7
2009-12-20 09:39 . 2009-07-26 07:04	664	----a-w-	c:\windows\system32\d3d9caps.dat
2009-12-15 06:47 . 2005-10-10 11:39	512670	----a-w-	c:\windows\system32\perfh00C.dat
2009-12-15 06:47 . 2005-10-10 11:39	85784	----a-w-	c:\windows\system32\perfc00C.dat
2009-12-13 15:18 . 2009-12-03 17:48	1924744	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-12-09 21:48 . 2007-08-28 13:43	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-03 20:04 . 2009-12-03 20:04	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\CoSoSys
2009-12-02 17:31 . 2009-12-02 17:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Zylom
2009-12-02 17:30 . 2009-12-02 17:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\GameHouse
2009-12-02 07:22 . 2009-12-02 07:22	--------	d-----w-	c:\program files\WalterShop.com
2009-11-13 20:18 . 2009-09-03 16:27	--------	d-----w-	c:\documents and settings\HP_Administrateur\Application Data\HpUpdate
2009-11-05 17:56 . 2006-01-02 19:37	--------	d-----w-	c:\program files\Java
2009-11-05 17:54 . 2009-11-05 17:54	152576	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-05 17:54 . 2009-11-05 17:54	79488	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-02 18:11 . 2009-07-12 07:52	120	----a-w-	C:\drmHeader.bin
2009-10-29 07:44 . 2004-08-10 11:00	832512	------w-	c:\windows\system32\wininet.dll
2009-10-29 07:44 . 2004-08-10 11:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-10-29 07:44 . 2004-08-10 11:00	17408	----a-w-	c:\windows\system32\corpol.dll
2009-10-27 07:09 . 2009-10-27 07:09	2585872	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Research In Motion\BlackBerry\BBMediaSyncInstall\Tools\WindowsInstaller-KB893803-v2-x86.exe
2009-10-21 05:39 . 2004-08-10 11:00	75776	----a-w-	c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-10 11:00	25088	----a-w-	c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2009-01-25 10:31	265728	----a-w-	c:\windows\system32\drivers\http.sys
2009-10-17 10:05 . 2009-10-17 10:05	152576	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-15 19:04 . 2009-10-15 19:04	435720	----a-w-	c:\documents and settings\HP_Administrateur\Application Data\Real\Update\setup3.08\setup.exe
2009-10-13 10:33 . 2004-08-10 11:00	271360	----a-w-	c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2004-08-10 11:00	79872	----a-w-	c:\windows\system32aschap.dll
2009-10-12 13:39 . 2004-08-10 11:00	150528	----a-w-	c:\windows\system32astls.dll
2009-10-11 03:17 . 2009-03-12 06:31	411368	----a-w-	c:\windows\system32\deploytk.dll
2007-11-15 20:19 . 2006-08-06 20:27	2067968	-csha-w-	c:\program files\ehthumbs.db
2007-11-15 20:12 . 2007-11-15 20:11	1566720	-csha-w-	c:\program files\Fichiers communs\ehthumbs.db
2007-05-21 18:00 . 2007-05-21 18:00	251	-c--a-w-	c:\program files\wt3d.ini
2009-09-25 16:41 . 2009-09-25 16:41	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-04 16:04	1144712	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]
"{9ec204df-0e48-4c32-816e-2e928a4fd9c2}"= "mscoree.dll" [2008-07-25 282112]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{9ec204df-0e48-4c32-816e-2e928a4fd9c2}]
[HKEY_CLASSES_ROOT\IEToolbar.Toolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-04 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"Google Update"="c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-15 133104]
"Assistant DartyBox"="c:\program files\DartyBox_v3\Sagem\AssistantDB\AssistantDB_Sagem.exe" [2009-04-09 4665856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 106496]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-14 7323648]
"nwiz"="nwiz.exe" [2005-12-14 1519616]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-10 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2006-01-02 180269]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-09-11 368640]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"Ask and Record FLV Service"="c:\program files\Ask & Record Toolbar\FLVSrvc.exe" [2009-03-10 156672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"RoxWatchTray"="c:\program files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-06-26 236016]

c:\documents and settings\HP_Administrateur\Menu D‚marrer\Programmes\D‚marrage\
Sommaire de OneNote.onetoc2 [2007-10-27 3656]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\GoToAssist]
2009-10-10 08:56	10536	----a-w-	c:\program files\Citrix\GoToAssist\508\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrateur^Menu Démarrer^Programmes^Démarrage^Juice.lnk]
path=c:\documents and settings\HP_Administrateur\Menu Démarrer\Programmes\Démarrage\Juice.lnk
backup=c:\windows\pss\Juice.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrateur^Menu Démarrer^Programmes^Démarrage^OneNote 2007 - Capture d'écran et lancement.lnk]
path=c:\documents and settings\HP_Administrateur\Menu Démarrer\Programmes\Démarrage\OneNote 2007 - Capture d'écran et lancement.lnk
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrateur^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\HP_Administrateur\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 11:08	935288	----a-r-	c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-23 18:33	57344	----a-w-	c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 03:08	35696	----a-w-	c:\program files\Adobe\Reader 9.0\Readereader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:33	15360	------w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 19:34	64512	----a-w-	c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-11-20 12:20	290088	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-05-15 16:12	484904	----a-w-	c:\program files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-10-18 10:34	5724184	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Name of App]
2009-10-12 15:51	692321	----a-w-	c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-04 23:54	417792	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2006-11-24 00:06	487424	----a-w-	c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2009-12-23 22:00	289584	----a-w-	c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [02/01/2006 20:51 2815744]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [25/01/2008 14:40 86792]
S3 PLCMPR5;PLCMPR5 NDIS Protocol Driver;\??\c:\windows\system32\PLCMPR5.SYS --> c:\windows\system32\PLCMPR5.SYS [?]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [16/08/2008 20:03 17280]
S3 se57bus;Sony Ericsson Device 087 driver (WDM);c:\windows\system32\drivers\se57bus.sys [09/07/2008 18:58 61536]
S3 se57mdfl;Sony Ericsson Device 087 USB WMC Modem Filter;c:\windows\system32\drivers\se57mdfl.sys [22/09/2008 19:49 9360]
S3 se57mdm;Sony Ericsson Device 087 USB WMC Modem Driver;c:\windows\system32\drivers\se57mdm.sys [22/09/2008 19:49 97088]
S3 TV_551805_Sp50;TV_551805_Sp50 NDIS Protocol Driver;c:\windows\system32\drivers\TV_551805_Sp50.sys [14/08/2008 13:30 27072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ   	scan

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-05-15 16:08	452136	----a-w-	c:\program files\Fichiers communs\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'

2010-01-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]

2010-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-862268331-8224007-65136950-1007Core.job
- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-15 17:57]

2010-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-862268331-8224007-65136950-1007UA.job
- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-15 17:57]

2010-01-02 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-04 16:04]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.dartybox.com
uSearchMigratedDefaultURL = hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q={searchTerms}
uDefault_Search_URL = hxxp://www.durable.com/recherche
mStart Page = hxxp://www.durable.com/recherche
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.durable.com/recherche
uSearchURL,(Default) = hxxp://www.durable.com/recherche
IE: &Télécharger avec NetTransport - k:
ettransport 2\NTAddLink.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Tout t&élécharger avec NetTransport - k:
ettransport 2\NTAddList.html
DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} - hxxp://www.gamehouse.com/games/gamehouse/ghplayer.cab
FF - ProfilePath - c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.durable.com/recherche
FF - prefs.js: keyword.URL - hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
FF - plugin: c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\ijrnjsov.default\extensions\firefox@tvunetworks.com\plugins
pTVUAx.dll
FF - plugin: c:\documents and settings\HP_Administrateur\Application Data\Mozilla\plugins
pgoogletalk.dll
FF - plugin: c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Google\Update\1.2.183.13
pGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pzylomgamesplayer.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
 FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-02 22:40
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\EN]
@DACL=(02 0000)
"OnLineServicesDirName"="Online Services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\FR]
@DACL=(02 0000)
"OnLineServicesDirName"="Services en ligne"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\MX]
@DACL=(02 0000)
"OnLineServicesDirName"="Servicios en línea"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NL]
@DACL=(02 0000)
"OnLineServicesDirName"="Online Services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NW]
@DACL=(02 0000)
"OnLineServicesDirName"="Online tjenster"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SP]
@DACL=(02 0000)
"OnLineServicesDirName"="Servicios en línea"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SW]
@DACL=(02 0000)
"OnLineServicesDirName"="Online tjänster"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\UK]
@DACL=(02 0000)
"OnLineServicesDirName"="Online services"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\US]
@DACL=(02 0000)
"OnLineServicesDirName"="Online Services"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{48EF620C-07E8-45B1-9BEF-34F35644DA44}\Implemented Categories\{FD8ABB6D-B549-4a66-94A9-3C360CD70490}]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{9CD2C438-F8EA-4E77-A6D2-9346EC389E01}\Implemented Categories\{FD8ABB6D-B549-4a66-94A9-3C360CD70490}]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E353A52E-ADD0-426D-A7D3-4D750940BF1F}\Implemented Categories\{FD8ABB6D-B549-4a66-94A9-3C360CD70490}]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Classes\Software\RealNetworks\Update\6.0\Preferences\Components\Free:6.0\File38\ACCESSPOINT]
@DACL=(02 0000)
@SACL=
@="DESKTOP"

[HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\Browser]
@DACL=(02 0000)
@SACL=
"IE"="0"
"Netscape"="0"

[HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\BWOPT]
@DACL=(02 0000)
@SACL=
"bwsupport"="1"
"bwoffers"="0"

[HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\HPGuide]
@DACL=(02 0000)
@SACL=
"HPGuideLaunch"="0"

[HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\HPSU]
@DACL=(02 0000)
@SACL=
"OptInPath"="c:\hp\bin\cloaker.exe"
"OptInCmdLine"="c:\hp\drivers\hpsu\HPSU_optin.bat"
"OptOutPath"="c:\hp\bin\cloaker.exe"
"OptOutCmdLine"="c:\hp\drivers\hpsu\HPSU_optout.bat"
"hpsulaunch"="1"

[HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\NIS]
@DACL=(02 0000)
@SACL=
"NISRun"="0"
"NISPath"="c:\windows\system32\pcintro\autorun.exe"
"NISCmdLine"="security.cmd"

[HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Objects\Effects\Alchemy]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
@DACL=(02 0000)
@SACL=
"NoServices"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{077ACEC7-979C-40AB-9835-435BA1511E0D}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\WINDOWS\RegisteredPackages\{077ACEC7-979C-40AB-9835-435BA1511E0D}\MPPRE10.inf"
"ExceptionCatalogName"=expand:"c:\WINDOWS\RegisteredPackages\{077ACEC7-979C-40AB-9835-435BA1511E0D}\mppre10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{30C7234B-6482-4A55-A11D-ECD9030313F2}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\WMDM10.inf"
"ExceptionCatalogName"=expand:"c:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\wmdm10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{981FB688-E76B-4246-987B-92083185B90A}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\WPD10.inf"
"ExceptionCatalogName"=expand:"c:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wpd10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{A47B3654-48EE-48A5-B629-97D70175E58F}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\codecs10.inf"
"ExceptionCatalogName"=expand:"c:\WINDOWS\RegisteredPackages\{A47B3654-48EE-48A5-B629-97D70175E58F}\codecs10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\WMFSDK10.inf"
"ExceptionCatalogName"=expand:"c:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\wmfsdk10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}]
@DACL=(02 0000)
@SACL=
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}"
"Version"=dword:000a0000
"Sub-Version"=dword:000010ec
"ExceptionInfName"=expand:"c:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\DRM10.inf"
"ExceptionCatalogName"=expand:"c:\WINDOWS\RegisteredPackages\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}\drm10.cat"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash]
@DACL=(02 0000)
@SACL=
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Symantec\CCPD-LC]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Symantec\Shared Technology]
@DACL=(02 0000)
@SACL=

[HKEY_LOCAL_MACHINE\software\Symantec\SharedUsage]
@DACL=(02 0000)
@SACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1360)
c:\program files\Citrix\GoToAssist\508\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(1836)
c:\windows\system32
view.dll
c:\windows\system32\NVWRSFR.DLL
c:\documents and settings\HP_Administrateur\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll
c:\windows\system32
vwddi.dll
c:\windows\system32\eappprxy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32
vsvc32.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
c:\windows\ARPWRMSG.EXE
c:\windows\system32undll32.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-01-02  22:46:37 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-01-02 21:46
ComboFix2.txt  2010-01-02 20:46

Avant-CF: 100 601 352 192 octets libres
Après-CF: 100 564 848 640 octets libres

- - End Of File - - 5DFE7A6F23B5DBA6928E061D588C2251

gambite2 · Answer

Bonjours 
bien dormi!!!! fais beau ici à Paris.
voila la suite

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 26.12.2009 à 20:47
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 11:11:51, 03/01/2010 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: NOM-FB9B15D2723 | Utilisateur actuel: HP_Administrateur

Bonnes fêtes de fin d'année à vous tous :)
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.

C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla\FireFox\Profiles\ijrnjsov.default\extensions	oolbar@ask.com 
C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla\FireFox\Profiles\ijrnjsov.default\searchplugins\ask.xml 
C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla\FireFox\Profiles\ijrnjsov.default\searchplugins\askcom.xml 
C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} 
C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js 
C:\Program Files\Mozilla FireFox\Components\AskSearch.js 
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job 
C:\Program Files\Ask.com 
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\AskToolbar 
.
HKCU\software\appdatalow\AskBarDis
HKCU\software\appdatalow\AskHomepage
HKCU\software\Ask.com
HKCU\software\AskToolbar
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\software\classes\appid\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\classes\GenericAskToolbar.ToolbarWnd
HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKU\s-1-5-21-862268331-8224007-65136950-1007\software\appdatalow\AskBarDis
HKU\s-1-5-21-862268331-8224007-65136950-1007\software\appdatalow\AskHomepage
HKU\s-1-5-21-862268331-8224007-65136950-1007\software\Ask.com
HKU\s-1-5-21-862268331-8224007-65136950-1007\software\AskToolbar
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.6 [fr] *
.
 Nom du profil: ijrnjsov.default (HP_Administrateur)
.
(HP_ADM~1, prefs.js) Browser.download.dir, C:\Documents and Settings\HP_Administrateur\Bureau
(HP_ADM~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\HP_Administrateur\Mes documents\PAULINA
(HP_ADM~1, prefs.js) Browser.search.defaultenginename, Durable
(HP_ADM~1, prefs.js) Browser.search.defaulturl, hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
(HP_ADM~1, prefs.js) Browser.search.selectedEngine, Google
(HP_ADM~1, prefs.js) Browser.startup.homepage, hxxp://www.durable.com/recherche
(HP_ADM~1, prefs.js) Extensions.enabledItems, toolbar@ask.com:3.4.4.113,{c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,tv@programs:1.1.1,firefox@tvunetworks.com:2,4,9,1,toolbar@waltershop.com:1.0,{635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(HP_ADM~1, prefs.js) Keyword.URL, hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
(HP_ADM~1, prefs.js) Privacy.popups.showBrowserMessage, false
. 
(HP_ADM~1, prefs.js) TROUVE - Browser.search.defaultengine, Ask.com
(HP_ADM~1, prefs.js) TROUVE - Browser.search.order.1, Ask.com
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.cbid, PQ
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.default-channel-url-mask, hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.fresh-install, false
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.l, dis
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.last-config-req, 1262383627580
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.locale, en_US
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.o, 14912
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.options-lang, en
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.options-locale, US
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.overlay-reloaded-using-restart, true
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.qsrc, 2871
(HP_ADM~1, prefs.js) TROUVE - Extensions.asktb.r, 4
(HP_ADM~1, prefs.js) TROUVE - Extensions.enabledItems, toolbar@ask.com:3.4.4.113,{c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,tv@programs:1.1.1,firefox@tvunetworks.com:2,4,9,1,toolbar@waltershop.com:1.0,{635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(HP_ADM~1, prefs.js) TROUVE - Extensions.snipit.chromeURL, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q={searchTerms}&crm=1
. 
. 
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Show_ToolBar: yes
Start Page: hxxp://www.dartybox.com
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Enable Browser Extensions: yes
Use Search Asst: no
Use Custom Search URL: 1 (0x1)
Default_Search_URL: hxxp://www.durable.com/recherche
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Start Page: hxxp://www.durable.com/recherche
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: hxxp://www.durable.com/recherche
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Adobe Photoshop 7.0 with serial.torrent
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Adobe Photoshop CS4 Extended + Activator & Serial.rar.torrent
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Adobe Photoshop CS4 Me_with_working_crack.torrent
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Photoshop CS4 (Keygen and tutorial).rar.torrent
C:\Documents and Settings\HP_Administrateur\Favoris\Nettoye pc\adob\Adobe Photoshop CS4 Extended Final + Keygen + Portable (download torrent) - TPB.url
C:\Documents and Settings\HP_Administrateur\Favoris\Nettoye pc\adob\Photoshop CS4 Extended (Activation Tutorial + Keygens + Screensh (download torrent) - TPB.url
.
===================================
.
10035 Octet(s) - C:\Ad-Report-SCAN[1].log 
.
9 Fichier(s) - C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp 
6 Fichier(s) - C:\WINDOWS\Temp 
50 Fichier(s) - C:\WINDOWS\Prefetch 
.
2 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à: 11:22:08 | 03/01/2010 - SCAN[1]
.
============== E.O.F ==============
.

gambite2 · Answer

window ne trouve le chemin pour ad-r c'est le message que j'ai

gambite2 · Answer

je recommence

gambite2 · Answer

ça à marché 
.
======= RAPPORT D'AD-REMOVER 1.1.4.6_G | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 03.01.2010 à 12:47
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 13:58:19, 03/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Nom du PC: NOM-FB9B15D2723 | Utilisateur actuel: HP_Administrateur

.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla\FireFox\Profiles\ijrnjsov.default\extensions	oolbar@ask.com 
C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla\FireFox\Profiles\ijrnjsov.default\searchplugins\ask.xml 
C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla\FireFox\Profiles\ijrnjsov.default\searchplugins\askcom.xml 
C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} 
C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js 
C:\Program Files\Mozilla FireFox\Components\AskSearch.js 
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job 
C:\Program Files\Ask.com 
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\AskToolbar 

(!) -- Fichiers temporaires supprimés.
 
.
HKCU\software\appdatalow\AskBarDis
HKCU\software\appdatalow\AskHomepage
HKCU\software\Ask.com
HKCU\software\AskToolbar
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} 
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\software\classes\appid\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\classes\GenericAskToolbar.ToolbarWnd
HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.6 [fr] *
.
 Nom du profil: ijrnjsov.default (HP_Administrateur)
.
(HP_ADM~1, prefs.js) Browser.download.dir, C:\Documents and Settings\HP_Administrateur\Bureau
(HP_ADM~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\HP_Administrateur\Mes documents\PAULINA
(HP_ADM~1, prefs.js) Browser.search.defaultenginename, Durable
(HP_ADM~1, prefs.js) Browser.search.defaulturl, hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
(HP_ADM~1, prefs.js) Browser.search.selectedEngine, Google
(HP_ADM~1, prefs.js) Browser.startup.homepage, hxxp://www.durable.com/recherche
(HP_ADM~1, prefs.js) Extensions.enabledItems, toolbar@ask.com:3.4.4.113,{c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,tv@programs:1.1.1,firefox@tvunetworks.com:2,4,9,1,toolbar@waltershop.com:1.0,{635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(HP_ADM~1, prefs.js) Keyword.URL, hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=
(HP_ADM~1, prefs.js) Privacy.popups.showBrowserMessage, false
. 
(HP_ADM~1, prefs.js) EFFACE - Browser.search.defaultengine, Ask.com
(HP_ADM~1, prefs.js) EFFACE - Browser.search.order.1, Ask.com
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.cbid, PQ
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.default-channel-url-mask, hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.fresh-install, false
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.l, dis
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.last-config-req, 1262383627580
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.locale, en_US
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.o, 14912
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.options-lang, en
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.options-locale, US
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.overlay-reloaded-using-restart, true
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.qsrc, 2871
(HP_ADM~1, prefs.js) EFFACE - Extensions.asktb.r, 4
(HP_ADM~1, prefs.js) EFFACE - Extensions.enabledItems, toolbar@ask.com:3.4.4.113,{c50ca3c4-5656-43c2-a061-13e717f73fc8}:3.0.8,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:1.1,tv@programs:1.1.1,firefox@tvunetworks.com:2,4,9,1,toolbar@waltershop.com:1.0,{635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.6
(HP_ADM~1, prefs.js) EFFACE - Extensions.snipit.chromeURL, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q={searchTerms}&crm=1
. 
. 
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Enable Browser Extensions: yes
Use Search Asst: no
Use Custom Search URL: 1 (0x1)
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Adobe Photoshop 7.0 with serial.torrent
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Adobe Photoshop CS4 Extended + Activator & Serial.rar.torrent
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Adobe Photoshop CS4 Me_with_working_crack.torrent
C:\Documents and Settings\HP_Administrateur\Application Data\BitTorrent\Photoshop CS4 (Keygen and tutorial).rar.torrent
C:\Documents and Settings\HP_Administrateur\Favoris\Nettoye pc\adob\Adobe Photoshop CS4 Extended Final + Keygen + Portable (download torrent) - TPB.url
C:\Documents and Settings\HP_Administrateur\Favoris\Nettoye pc\adob\Photoshop CS4 Extended (Activation Tutorial + Keygens + Screensh (download torrent) - TPB.url
.
===================================
.
10033 Octet(s) - C:\Ad-Report-CLEAN[1].log 
10401 Octet(s) - C:\Ad-Report-SCAN[1].log 
.
0 Fichier(s) - C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp 
2 Fichier(s) - C:\WINDOWS\Temp 
9 Fichier(s) - C:\WINDOWS\Prefetch 
.
20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
79 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
Fin à: 14:09:27 | 03/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.
je passe à la suite

gambite2 · Answer

j'ai pas de lien sur le bureau mais un bloc note qui s'ouvre voila le résulta
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:54, on 03/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\DartyBox_v3\Sagem\AssistantDB\AssistantDB_Sagem.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dartybox.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.durable.com/recherche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: WalterShop - {9ec204df-0e48-4c32-816e-2e928a4fd9c2} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Ask and Record FLV Service] "C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Assistant DartyBox] C:\Program Files\DartyBox_v3\Sagem\AssistantDB\AssistantDB_Sagem.exe -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Sommaire de OneNote.onetoc2
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Télécharger avec NetTransport - K:\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout t&élécharger avec NetTransport - K:\NetTransport 2\NTAddList.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://www.gamehouse.com/games/gamehouse/ghplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\508\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\508\g2aservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

gambite2 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by HP_Administrateur at 2010-01-03 14:39:47
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 96 GB (52%) free of 184 GB
Total RAM: 1022 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:39:48, on 03/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\DartyBox_v3\Sagem\AssistantDB\AssistantDB_Sagem.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\HP_Administrateur\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\HP_Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dartybox.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.durable.com/recherche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: WalterShop - {9ec204df-0e48-4c32-816e-2e928a4fd9c2} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Ask and Record FLV Service] "C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Assistant DartyBox] C:\Program Files\DartyBox_v3\Sagem\AssistantDB\AssistantDB_Sagem.exe -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: Sommaire de OneNote.onetoc2
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Télécharger avec NetTransport - K:\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout t&élécharger avec NetTransport - K:\NetTransport 2\NTAddList.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} (GameHouse Games Player) - http://www.gamehouse.com/games/gamehouse/ghplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\508\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\508\g2aservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

gambite2 · Answer

Qui cherche trouve !!!!!!!!!!!!!!!!!!!!!!!!!

info.txt logfile of random's system information tool 1.06 2010-01-01 22:57:49

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920}
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->MsiExec.exe /I{48A669A9-76FA-4CA8-BFD5-00C125AC4166}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Amélioration de nos services-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1036 
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Applian FLV Player-->"C:\WINDOWS\Applian FLV Player\uninstall.exe" "/U:C:\Uninstall\uninstall.xml"
Ask & Record Toolbar 4.01 -->"C:\WINDOWS\Ask & Record Toolbar\uninstall.exe" "/U:C:\Program Files\Ask & Record Toolbar\Uninstall\uninstall.xml"
Ask Toolbar-->MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Audacity 1.3.9 (Unicode)-->"C:\Program Files\Audacity 1.3 Beta (Unicode)\unins000.exe"
BitDefender Internet Security 2008-->MsiExec.exe /I{BF7D87C5-CFC3-40C5-A367-24586EEBB8CA}
BlackBerry Desktop Software 4.6-->MsiExec.exe /I{D0C2E24E-2496-42F8-A065-E5E49B6C1088}
BlackBerry Desktop Software 4.6-->MsiExec.exe /i{D0C2E24E-2496-42F8-A065-E5E49B6C1088}
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CD Installation DartyBox-->"C:\Program Files\InstallShield Installation Information\{2962D91C-4D8F-46F8-AD24-0E17A92207A2}\setup.exe" -runfromtemp -l0x040c -removeonly
Code de la Route - 10 Examens Blancs-->C:\Program Files\InstallShield Installation Information\{4E91E503-7370-4EC3-AEAC-948A46B8B50A}\SETUP.EXE -runfromtemp -l0x040c
Code de la Route-->C:\Program Files\InstallShield Installation Information\{B9A3CA56-2B6A-4FE3-8CB8-F17BD5FCDB75}\SETUP.EXE -runfromtemp -l0x040c
Code de la Route-->MsiExec.exe /X{A37A26D5-8444-4862-933B-478371D0299D}
Coloriage-->C:\WINDOWS\GPInstall.exe "/UNINST=K:\UnInst01.log" "/APPNAME=Coloriage"
Connexion Facile à Internet-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1036 
Correctif pour Lecteur Windows Media 10 (KB910393)-->"C:\WINDOWS\$NtUninstallKB910393$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
DartyBox-->C:\Program Files\InstallShield Installation Information\{4A975AC1-1E5B-43B7-B42B-6E617B39C936}\setup.exe -runfromtemp -l0x040c -removeonly
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule-->"K:\wd_windows_tools\eMule\Uninstall.exe"
Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /u
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
FLV Video Downloader Trial 1.0-->C:\Program Files\Diplodock\FLV Video Downloader Trial\uninst.exe
FW LiveUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11F5D779-7BD9-465A-BBC4-10701386BCB9}\setup.exe" -l0x9  -removeonly
GemMaster Mystic-->"C:\Program Files\GemMasterFrench\uninstallgemmaster.exe"
GIMP 2.6.7-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Google Talk Plugin-->MsiExec.exe /I{5299C5E1-70F9-3D1D-A1FA-BDECA4EC8015}
GoToAssist 8.0.0.508-->C:\Program Files\Citrix\GoToAssist\508\G2AUninstaller.exe /uninstall
High Definition Audio - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Appareils photos Photosmart 5.0-->C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Boot Optimizer-->C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall
HP Deskjet Printer Preload-->MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP DigitalMedia Archive-->MsiExec.exe /X{F80239D8-7811-4D5E-B033-0D0BBFE32920}
HP Document Viewer 5.3-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 1.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe"  -uninstall
HP Imaging Device Functions 6.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart 330,380,420,470,7800,8000,8200 Series-->C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart for Media Center PC-->c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u
HP Photosmart Premier Software 6.0-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
J2SE Runtime Environment 5.0 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150050}
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
MainConcept for Software Encoder-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{E7A02A01-C75A-4490-A168-5CA709A3D862} 
Microsoft .NET Framework 1.0 Hotfix (KB953295)-->"C:\WINDOWS\$NtUninstallKB953295$\spuninst\spuninst.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{511DF669-2930-30C0-8EB6-552887E29EC8}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack - fra-->MsiExec.exe /I{5B76AEA2-D4E5-3B55-B965-ACC36AE0EAFC}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Works-->MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB974455)-->"C:\WINDOWS\ie7updates\KB974455-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB976325)-->"C:\WINDOWS\ie7updates\KB976325-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Mise à jour pour Lecteur Windows Media 10 (KB913800)-->"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
Mise à jour pour Lecteur Windows Media 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 7 (KB976749)-->"C:\WINDOWS\ie7updates\KB976749-IE7\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
MobileMe Control Panel-->MsiExec.exe /I{2604C0F9-BFD3-4BA0-9EB5-22537C648F03}
Module linguistique Microsoft .NET Framework 3.5 - fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - fra\setup.exe
Mozilla Firefox (3.5.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
muvee autoProducer unPlugged 1.2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35DD9A1D-B340-4F41-A8B0-6EEBFB119280}\setup.exe" -l0x40c 
Nero 7 Essentials-->MsiExec.exe /X{1DED92A7-05FA-4736-8AEA-1BE2363F1036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32
vudisp.exe UninstallGUI
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Otto-->"C:\Program Files\FrenchOtto\uninstallotto.exe"
PS2-->C:\WINDOWS\system32\ps2.exe uninstall
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
Roxio Media Manager-->MsiExec.exe /X{EB3DF81F-5E70-4722-9D99-C1FC3EEF4DE1}
SAGEM TURBO PLUG-->C:\Program Files\InstallShield Installation Information\{D3A4B00E-D0BC-4F50-B8A6-9BA49C999A15}\Setup.exe -runfromtemp -l0x040c -removeonly
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Services Internet-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{5CFD7508-7774-48FE-8280-7A3C0AE71755} /l1036 
Sonic Express Labeler-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio-->MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy-->MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data-->MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
Sony Ericsson PC Suite-->MsiExec.exe /I{FC906D5C-91F9-4DA4-A765-6DCBB669F317}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Streambox Ripper-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Streambox\Streambox Ripper\Uninst.isu"
Subtitle Workshop 2.51-->"K:\Subtitle Workshop\uninstall.exe"
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Windows XP (KB953356)-->"C:\WINDOWS\$NtUninstallKB953356$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VLC media player 1.0.3-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WalterShop-->C:\Program Files\WalterShop.com\uninstaller.exe
WD Diagnostics-->MsiExec.exe /X{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB908250-->"C:\WINDOWS\$NtUninstallKB908250$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB973768-->"C:\WINDOWS\$NtUninstallKB973768$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: Bitdefender Antivirus
FW: Norton Internet Worm Protection (disabled)
FW: Bitdefender Firewall

======System event log======

Computer Name: NOM-FB9B15D2723
Event Code: 7036
Message: Le service Acquisition d'image Windows (WIA) est entré dans l'état : en cours d'exécution.

Record Number: 34633
Source Name: Service Control Manager
Time Written: 20091129110007.000000+060
Event Type: Informations
User: 

Computer Name: NOM-FB9B15D2723
Event Code: 7036
Message: Le service Carte de performance WMI est entré dans l'état : en cours d'exécution.

Record Number: 34632
Source Name: Service Control Manager
Time Written: 20091129110005.000000+060
Event Type: Informations
User: 

Computer Name: NOM-FB9B15D2723
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service BDSelfPr.

Record Number: 34631
Source Name: Service Control Manager
Time Written: 20091129110005.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: NOM-FB9B15D2723
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Carte de performance WMI.

Record Number: 34630
Source Name: Service Control Manager
Time Written: 20091129110005.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: NOM-FB9B15D2723
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Acquisition d'image Windows (WIA).

Record Number: 34629
Source Name: Service Control Manager
Time Written: 20091129110004.000000+060
Event Type: Informations
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: NOM-FB9B15D2723
Event Code: 20
Message: 
Record Number: 16770
Source Name: Google Update
Time Written: 20091006215752.000000+120
Event Type: erreur
User: NOM-FB9B15D2723\HP_Administrateur

Computer Name: NOM-FB9B15D2723
Event Code: 20
Message: 
Record Number: 16769
Source Name: Google Update
Time Written: 20091006211538.000000+120
Event Type: erreur
User: NOM-FB9B15D2723\HP_Administrateur

Computer Name: NOM-FB9B15D2723
Event Code: 20
Message: 
Record Number: 16768
Source Name: Google Update
Time Written: 20091006205750.000000+120
Event Type: erreur
User: NOM-FB9B15D2723\HP_Administrateur

Computer Name: NOM-FB9B15D2723
Event Code: 20
Message: 
Record Number: 16767
Source Name: Google Update
Time Written: 20091006201537.000000+120
Event Type: erreur
User: NOM-FB9B15D2723\HP_Administrateur

Computer Name: NOM-FB9B15D2723
Event Code: 20
Message: 
Record Number: 16766
Source Name: Google Update
Time Written: 20091006195751.000000+120
Event Type: erreur
User: NOM-FB9B15D2723\HP_Administrateur

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Python22;C:\Program Files\Fichiers communs\Teleca Shared;C:\Program Files\Fichiers communs\DivX Shared\;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Fichiers communs\Roxio Shared\DLLShared\;C:\Program Files\Fichiers communs\Roxio Shared\DLLShared\;C:\Program Files\Fichiers communs\Roxio Shared\9.0\DLLShared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2f02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=c:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

gambite2 · Answer

1er partie
All processes killed
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\sysReserve.ini moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 30157 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: HP_Administrateur
->Temp folder emptied: 6002 bytes
->Temporary Internet Files folder emptied: 7171815 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 46922888 bytes
->Apple Safari cache emptied: 7437814 bytes
 
User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: Willy
 
%systemdrive% .tmp files removed: 734003136 bytes
%systemroot% .tmp files removed: 3191748 bytes
%systemroot%\System32 .tmp files removed: 206833856 bytes
Windows Temp folder emptied: 511 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 959,00 mb
 
 
OTM by OldTimer - Version 3.1.4.0 log created on 01032010_151214

gambite2 · Answer

2eme partie

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:apport_clean.txt: trouvé !
C:\!Killbox: trouvé !
C:\HijackThis: trouvé !
C:\Qoobox: trouvé !
C:\_OTM: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\OTM.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\Ad-R.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\KillBox.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Navilog1.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Blocs notes\fixnavi.txt: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Blocs notes\cleannavi.txt: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Blocs notesapport_clean.txt: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\ENTRETIENT\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Raccourcis Bureau non utilisés\Navilog1.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\HP_Administrateur\Recent\HijackThis.lnk: trouvé !
C:\hijack this\HijackThis.exe: trouvé !
C:\hijack this\hijackthis.log: trouvé !
C:\hijackthis\HijackThis.exe: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\Program Files	rend micro\HijackThis: trouvé !
C:\Program Files	rend micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files	rend micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

gambite2 · Answer

Bonsoir voila la 3 eme partie
[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:apport_clean.txt: trouvé !
C:\!Killbox: trouvé !
C:\HijackThis: trouvé !
C:\Qoobox: trouvé !
C:\_OTM: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\OTM.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\Ad-R.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\KillBox.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Navilog1.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Blocs notes\fixnavi.txt: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Blocs notes\cleannavi.txt: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Blocs notesapport_clean.txt: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\ENTRETIENT\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\le foutoires\Raccourcis Bureau non utilisés\Navilog1.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\HP_Administrateur\Recent\HijackThis.lnk: trouvé !
C:\hijack this\HijackThis.exe: trouvé !
C:\hijack this\hijackthis.log: trouvé !
C:\hijackthis\HijackThis.exe: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\Program Files	rend micro\HijackThis: trouvé !
C:\Program Files	rend micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files	rend micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

gambite2 · Answer

Ho!! HO je me suis trompé de fichié mille excuses

BitDefender Log File !!!!!
Product : BitDefender Internet Security 2008 
Version : BitDefender UIScanner v.11 
Log date : 20:32:46 03/01/2010 
Log path : C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\deep_scan\1262547166_1_02.xml 

Scan Paths:Path0000: C:\ 
Path0001: D:\ 
Path0002: K:\ 


Scan Options:Scan for viruses : Yes 
Scan for adware : Yes 
Scan for spyware : Yes 
Scan for applications : Yes 
Scan for dialers : Yes 
Scan for rootkits : Yes 


Target selection options:Scan registry keys : Yes 
Scan cookies : Yes 
Scan boot sectors : Yes 
Scan memory processes : Yes 
Scan archives : Yes 
Scan runtime packers : Yes 
Scan emails : Yes 
Scan all files : Yes 
Heuristic Scan : Yes 
Scanned extensions :  
Excluded extensions :  


Target ProcessingDefault action for infected objects : Disinfect 
Default action for suspicious objects : None 
Default action for hidden objects : None 


Scan engines summaryNumber of virus signatures : 4810856 
Archive plugins : 44 
Email plugins : 6 
Scan plugins : 13 
Archive plugins : 44 
System plugins : 5 
Unpack plugins : 8 


Overall scan summaryScanned items : 1112952 
Infected items : 6 
Suspicious items : 0 
Resolved items : 1 
Individual viruses found : 4 
Scanned directories : 17647 
Scanned boot sectors : 3 
Scanned archives : 21646 
Input-output errors : 0 
Scan time : 00:04:58:02 
Files per second : 62 


Scanned processes summaryScanned : 48 
Infected : 0 


Scanned registry keys summaryScanned : 1486 
Infected : 0 


Scanned cookies summaryScanned : 49 
Infected : 1 


Remaining issues:Object Name Threat Name Final Status 
K:\wd_windows_tools\eMule\Incoming\alela diane (2008 Tour Edition).rar=]Setup.exe MemScan:Trojan.Generic.1560919 Delete Failed (file was in an archive) 
K:\film\Adobe Photoshop CS4 Extended + Activator & Serial.rar=]Adobe Photoshop CS4\ACTIVATE Adobe Photoshop\Photoshop CS4 Activation Blocker.exe=](CAB Sfx r)=]taskhost.exe Trojan.Generic.2571251 Infected (no action was possible, file was in an archive) 
K:\film\Adobe Photoshop CS4 Extended + Activator & Serial.rar=]Adobe Photoshop CS4\ACTIVATE Adobe Photoshop\Photoshop CS4 Activation Blocker.exe=](IExpress 0)=]taskhost.exe Trojan.Generic.2571251 Infected (no action was possible, file was in an archive) 
K:\film\PhotoshopCS4Portable.rar=]PhotoshopCS4Portable\PhotoshopPortable.exe=](NSIS o)=]bzip2_solid_nsis0001=](RAR Sfx o)=]wbemperf.exe=](NSIS o)=]bzip2_nsis0002 Trojan.Generic.IS.100071 Infected (no action was possible, file was in an archive) 
K:\film\PhotoshopCS4Portable.rar=]PhotoshopCS4Portable\PhotoshopPortable.exe=](NSIS o)=]bzip2_solid_nsis0001=](Dropped 1)=](NSIS o)=]bzip2_nsis0002 Trojan.Generic.IS.100071 Infected (no action was possible, file was in an archive) 


Resolved issues:Object Name Threat Name Final Status 
[System]=]C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@bs.serving-sys[2].txt Cookie.BS.Serving-Sys Deleted 


Objects that were not scanned:Object Name Reason Final Status 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Audio/Click1.ogg Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Audio/High1.ogg Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/autorun.cdd Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Buttons/14_1739.btn Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Buttons/orange_pill.btn Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Docs/setup_modem.exe Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Icons/Darty.ico Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]AutoPlay/Images/Accueil_choice_modem.bmp Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]autorun.exe Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]Darty.ico Password-Protected No action was possible 
C:\Program Files\CD_DartyBox\AMS\ChoixDartyBox.exe=](ZIP Sfx o)=]Thumbs.db Password-Protected No action was possible 
C:\winzip\wz100fev.exe=](ZIP Sfx s)=]SETUP.WZ=]WINZIP32.EX_ Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\01. Gnarls Barkley - Go Go Gadget Gospel.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\02. Gnarls Barkley - Crazy.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\03. Gnarls Barkley - St Elsewhere.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\04. Gnarls Barkley - Gone Daddy Gone.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\05. Gnarls Barkley - Smiley Faces.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\06. Gnarls Barkley - The Boogie Monster.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\07. Gnarls Barkley - Feng Shui.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\08. Gnarls Barkley - Just A Thought.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\09. Gnarls Barkley - Transformer.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\10. Gnarls Barkley - Who Cares.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\11. Gnarls Barkley - On-Line.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\12. Gnarls Barkley - Necromancing.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\13. Gnarls Barkley - Storm Coming.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\14. Gnarls Barkley - The Last Time.mp3 Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Artist Info.txt Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Front.jpg Password-Protected No action was possible 
K:\muisiques\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop.rar=]Gnarls Barkley - St. Elsewhere (Retail 2006) - Hip Hop\gnarls.jpg Password-Protected No action was possible

gambite2 · Answer

Bonsoir 
Je ne sais comment te remercier tu 'mas sauvé la mise et je t'en remerci.
A+ sur la toile

gambite2 · Answer

Merci pour la suite je pensais avoir fini avec sa.
J'ai instalé easycleaner pour effacer les doublons mais je n'ai pas compris si il effasait juste les doublons ou les doublons + l'original?Désoler pour la question mais ds les tutoras il ne l'explique pas merci pour d'avance .

gambite2 · Answer

ok merci

gambite2 · Answer

ok

Virus pc

18 réponses

Newsletters