coucou ben voilà ce qui se passe :
je vous montre un screen :
un lien a affiché dirrectement dont un scann... etc...

Hello,

C'est très probablement un rogue !

• Télécharge Malwarebytes' Anti-Malware (MBAM)
• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
• Sélectionne "Exécuter un examen complet"
• Clique sur "Rechercher"
• L'analyse démarre, le scan est relativement long, c'est normal.
• A la fin de l'analyse, un message s'affiche :
  

  L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  
  Clique sur "OK" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
• Ferme tes navigateurs.
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

• Double-clique sur RSIT.exe afin de lancer RSIT.
• Clique Continue à l'écran Disclaimer.
• Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
  ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
• NB : Les rapports sont sauvegardés dans le dossier C:\rsit

@+

rapport de MBAM :

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Version de la base de données: 4044

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28/04/2010 15:09:01
mbam-log-2010-04-28 (15-09-01).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 253362
Temps écoulé: 1 heure(s), 19 minute(s), 42 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{5F76EFD3-1EB7-45BC-A0E6-A2E3453F9A47}\RP44\A0017726.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

rapport rsit log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by dominique at 2010-04-28 15:19:14
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (3%) free of 238 GB
Total RAM: 2047 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:19:42, on 28/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\VNICMon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\USBIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Secunia\PSI\psi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Fichiers communs\Java\Java Update\jucheck.exe
C:\Documents and Settings\dominique\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\dominique.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/splitcam/{CFFA15AC-1B5C-4D98-8521-0CED71039D83}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NIC Monitor] VNICMon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MCI USB Icon] C:\WINDOWS\system32\USBIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453862 14
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Détection de dispositifs) - http://www.logitech.com/devicedetector/ ... tion32.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b47946.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 10313 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{916D55B7-C976-4802-8158-E7CF3BBA8E05}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-01 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-01 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"Muscbrigade"=c:\Musicbrigade\Musicbrigade.exe [2005-12-22 40960]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2006-10-01 190024]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [2002-03-18 188416]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-10-25 282624]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2006-10-30 256576]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-01-14 37888]
"NIC Monitor"=C:\WINDOWS\system32\VNICMon.exe [2002-12-17 40960]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-01-11 15961088]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-05-01 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-05-01 13750272]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-03-05 1135912]
"SunJavaUpdateSched"=C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [2010-02-18 248040]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"MCI USB Icon"=C:\WINDOWS\system32\USBIcon.exe [2004-09-17 81920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"fsc-reminder.exe"=C:\WINDOWS\reminder\fsc-reminder.exe 2453862 14 []
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet []
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-03-09 26100520]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe -silent []
"MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2006-10-01 190024]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Démarrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE

C:\Documents and Settings\dominique\Menu Démarrer\Programmes\Démarrage
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
Secunia PSI.lnk - C:\Program Files\Secunia\PSI\psi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
tkbdra.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\EA GAMES\MOHDA\MOHAA.exe"="C:\Program Files\EA GAMES\MOHDA\MOHAA.exe:*:Enabled:Medal of Honor Allied Assault(tm)"
"C:\Program Files\Messenger\Msmsgs.exe"="C:\Program Files\Messenger\Msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Download\utorrent.exe"="C:\Download\utorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\dominique\Bureau\Domi\Nouveau dossier\zsnesw.exe"="C:\Documents and Settings\dominique\Bureau\Domi\Nouveau dossier\zsnesw.exe:*:Enabled:zsnesw"
"C:\Program Files\zbattle.net\zbattle.net.exe"="C:\Program Files\zbattle.net\zbattle.net.exe:*:Enabled:zbattle.net"
"C:\Documents and Settings\dominique\Mes documents\Mes fichiers reçus\zsnesw.exe"="C:\Documents and Settings\dominique\Mes documents\Mes fichiers reçus\zsnesw.exe:*:Enabled:zsnesw"
"C:\Documents and Settings\dominique\Bureau\Domi\zsnes\zsnesw.exe"="C:\Documents and Settings\dominique\Bureau\Domi\zsnes\zsnesw.exe:*:Enabled:zsnesw"
"C:\zsnes\zsnesw.exe"="C:\zsnes\zsnesw.exe:*:Enabled:zsnesw"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\StubInstaller.exe"="C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Disabled:Yahoo! Messenger"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Conference\Conference.dll"="C:\Program Files\Conference\Conference.dll:*:Enabled:Audio/Video Conference by KIOSK Team"
"C:\Program Files\Electronic Arts\Need for Speed Carbon\NFSC.exe"="C:\Program Files\Electronic Arts\Need for Speed Carbon\NFSC.exe:*:Enabled:NFSC"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\Spotify\spotify.exe"="C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify"
"C:\Program Files\EA SPORTS\FIFA 2003\fifa2003.exe"="C:\Program Files\EA SPORTS\FIFA 2003\fifa2003.exe:*:Enabled:TestGame"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\world\World of Warcraft\WoW-3.2.0-frFR-downloader.exe"="C:\world\World of Warcraft\WoW-3.2.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"\"="C:\WINDOWS\system\svchost.exe:*:Enabled:KL"
"C:\WINDOWS\TEMP\mdqw.tmp\svchost.exe"="C:\WINDOWS\TEMP\mdqw.tmp\svchost.exe:*:Enabled:Service Updates"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c286f80-4583-11db-8ddc-0090d00cd4a3}]
shell\AutoRun\command - J:\wd_windows_tools\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93452c10-320a-11df-8fa5-003005a3f19b}]
shell\AutoRun\command - pbudsara.exe
shell\open\command - pbudsara.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{980d8e48-3c98-11df-8fc2-003005a3f19b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL JaNeD.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c507c432-2c24-11df-8f98-003005a3f19b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OperaTEUR.EXE


======List of files/folders created in the last 1 months======

2010-04-28 15:19:14 ----D---- C:\rsit
2010-04-21 02:19:18 ----A---- C:\WINDOWS\system32\MRT.INI
2010-04-21 02:15:56 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-21 02:15:36 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-20 16:14:21 ----D---- C:\icons
2010-04-20 16:14:20 ----A---- C:\WINDOWS\system32\usbicon.exe
2010-04-17 01:41:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-17 01:39:32 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-15 02:14:29 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-04-15 02:14:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-04-14 12:32:54 ----D---- C:\Documents and Settings\All Users\Application Data\Norton
2010-04-14 12:32:52 ----D---- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2010-04-12 21:02:34 ----D---- C:\Program Files\NOS
2010-04-12 21:02:34 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2010-04-12 16:59:10 ----A---- C:\RootRepeal report 04-12-10 (16-59-10).txt
2010-04-12 16:42:51 ----D---- C:\RootRepeal
2010-04-08 17:29:54 ----D---- C:\Program Files\Avira
2010-04-08 17:29:54 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2010-04-08 11:22:26 ----A---- C:\Documents and Settings\All Users\Application Data\_VOIDmfeklnmal.dll
2010-04-08 11:11:16 ----D---- C:\Your Protection
2010-04-04 17:38:46 ----D---- C:\Program Files\Winamp Detect
2010-04-04 17:37:07 ----D---- C:\Documents and Settings\dominique\Application Data\Winamp
2010-04-04 01:32:04 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2010-04-03 17:57:01 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-04-03 02:32:46 ----D---- C:\Program Files\OpenOffice.org 3
2010-04-02 22:02:08 ----D---- C:\Documents and Settings\dominique\Application Data\vlc
2010-04-01 21:17:10 ----A---- C:\WINDOWS\system32\javaws.exe
2010-04-01 21:17:10 ----A---- C:\WINDOWS\system32\javaw.exe
2010-04-01 21:17:10 ----A---- C:\WINDOWS\system32\java.exe
2010-04-01 21:16:41 ----D---- C:\Program Files\Java
2010-03-29 17:50:18 ----D---- C:\Program Files\Fichiers communs\Skype

======List of files/folders modified in the last 1 months======

2010-04-28 15:19:42 ----D---- C:\Program Files\Trend Micro
2010-04-28 15:19:19 ----D---- C:\WINDOWS\Prefetch
2010-04-28 15:17:28 ----D---- C:\WINDOWS\Temp
2010-04-28 15:14:00 ----D---- C:\Documents and Settings\dominique\Application Data\Skype
2010-04-28 15:13:27 ----D---- C:\Documents and Settings\dominique\Application Data\skypePM
2010-04-28 15:13:04 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-28 15:12:39 ----D---- C:\WINDOWS\system32\Lang
2010-04-28 15:12:29 ----D---- C:\WINDOWS
2010-04-28 15:12:12 ----D---- C:\Documents and Settings
2010-04-28 15:11:35 ----D---- C:\WINDOWS\system32\drivers
2010-04-28 15:11:35 ----D---- C:\WINDOWS\security
2010-04-28 15:10:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-26 23:37:00 ----HDC---- C:\WINDOWS\$NtUninstallKB910437$
2010-04-26 21:50:05 ----D---- C:\Documents and Settings\dominique\Application Data\dvdcss
2010-04-25 19:58:07 ----A---- C:\TCleaner.txt
2010-04-25 19:57:52 ----D---- C:\WINDOWS\ERUNT
2010-04-25 00:07:55 ----A---- C:\WINDOWS\NeroDigital.ini
2010-04-21 15:29:08 ----SD---- C:\Documents and Settings\dominique\Application Data\Microsoft
2010-04-21 15:06:15 ----AD---- C:\WINDOWS\system32
2010-04-21 09:11:41 ----HD---- C:\WINDOWS\inf
2010-04-21 02:15:58 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-21 02:15:42 ----A---- C:\WINDOWS\imsins.BAK
2010-04-21 02:14:13 ----SHD---- C:\WINDOWS\Installer
2010-04-21 02:14:13 ----D---- C:\Config.Msi
2010-04-20 16:14:20 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-20 14:09:19 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-18 02:36:50 ----D---- C:\WINDOWS\ie8updates
2010-04-17 00:29:47 ----A---- C:\WINDOWS\win.ini
2010-04-15 11:50:05 ----RD---- C:\Program Files
2010-04-15 02:14:10 ----D---- C:\Program Files\Movie Maker
2010-04-14 12:33:53 ----SD---- C:\WINDOWS\Tasks
2010-04-14 12:32:54 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2010-04-14 12:29:35 ----D---- C:\Documents and Settings\All Users\Application Data\DivX
2010-04-14 09:26:34 ----D---- C:\Program Files\DivX
2010-04-12 21:06:24 ----D---- C:\WINDOWS\Internet Logs
2010-04-11 13:18:15 ----A---- C:\WINDOWS\ntbtlog.txt
2010-04-09 20:46:22 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-08 17:28:00 ----D---- C:\WINDOWS\WinSxS
2010-04-08 17:05:06 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2010-04-06 21:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-04 17:39:03 ----D---- C:\Program Files\Winamp
2010-04-04 17:37:46 ----A---- C:\WINDOWS\wininit.ini
2010-04-04 00:55:20 ----D---- C:\Program Files\Google
2010-04-03 17:57:02 ----D---- C:\Program Files\Fichiers communs\Adobe
2010-04-03 17:56:27 ----D---- C:\Program Files\Adobe
2010-04-03 02:34:34 ----RSD---- C:\WINDOWS\assembly
2010-04-03 02:33:09 ----RSD---- C:\WINDOWS\Fonts
2010-04-03 02:31:37 ----D---- C:\Program Files\OpenOffice.org 2.0
2010-04-03 02:28:18 ----D---- C:\Program Files\Mozilla Firefox
2010-04-02 10:56:03 ----D---- C:\Documents and Settings\dominique\Application Data\OpenOffice.org2
2010-04-01 21:16:45 ----A---- C:\WINDOWS\system32\deploytk.dll
2010-03-29 17:50:18 ----D---- C:\Program Files\Fichiers communs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-11-25 56816]
R2 BT848;Bt878, WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2002-06-26 207154]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
R2 HWiNFO32;HWiNFO32 Kernel Driver; \??\C:\Program Files\HWiNFO32\HWiNFO32.SYS []
R2 TICalc;TICalc; C:\WINDOWS\system32\drivers\TICalc.sys [1999-04-18 9152]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-01-13 4137984]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-05 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver; C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-06-20 215040]
R3 SPLITCAM;Splitcam, WDM Camera Stream Splitter; C:\WINDOWS\system32\DRIVERS\splitcam.sys [2010-03-02 13824]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 iunbjurw;Microsoft iunbjurw support; C:\WINDOWS\system32\drivers\iunbjurw.sys [2009-08-04 54144]
S2 BTTUNER;BtTuner, WDM TvTuner; C:\WINDOWS\system32\drivers\BTTUNER.sys [2002-02-22 8680]
S2 BTXBAR;BtXBar, WDM Crossbar; C:\WINDOWS\system32\drivers\BTXBAR.sys [2002-03-07 7930]
S2 jjjrqsq;\??\C:\W; \??\C:\WINDOWS\TEMP\iyqaszwkcyehxrw.sys []
S2 Pv848;Hercules, SmartTV WDM Video Capture; C:\WINDOWS\system32\drivers\PH848.sys []
S2 PVTUNER;ProVideo, PV-957 WDM TvTuner; C:\WINDOWS\system32\drivers\PHtuner.sys []
S2 PVXBAR;Hercules, SmartTV WDM Crossbar; C:\WINDOWS\system32\drivers\PvXBAR.sys []
S2 xldfceygtvevq;xldfceygtvevq; \??\C:\WINDOWS\system32\drivers\bdgqs.sys []
S3 alcan5wn;Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [2002-06-06 53168]
S3 alcaudsl;Alcatel Speed Touch ADSL Modem ATM Transport; C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [2002-06-06 743136]
S3 catchme;catchme; \??\C:\DOCUME~1\DOMINI~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 DSDrv4;DSDrv4; \??\C:\DOCUME~1\DOMINI~1\MESDOC~1\DOWNLO~1\Plugins\S_Bt8x8\DSDrv4.sys []
S3 FETNDISB;D-Link DFE-530TX PCI Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\dlkfet5b.sys [2003-04-02 41984]
S3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2006-09-23 10345]
S3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32\ntsim.sys []
S3 PSI;PSI; C:\WINDOWS\system32\DRIVERS\psi_mf.sys [2009-06-17 12648]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usb_rndisx;Carte ISDN USB; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 utk0otc2;AVZ Kernel Driver; \??\C:\WINDOWS\system32\Drivers\utk0otc2.sys []
S3 VNICPKT5;VNICPKT5 Protocol Driver; \??\C:\WINDOWS\system32\VNICPKT5.SYS []
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 _VOIDekciouoiev;_VOIDekciouoiev; C:\WINDOWS\_VOIDekciouoiev\_VOIDd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-01 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-05-01 168004]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2006-10-30 492608]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 268800]
S2 vzinfhec;AVZ Kernel Helper; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 fsssvc;Service Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Infrastructure de pilote-mode utilisateur Windows; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2005-03-11 455632]

-----------------EOF-----------------

et rapport de info :

info.txt logfile of random's system information tool 1.06 2010-04-28 15:19:45

======Uninstall list======

-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->MsiExec /X{1C4551A6-4743-4093-91E4-1477CD655043}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe Download Manager-->"C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.3.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A93000000001}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Apple Software Update-->MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D}
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Bibliothèques GTK+ 2.10.6 rev a (supprimer uniquement)-->C:\Program Files\Fichiers communs\GTK\2.0\uninst.exe
BitTorrent-->C:\Program Files\BitTorrent\uninst.exe
Configuration DivX-->C:\Documents and Settings\All Users\Application Data\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"
CS881X & MTM80X Driver(Auto Installation, Safely Remove Feature, Icon Utility)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8BD7D8D6-5E89-42B5-A313-5E75128BC144}\setup.exe" -l0x9 -removeonly
DFE-530TX Driver-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F2BB456F-C07B-4EDE-975F-4D6DED19750A}
Direct Show Ogg Vorbis Filter (remove only)-->"C:\WINDOWS\system32\OggDSuninst.exe"
EGoGameS V1.0.0.1372-->"C:\Program Files\EGoGameS\Uninstall.exe"
FileZilla Client 3.0.0-beta4-->C:\Program Files\FileZilla Client\uninstall.exe
Fujitsu Siemens Computers WLAN 802.11b/g D1705/D1706-->C:\WINDOWS\system32\unwlsdrv.exe SiS163u
Gaim (supprimer uniquement)-->C:\Program Files\Gaim\gaim-uninst.exe
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
GNU Aspell 0.50-3-->"C:\Program Files\Aspell\unins000.exe"
Google Earth-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x40c -removeonly
Haali Media Splitter-->"C:\Program Files\Matroska Pack\haali\uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
hp deskjet 5550 series (Supprimer uniquement)-->C:\Program Files\hp deskjet 5550 series\hpfiui.exe -c -vdivid=HPF -vpnum=95 -vinstport=USB001 -vproduct=5550 -huninstall
hp deskjet 5550 series-->rundll32 hpzcon05.dll,VendorJettison hp deskjet 5550 series
hp print screen utility-->C:\Program Files\Hewlett-Packard\hp print screen utility\UnInstall\prnunins.exe
HWiNFO32 Version 2.36-->"C:\Program Files\HWiNFO32\unins000.exe"
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
InterVideo WinDVD-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
iTunes-->MsiExec.exe /I{446DBFFA-4088-48E3-8932-74316BA4CAE4}
Java(TM) 6 Update 19-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216019FF}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
K!TV-->C:\Program Files\K!TV\UninstKTV.exe
Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\setup.exe" -runfromtemp -l0x040c -removeonly
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
Macromedia Flash Player 8-->MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Matroska Pack - Lazy Man's MKV 0.9.9-->"C:\Program Files\LD-Anime\unins000.exe"
Matroska Pack-->C:\Program Files\Matroska Pack\uninstall.exe
Messenger Plus! 3-->"C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /Remove
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft ActiveSync-->MsiExec.exe /I{99052DB7-9592-4522-A558-5417BBAD48EE}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 97 Professional-->C:\Program Files\Microsoft Office\Office\Install\Acme.exe /w Off97Pro.STF
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0122-040C-0000-0000000FF1CE}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Midgar Launcher-->"C:\Program Files\World Of Warcraft\unins000.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB981332)-->"C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB977165-v2)-->"C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB971180)-->"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Module de compatibilité pour Microsoft Office System 2007-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Mumble and Murmur-->C:\Program Files\Mumble\Uninstall.exe
Nero BurnRights-->C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
Nero Digital-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NeroVision Express Content-->C:\WINDOWS\UNNVEContent.exe /UNINSTALL
NICSET-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\OEM\NICSET\Uninst_VNIC.isu" -c"C:\Program Files\OEM\NICSET\VNICu.dll"
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{1C4551A6-4743-4093-91E4-1477CD655043}
OpenOffice.org 3.2-->MsiExec.exe /I{97B3824E-B2D2-4C49-A860-BCA56F10B040}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe"
QuickTime 3.0-->C:\WINDOWS\uninst.exe -f"C:\Program Files\QuickTime\DeIsL1.isu" -c"C:\WINDOWS\system32\QTUninst.dll
QuickTime-->MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A}
Real Alternative 1.48-->"C:\Program Files\Real Alternative\unins000.exe"
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Secunia PSI-->"C:\Program Files\Secunia\PSI\uninstall.exe"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.2-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Smart TV Sound Tools-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5F647382-4910-4AB2-9C97-AD0714F63C3D}\Setup.exe"
SpeedFan (remove only)-->"C:\Program Files\SpeedFan\uninstall.exe"
SplitCam-->"C:\Program Files\InstallShield Installation Information\{0C0670E5-2D51-42C6-ACFF-CBCB65B7DCDB}\setup.exe" -runfromtemp -l0x0009 -removeonly
Spotify-->"C:\Program Files\Spotify\uninstall.exe"
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
TI-Black Link-->C:\PROGRA~1\TIEDUC~1\BLACKL~1\Unwise.exe /U /Z C:\PROGRA~1\TIEDUC~1\BLACKL~1\Install.log
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VirginMega.Fr Premium-->MsiExec.exe /I{EE467474-04A8-48D5-8DDF-0F8D3A3CCBE5}
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VNC Free Edition 4.1.1-->"C:\Program Files\RealVNC\VNC4\unins000.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10 Hotfix - KB894476-->"C:\WINDOWS\$NtUninstallKB894476$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Messenger 5.1 MUI Pack-->MsiExec.exe /I{F3CBA4E6-436E-4B51-9651-93830EE38616}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Wow Cartographe 1.07-->C:\Program Files\WowCartographe\uninst.exe
Xfire (remove only)-->"C:\Program Files\Xfire\uninst.exe"
zbattle.net 1.09 SR-1 beta-->"C:\Program Files\zbattle.net\unins000.exe"

Hosts File Missing
======Security center information======

AV: Your Protection (outdated)
AV: AntiVir Desktop (disabled) (outdated)
FW: Norton Internet Worm Protection (disabled)

======System event log======

Computer Name: DOMI
Event Code: 7000
Message: Le service BtTuner, WDM TvTuner n'a pas pu démarrer en raison de l'erreur :
Le service ne peut pas être démarré parce qu'il est désactivé ou qu'aucun périphérique activé ne lui est associé.


Record Number: 26961
Source Name: Service Control Manager
Time Written: 20100411185620.000000+240
Event Type: erreur
User:

Computer Name: DOMI
Event Code: 7000
Message: Le service Avira AntiVir Guard n'a pas pu démarrer en raison de l'erreur :
Le service n'a pas répondu assez vite à la demande de lancement ou de contrôle.


Record Number: 26960
Source Name: Service Control Manager
Time Written: 20100411185620.000000+240
Event Type: erreur
User:

Computer Name: DOMI
Event Code: 7009
Message: Délai (30000 millisecondes) d'attente pour une connexion du service Avira AntiVir Guard.

Record Number: 26959
Source Name: Service Control Manager
Time Written: 20100411185620.000000+240
Event Type: erreur
User:

Computer Name: DOMI
Event Code: 7000
Message: Le service Avira AntiVir Planificateur n'a pas pu démarrer en raison de l'erreur :
Le service n'a pas répondu assez vite à la demande de lancement ou de contrôle.


Record Number: 26958
Source Name: Service Control Manager
Time Written: 20100411185620.000000+240
Event Type: erreur
User:

Computer Name: DOMI
Event Code: 7009
Message: Délai (30000 millisecondes) d'attente pour une connexion du service Avira AntiVir Planificateur.

Record Number: 26957
Source Name: Service Control Manager
Time Written: 20100411185620.000000+240
Event Type: erreur
User:

=====Application event log=====

Computer Name: DOMI
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 5
Source Name: SecurityCenter
Time Written: 20100311105222.000000+240
Event Type: Informations
User:

Computer Name: DOMI
Event Code: 1511
Message: Windows ne peut pas trouver le profil local et tente de vous connecter avec un profil temporaire. Les modifications effectuées à ce profil seront perdues lorsque vous vous déconnecterez.

Record Number: 4
Source Name: Userenv
Time Written: 20100311105138.000000+240
Event Type: erreur
User: AUTORITE NT\SERVICE RÉSEAU

Computer Name: DOMI
Event Code: 1515
Message: Windows a sauvegardé le profil de cet utilisateur. Windows tentera automatiquement d'utiliser le profil sauvegardé la prochaine fois que cet utilisateur ouvre une connexion.

Record Number: 3
Source Name: Userenv
Time Written: 20100311105138.000000+240
Event Type: erreur
User: AUTORITE NT\SERVICE RÉSEAU

Computer Name: DOMI
Event Code: 1502
Message: Windows ne peut pas charger le profil stocké localement. Les causes possibles de cette erreur incluent des droits de sécurité insuffisants ou un profil local endommagé. Si ce problème persiste, contactez votre administrateur réseau.


DÉTAIL - Erreur lors d'une opération de pagination.

Record Number: 2
Source Name: Userenv
Time Written: 20100311105138.000000+240
Event Type: erreur
User: AUTORITE NT\SERVICE RÉSEAU

Computer Name: DOMI
Event Code: 1508
Message: Windows ne peut pas charger le Registre. Il s'agit souvent d'une mémoire insuffisante ou de droits d'accès insuffisants.


Détail - Erreur lors d'une opération de pagination. pour C:\Documents and Settings\NetworkService\ntuser.dat.

Record Number: 1
Source Name: Userenv
Time Written: 20100311105138.000000+240
Event Type: erreur
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0404
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0_09\lib\ext\QTJava.zip

-----------------EOF-----------------

ps : je ne sais pas d'ou il vient, mais j'ai parfois des pubs ouvert a une nouvelle onglet !
une redirection je crois

Hello,

2-3 trucs sont présents sur ton pc ...

1) L'espace disque C: est toujours critique, fait de la place dessus pour que windows respire ...

2) Est-ce toi qui à supprimé ton fichier HOST ?

3) Infection USB

• Télécharge USBFix par El Desaparecido , C_XX & Chimay8
• Double cliques sur le fichier téléchargé
• Il va se décompresser et se lancer automatiquement
• Tape F pour le Français
• Choisis l'option 1
• Lorsque l'avertissement apparait, branche tout tes périphériques amovibles (Clé USB, Disque Dur,...)
• La recherche peut prendre du temps
• Poste le rapport qui se trouve sur C:\UsbFix.txt

4) Poste-moi un nouveau rapport RSIT

@+

# Lorsque l'avertissement apparait, branche tout tes périphériques amovibles (Clé USB, Disque Dur,...) =
ça veut dire que je branche ma clé usb sur tous les ports ????
je ne comprends pas trop

Hello,

Tous les périphériques qui ont été branchés sur ton pc entre ta dernière désinfection (Il y a un mois sauf erreur) et maintenant, sont susceptibles d'être infectés. Branche tous ceux que tu as sous la main. Du genre clé usb, disque dur externe, etc) il faut les brancher avant de lancer le programme et ne pas les débrancher avant qu'USBFix aie terminé.

Je sais pas si c'est plus clair mais c'est difficile à expliquer ...

@+

mes clés usb ne marchent plus donc à cause de ça ? :/
parceque mes 2 clés usb marchent pu, mon pc ne les détecte plus, sur les autres ordis marchent pu aussi
bon je vais essayer !

rapport de usbfix :


############################## | UsbFix V6.110 |

User : dominique (Administrateurs) # DOMI
Update on 28/04/2010 by El Desaparecido , C_XX & Chimay8
Start at: 15:25:45 | 29/04/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) D CPU 2.80GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Your Protection 1.0 [ Enabled | (!) Outdated ]
AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | (!) Outdated ]
FW : Norton Internet Worm Protection[ (!) Disabled ]2006

C:\ -> Disque fixe local # 232,88 Go (7,38 Go free) [450659] # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible

################## | Elements infectieux |


################## | Registre |

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System] "DisableTaskMgr"
[HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System] "DisableTaskMgr"

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{7c286f80-4583-11db-8ddc-0090d00cd4a3}
Shell\AutoRun\command =J:\wd_windows_tools\setup.exe

HKCU\..\..\Explorer\MountPoints2\{93452c10-320a-11df-8fa5-003005a3f19b}
Shell\AutoRun\command =pbudsara.exe
Shell\open\Command =pbudsara.exe

HKCU\..\..\Explorer\MountPoints2\{980d8e48-3c98-11df-8fc2-003005a3f19b}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL JaNeD.EXE

HKCU\..\..\Explorer\MountPoints2\{c507c432-2c24-11df-8f98-003005a3f19b}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OperaTEUR.EXE

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné !

################## | ! Fin du rapport # UsbFix V6.110 ! |

non je n'ai pas supprimé le fichier host y avait eu un prob je crois !

Hello,

Pour ton fichier host :

• Télécharge RHosts par S!RI
• Lance-le, clique sur restaurer[b]
• Cliques sur [b]OK

Pour la deuxième infection :

• Télécharge load_tdsskiller de Loup Blanc
• Lance load_tdsskiller en double-cliquant dessus. Clic droit et exécuter en tant qu'administrateur avec Vista/Sept
• L'outil va se connecter au Net pour télécharger une copie à jour de TDSSKiller, puis va lancer le scan.
• A la fin du scan, appuie sur une touche pour continuer, comme l'indique le message dans la fenêtre noire d'invite de commande
• Le rapport s'affichera automatiquement : copie-colle son contenu dans ta prochaine réponse
• Le fichier est enregistré ici : C:\tdsskiller\report.txt

en cliquant sur rhost ça me met ça :

Page malveillante !













La page Web sur siri.urz.free.fr a été signalée comme étant une page malveillante et a été bloquée sur la base de vos préférences de sécurité.










Les pages malveillantes essaient d'installer des programmes qui volent des informations personnelles, qui utilisent votre ordinateur pour en attaquer d'autres ou qui endommagent votre système.

Certaines pages distribuent intentionnellement des logiciels malfaisants, mais beaucoup sont compromises sans la permission de leurs propriétaires ou sans qu'ils en aient connaissance.

je ne sais pas si ça bien pris, voici le rapport car y a eu une erreur je crois mais je sais pas lequel :

11:52:17:145 3640 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
11:52:17:145 3640 ================================================================================
11:52:17:145 3640 SystemInfo:

11:52:17:145 3640 OS Version: 5.1.2600 ServicePack: 3.0
11:52:17:145 3640 Product type: Workstation
11:52:17:145 3640 ComputerName: DOMI
11:52:17:145 3640 UserName: dominique
11:52:17:145 3640 Windows directory: C:\WINDOWS
11:52:17:145 3640 Processor architecture: Intel x86
11:52:17:145 3640 Number of processors: 2
11:52:17:145 3640 Page size: 0x1000
11:52:17:145 3640 Boot type: Normal boot
11:52:17:145 3640 ================================================================================
11:52:17:161 3640 UnloadDriverW: NtUnloadDriver error 2
11:52:17:161 3640 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
11:52:17:176 3640 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
11:52:17:176 3640 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
11:52:17:176 3640 wfopen_ex: Trying to KLMD file open
11:52:17:176 3640 wfopen_ex: File opened ok (Flags 2)
11:52:17:176 3640 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
11:52:17:176 3640 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
11:52:17:176 3640 wfopen_ex: Trying to KLMD file open
11:52:17:176 3640 wfopen_ex: File opened ok (Flags 2)
11:52:17:176 3640 Initialize success
11:52:17:176 3640
11:52:17:176 3640 Scanning Services ...
11:52:17:723 3640 Raw services enum returned 367 services
11:52:17:739 3640
11:52:17:739 3640 Scanning Kernel memory ...
11:52:17:739 3640 Devices to scan: 12
11:52:17:739 3640
11:52:17:739 3640 Driver Name: Disk
11:52:17:739 3640 IRP_MJ_CREATE : B810EBB0
11:52:17:739 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:739 3640 IRP_MJ_CLOSE : B810EBB0
11:52:17:739 3640 IRP_MJ_READ : B8108D1F
11:52:17:739 3640 IRP_MJ_WRITE : B8108D1F
11:52:17:739 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:739 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:739 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:739 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:739 3640 IRP_MJ_FLUSH_BUFFERS : B81092E2
11:52:17:739 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:739 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:739 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:739 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:739 3640 IRP_MJ_DEVICE_CONTROL : B81093BB
11:52:17:739 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : B810CF28
11:52:17:739 3640 IRP_MJ_SHUTDOWN : B81092E2
11:52:17:739 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:739 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:739 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:739 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:739 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:739 3640 IRP_MJ_POWER : B810AC82
11:52:17:739 3640 IRP_MJ_SYSTEM_CONTROL : B810F99E
11:52:17:739 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:739 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:739 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:770 3640 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
11:52:17:770 3640
11:52:17:770 3640 Driver Name: Disk
11:52:17:770 3640 IRP_MJ_CREATE : B810EBB0
11:52:17:770 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:770 3640 IRP_MJ_CLOSE : B810EBB0
11:52:17:770 3640 IRP_MJ_READ : B8108D1F
11:52:17:770 3640 IRP_MJ_WRITE : B8108D1F
11:52:17:770 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:770 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:770 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:770 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:770 3640 IRP_MJ_FLUSH_BUFFERS : B81092E2
11:52:17:770 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:770 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:770 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:770 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:770 3640 IRP_MJ_DEVICE_CONTROL : B81093BB
11:52:17:770 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : B810CF28
11:52:17:770 3640 IRP_MJ_SHUTDOWN : B81092E2
11:52:17:770 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:770 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:770 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:770 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:770 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:770 3640 IRP_MJ_POWER : B810AC82
11:52:17:770 3640 IRP_MJ_SYSTEM_CONTROL : B810F99E
11:52:17:770 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:770 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:770 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:786 3640 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
11:52:17:786 3640
11:52:17:786 3640 Driver Name: Disk
11:52:17:786 3640 IRP_MJ_CREATE : B810EBB0
11:52:17:786 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:786 3640 IRP_MJ_CLOSE : B810EBB0
11:52:17:786 3640 IRP_MJ_READ : B8108D1F
11:52:17:786 3640 IRP_MJ_WRITE : B8108D1F
11:52:17:786 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:786 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:786 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:786 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:786 3640 IRP_MJ_FLUSH_BUFFERS : B81092E2
11:52:17:786 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:786 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:786 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:786 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:786 3640 IRP_MJ_DEVICE_CONTROL : B81093BB
11:52:17:786 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : B810CF28
11:52:17:786 3640 IRP_MJ_SHUTDOWN : B81092E2
11:52:17:786 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:786 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:786 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:786 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:786 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:786 3640 IRP_MJ_POWER : B810AC82
11:52:17:786 3640 IRP_MJ_SYSTEM_CONTROL : B810F99E
11:52:17:786 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:786 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:786 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:801 3640 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
11:52:17:801 3640
11:52:17:801 3640 Driver Name: Disk
11:52:17:801 3640 IRP_MJ_CREATE : B810EBB0
11:52:17:801 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:801 3640 IRP_MJ_CLOSE : B810EBB0
11:52:17:801 3640 IRP_MJ_READ : B8108D1F
11:52:17:801 3640 IRP_MJ_WRITE : B8108D1F
11:52:17:801 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:801 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:801 3640 IRP_MJ_FLUSH_BUFFERS : B81092E2
11:52:17:801 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_DEVICE_CONTROL : B81093BB
11:52:17:801 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : B810CF28
11:52:17:801 3640 IRP_MJ_SHUTDOWN : B81092E2
11:52:17:801 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:801 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:801 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:801 3640 IRP_MJ_POWER : B810AC82
11:52:17:801 3640 IRP_MJ_SYSTEM_CONTROL : B810F99E
11:52:17:801 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:801 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:801 3640 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
11:52:17:801 3640
11:52:17:801 3640 Driver Name: Disk
11:52:17:801 3640 IRP_MJ_CREATE : B810EBB0
11:52:17:801 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:801 3640 IRP_MJ_CLOSE : B810EBB0
11:52:17:801 3640 IRP_MJ_READ : B8108D1F
11:52:17:801 3640 IRP_MJ_WRITE : B8108D1F
11:52:17:801 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:801 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:801 3640 IRP_MJ_FLUSH_BUFFERS : B81092E2
11:52:17:801 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_DEVICE_CONTROL : B81093BB
11:52:17:801 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : B810CF28
11:52:17:801 3640 IRP_MJ_SHUTDOWN : B81092E2
11:52:17:801 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:801 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:801 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:801 3640 IRP_MJ_POWER : B810AC82
11:52:17:801 3640 IRP_MJ_SYSTEM_CONTROL : B810F99E
11:52:17:801 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:801 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:801 3640 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
11:52:17:801 3640
11:52:17:801 3640 Driver Name: usbstor
11:52:17:801 3640 IRP_MJ_CREATE : AEDE5218
11:52:17:801 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:801 3640 IRP_MJ_CLOSE : AEDE5218
11:52:17:801 3640 IRP_MJ_READ : AEDE523C
11:52:17:801 3640 IRP_MJ_WRITE : AEDE523C
11:52:17:801 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:801 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:801 3640 IRP_MJ_FLUSH_BUFFERS : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:801 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_DEVICE_CONTROL : AEDE5180
11:52:17:801 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : AEDE09E6
11:52:17:801 3640 IRP_MJ_SHUTDOWN : 804F4562
11:52:17:801 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:801 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:801 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:801 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:801 3640 IRP_MJ_POWER : AEDE45F0
11:52:17:801 3640 IRP_MJ_SYSTEM_CONTROL : AEDE2A6E
11:52:17:801 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:801 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:801 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:817 3640 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
11:52:17:817 3640
11:52:17:817 3640 Driver Name: usbstor
11:52:17:817 3640 IRP_MJ_CREATE : AEDE5218
11:52:17:817 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:817 3640 IRP_MJ_CLOSE : AEDE5218
11:52:17:817 3640 IRP_MJ_READ : AEDE523C
11:52:17:817 3640 IRP_MJ_WRITE : AEDE523C
11:52:17:817 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:817 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:817 3640 IRP_MJ_FLUSH_BUFFERS : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_DEVICE_CONTROL : AEDE5180
11:52:17:817 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : AEDE09E6
11:52:17:817 3640 IRP_MJ_SHUTDOWN : 804F4562
11:52:17:817 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:817 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:817 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:817 3640 IRP_MJ_POWER : AEDE45F0
11:52:17:817 3640 IRP_MJ_SYSTEM_CONTROL : AEDE2A6E
11:52:17:817 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:817 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:817 3640 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
11:52:17:817 3640
11:52:17:817 3640 Driver Name: usbstor
11:52:17:817 3640 IRP_MJ_CREATE : AEDE5218
11:52:17:817 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:817 3640 IRP_MJ_CLOSE : AEDE5218
11:52:17:817 3640 IRP_MJ_READ : AEDE523C
11:52:17:817 3640 IRP_MJ_WRITE : AEDE523C
11:52:17:817 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:817 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:817 3640 IRP_MJ_FLUSH_BUFFERS : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_DEVICE_CONTROL : AEDE5180
11:52:17:817 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : AEDE09E6
11:52:17:817 3640 IRP_MJ_SHUTDOWN : 804F4562
11:52:17:817 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:817 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:817 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:817 3640 IRP_MJ_POWER : AEDE45F0
11:52:17:817 3640 IRP_MJ_SYSTEM_CONTROL : AEDE2A6E
11:52:17:817 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:817 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:817 3640 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
11:52:17:817 3640
11:52:17:817 3640 Driver Name: usbstor
11:52:17:817 3640 IRP_MJ_CREATE : AEDE5218
11:52:17:817 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:817 3640 IRP_MJ_CLOSE : AEDE5218
11:52:17:817 3640 IRP_MJ_READ : AEDE523C
11:52:17:817 3640 IRP_MJ_WRITE : AEDE523C
11:52:17:817 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:817 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:817 3640 IRP_MJ_FLUSH_BUFFERS : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:817 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_DEVICE_CONTROL : AEDE5180
11:52:17:817 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : AEDE09E6
11:52:17:817 3640 IRP_MJ_SHUTDOWN : 804F4562
11:52:17:817 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:817 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:817 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:817 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:817 3640 IRP_MJ_POWER : AEDE45F0
11:52:17:817 3640 IRP_MJ_SYSTEM_CONTROL : AEDE2A6E
11:52:17:817 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:817 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:817 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:817 3640 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
11:52:17:817 3640
11:52:17:832 3640 Driver Name: usbstor
11:52:17:832 3640 IRP_MJ_CREATE : AEDE5218
11:52:17:832 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:832 3640 IRP_MJ_CLOSE : AEDE5218
11:52:17:832 3640 IRP_MJ_READ : AEDE523C
11:52:17:832 3640 IRP_MJ_WRITE : AEDE523C
11:52:17:832 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:832 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:832 3640 IRP_MJ_FLUSH_BUFFERS : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:832 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:832 3640 IRP_MJ_DEVICE_CONTROL : AEDE5180
11:52:17:832 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : AEDE09E6
11:52:17:832 3640 IRP_MJ_SHUTDOWN : 804F4562
11:52:17:832 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:832 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:832 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:832 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:832 3640 IRP_MJ_POWER : AEDE45F0
11:52:17:832 3640 IRP_MJ_SYSTEM_CONTROL : AEDE2A6E
11:52:17:832 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:832 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:832 3640 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
11:52:17:832 3640
11:52:17:832 3640 Driver Name: Disk
11:52:17:832 3640 IRP_MJ_CREATE : B810EBB0
11:52:17:832 3640 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
11:52:17:832 3640 IRP_MJ_CLOSE : B810EBB0
11:52:17:832 3640 IRP_MJ_READ : B8108D1F
11:52:17:832 3640 IRP_MJ_WRITE : B8108D1F
11:52:17:832 3640 IRP_MJ_QUERY_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_SET_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_EA : 804F4562
11:52:17:832 3640 IRP_MJ_SET_EA : 804F4562
11:52:17:832 3640 IRP_MJ_FLUSH_BUFFERS : B81092E2
11:52:17:832 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
11:52:17:832 3640 IRP_MJ_DIRECTORY_CONTROL : 804F4562
11:52:17:832 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
11:52:17:832 3640 IRP_MJ_DEVICE_CONTROL : B81093BB
11:52:17:832 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : B810CF28
11:52:17:832 3640 IRP_MJ_SHUTDOWN : B81092E2
11:52:17:832 3640 IRP_MJ_LOCK_CONTROL : 804F4562
11:52:17:832 3640 IRP_MJ_CLEANUP : 804F4562
11:52:17:832 3640 IRP_MJ_CREATE_MAILSLOT : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_SECURITY : 804F4562
11:52:17:832 3640 IRP_MJ_SET_SECURITY : 804F4562
11:52:17:832 3640 IRP_MJ_POWER : B810AC82
11:52:17:832 3640 IRP_MJ_SYSTEM_CONTROL : B810F99E
11:52:17:832 3640 IRP_MJ_DEVICE_CHANGE : 804F4562
11:52:17:832 3640 IRP_MJ_QUERY_QUOTA : 804F4562
11:52:17:832 3640 IRP_MJ_SET_QUOTA : 804F4562
11:52:17:832 3640 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
11:52:17:832 3640
11:52:17:832 3640 Driver Name: atapi
11:52:17:832 3640 IRP_MJ_CREATE : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_CREATE_NAMED_PIPE : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_CLOSE : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_READ : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_WRITE : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_QUERY_INFORMATION : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SET_INFORMATION : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_QUERY_EA : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SET_EA : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_FLUSH_BUFFERS : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_QUERY_VOLUME_INFORMATION : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SET_VOLUME_INFORMATION : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_DIRECTORY_CONTROL : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_FILE_SYSTEM_CONTROL : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_DEVICE_CONTROL : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SHUTDOWN : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_LOCK_CONTROL : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_CLEANUP : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_CREATE_MAILSLOT : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_QUERY_SECURITY : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SET_SECURITY : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_POWER : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SYSTEM_CONTROL : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_DEVICE_CHANGE : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_QUERY_QUOTA : 8A8A0A9A
11:52:17:832 3640 IRP_MJ_SET_QUOTA : 8A8A0A9A
11:52:17:832 3640 Driver "atapi" infected by TDSS rootkit!
11:52:17:832 3640 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
11:52:17:832 3640 File "C:\WINDOWS\system32\DRIVERS\atapi.sys" infected by TDSS rootkit ... 11:52:17:832 3640 Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
11:52:17:832 3640 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\system32\DriverStore\FileRepository\*) error 3
11:52:18:114 3640 vfvi6
11:52:18:192 3640 !dsvbh1
11:52:18:567 3640 dsvbh2
11:52:18:567 3640 fdfb2
11:52:18:567 3640 Backup copy found, using it..
11:52:18:582 3640 will be cured on next reboot
11:52:18:582 3640 Reboot required for cure complete..
11:52:18:598 3640 Cure on reboot scheduled successfully
11:52:18:598 3640
11:52:18:598 3640 Completed
11:52:18:598 3640
11:52:18:598 3640 Results:
11:52:18:598 3640 Memory objects infected / cured / cured on reboot: 1 / 0 / 0
11:52:18:598 3640 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
11:52:18:598 3640 File objects infected / cured / cured on reboot: 1 / 0 / 1
11:52:18:598 3640
11:52:18:598 3640 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
11:52:18:598 3640 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
11:52:18:598 3640 UnloadDriverW: NtUnloadDriver error 1
11:52:18:598 3640 KLMD(ARK) unloaded successfully

Hello,

Domi974 a écrit:Page malveillante !

Youps, ça me le fait aussi.

Après vérification, il s'agit d'une infection via un pdf foireux ... Je vais prévenir S!RI !

Pour pouvoir continuer, je l'ai uploadé sur mon site perso : http://www.fajinfo.ch/RHosts.exe la procédure est la même !

@+

Pour TDSS, redémarre ton pc et poste moi un nouveau rapport RSIT, merci

voilà c'est fait, mais il doit charger un truc apres confirmer et cliquer sur ok? car rien ne se passe ou est ce normal ?

Logfile of random's system information tool 1.06 (written by random/random)
Run by dominique at 2010-04-30 12:33:33
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (3%) free of 238 GB
Total RAM: 2047 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:47, on 30/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\VNICMon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\USBIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\wlcsdk.exe
C:\Documents and Settings\dominique\Mes documents\Téléchargements\RSIT.exe
C:\Program Files\trend micro\dominique.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/splitcam/{CFFA15AC-1B5C-4D98-8521-0CED71039D83}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NIC Monitor] VNICMon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MCI USB Icon] C:\WINDOWS\system32\USBIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453862 14
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Détection de dispositifs) - http://www.logitech.com/devicedetector/ ... tion32.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b47946.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 10375 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{916D55B7-C976-4802-8158-E7CF3BBA8E05}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-04-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Raccourci vers la page des propriétés de High Definition Audio"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"Muscbrigade"=c:\Musicbrigade\Musicbrigade.exe [2005-12-22 40960]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2006-10-01 190024]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe [2002-03-18 188416]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-10-25 282624]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2006-10-30 256576]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-01-14 37888]
"NIC Monitor"=C:\WINDOWS\system32\VNICMon.exe [2002-12-17 40960]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-01-11 15961088]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-05-01 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-05-01 13750272]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-03-05 1135912]
"SunJavaUpdateSched"=C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [2010-02-18 248040]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"MCI USB Icon"=C:\WINDOWS\system32\USBIcon.exe [2004-09-17 81920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"fsc-reminder.exe"=C:\WINDOWS\reminder\fsc-reminder.exe 2453862 14 []
"Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet []
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2010-03-09 26100520]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe -silent []
"MessengerPlus3"=C:\Program Files\MessengerPlus! 3\MsgPlus.exe [2006-10-01 190024]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Démarrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE

C:\Documents and Settings\dominique\Menu Démarrer\Programmes\Démarrage
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
Secunia PSI.lnk - C:\Program Files\Secunia\PSI\psi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
tkbdra.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\klmdb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\klmdb.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\EA GAMES\MOHDA\MOHAA.exe"="C:\Program Files\EA GAMES\MOHDA\MOHAA.exe:*:Enabled:Medal of Honor Allied Assault(tm)"
"C:\Program Files\Messenger\Msmsgs.exe"="C:\Program Files\Messenger\Msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Download\utorrent.exe"="C:\Download\utorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\dominique\Bureau\Domi\Nouveau dossier\zsnesw.exe"="C:\Documents and Settings\dominique\Bureau\Domi\Nouveau dossier\zsnesw.exe:*:Enabled:zsnesw"
"C:\Program Files\zbattle.net\zbattle.net.exe"="C:\Program Files\zbattle.net\zbattle.net.exe:*:Enabled:zbattle.net"
"C:\Documents and Settings\dominique\Mes documents\Mes fichiers reçus\zsnesw.exe"="C:\Documents and Settings\dominique\Mes documents\Mes fichiers reçus\zsnesw.exe:*:Enabled:zsnesw"
"C:\Documents and Settings\dominique\Bureau\Domi\zsnes\zsnesw.exe"="C:\Documents and Settings\dominique\Bureau\Domi\zsnes\zsnesw.exe:*:Enabled:zsnesw"
"C:\zsnes\zsnesw.exe"="C:\zsnes\zsnesw.exe:*:Enabled:zsnesw"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\StubInstaller.exe"="C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Disabled:Yahoo! Messenger"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Exécuter une DLL en tant qu'application"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Conference\Conference.dll"="C:\Program Files\Conference\Conference.dll:*:Enabled:Audio/Video Conference by KIOSK Team"
"C:\Program Files\Electronic Arts\Need for Speed Carbon\NFSC.exe"="C:\Program Files\Electronic Arts\Need for Speed Carbon\NFSC.exe:*:Enabled:NFSC"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\Spotify\spotify.exe"="C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify"
"C:\Program Files\EA SPORTS\FIFA 2003\fifa2003.exe"="C:\Program Files\EA SPORTS\FIFA 2003\fifa2003.exe:*:Enabled:TestGame"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\world\World of Warcraft\WoW-3.2.0-frFR-downloader.exe"="C:\world\World of Warcraft\WoW-3.2.0-frFR-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"\"="C:\WINDOWS\system\svchost.exe:*:Enabled:KL"
"C:\WINDOWS\TEMP\mdqw.tmp\svchost.exe"="C:\WINDOWS\TEMP\mdqw.tmp\svchost.exe:*:Enabled:Service Updates"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c286f80-4583-11db-8ddc-0090d00cd4a3}]
shell\AutoRun\command - J:\wd_windows_tools\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93452c10-320a-11df-8fa5-003005a3f19b}]
shell\AutoRun\command - pbudsara.exe
shell\open\command - pbudsara.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{980d8e48-3c98-11df-8fc2-003005a3f19b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL JaNeD.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c507c432-2c24-11df-8f98-003005a3f19b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OperaTEUR.EXE


======List of files/folders created in the last 1 months======

2010-04-30 11:52:17 ----A---- C:\TDSSKiller.2.2.8.1_30.04.2010_11.52.17_log.txt
2010-04-30 11:52:00 ----D---- C:\tdsskiller
2010-04-29 15:25:43 ----A---- C:\UsbFix.txt
2010-04-29 15:24:31 ----D---- C:\UsbFix
2010-04-28 17:43:12 ----A---- C:\WINDOWS\system32\javaws.exe
2010-04-28 17:43:12 ----A---- C:\WINDOWS\system32\javaw.exe
2010-04-28 17:43:12 ----A---- C:\WINDOWS\system32\java.exe
2010-04-28 17:43:12 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-04-28 15:31:03 ----D---- C:\Documents and Settings\dominique\Application Data\OpenOffice.org
2010-04-28 15:19:14 ----D---- C:\rsit
2010-04-21 02:19:18 ----A---- C:\WINDOWS\system32\MRT.INI
2010-04-21 02:15:56 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-21 02:15:36 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-20 16:14:21 ----D---- C:\icons
2010-04-20 16:14:20 ----A---- C:\WINDOWS\system32\usbicon.exe
2010-04-17 01:41:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-17 01:39:32 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-15 02:14:29 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-04-15 02:14:08 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-04-14 12:32:54 ----D---- C:\Documents and Settings\All Users\Application Data\Norton
2010-04-14 12:32:52 ----D---- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2010-04-12 21:02:34 ----D---- C:\Program Files\NOS
2010-04-12 21:02:34 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2010-04-12 16:59:10 ----A---- C:\RootRepeal report 04-12-10 (16-59-10).txt
2010-04-12 16:42:51 ----D---- C:\RootRepeal
2010-04-08 17:29:54 ----D---- C:\Program Files\Avira
2010-04-08 17:29:54 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2010-04-08 11:22:26 ----A---- C:\Documents and Settings\All Users\Application Data\_VOIDmfeklnmal.dll
2010-04-08 11:11:16 ----D---- C:\Your Protection
2010-04-04 17:38:46 ----D---- C:\Program Files\Winamp Detect
2010-04-04 17:37:07 ----D---- C:\Documents and Settings\dominique\Application Data\Winamp
2010-04-04 01:32:04 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2010-04-03 17:57:01 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-04-03 02:32:46 ----D---- C:\Program Files\OpenOffice.org 3
2010-04-02 22:02:08 ----D---- C:\Documents and Settings\dominique\Application Data\vlc
2010-04-01 21:16:41 ----D---- C:\Program Files\Java

======List of files/folders modified in the last 1 months======

2010-04-30 12:33:41 ----D---- C:\WINDOWS\Prefetch
2010-04-30 12:33:36 ----D---- C:\Program Files\Trend Micro
2010-04-30 11:56:24 ----D---- C:\Documents and Settings\dominique\Application Data\Skype
2010-04-30 11:56:16 ----D---- C:\Documents and Settings\dominique\Application Data\skypePM
2010-04-30 11:55:32 ----D---- C:\WINDOWS\Temp
2010-04-30 11:55:25 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-30 11:54:58 ----D---- C:\WINDOWS\system32\Lang
2010-04-30 11:54:51 ----D---- C:\WINDOWS
2010-04-30 11:54:38 ----D---- C:\Documents and Settings
2010-04-30 11:54:10 ----D---- C:\WINDOWS\system32\drivers
2010-04-30 11:53:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-28 17:44:45 ----SHD---- C:\WINDOWS\Installer
2010-04-28 17:44:45 ----D---- C:\Config.Msi
2010-04-28 17:43:12 ----AD---- C:\WINDOWS\system32
2010-04-28 17:29:16 ----D---- C:\Program Files\Teamspeak2_RC2
2010-04-28 17:28:50 ----D---- C:\Program Files\Mumble
2010-04-28 15:11:35 ----D---- C:\WINDOWS\security
2010-04-26 23:37:00 ----HDC---- C:\WINDOWS\$NtUninstallKB910437$
2010-04-26 21:50:05 ----D---- C:\Documents and Settings\dominique\Application Data\dvdcss
2010-04-25 19:58:07 ----A---- C:\TCleaner.txt
2010-04-25 19:57:52 ----D---- C:\WINDOWS\ERUNT
2010-04-25 00:07:55 ----A---- C:\WINDOWS\NeroDigital.ini
2010-04-21 15:29:08 ----SD---- C:\Documents and Settings\dominique\Application Data\Microsoft
2010-04-21 09:11:41 ----HD---- C:\WINDOWS\inf
2010-04-21 02:15:58 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-21 02:15:42 ----A---- C:\WINDOWS\imsins.BAK
2010-04-20 16:14:20 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-20 14:09:19 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-18 02:36:50 ----D---- C:\WINDOWS\ie8updates
2010-04-17 00:29:47 ----A---- C:\WINDOWS\win.ini
2010-04-15 11:50:05 ----RD---- C:\Program Files
2010-04-15 02:14:10 ----D---- C:\Program Files\Movie Maker
2010-04-14 12:33:53 ----SD---- C:\WINDOWS\Tasks
2010-04-14 12:32:54 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2010-04-14 12:29:35 ----D---- C:\Documents and Settings\All Users\Application Data\DivX
2010-04-14 09:26:34 ----D---- C:\Program Files\DivX
2010-04-12 21:06:24 ----D---- C:\WINDOWS\Internet Logs
2010-04-11 13:18:15 ----A---- C:\WINDOWS\ntbtlog.txt
2010-04-09 20:46:22 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-04-08 17:28:00 ----D---- C:\WINDOWS\WinSxS
2010-04-08 17:05:06 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2010-04-06 21:52:54 ----A---- C:\WINDOWS\system32\MRT.exe
2010-04-04 17:39:03 ----D---- C:\Program Files\Winamp
2010-04-04 17:37:46 ----A---- C:\WINDOWS\wininit.ini
2010-04-04 00:55:20 ----D---- C:\Program Files\Google
2010-04-03 17:57:02 ----D---- C:\Program Files\Fichiers communs\Adobe
2010-04-03 17:56:27 ----D---- C:\Program Files\Adobe
2010-04-03 02:34:34 ----RSD---- C:\WINDOWS\assembly
2010-04-03 02:33:09 ----RSD---- C:\WINDOWS\Fonts
2010-04-03 02:31:37 ----D---- C:\Program Files\OpenOffice.org 2.0
2010-04-03 02:28:18 ----D---- C:\Program Files\Mozilla Firefox
2010-04-02 10:56:03 ----D---- C:\Documents and Settings\dominique\Application Data\OpenOffice.org2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-11-25 56816]
R2 BT848;Bt878, WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2002-06-26 207154]
R2 fssfltr;FssFltr; C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
R2 HWiNFO32;HWiNFO32 Kernel Driver; \??\C:\Program Files\HWiNFO32\HWiNFO32.SYS []
R2 TICalc;TICalc; C:\WINDOWS\system32\drivers\TICalc.sys [1999-04-18 9152]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-01-13 4137984]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-05 12288]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver; C:\WINDOWS\system32\DRIVERS\sis163u.sys [2005-06-20 215040]
R3 SPLITCAM;Splitcam, WDM Camera Stream Splitter; C:\WINDOWS\system32\DRIVERS\splitcam.sys [2010-03-02 13824]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 iunbjurw;Microsoft iunbjurw support; C:\WINDOWS\system32\drivers\iunbjurw.sys [2009-08-04 54144]
S2 BTTUNER;BtTuner, WDM TvTuner; C:\WINDOWS\system32\drivers\BTTUNER.sys [2002-02-22 8680]
S2 BTXBAR;BtXBar, WDM Crossbar; C:\WINDOWS\system32\drivers\BTXBAR.sys [2002-03-07 7930]
S2 jjjrqsq;\??\C:\W; \??\C:\WINDOWS\TEMP\iyqaszwkcyehxrw.sys []
S2 Pv848;Hercules, SmartTV WDM Video Capture; C:\WINDOWS\system32\drivers\PH848.sys []
S2 PVTUNER;ProVideo, PV-957 WDM TvTuner; C:\WINDOWS\system32\drivers\PHtuner.sys []
S2 PVXBAR;Hercules, SmartTV WDM Crossbar; C:\WINDOWS\system32\drivers\PvXBAR.sys []
S2 xldfceygtvevq;xldfceygtvevq; \??\C:\WINDOWS\system32\drivers\bdgqs.sys []
S3 alcan5wn;Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [2002-06-06 53168]
S3 alcaudsl;Alcatel Speed Touch ADSL Modem ATM Transport; C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [2002-06-06 743136]
S3 catchme;catchme; \??\C:\DOCUME~1\DOMINI~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 DSDrv4;DSDrv4; \??\C:\DOCUME~1\DOMINI~1\MESDOC~1\DOWNLO~1\Plugins\S_Bt8x8\DSDrv4.sys []
S3 FETNDISB;D-Link DFE-530TX PCI Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\dlkfet5b.sys [2003-04-02 41984]
S3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2006-09-23 10345]
S3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32\ntsim.sys []
S3 PSI;PSI; C:\WINDOWS\system32\DRIVERS\psi_mf.sys [2009-06-17 12648]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usb_rndisx;Carte ISDN USB; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 utk0otc2;AVZ Kernel Driver; \??\C:\WINDOWS\system32\Drivers\utk0otc2.sys []
S3 VNICPKT5;VNICPKT5 Protocol Driver; \??\C:\WINDOWS\system32\VNICPKT5.SYS []
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 _VOIDekciouoiev;_VOIDekciouoiev; C:\WINDOWS\_VOIDekciouoiev\_VOIDd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-05-01 168004]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2006-10-30 492608]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 268800]
S2 vzinfhec;AVZ Kernel Helper; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 fsssvc;Service Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Infrastructure de pilote-mode utilisateur Windows; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2005-03-11 455632]

-----------------EOF-----------------

Hello,

Ok, merci pour le rapport !

Re-branche tous tes périphériques USB et passe USBFix avec l'option 2

Tu trouves un tutoriel ici : http://pagesperso-orange.fr/NosTools/tuto_usbfix3.html

@+