rootkit/spyware

Salut radzinskis


 Poste ton rapport de Combofix


 @++  

merci de répondre

 voici

 ComboFix 09-11-20.02 - Administrateur 21/11/2009 13:46.35.2 - x86
 Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.204​7.1688 [GMT 1:00]
 Lancé depuis: c:\documents and settings\Administrateur\Bureau​\ComboFix.exe
 .

 ((((((((((((((((((((((((((((((​((((((   Autres suppressions   ))))))))))))))))))))))))))))))​))))))))))))))))))
 .

 c:\windows\system32\wmcache.nl​d

 Une copie infectée de c:\windows\system32\drivers\at​api.sys a été trouvée et désinfectée
 Copie restaurée à partir de - Kitty ate it
 .
 (((((((((((((((((((((((((((((   Fichiers créés du 2009-10-21 au 2009-11-21  ))))))))))))))))))))))))))))))​))))))
 .

 2009-11-21 12:12 . 2009-11-21 12:17 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Partouche
 2009-11-20 16:44 . 2002-08-30 13:00 114688 --sha-r- c:\windows\system32\msvcp6q.dl​l
 2009-11-16 21:29 . 2009-06-18 11:55 18816 ------w- c:\windows\system32\SAVRKBootT​asks.sys
 2009-11-16 20:42 . 2009-11-16 20:42 54624 ----a-w- c:\windows\system32\1ac5.sys
 2009-11-16 19:48 . 2009-11-16 21:25 -------- d-----w- c:\program files\Sophos
 2009-11-16 19:24 . 2009-11-16 19:24 -------- d-----w- C:\rsit
 2009-11-16 19:05 . 2003-10-15 08:28 10240 ----a-w- c:\windows\system32\drivers\Si​WinAcc.sys
 2009-11-16 18:41 . 2009-11-16 18:57 81984 ----a-w- c:\windows\system32\bdod.bin
 2009-11-16 18:24 . 2009-11-16 18:58 -------- d-----w- c:\program files\Fichiers communs\BitDefender
 2009-11-16 17:47 . 2009-11-16 17:47 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Grisoft
 2009-11-16 17:47 . 2007-05-30 12:10 10872 ----a-w- c:\windows\system32\drivers\Av​gAsCln.sys
 2009-11-07 15:46 . 2009-11-07 15:46 159744 ----a-w- c:\documents and settings\Administrateur\Applic​ation Data\UltimateBet\DownLoad\live​update.exe
 2009-11-07 15:42 . 2009-11-07 15:55 -------- d-----w- c:\program files\UltimateBet
 2009-11-07 15:42 . 2009-11-07 15:45 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\UltimateBet
 2009-11-07 15:42 . 2009-11-07 15:42 -------- d-----w- c:\program files\_uninstallation_info
 2009-11-07 13:19 . 2009-11-07 13:37 -------- d-----w- c:\program files\PartyGaming
 2009-11-06 21:26 . 2009-11-06 21:26 -------- d-----w- c:\program files\Ventrilo
 2009-10-28 16:59 . 2009-10-28 16:59 -------- d-----w- c:\program files\Fichiers communs\xing shared
 2009-10-28 16:59 . 2009-10-28 16:59 -------- d-----w- c:\program files\Real
 2009-10-28 16:59 . 2009-10-28 16:59 -------- d-----w- c:\program files\Fichiers communs\Real
 2009-10-27 16:51 . 2009-10-27 16:51 38208 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\​airappinstaller\airappinstalle​r.exe
 2009-10-27 16:49 . 2009-10-27 16:51 38208 ----a-w- c:\documents and settings\Administrateur\Applic​ation Data\Macromedia\Flash Player\www.macromedia.com\bin\​airappinstaller\airappinstalle​r.exe
 2009-10-27 16:49 . 2009-10-27 16:51 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
 2009-10-27 16:47 . 2009-11-04 18:40 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\P5

 .
 ((((((((((((((((((((((((((((((​((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))​))))))))))))))))))
 .
 2009-11-20 22:56 . 2008-05-03 10:48 32 -c--a-w- c:\windows\msocreg32.dat
 2009-11-20 22:55 . 2006-09-25 13:49 -------- d-----w- c:\program files\mIRC
 2009-11-20 22:28 . 2006-09-25 12:06 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\teamspeak2
 2009-11-15 20:50 . 2008-10-19 11:05 -------- d-----w- c:\program files\Full Tilt Poker
 2009-11-15 19:51 . 2009-10-17 19:25 -------- d-----w- c:\program files\PokerStars
 2009-11-15 19:48 . 2008-07-08 10:43 -------- d-----w- c:\program files\Everest Poker
 2009-11-15 18:47 . 2008-09-05 11:37 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Microgaming
 2009-11-14 18:44 . 2006-09-22 12:10 -------- d--h--w- c:\program files\InstallShield Installation Information
 2009-11-12 21:58 . 2009-03-20 19:51 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Mumble
 2009-11-08 17:00 . 2009-07-30 20:08 -------- d-----w- c:\program files\SopCast
 2009-11-06 21:25 . 2009-04-19 19:49 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
 2009-11-05 19:58 . 2009-09-17 18:14 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\RayV
 2009-11-05 12:05 . 2009-09-07 18:38 -------- d-----w- c:\program files\Navilog1
 2009-11-03 04:08 . 2007-10-06 16:50 -------- d-----w- c:\program files\eMule
 2009-10-30 20:52 . 2008-07-04 19:46 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\dvdcss
 2009-10-28 18:56 . 2006-09-25 11:50 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\BSplayer
 2009-10-25 10:08 . 2001-08-24 14:00 72092 ----a-w- c:\windows\system32\perfc00C.d​at
 2009-10-25 10:08 . 2001-08-24 14:00 461134 ----a-w- c:\windows\system32\perfh00C.d​at
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\NewShortcut6_504C9DBC7EE64​5B2A9CF47F39BEDA88E.exe
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\NewShortcut2_C8CBC5632A224​D2D83650A01AF12D5F6.exe
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\NewShortcut1_F627668DCED74​C3B92937B05B370A211.exe
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\ARPPRODUCTICON.exe
 2009-10-05 12:17 . 2009-07-25 11:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
 2009-10-05 12:17 . 2009-08-26 10:22 4045528 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes​' Anti-Malware\mbam-setup.exe
 2009-09-13 20:42 . 2009-09-13 20:42 60416 ----a-w- c:\windows\ALCFDRTM.EXE
 2009-09-10 12:54 . 2009-07-25 11:28 38224 ----a-w- c:\windows\system32\drivers\mb​amswissarmy.sys
 2009-09-10 12:53 . 2009-07-25 11:28 19160 ----a-w- c:\windows\system32\drivers\mb​am.sys
 2009-08-26 13:07 . 2009-08-26 13:07 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
 2009-08-26 13:07 . 2009-08-26 13:07 368640 ----a-w- c:\windows\system32\ReWire.dll
 2002-08-30 13:00 . 2009-11-20 16:44 114688 --sha-r- c:\windows\system32\msvcp6q.dl​l
 .

 ------- Sigcheck -------

 [-] 2004-08-18 . 27A5959C94EE173A063CA06BD14F02​1A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tc​pip.sys

 [-] 2006-07-05 . CE4AF1FA47A29ADF97CB107775CE39​5C . 1049088 . . [5.1.2600.2945] . . c:\windows\system32\kernel32.d​ll
 [-] 2006-07-05 . CE4AF1FA47A29ADF97CB107775CE39​5C . 1049088 . . [5.1.2600.2945] . . c:\windows\system32\dllcache\k​ernel32.dll

 [-] 2004-08-22 . 998F3F568F6074A35AB08CD3395A9D​C2 . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe
 .
 (((((((((((((((((((((((((((((   SnapShot@2009-11-16_19.37.13   ))))))))))))))))))))))))))))))​)))))))))))
 .
 + 2009-11-16 22:20 . 2009-11-16 22:20 85969              c:\windows\system32\drivers\gm​er.sys
 + 2006-09-21 19:17 . 2001-08-24 14:00 34816              c:\windows\system32\dllcache\a​dmwprox.dll
 + 2009-11-16 19:48 . 2009-11-16 19:48 262144              c:\windows\system32\config\sys​temprofile\Local Settings\Application Data\Microsoft\Windows\UsrClas​s.dat
 + 2009-11-16 22:20 . 2008-04-17 20:13 811008              c:\windows\gmer.exe
 + 2009-11-16 22:20 . 2009-11-16 22:20 884736              c:\windows\gmer.dll
 .
 ((((((((((((((((((((((((((((((​(((   Points de chargement Reg   ))))))))))))))))))))))))))))))​))))))))))))))))))
 .
 .
 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
 REGEDIT4

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\Run]
 "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-14 282624]
 "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
 "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Stat​ic\CLIStart.exe" [2009-08-13 98304]
 "amd_dc_opt"="c:\program files\AMD\amd_dc_opt\amd_dc_op​t.exe" [2006-06-28 106496]
 "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
 "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-06-20 77824]

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\ShellServiceObjectDelayLoad]
 "UpdateCheck"= {55E99EC8-3D20-47F6-8C2B-3435D​1B2050A} - c:\windows\system32\msvcp6q.dl​l [2002-08-30 114688]

 [HKEY_LOCAL_MACHINE\software\mi​crosoft\windows nt\currentversion\drivers32]
 "midi2"=KORGUMDD.DRV
 "midi3"=KORGUMDD.DRV

 [HKEY_LOCAL_MACHINE\system\curr​entcontrolset\control\session manager]
 BootExecute REG_MULTI_SZ    autocheck autochk *\0OODBS

 [HKEY_LOCAL_MACHINE\SYSTEM\Curr​entControlSet\Control\SafeBoot​\Minimal\AVG Anti-Spyware Guard]
 @="Service"

 [HKLM\~\services\sharedaccess\p​arameters\firewallpolicy\stand​ardprofile]
 "EnableFirewall"= 0 (0x0)

 [HKLM\~\services\sharedaccess\p​arameters\firewallpolicy\stand​ardprofile\AuthorizedApplicati​ons\List]
 "c:\\Program Files\\FreeCall.com\\FreeCall\​\FreeCall.exe"=
 "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"​=
 "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
 "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
 "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

 R0 SiWinAcc;SiWinAcc;c:\windows\s​ystem32\drivers\SiWinAcc.sys [16/11/2009 20:05 10240]
 R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAV​RKBootTasks.sys [16/11/2009 22:29 18816]
 R3 AmdTools;AMD Special Tools Driver;c:\windows\system32\dri​vers\AmdTools.sys [12/09/2009 21:39 31744]
 S2 Intelligent Transfer Service;Windows InstallService;c:\windows\syst​em32\servtie.exe --> c:\windows\system32\servtie.ex​e [?]
 S3 03622;03622;\??\c:\windows\sys​tem32\03622.sys --> c:\windows\system32\03622.sys [?]
 S3 06e38;06e38;\??\c:\windows\sys​tem32\06e38.sys --> c:\windows\system32\06e38.sys [?]
 S3 0ca26;0ca26;\??\c:\windows\sys​tem32\0ca26.sys --> c:\windows\system32\0ca26.sys [?]
 S3 1478;1478;\??\c:\windows\syste​m32\1478.sys --> c:\windows\system32\1478.sys [?]
 S3 19418;19418;\??\c:\windows\sys​tem32\19418.sys --> c:\windows\system32\19418.sys [?]
 S3 1ac5;1ac5;c:\windows\system32\​1ac5.sys [16/11/2009 21:42 54624]
 S3 37828;37828;\??\c:\windows\sys​tem32\37828.sys --> c:\windows\system32\37828.sys [?]
 S3 3a933;3a933;\??\c:\windows\sys​tem32\3a933.sys --> c:\windows\system32\3a933.sys [?]
 S3 3af7;3af7;\??\c:\windows\syste​m32\3af7.sys --> c:\windows\system32\3af7.sys [?]
 S3 3e53;3e53;\??\c:\windows\syste​m32\3e53.sys --> c:\windows\system32\3e53.sys [?]
 S3 3fc17;3fc17;\??\c:\windows\sys​tem32\3fc17.sys --> c:\windows\system32\3fc17.sys [?]
 S3 4bb3C;4bb3C;\??\c:\windows\sys​tem32\4bb3C.sys --> c:\windows\system32\4bb3C.sys [?]
 S3 4be24;4be24;\??\c:\windows\sys​tem32\4be24.sys --> c:\windows\system32\4be24.sys [?]
 S3 4de1B;4de1B;\??\c:\windows\sys​tem32\4de1B.sys --> c:\windows\system32\4de1B.sys [?]
 S3 4de1C;4de1C;\??\c:\windows\sys​tem32\4de1C.sys --> c:\windows\system32\4de1C.sys [?]
 S3 5861E;5861E;\??\c:\windows\sys​tem32\5861E.sys --> c:\windows\system32\5861E.sys [?]
 S3 5a32A;5a32A;\??\c:\windows\sys​tem32\5a32A.sys --> c:\windows\system32\5a32A.sys [?]
 S3 634A;634A;\??\c:\windows\syste​m32\634A.sys --> c:\windows\system32\634A.sys [?]
 S3 63cE;63cE;\??\c:\windows\syste​m32\63cE.sys --> c:\windows\system32\63cE.sys [?]
 S3 72523;72523;\??\c:\windows\sys​tem32\72523.sys --> c:\windows\system32\72523.sys [?]
 S3 7b927;7b927;\??\c:\windows\sys​tem32\7b927.sys --> c:\windows\system32\7b927.sys [?]
 S3 7db12;7db12;\??\c:\windows\sys​tem32\7db12.sys --> c:\windows\system32\7db12.sys [?]
 S3 82730;82730;\??\c:\windows\sys​tem32\82730.sys --> c:\windows\system32\82730.sys [?]
 S3 82731;82731;\??\c:\windows\sys​tem32\82731.sys --> c:\windows\system32\82731.sys [?]
 S3 83035;83035;\??\c:\windows\sys​tem32\83035.sys --> c:\windows\system32\83035.sys [?]
 S3 8ef2;8ef2;\??\c:\windows\syste​m32\8ef2.sys --> c:\windows\system32\8ef2.sys [?]
 S3 9423E;9423E;\??\c:\windows\sys​tem32\9423E.sys --> c:\windows\system32\9423E.sys [?]
 S3 a0d20;a0d20;\??\c:\windows\sys​tem32\a0d20.sys --> c:\windows\system32\a0d20.sys [?]
 S3 a2a2C;a2a2C;\??\c:\windows\sys​tem32\a2a2C.sys --> c:\windows\system32\a2a2C.sys [?]
 S3 a8914;a8914;\??\c:\windows\sys​tem32\a8914.sys --> c:\windows\system32\a8914.sys [?]
 S3 a9834;a9834;\??\c:\windows\sys​tem32\a9834.sys --> c:\windows\system32\a9834.sys [?]
 S3 abbC;abbC;\??\c:\windows\syste​m32\abbC.sys --> c:\windows\system32\abbC.sys [?]
 S3 ac310;ac310;\??\c:\windows\sys​tem32\ac310.sys --> c:\windows\system32\ac310.sys [?]
 S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\dri​vers\a38usb.sys [15/12/2008 22:00 33536]
 S3 b1a4;b1a4;\??\c:\windows\syste​m32\b1a4.sys --> c:\windows\system32\b1a4.sys [?]
 S3 baa3D;baa3D;\??\c:\windows\sys​tem32\baa3D.sys --> c:\windows\system32\baa3D.sys [?]
 S3 baa6;baa6;\??\c:\windows\syste​m32\baa6.sys --> c:\windows\system32\baa6.sys [?]
 S3 be43A;be43A;\??\c:\windows\sys​tem32\be43A.sys --> c:\windows\system32\be43A.sys [?]
 S3 c692F;c692F;\??\c:\windows\sys​tem32\c692F.sys --> c:\windows\system32\c692F.sys [?]
 S3 c751F;c751F;\??\c:\windows\sys​tem32\c751F.sys --> c:\windows\system32\c751F.sys [?]
 S3 c922B;c922B;\??\c:\windows\sys​tem32\c922B.sys --> c:\windows\system32\c922B.sys [?]
 S3 d22B;d22B;\??\c:\windows\syste​m32\d22B.sys --> c:\windows\system32\d22B.sys [?]
 S3 d2bF;d2bF;\??\c:\windows\syste​m32\d2bF.sys --> c:\windows\system32\d2bF.sys [?]
 S3 def1A;def1A;\??\c:\windows\sys​tem32\def1A.sys --> c:\windows\system32\def1A.sys [?]
 S3 e0739;e0739;\??\c:\windows\sys​tem32\e0739.sys --> c:\windows\system32\e0739.sys [?]
 S3 eca13;eca13;\??\c:\windows\sys​tem32\eca13.sys --> c:\windows\system32\eca13.sys [?]
 S3 ee716;ee716;\??\c:\windows\sys​tem32\ee716.sys --> c:\windows\system32\ee716.sys [?]
 S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP;c:\windows\system32\drivers​\KORGUMDS.SYS [20/12/2005 1:07 14976]
 S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWSer​vice.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWSer​vice.exe [?]

 --- Autres Services/Pilotes en mémoire ---

 *NewlyCreated* - ATAPI
 .
 .
 ------- Examen supplémentaire -------
 .
 uStart Page = about:blank
 .

 ******************************​******************************​**************

 catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
 Rootkit scan 2009-11-21 13:50
 Windows 5.1.2600 Service Pack 2 NTFS

 Recherche de processus cachés ...

 Recherche d'éléments en démarrage automatique cachés ...

 Recherche de fichiers cachés ...

 Scan terminé avec succès
 Fichiers cachés: 0

 ******************************​******************************​**************

 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 device: opened successfully
 user: MBR read successfully
 called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS >>UNKNOWN [0x8A2F7868]<<
 kernel: MBR read successfully
 detected MBR rootkit hooks:
 \Driver\Disk -> CLASSPNP.SYS @ 0xba0ecfc3
 \Driver\ACPI -> ACPI.sys @ 0xb9f56cb8
 \Driver\atapi -> atapi.sys @ 0xb9ed57b4
 IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
 ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
 ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
 NDIS: NVIDIA nForce 10/100/1000 Mbps Ethernet  -> SendCompleteHandler -> NDIS.sys @ 0xb9d61ba0
 PacketIndicateHandler -> NDIS.sys @ 0xb9d6eb21
 SendHandler -> NDIS.sys @ 0xb9d4c87b
 user & kernel MBR OK

 ******************************​******************************​**************
 .
 --------------------- CLES DE REGISTRE BLOQUEES ---------------------

 [HKEY_LOCAL_MACHINE\software\Cl​asses\CLSID\{4722EE48-40E7-10C​3-749F-74DFCE71B7CA}\InProcSer​ver32*]
 "oabhajjcjkobfaikndpifbngojdbp​f"=hex:6a,61,64,69,63,63,68,6b​,65,61,67,62,6c,6d,
  6a,62,6a,6d,62,65,00,f9
 "nabhgjlkenekdmlokipjcbclobne"​=hex:6a,61,64,69,63,63,68,6b,6​5,61,67,62,6c,6d,
  6a,62,6a,6d,62,65,00,f9

 [HKEY_LOCAL_MACHINE\software\Cl​asses\CLSID\{F592A3F4-1E8F-F23​D-181A-D5DEAD3CBB53}\InProcSer​ver32*]
 "oafebebpjjkiebppncbphmbgibcoe​b"=hex:6a,61,63,6c,6d,6f,69,69​,6f,65,70,6b,65,62,
  67,70,6e,61,6d,6c,00,f9
 "nafeldhldindccjgoakbidlmbafl"​=hex:6a,61,63,6c,6d,6f,69,69,6​f,65,70,6b,65,62,
  67,70,6e,61,6d,6c,00,f9

 [HKEY_LOCAL_MACHINE\software\Mi​crosoft\Windows\CurrentVersion​\System*]
 "OODEFRAG10.00.00.01WORKSTATIO​N"="C3CA43629C4D5DB8FC0D5EC5A7​02DB907BFC5BDFD6887BD3168EDA4E​BD4E79BED37DB16569A5F032550DBD​B5B24ADB538FCBFD33E66E57255B71​0ADB3AE03C4ACEC8CFFD09BF88C46E​2A237E723918D0A2079FBDB8DEAAC5​8B825B04F509C0911A1EE00024C640​3FF9708753EAE36F8AD2740EB54BF8​3B8653620F9C100D50FEBC9E127BEC​C74CFEBC9E127BECC74CFEBC9E127B​ECC74CFEBC9E127BECC74CFEBC9E12​7BECC74CFEBC9E127BECC74CA6A0AC​4980AC79338EDD5E5BE2F6E6675D57​5E7D6A3B9808A6171C11EC38DE3D66​0943E3B41C49F3FEAB214F60C26A0F​758BDBB86F76CD717DD117CB856141​D969E90525BFC987B5468BBB42E68A​FA3D9E1C1EC6AB54BED6B656DA05F3​440754E6C8F366BD47E2F883255A17​884FA752CF571806D6575BDF89F50A​BA3C38BC8DF9FCABEE7BCCD2F91F5C​F20633671211634FB64622138C74E1​11ABEFEDADB3AFBC51EF9809473048​0786A2DF995BBC10378611EC004D1E​CDAE756F3F5EC7A33C528126D0BCD8​BAC92E6FA60831690F372F755CEF27​81C07DE46AA4D4A45D23865DC1D69B​2ED292378956E174B4025446B08876​DE925D09E3FA2840F39C7B323609B6​B18D3C40419D126E5CB2A14CBBCD27​1EDE5782436FB8ED5C5BEFE6E0AFC7​7EFB0851865D2EDBC6DDBF5FBA2159​B3010DB88EF9C9CF07BCA733336700​E209F01E4F2673192AA9A741DBAF85​0E25B2319A4C4CBEBCEAAD6A1E29BA​C782F49F941F225D2C99E68D3C2523​EACC537856AE8485EDDD9966DE7F49​4097F1427282A275BDDC1DB6F9658D​0F2D6B1F681483F27AF3E2A4124821​0727A26F974FCDFDD48B042076FD5E​612875B3204DF69BEDFDA04CAFA78E​FD4F91A79DFAAB6D5A32EFBE7BB4B0​AE72069DC2160D6D5A959FD08D656C​BDA8D81A31302187E713D311B562CD​3D013D78AD86D558C95BA56E76F350​3C46812E8B01FE9AC1F6C6ECD7E46F​3BC8EFE753170378811F81341FF325​70E5EF7CD223B0DD96B2BABE895BE5​476B035F17A4CBD888150E3873D9BD​DBAFD5C3C563543D43D817B9E6E7B4​EF64297768A5903C392B12F9B410F2​73B13CF137D123646CE6A2732365C6​0E0FF29C4DEA0ED54EF85FE1495027​3AE5EADA0F972A6B96F9483F95FD65​5E81E426DF3B4D1C884FD767B633A9​BF85ED496DCFB6A349E14E36D51843​210641DDB0C8E6D313E9E2934758EA​388576E886AB6DD9746C34F71F3BC7​F7B756B71FC9CA0C6A5960339B4649​E0DCEF00265B02B02175F0998D6680​C31619646CABFDD5A0478227475D23​34A25C22BD1305DC041004D5B6ABFA​598D1A7CEB9C869AD537B3187BF82F​D0E04A27E482670A4B5FD213525E35​F128EF089F7811199C40944618DDD3​71D57BAD19C2DC7A9608384A599A10​2A4014C3BF52C84D60F6F7DC9A80F7​3CBE9549CBD85873E9B9DA000CF727​1A0187108A7F"
 .
 --------------------- DLLs chargées dans les processus actifs ---------------------

 - - - - - - - > 'winlogon.exe'(676)
 c:\windows\system32\Ati2evxx.d​ll
 .
 Heure de fin: 2009-11-21 13:50
 ComboFix-quarantined-files.txt  2009-11-21 12:50
 ComboFix2.txt  2009-11-16 19:38

 Avant-CF: 3.414.315.008 octets libres
 Après-CF: 3.379.884.032 octets libres

 - - End Of File - - C17E45F92CD980A4B013F9D2619110​1D

Salut radzinskis


 Faire un scan de ce fichier msvcp6q.dll ici :

 http://www.virustotal.com/fr/


 Clique sur Parcourir et copie/colle ceci :
 c:\windows\system32\msvcp6q.dl​l
 Après tu clique sur Envoyer le fichier et attendre le résultat de l’analyse.

 Si il te dit que le fichier a déjà été analysé, sélectionne le bouton :
 Reanalyse le fichier maintenant et attendre le résultat de l'analyse, poste le résultat au complet.

 Poste le résultat au complet

 Aide : http://bibou0007.com/scans-en- [...] l-t190.htm

 Faire le scan de ce fichier aussi :
 c:\windows\system32\1ac5.sys


 @++  

voilà

 Fichier msvcp6q.dll reçu le 2009.11.22 14:56:46 (UTC)Antivirus Version Dernière mise à jour Résultat
 a-squared 4.5.0.41 2009.11.22 Virus.Win32.AutoRun.sd!IK
 AhnLab-V3 5.0.0.2 2009.11.20 Win-Trojan/Backdoor.114688.C
 AntiVir 7.9.1.72 2009.11.20 Worm/Autorun.cob
 Antiy-AVL 2.0.3.7 2009.11.20 -
 Authentium 5.2.0.5 2009.11.21 W32/Worm.AKNM
 Avast 4.8.1351.0 2009.11.22 Win32:AutoRun-SD
 AVG 8.5.0.425 2009.11.22 Worm/Generic.GEM
 BitDefender 7.2 2009.11.22 Trojan.Inject.GK
 CAT-QuickHeal 10.00 2009.11.21 Worm.AutoRun.cob
 ClamAV 0.94.1 2009.11.22 Worm.Autorun-1854
 Comodo 2998 2009.11.22 -
 DrWeb 5.0.0.12182 2009.11.22 Win32.HLLW.Autoruner.5122
 eSafe 7.0.17.0 2009.11.19 Win32.WormAutorun.co
 eTrust-Vet 35.1.7133 2009.11.20 Win32/Milsni!generic
 F-Prot 4.5.1.85 2009.11.21 W32/Worm.AKNM
 F-Secure 9.0.15370.0 2009.11.20 Trojan.Inject.GK
 Fortinet 3.120.0.0 2009.11.22 W32/AutoRun.COB!worm
 GData 19 2009.11.22 Trojan.Inject.GK
 Ikarus T3.1.1.74.0 2009.11.22 Virus.Win32.AutoRun.sd
 Jiangmin 11.0.800 2009.11.22 Worm/AutoRun.jey
 K7AntiVirus 7.10.901 2009.11.20 Worm.Win32.AutoRun
 Kaspersky 7.0.0.125 2009.11.22 Worm.Win32.AutoRun.cob
 McAfee 5809 2009.11.21 W32/Autorun.worm.dw
 McAfee+Artemis 5809 2009.11.21 W32/Autorun.worm.dw
 McAfee-GW-Edition 6.8.5 2009.11.21 Worm.Autorun.cob
 Microsoft 1.5302 2009.11.22 Worm:Win32/Autorun.FC
 NOD32 4627 2009.11.21 Win32/AutoRun.COB
 Norman 6.03.02 2009.11.21 W32/AutoRun.IMP
 nProtect 2009.1.8.0 2009.11.22 Worm/W32.AutoRun.114688.B
 Panda 10.0.2.2 2009.11.22 Trj/Autorun.AOD
 PCTools 7.0.3.5 2009.11.22 Net-Worm.SillyFDC
 Prevx 3.0 2009.11.22 High Risk Worm
 Rising 22.22.06.04 2009.11.22 Trojan.Win32.Generic.51E90AA1
 Sophos 4.47.0 2009.11.22 W32/Autorun-BY
 Sunbelt 3.2.1858.2 2009.11.21 Trojan.Win32.Generic!BT
 Symantec 1.4.4.12 2009.11.22 W32.SillyFDC
 TheHacker 6.5.0.2.075 2009.11.20 W32/AutoRun.cob
 TrendMicro 9.0.0.1003 2009.11.22 TROJ_GEN.0X0312S
 VBA32 3.12.12.0 2009.11.22 Worm.Win32.AutoRun.cob
 ViRobot 2009.11.20.2047 2009.11.20 Worm.Win32.Autorun.114688.N
 VirusBuster 5.0.21.0 2009.11.21 Worm.Autorun.Gen.13
 
 Information additionnelle
 File size: 114688 bytes
 MD5...: d31885f0a63542b402d9848b19d437​81
 SHA1..: 21075e7f8f8991a5a12ab031844ab4​f9083e27c3
 SHA256: 4eab277a1b5363e98e1a3a7003d897​1c7ab3f1a2576d3b8738029d7e7901​46d2
 ssdeep: 1536:tdOVZzUAHQQVg32vqIhDGQNNZ​TBOvbB5Rz+CdHEow1KivYN:GbG3CqI​VDOv<BR>rRCOHEowsiQ<BR>
 PEiD..: -


 Fichier 1ac5.sys reçu le 2009.11.22 15:04:14 (UTC)Antivirus Version Dernière mise à jour Résultat
 a-squared 4.5.0.41 2009.11.22 -
 AhnLab-V3 5.0.0.2 2009.11.20 -
 AntiVir 7.9.1.72 2009.11.20 -
 Antiy-AVL 2.0.3.7 2009.11.20 -
 Authentium 5.2.0.5 2009.11.21 -
 Avast 4.8.1351.0 2009.11.22 -
 AVG 8.5.0.425 2009.11.22 -
 BitDefender 7.2 2009.11.22 -
 CAT-QuickHeal 10.00 2009.11.21 -
 ClamAV 0.94.1 2009.11.22 -
 Comodo 2998 2009.11.22 -
 DrWeb 5.0.0.12182 2009.11.22 -
 eSafe 7.0.17.0 2009.11.19 -
 eTrust-Vet 35.1.7133 2009.11.20 -
 F-Prot 4.5.1.85 2009.11.21 -
 Fortinet 3.120.0.0 2009.11.22 -
 GData 19 2009.11.22 -
 Ikarus T3.1.1.74.0 2009.11.22 -
 Jiangmin 11.0.800 2009.11.22 -
 K7AntiVirus 7.10.901 2009.11.20 -
 Kaspersky 7.0.0.125 2009.11.22 -
 McAfee 5809 2009.11.21 -
 McAfee+Artemis 5809 2009.11.21 -
 McAfee-GW-Edition 6.8.5 2009.11.21 -
 Microsoft 1.5302 2009.11.22 -
 NOD32 4627 2009.11.21 -
 Norman 6.03.02 2009.11.21 -
 nProtect 2009.1.8.0 2009.11.22 -
 Panda 10.0.2.2 2009.11.22 -
 PCTools 7.0.3.5 2009.11.22 -
 Prevx 3.0 2009.11.22 -
 Rising 22.22.06.04 2009.11.22 -
 Sophos 4.47.0 2009.11.22 -
 Sunbelt 3.2.1858.2 2009.11.21 -
 Symantec 1.4.4.12 2009.11.22 -
 TheHacker 6.5.0.2.075 2009.11.20 -
 TrendMicro 9.0.0.1003 2009.11.22 -
 VBA32 3.12.12.0 2009.11.22 -
 ViRobot 2009.11.20.2047 2009.11.20 -
 VirusBuster 5.0.21.0 2009.11.21 -
 
 Information additionnelle
 File size: 54624 bytes
 MD5...: 43b0076b3ab8996b84d2cc8f990b58​2f
 SHA1..: 97d13f87d18e1829d9af7e54cd5a0b​2d68d684e7
 SHA256: 5787ad3e47054ed8417522330be69c​9b122d33373b960a21ac52eb2d25ad​3259
 ssdeep: 768:Xht98mhWffPd0l3V+Vdj4AGXwZ​ONbB0/92+U48swGs47+Sv9NLzbRUh:​XhTb<BR>E6VFXwkb0F2+U4nS8J7jRe​<BR>
 PEiD..: -

Salut radzinskis


 Clique sur le menu démarrer/Exécuter, tape notepad à l’invite de commande et OK.

 - Copie/colle ce qui est en citation ci-dessous dans le Bloc-Notes :

 

 - Enregistre ce fichier sur le bureau (Impératif)

 -Nom du fichier : CFScript.txt
 -Type du fichier : tous les fichiers

 - Clique sur Enregistrer et quitte le Bloc Notes

 Important Désactive ton Antivirus et antispyware avant de faire le glisser/déposer

 - Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe sur le bureau, comme sur cette capture (l’icône est un lion) :

 http://free0.hiboox.com/images​/2409/9126d3b136f7db9ab6242ad7​15b44296.gif

* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ ComboFix.txt


 @++  

Alors plusieurs choses se sont passées.

 Lorsque le fichier cfsript a été accepté par combofix celui-ci s'est lancé et ensuite a dit "cd-emulation drivers running...".
 Donc le pc rédémarre, combofix revient et fait un scan puis le pc plante("écran bleu :IRQL_NOT_LESS_OR_Equall...".
 Je rédémarre manuellement et je vais voir si j'ai un rapport mais il y en a pas.
 Le fichier script n'étant plus sur le bureau j'en refait un mais de nouveau "cd-emulation...".
 Le pc redémarre mais rien ne se passe. Alors je lance combofix seul pour voir s'il fait tjrs "cd-emulation...".
 Etrangement il fait un scan tranquille.

 Voici le rapport

 

 Je décide en suite de tt de meme recommencer avec le fichier script, combofix scan, j'ai un rapport puis un plantage (écran bleu: problème ACPI_2.sys (à noter que depuis que j'ai commencé a avoir des problèmes à cause du "rootkit" j'ai ce plantage))

 J'ai tt de meme le rapport:




 mboFix 09-11-21.03 - Administrateur 22/11/2009 17:02.38.2 - x86
 Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.204​7.1586 [GMT 1:00]
 Lancé depuis: c:\documents and settings\Administrateur\Bureau​\ComboFix.exe
 Commutateurs utilisés :: c:\documents and settings\Administrateur\Bureau​\CFScript.txt

 FILE ::
 "c:\windows\system32\msvcp6q.d​ll"
 .

 (((((((((((((((((((((((((((((   Fichiers créés du 2009-10-22 au 2009-11-22  ))))))))))))))))))))))))))))))​))))))
 .

 2009-11-21 21:38 . 2006-04-14 13:00 208896 ------w- c:\windows\system32\nvuide.exe
 2009-11-21 15:22 . 2009-11-21 15:22 -------- d-----w- c:\program files\Navilog1
 2009-11-21 12:12 . 2009-11-21 12:17 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Partouche
 2009-11-16 20:42 . 2009-11-16 20:42 54624 ----a-w- c:\windows\system32\1ac5.sys
 2009-11-16 19:48 . 2009-11-16 21:25 -------- d-----w- c:\program files\Sophos
 2009-11-16 19:24 . 2009-11-16 19:24 -------- d-----w- C:\rsit
 2009-11-16 19:05 . 2003-10-15 08:28 10240 ----a-w- c:\windows\system32\drivers\Si​WinAcc.sys
 2009-11-16 18:41 . 2009-11-16 18:57 81984 ----a-w- c:\windows\system32\bdod.bin
 2009-11-16 18:24 . 2009-11-16 18:58 -------- d-----w- c:\program files\Fichiers communs\BitDefender
 2009-11-07 15:46 . 2009-11-07 15:46 159744 ----a-w- c:\documents and settings\Administrateur\Applic​ation Data\UltimateBet\DownLoad\live​update.exe
 2009-11-07 15:42 . 2009-11-07 15:55 -------- d-----w- c:\program files\UltimateBet
 2009-11-07 15:42 . 2009-11-07 15:45 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\UltimateBet
 2009-11-07 15:42 . 2009-11-07 15:42 -------- d-----w- c:\program files\_uninstallation_info
 2009-11-07 13:19 . 2009-11-07 13:37 -------- d-----w- c:\program files\PartyGaming
 2009-11-06 21:26 . 2009-11-06 21:26 -------- d-----w- c:\program files\Ventrilo
 2009-10-28 16:59 . 2009-10-28 16:59 -------- d-----w- c:\program files\Fichiers communs\xing shared
 2009-10-28 16:59 . 2009-10-28 16:59 -------- d-----w- c:\program files\Real
 2009-10-28 16:59 . 2009-10-28 16:59 -------- d-----w- c:\program files\Fichiers communs\Real
 2009-10-27 16:51 . 2009-10-27 16:51 38208 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\​airappinstaller\airappinstalle​r.exe
 2009-10-27 16:49 . 2009-10-27 16:51 38208 ----a-w- c:\documents and settings\Administrateur\Applic​ation Data\Macromedia\Flash Player\www.macromedia.com\bin\​airappinstaller\airappinstalle​r.exe
 2009-10-27 16:49 . 2009-10-27 16:51 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
 2009-10-27 16:47 . 2009-11-04 18:40 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\P5

 .
 ((((((((((((((((((((((((((((((​((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))​))))))))))))))))))
 .
 2009-11-22 14:51 . 2006-09-25 12:06 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\teamspeak2
 2009-11-22 14:51 . 2006-09-25 13:49 -------- d-----w- c:\program files\mIRC
 2009-11-21 21:43 . 2001-08-24 14:00 72092 ----a-w- c:\windows\system32\perfc00C.d​at
 2009-11-21 21:43 . 2001-08-24 14:00 461134 ----a-w- c:\windows\system32\perfh00C.d​at
 2009-11-21 19:25 . 2009-07-30 20:08 -------- d-----w- c:\program files\SopCast
 2009-11-21 15:29 . 2009-03-20 19:51 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Mumble
 2009-11-20 22:56 . 2008-05-03 10:48 32 -c--a-w- c:\windows\msocreg32.dat
 2009-11-15 20:50 . 2008-10-19 11:05 -------- d-----w- c:\program files\Full Tilt Poker
 2009-11-15 19:51 . 2009-10-17 19:25 -------- d-----w- c:\program files\PokerStars
 2009-11-15 19:48 . 2008-07-08 10:43 -------- d-----w- c:\program files\Everest Poker
 2009-11-15 18:47 . 2008-09-05 11:37 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\Microgaming
 2009-11-14 18:44 . 2006-09-22 12:10 -------- d--h--w- c:\program files\InstallShield Installation Information
 2009-11-06 21:25 . 2009-04-19 19:49 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard
 2009-11-05 19:58 . 2009-09-17 18:14 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\RayV
 2009-11-03 04:08 . 2007-10-06 16:50 -------- d-----w- c:\program files\eMule
 2009-10-30 20:52 . 2008-07-04 19:46 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\dvdcss
 2009-10-28 18:56 . 2006-09-25 11:50 -------- d-----w- c:\documents and settings\Administrateur\Applic​ation Data\BSplayer
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\NewShortcut6_504C9DBC7EE64​5B2A9CF47F39BEDA88E.exe
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\NewShortcut2_C8CBC5632A224​D2D83650A01AF12D5F6.exe
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\NewShortcut1_F627668DCED74​C3B92937B05B370A211.exe
 2009-10-16 12:19 . 2009-10-16 12:19 292878 ----a-r- c:\documents and settings\Administrateur\Applic​ation Data\Microsoft\Installer\{C962​EF10-7539-477A-A0AD-F8CBD0E9F7​E5}\ARPPRODUCTICON.exe
 2009-10-05 12:17 . 2009-07-25 11:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
 2009-10-05 12:17 . 2009-08-26 10:22 4045528 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes​' Anti-Malware\mbam-setup.exe
 2009-09-13 20:42 . 2009-09-13 20:42 60416 ----a-w- c:\windows\ALCFDRTM.EXE
 2009-09-10 12:54 . 2009-07-25 11:28 38224 ----a-w- c:\windows\system32\drivers\mb​amswissarmy.sys
 2009-09-10 12:53 . 2009-07-25 11:28 19160 ----a-w- c:\windows\system32\drivers\mb​am.sys
 2009-08-26 13:07 . 2009-08-26 13:07 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
 2009-08-26 13:07 . 2009-08-26 13:07 368640 ----a-w- c:\windows\system32\ReWire.dll
 .

 ------- Sigcheck -------

 [-] 2004-08-18 . 27A5959C94EE173A063CA06BD14F02​1A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tc​pip.sys

 [-] 2006-07-05 . CE4AF1FA47A29ADF97CB107775CE39​5C . 1049088 . . [5.1.2600.2945] . . c:\windows\system32\kernel32.d​ll
 [-] 2006-07-05 . CE4AF1FA47A29ADF97CB107775CE39​5C . 1049088 . . [5.1.2600.2945] . . c:\windows\system32\dllcache\k​ernel32.dll

 [-] 2004-08-22 . 998F3F568F6074A35AB08CD3395A9D​C2 . 1036288 . . [6.00.2900.2180] . . c:\windows\explorer.exe
 .
 ((((((((((((((((((((((((((((((​(((   Points de chargement Reg   ))))))))))))))))))))))))))))))​))))))))))))))))))
 .
 .
 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
 REGEDIT4

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\Run]
 "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-14 282624]
 "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
 "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Stat​ic\CLIStart.exe" [2009-08-13 98304]
 "amd_dc_opt"="c:\program files\AMD\amd_dc_opt\amd_dc_op​t.exe" [2006-06-28 106496]
 "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
 "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-06-20 77824]

 [HKEY_LOCAL_MACHINE\software\mi​crosoft\windows nt\currentversion\drivers32]
 "midi2"=KORGUMDD.DRV
 "midi3"=KORGUMDD.DRV

 [HKEY_LOCAL_MACHINE\system\curr​entcontrolset\control\session manager]
 BootExecute REG_MULTI_SZ    autocheck autochk *\0OODBS

 [HKLM\~\services\sharedaccess\p​arameters\firewallpolicy\stand​ardprofile]
 "EnableFirewall"= 0 (0x0)

 [HKLM\~\services\sharedaccess\p​arameters\firewallpolicy\stand​ardprofile\AuthorizedApplicati​ons\List]
 "c:\\Program Files\\FreeCall.com\\FreeCall\​\FreeCall.exe"=
 "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"​=
 "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
 "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
 "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

 R0 SiWinAcc;SiWinAcc;c:\windows\s​ystem32\drivers\SiWinAcc.sys [16/11/2009 20:05 10240]
 R3 AmdTools;AMD Special Tools Driver;c:\windows\system32\dri​vers\AmdTools.sys [12/09/2009 21:39 31744]
 S2 Intelligent Transfer Service;Windows InstallService;c:\windows\syst​em32\servtie.exe --> c:\windows\system32\servtie.ex​e [?]
 S3 1ac5;1ac5;c:\windows\system32\​1ac5.sys [16/11/2009 21:42 54624]
 S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\dri​vers\a38usb.sys [15/12/2008 22:00 33536]
 S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP;c:\windows\system32\drivers​\KORGUMDS.SYS [20/12/2005 1:07 14976]
 S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWSer​vice.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWSer​vice.exe [?]

 --- Autres Services/Pilotes en mémoire ---

 *Deregistered* - CLASSPNP_2
 .
 .
 ------- Examen supplémentaire -------
 .
 uStart Page = about:blank
 .

 ******************************​******************************​**************

 catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
 Rootkit scan 2009-11-22 17:06
 Windows 5.1.2600 Service Pack 2 NTFS

 Recherche de processus cachés ...

 Recherche d'éléments en démarrage automatique cachés ...

 Recherche de fichiers cachés ...

 Scan terminé avec succès
 Fichiers cachés: 0

 ******************************​******************************​**************

 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 device: opened successfully
 user: MBR read successfully
 called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A06F938]<<
 kernel: MBR read successfully
 detected MBR rootkit hooks:
 \Driver\Disk -> CLASSPNP.SYS @ 0xba0ecfc3
 \Driver\ACPI -> ACPI.sys @ 0xb9f56cb8
 \Driver\atapi -> atapi.sys @ 0xb9ed57b4
 IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
 ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
 ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
 NDIS: NVIDIA nForce 10/100/1000 Mbps Ethernet  -> SendCompleteHandler -> NDIS.sys @ 0xb9d48ba0
 PacketIndicateHandler -> NDIS.sys @ 0xb9d55b21
 SendHandler -> NDIS.sys @ 0xb9d3387b
 user & kernel MBR OK

 ******************************​******************************​**************
 .
 --------------------- CLES DE REGISTRE BLOQUEES ---------------------

 [HKEY_LOCAL_MACHINE\software\Cl​asses\CLSID\{4722EE48-40E7-10C​3-749F-74DFCE71B7CA}\InProcSer​ver32*]
 "oabhajjcjkobfaikndpifbngojdbp​f"=hex:6a,61,64,69,63,63,68,6b​,65,61,67,62,6c,6d,

6a,62,6a,6d,62,65,00,f9
 "nabhgjlkenekdmlokipjcbclobne"​=hex:6a,61,64,69,63,63,68,6b,6​5,61,67,62,6c,6d,

6a,62,6a,6d,62,65,00,f9

 [HKEY_LOCAL_MACHINE\software\Cl​asses\CLSID\{F592A3F4-1E8F-F23​D-181A-D5DEAD3CBB53}\InProcSer​ver32*]
 "oafebebpjjkiebppncbphmbgibcoe​b"=hex:6a,61,63,6c,6d,6f,69,69​,6f,65,70,6b,65,62,

67,70,6e,61,6d,6c,00,f9
 "nafeldhldindccjgoakbidlmbafl"​=hex:6a,61,63,6c,6d,6f,69,69,6​f,65,70,6b,65,62,

67,70,6e,61,6d,6c,00,f9

 [HKEY_LOCAL_MACHINE\software\Mi​crosoft\Windows\CurrentVersion​\System*]
 "OODEFRAG10.00.00.01WORKSTATIO​N"="C3CA43629C4D5DB8FC0D5EC5A7​02DB907BFC5BDFD6887BD3168EDA4E​BD4E79BED37DB16569A5F032550DBD​B5B24ADB538FCBFD33E66E57255B71​0ADB3AE03C4ACEC8CFFD09BF88C46E​2A237E723918D0A2079FBDB8DEAAC5​8B825B04F509C0911A1EE00024C640​3FF9708753EAE36F8AD2740EB54BF8​3B8653620F9C100D50FEBC9E127BEC​C74CFEBC9E127BECC74CFEBC9E127B​ECC74CFEBC9E127BECC74CFEBC9E12​7BECC74CFEBC9E127BECC74CA6A0AC​4980AC79338EDD5E5BE2F6E6675D57​5E7D6A3B9808A6171C11EC38DE3D66​0943E3B41C49F3FEAB214F60C26A0F​758BDBB86F76CD717DD117CB856141​D969E90525BFC987B5468BBB42E68A​FA3D9E1C1EC6AB54BED6B656DA05F3​440754E6C8F366BD47E2F883255A17​884FA752CF571806D6575BDF89F50A​BA3C38BC8DF9FCABEE7BCCD2F91F5C​F20633671211634FB64622138C74E1​11ABEFEDADB3AFBC51EF9809473048​0786A2DF995BBC10378611EC004D1E​CDAE756F3F5EC7A33C528126D0BCD8​BAC92E6FA60831690F372F755CEF27​81C07DE46AA4D4A45D23865DC1D69B​2ED292378956E174B4025446B08876​DE925D09E3FA2840F39C7B323609B6​B18D3C40419D126E5CB2A14CBBCD27​1EDE5782436FB8ED5C5BEFE6E0AFC7​7EFB0851865D2EDBC6DDBF5FBA2159​B3010DB88EF9C9CF07BCA733336700​E209F01E4F2673192AA9A741DBAF85​0E25B2319A4C4CBEBCEAAD6A1E29BA​C782F49F941F225D2C99E68D3C2523​EACC537856AE8485EDDD9966DE7F49​4097F1427282A275BDDC1DB6F9658D​0F2D6B1F681483F27AF3E2A4124821​0727A26F974FCDFDD48B042076FD5E​612875B3204DF69BEDFDA04CAFA78E​FD4F91A79DFAAB6D5A32EFBE7BB4B0​AE72069DC2160D6D5A959FD08D656C​BDA8D81A31302187E713D311B562CD​3D013D78AD86D558C95BA56E76F350​3C46812E8B01FE9AC1F6C6ECD7E46F​3BC8EFE753170378811F81341FF325​70E5EF7CD223B0DD96B2BABE895BE5​476B035F17A4CBD888150E3873D9BD​DBAFD5C3C563543D43D817B9E6E7B4​EF64297768A5903C392B12F9B410F2​73B13CF137D123646CE6A2732365C6​0E0FF29C4DEA0ED54EF85FE1495027​3AE5EADA0F972A6B96F9483F95FD65​5E81E426DF3B4D1C884FD767B633A9​BF85ED496DCFB6A349E14E36D51843​210641DDB0C8E6D313E9E2934758EA​388576E886AB6DD9746C34F71F3BC7​F7B756B71FC9CA0C6A5960339B4649​E0DCEF00265B02B02175F0998D6680​C31619646CABFDD5A0478227475D23​34A25C22BD1305DC041004D5B6ABFA​598D1A7CEB9C869AD537B3187BF82F​D0E04A27E482670A4B5FD213525E35​F128EF089F7811199C40944618DDD3​71D57BAD19C2DC7A9608384A599A10​2A4014C3BF52C84D60F6F7DC9A80F7​3CBE9549CBD85873E9B9DA000CF727​1A0187108A7F"
 .
 --------------------- DLLs chargées dans les processus actifs ---------------------

 - - - - - - - > 'winlogon.exe'(688)
 c:\windows\system32\Ati2evxx.d​ll
 .
 ------------------------ Autres processus actifs ------------------------
 .
 c:\windows\system32\Ati2evxx.e​xe
 c:\windows\System32\SCardSvr.e​xe
 c:\windows\system32\Ati2evxx.e​xe
 c:\program files\ATI Technologies\ATI.ACE\Core-Stat​ic\MOM.exe
 c:\windows\system32\wdfmgr.exe
 c:\program files\ATI Technologies\ATI.ACE\Core-Stat​ic\ccc.exe
 c:\windows\system32\wscntfy.ex​e
 c:\windows\system32\rundll32.e​xe
 .
 ******************************​******************************​**************
 .
 Heure de fin: 2009-11-22 17:07 - La machine a redémarré
 ComboFix-quarantined-files.txt  2009-11-22 16:07
 ComboFix2.txt  2009-11-22 16:00

 Avant-CF: 3.409.702.912 octets libres
 Après-CF: 3.374.379.008 octets libres

 - - End Of File - - 1E92A63088DA1F4D539B23B8EDB6DE​76

Salut radzinskis


 Pourquoi avoir installer Navilog1? Ne plus rien installer autre chose que je te demande

 Télécharge MBR par GMER sur ton Bureau :

 http://www2.gmer.net/mbr/mbr.exe

 - Désactive tous les programmes de protection (antivirus, antispyware etc.)
 - Double-clique sur mbr.exe > une fenêtre noire va s'ouvrir et se refermer.
 - Poste le rapport mbr.log qui apparaît.


 @++  

merci de ton aide dédétraqué

 J'avais installé navilog hier lorsque que j'essayais d 'agir par moi meme.

 voici le rapport

 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 device: opened successfully
 user: MBR read successfully
 kernel: MBR read successfully
 user & kernel MBR OK

Salut radzinskis


 Télécharge SDFix par AndyManchesta sur le Bureau :

 http://downloads.andymanchesta [...] /SDFix.exe


 Double clic sur SDFix.exe sur le bureau et clic sur Install , choisi le bureau pour l’intallation et un dossier sera créer sur le bureau.


 Redémarre ton PC en mode sans échec :

 Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur.


 Ouvre le dossier SDFix sur le bureau et double clique sur RunThis.bat, appuie sur Y pour lancer le nettoyage.

 Il y aura redémarrage, quand Finished s’affichera appuie sur un touche pour terminer.

 Poste le rapport qui se trouve dans le dossier SDFix sous le nom de Report.txt dans ta prochaine réponse.


 @++

voici le rapport sdfix


 SDFix: Version 1.240
 Run by Administrateur on dim. 22/11/2009 at 19:30

 Microsoft Windows XP [version 5.1.2600]
 Running From: C:\Documents and Settings\Administrateur\Bureau​\SDFix

 Checking Services :


 Restoring Default Security Values
 Restoring Default Hosts File

 Rebooting


 Checking Files :

 No Trojan Files Found






 Removing Temp Files

 ADS Check :

Final Check :

 catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
 Rootkit scan 2009-11-22 19:34:46
 Windows 5.1.2600 Service Pack 2 NTFS

 scanning hidden processes ...

 scanning hidden services & system hive ...

 [HKEY_LOCAL_MACHINE\SYSTEM\Curr​entControlSet\Services\a347scs​i\Config\jdgg40]
 "ujdew"=hex:20,02,00,00,31,3c,​fc,21,91,33,c6,cf,60,3c,8c,bf,​03,26,fa,48,fa,..
 "ljej40"=hex:3b,c8,ad,92,7a,d0​,8f,c1,00,e8,86,44,e9,29,e3,01​,1f,fa,97,b6,c1,..
 [HKEY_LOCAL_MACHINE\SYSTEM\Curr​entControlSet\Services\a347scs​i\Config\jdgg40.REN]

 scanning hidden registry entries ...

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\System]
 "OODEFRAG10.00.00.01WORKSTATIO​N"="C3CA43629C4D5DB8FC0D5EC5A7​02DB907BFC5BDFD6887BD3168EDA4E​BD4E79BED37DB16569A5F032550DBD​B5B24ADB538FCBFD33E66E57255B71​0ADB3AE03C4ACEC8CFFD09BF88C46E​2A237E723918D0A2079FBDB8DEAAC5​8B825B04F509C0911A1EE00024C640​3FF9708753EAE36F8AD2740EB54BF8​3B8653620F9C100D50FEBC9E127BEC​C74CFEBC9E127BECC74CFEBC9E127B​ECC74CFEBC9E127BECC74CFEBC9E12​7BECC74CFEBC9E127BECC74CA6A0AC​4980AC79338EDD5E5BE2F6E6675D57​5E7D6A3B9808A6171C11EC38DE3D66​0943E3B41C49F3FEAB214F60C26A0F​758BDBB86F76CD717DD117CB856141​D969E90525BFC987B5468BBB42E68A​FA3D9E1C1EC6AB54BED6B656DA05F3​440754E6C8F366BD47E2F883255A17​884FA752CF571806D6575BDF89F50A​BA3C38BC8DF9FCABEE7BCCD2F91F5C​F20633671211634FB64622138C74E1​11ABEFEDADB3AFBC51EF9809473048​0786A2DF995BBC10378611EC004D1E​CDAE756F3F5EC7A33C528126D0BCD8​BAC92E6FA60831690F372F755CEF27​81C07DE46AA4D4A45D23865DC1D69B​2ED292378956E174B4025446B08876​DE925D09E3FA2840F39C7B323609B6​B18D3C40419D126E5CB2A14CBBCD27​1EDE5782436FB8ED5C5BEFE6E0AFC7​7EFB0851865D2EDBC6DDBF5FBA2159​B3010DB88EF9C9CF07BCA733336700​E209F01E4F2673192AA9A741DBAF85​0E25B2319A4C4CBEBCEAAD6A1E29BA​C782F49F941F225D2C99E68D3C2523​EACC537856AE8485EDDD9966DE7F49​4097F1427282A275BDDC1DB6F9658D​0F2D6B1F681483F27AF3E2A4124821​0727A26F974FCDFDD48B042076FD5E​612875B3204DF69BEDFDA04CAFA78E​FD4F91A79DFAAB6D5A32EFBE7BB4B0​AE72069DC2160D6D5A959FD08D656C​BDA8D81A31302187E713D311B562CD​3D013D78AD86D558C95BA56E76F350​3C46812E8B01FE9AC1F6C6ECD7E46F​3BC8EFE753170378811F81341FF325​70E5EF7CD223B0DD96B2BABE895BE5​476B035F17A4CBD888150E3873D9BD​DBAFD5C3C563543D43D817B9E6E7B4​EF64297768A5903C392B12F9B410F2​73B13CF137D123646CE6A2732365C6​0E0FF29C4DEA0ED54EF85FE1495027​3AE5EADA0F972A6B96F9483F95FD65​5E81E426DF3B4D1C884FD767B633A9​BF85ED496DCFB6A349E14E36D51843​210641DDB0C8E6D313E9E2934758EA​388576E886AB6DD9746C34F71F3BC7​F7B756B71FC9CA0C6A5960339B4649​E0DCEF00265B02B02175F0998D6680​C31619646CABFDD5A0478227475D23​34A25C22BD1305DC041004D5B6ABFA​598D1A7CEB9C869AD537B3187BF82F​D0E04A27E482670A4B5FD213525E35​F128EF089F7811199C40944618DDD3​71D57BAD19C2DC7A9608384A599A10​2A4014C3BF52C84D60F6F7DC9A80F7​3CBE9549CBD85873E9B9DA000CF727​1A0187108A7F"

 scanning hidden files ...

 scan completed successfully
 hidden processes: 0
 hidden services: 0
 hidden files: 0


 Remaining Services :




 Authorized Application Key Export:

 [HKEY_LOCAL_MACHINE\system\curr​entcontrolset\services\shareda​ccess\parameters\firewallpolic​y\standardprofile\authorizedap​plications\list]
 "C:\\Program Files\\FreeCall.com\\FreeCall\​\FreeCall.exe"="C:\\Program Files\\FreeCall.com\\FreeCall\​\FreeCall.exe:*:Enabled:FreeCa​ll"
 "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"​="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:​*:Enabled:Microsoft Office Outlook"
 "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%w​indir%\\Network Diagnostic\\xpnetdiag.exe:*:En​abled:@xpsp3res.dll,-20000"
 "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="​C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:​Enabled:Windows Live Call"
 "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=​"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*​:Enabled:Windows Live Messenger"

 [HKEY_LOCAL_MACHINE\system\curr​entcontrolset\services\shareda​ccess\parameters\firewallpolic​y\domainprofile\authorizedappl​ications\list]
 "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%w​indir%\\Network Diagnostic\\xpnetdiag.exe:*:En​abled:@xpsp3res.dll,-20000"
 "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="​C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:​Enabled:Windows Live Call"
 "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=​"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*​:Enabled:Windows Live Messenger"

 Remaining Files :



 Files with Hidden Attributes :

 Thu 22 Mar 2007        19,968 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL0590.tmp"
 Thu 22 Mar 2007        20,480 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL1119.tmp"
 Thu 22 Mar 2007        19,968 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL1198.tmp"
 Thu 22 Mar 2007        19,968 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL1334.tmp"
 Thu 22 Mar 2007        19,968 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL2045.tmp"
 Thu 22 Mar 2007        20,480 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL2526.tmp"
 Thu 22 Mar 2007        19,968 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL2722.tmp"
 Thu 22 Mar 2007        19,968 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL3025.tmp"
 Thu 22 Mar 2007        20,480 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL3387.tmp"
 Thu 22 Mar 2007        20,480 ...H. --- "C:\Documents and Settings\Administrateur\Bureau​\~WRL3647.tmp"
 Sun 19 Apr 2009         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
 Wed 29 Oct 2003         4,587 A..H. --- "C:\PAPA\SauvegardeI\Documents​\AMHL\Polonia\~WRL0944.tmp"
 Tue 23 Apr 2002        37,888 A..H. --- "C:\PAPA\SauvegardeI\Documents​\JPLH internet\DiscPGO\_WRL0001.TMP"
 Tue 30 Apr 2002        39,424 A..H. --- "C:\PAPA\SauvegardeI\Documents​\JPLH internet\DiscPGO\_WRL0004.TMP"
 Tue 23 Apr 2002        32,768 A..H. --- "C:\PAPA\SauvegardeI\Documents​\JPLH internet\DiscPGO\_WRL1769.TMP"
 Mon 26 Jul 2004        99,328 A..H. --- "C:\PAPA\SauvegardeI\Documents​\santosdict‚e\santosusb\fisc\i​o\~WRL2450.tmp"
 Sat 12 Aug 2006       156,982 A..H. --- "C:\PAPA\SauvegardeI\Documents​\Traduction\TribNivel\PolJodoi​gne\Jod00100606\~WRL2235.tmp"

 Finished!

Salut radzinskis


 Télécharge RSIT (de random/random) sur le bureau ici :
 http://images.malwareremoval.com/random/RSIT.exe

 - Double clique sur RSIT.exe qui est sur le bureau
 - Clique sur Continue dans la fenêtre
 - RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
 - Poste le contenue des deux rapports, log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

 Les rapports sont dans le dossier ici C:\rsit


 @++  

voici


 logfile of random's system information tool 1.06 (written by random/random)
 Run by Administrateur at 2009-11-23 14:22:13
 Microsoft Windows XP Professionnel Service Pack 2
 System drive C: has 3 GB (7%) free of 45 GB
 Total RAM: 2047 MB (81% free)

 Logfile of Trend Micro HijackThis v2.0.2
 Scan saved at 14:22:16, on 23/11/2009
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 Boot mode: Normal

 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.e​xe
 C:\WINDOWS\system32\services.e​xe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\Ati2evxx.e​xe
 C:\WINDOWS\system32\svchost.ex​e
 C:\WINDOWS\System32\svchost.ex​e
 C:\WINDOWS\system32\spoolsv.ex​e
 C:\WINDOWS\system32\Ati2evxx.e​xe
 C:\WINDOWS\Explorer.EXE
 C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
 C:\WINDOWS\SOUNDMAN.EXE
 C:\Program Files\ATI Technologies\ATI.ACE\Core-Stat​ic\MOM.exe
 C:\Program Files\ATI Technologies\ATI.ACE\Core-Stat​ic\ccc.exe
 C:\WINDOWS\system32\svchost.ex​e
 C:\WINDOWS\system32\wscntfy.ex​e
 C:\WINDOWS\System32\svchost.ex​e
 C:\WINDOWS\system32\wuauclt.ex​e
 C:\Program Files\internet explorer\iexplore.exe
 C:\Documents and Settings\Administrateur\Bureau​\RSIT.exe
 C:\Program Files\Trend Micro\HijackThis\Administrateu​r.exe

 R0 - HKCU\Software\Microsoft\Intern​et Explorer\Main,Start Page = about:blank
 R1 - HKLM\Software\Microsoft\Intern​et Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
 R1 - HKLM\Software\Microsoft\Intern​et Explorer\Main,Default_Search_U​RL = http://go.microsoft.com/fwlink/?LinkId=54896
 R1 - HKLM\Software\Microsoft\Intern​et Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
 O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578​C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\​AcroIEHelperShim.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF​1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv​.dll
 O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-51647​60863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
 O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Stat​ic\CLIStart.exe" MSRun
 O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_op​t.exe"
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
 O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E​0DC46EF} - http://fichiers.touslesdrivers [...] _5_2_1.cab
 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.e​xe
 O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.e​xe
 O23 - Service: Windows InstallService (Intelligent Transfer Service) - Unknown owner - C:\WINDOWS\system32\servtie.ex​e (file missing)

 --
 End of file - 2945 bytes

 ======Registry dump======

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
 Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\​AcroIEHelperShim.dll [2009-02-27 75128]

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
 SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv​.dll [2007-09-25 501136]

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows\CurrentVersion​\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
 Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

 [HKEY_LOCAL_MACHINE\Software\Mi​crosoft\Windows\CurrentVersion​\Run]
 "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-11-14 282624]
 "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
 "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Stat​ic\CLIStart.exe [2009-08-13 98304]
 "amd_dc_opt"=C:\Program Files\AMD\amd_dc_opt\amd_dc_op​t.exe [2006-06-28 106496]
 "SoundMan"=C:\WINDOWS\SOUNDMAN​.EXE [2005-06-20 77824]
 "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

 [HKEY_LOCAL_MACHINE\SOFTWARE\Mi​crosoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
 C:\WINDOWS\system32\Ati2evxx.d​ll [2009-08-14 155648]

 [HKEY_LOCAL_MACHINE\SYSTEM\Curr​entControlSet\Control\SafeBoot​\network\vsmon]

 [HKEY_LOCAL_MACHINE\SYSTEM\Curr​entControlSet\Control\SafeBoot​\network\{1a3e09be-1e45-494b-9​174-d7385b45bbf5}]

 [HKEY_LOCAL_MACHINE\Software\Mi​crosoft\Windows\CurrentVersion​\Policies\System]
 "dontdisplaylastusername"=0
 "legalnoticecaption"=
 "legalnoticetext"=
 "shutdownwithoutlogon"=1
 "undockwithoutlogon"=1

 [HKEY_CURRENT_USER\Software\Mic​rosoft\Windows\CurrentVersion\​Policies\explorer]
 "NoDriveTypeAutoRun"=323
 "NoDriveAutoRun"=67108863
 "NoDrives"=0

 [HKEY_LOCAL_MACHINE\Software\Mi​crosoft\Windows\CurrentVersion​\Policies\explorer]
 "NoDriveAutoRun"=
 "NoDriveTypeAutoRun"=
 "NoDrives"=

 [HKEY_LOCAL_MACHINE\system\curr​entcontrolset\services\shareda​ccess\parameters\firewallpolic​y\standardprofile\authorizedap​plications\list]
 "C:\Program Files\FreeCall.com\FreeCall\Fr​eeCall.exe"="C:\Program Files\FreeCall.com\FreeCall\Fr​eeCall.exe:*:Enabled:FreeCall"
 "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="​C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:​Enabled:Microsoft Office Outlook"
 "%windir%\Network Diagnostic\xpnetdiag.exe"="%wi​ndir%\Network Diagnostic\xpnetdiag.exe:*:Ena​bled:@xpsp3res.dll,-20000"
 "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:​\Program Files\Windows Live\Messenger\wlcsdk.exe:*:En​abled:Windows Live Call"
 "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C​:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:E​nabled:Windows Live Messenger"

 [HKEY_LOCAL_MACHINE\system\curr​entcontrolset\services\shareda​ccess\parameters\firewallpolic​y\domainprofile\authorizedappl​ications\list]
 "%windir%\Network Diagnostic\xpnetdiag.exe"="%wi​ndir%\Network Diagnostic\xpnetdiag.exe:*:Ena​bled:@xpsp3res.dll,-20000"
 "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:​\Program Files\Windows Live\Messenger\wlcsdk.exe:*:En​abled:Windows Live Call"
 "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C​:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:E​nabled:Windows Live Messenger"

 ======List of files/folders created in the last 1 months======

 2009-11-22 17:07:45 ----D---- C:\WINDOWS\temp
 2009-11-22 17:07:43 ----A---- C:\ComboFix.txt
 2009-11-21 22:38:15 ----N---- C:\WINDOWS\system32\nvuide.exe
 2009-11-21 16:22:02 ----D---- C:\Program Files\Navilog1
 2009-11-21 13:12:21 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\Partouche
 2009-11-16 23:20:42 ----A---- C:\WINDOWS\gmer_uninstall.cmd
 2009-11-16 23:20:42 ----A---- C:\WINDOWS\gmer.exe
 2009-11-16 23:20:42 ----A---- C:\WINDOWS\gmer.dll
 2009-11-16 20:48:19 ----D---- C:\Program Files\Sophos
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\zip.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\SWXCACLS.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\SWSC.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\SWREG.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\sed.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\PEV.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\NIRCMD.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\MBR.exe
 2009-11-16 20:30:10 ----A---- C:\WINDOWS\grep.exe
 2009-11-16 20:30:05 ----D---- C:\Qoobox
 2009-11-16 20:24:53 ----D---- C:\rsit
 2009-11-16 19:24:21 ----D---- C:\Program Files\Fichiers communs\BitDefender
 2009-11-07 16:42:55 ----D---- C:\Program Files\UltimateBet
 2009-11-07 16:42:55 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\UltimateBet
 2009-11-07 16:42:53 ----D---- C:\Program Files\_uninstallation_info
 2009-11-07 14:19:46 ----D---- C:\Program Files\PartyGaming
 2009-11-06 22:26:00 ----D---- C:\Program Files\Ventrilo
 2009-10-28 17:59:42 ----A---- C:\WINDOWS\system32\rmoc3260.d​ll
 2009-10-28 17:59:32 ----A---- C:\WINDOWS\system32\pndx5032.d​ll
 2009-10-28 17:59:32 ----A---- C:\WINDOWS\system32\pndx5016.d​ll
 2009-10-28 17:59:30 ----D---- C:\Program Files\Fichiers communs\xing shared
 2009-10-28 17:59:16 ----D---- C:\Program Files\Real
 2009-10-28 17:59:16 ----A---- C:\WINDOWS\system32\pncrt.dll
 2009-10-28 17:59:15 ----D---- C:\Program Files\Fichiers communs\Real
 2009-10-28 17:59:14 ----D---- C:\Documents and Settings\All Users\Application Data\Real
 2009-10-27 17:49:01 ----D---- C:\Program Files\Fichiers communs\Adobe AIR

 ======List of files/folders modified in the last 1 months======

 2009-11-23 14:20:41 ----D---- C:\WINDOWS\Prefetch
 2009-11-23 14:18:17 ----D---- C:\WINDOWS\system32\CatRoot2
 2009-11-22 23:58:40 ----A---- C:\WINDOWS\SchedLgU.Txt
 2009-11-22 23:52:52 ----D---- C:\Program Files\mIRC
 2009-11-22 21:11:44 ----SHD---- C:\WINDOWS\Installer
 2009-11-22 21:11:43 ----D---- C:\Config.Msi
 2009-11-22 19:30:33 ----A---- C:\WINDOWS\ntbtlog.txt
 2009-11-22 17:07:45 ----HD---- C:\WINDOWS\system32\drivers
 2009-11-22 17:07:45 ----D---- C:\WINDOWS
 2009-11-22 17:05:53 ----A---- C:\WINDOWS\system.ini
 2009-11-22 17:03:42 ----D---- C:\WINDOWS\system32
 2009-11-22 17:03:42 ----D---- C:\WINDOWS\AppPatch
 2009-11-22 17:03:42 ----D---- C:\Program Files\Fichiers communs
 2009-11-22 16:45:22 ----D---- C:\WINDOWS\system32\config
 2009-11-22 16:45:15 ----D---- C:\WINDOWS\erdnt
 2009-11-22 16:09:07 ----AC---- C:\WINDOWS\NeroDigital.ini
 2009-11-22 15:51:47 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\teamspeak2
 2009-11-21 22:43:54 ----AC---- C:\WINDOWS\system32\PerfString​Backup.INI
 2009-11-21 20:25:27 ----D---- C:\Program Files\SopCast
 2009-11-21 16:29:50 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\Mumble
 2009-11-21 16:24:03 ----D---- C:\Program Files
 2009-11-21 15:36:23 ----D---- C:\NVIDIA
 2009-11-21 13:44:38 ----RSHDC---- C:\WINDOWS\system32\dllcache
 2009-11-21 00:05:47 ----AC---- C:\WINDOWS\egcomp.ini
 2009-11-17 21:29:25 ----D---- C:\Temp
 2009-11-16 20:38:31 ----SHD---- C:\System Volume Information
 2009-11-16 20:38:31 ----D---- C:\WINDOWS\system32\Restore
 2009-11-16 17:12:16 ----D---- C:\WINDOWS\system32\ZoneLabs
 2009-11-16 17:12:16 ----D---- C:\WINDOWS\Internet Logs
 2009-11-16 00:23:42 ----A---- C:\WINDOWS\system32\tmp.txt
 2009-11-15 21:50:11 ----D---- C:\Program Files\Full Tilt Poker
 2009-11-15 20:51:07 ----D---- C:\Program Files\PokerStars
 2009-11-15 20:48:19 ----D---- C:\Program Files\Everest Poker
 2009-11-15 19:47:56 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\Microgaming
 2009-11-14 19:44:49 ----HD---- C:\Program Files\InstallShield Installation Information
 2009-11-06 22:25:53 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
 2009-11-05 20:58:06 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\RayV
 2009-11-05 17:05:11 ----D---- C:\Poker
 2009-11-03 05:08:44 ----D---- C:\Program Files\eMule
 2009-10-30 21:52:58 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\dvdcss
 2009-10-28 19:56:53 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\BSplayer
 2009-10-28 18:00:31 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\Real
 2009-10-27 17:49:05 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
 2009-10-27 17:49:05 ----D---- C:\Documents and Settings\Administrateur\Applic​ation Data\Adobe

 ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\El​byCDIO.sys [2006-04-22 8064]
 R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.9; C:\WINDOWS\system32\DRIVERS\md​c8021x.sys [2007-06-06 15781]
 R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\AL​CXWDM.SYS [2005-06-20 2324480]
 R3 AmdTools;AMD Special Tools Driver; C:\WINDOWS\system32\DRIVERS\Am​dTools.sys [2006-06-27 31744]
 R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\at​i2mtag.sys [2009-08-14 4485632]
 R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\El​byCDFL.sys [2004-08-31 26240]
 R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\El​byDelay.sys [2005-04-12 4608]
 R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HD​AudBus.sys [2005-01-07 138752]
 R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hi​dusb.sys [2001-08-24 9600]
 R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mo​uhid.sys [2001-08-24 12288]
 R3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft; C:\WINDOWS\system32\drivers\ms​mpu401.sys [2001-08-17 2944]
 R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\AS​ACPI.sys [2004-08-13 5810]
 R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\WINDOWS\system32\DRIVERS\NV​ENETFD.sys [2008-08-01 54784]
 R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nv​netbus.sys [2008-08-01 22016]
 R3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pc​ouffin.sys [2006-12-20 47360]
 R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\us​behci.sys [2004-08-04 26624]
 R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\us​bhub.sys [2004-08-04 57600]
 R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\us​bohci.sys [2004-08-04 17024]
 S3 1ac5;1ac5; \??\C:\WINDOWS\system32\1ac5.s​ys []
 S3 ACSSCR;ACR38 Smart Card Reader; C:\WINDOWS\system32\DRIVERS\a3​8usb.sys [2008-12-15 33536]
 S3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\ar​p1394.sys [2004-08-04 60800]
 S3 ASNDIS5;ASNDIS5 Protocol Driver; \??\C:\WINDOWS\system32\ASNDIS​5.SYS []
 S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCAL​S~1\Temp\catchme.sys []
 S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP; C:\WINDOWS\System32\Drivers\KO​RGUMDS.SYS [2005-12-20 14976]
 S3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\ni​c1394.sys [2004-08-04 61824]
 S3 RT2500USB;ASUS USB Wireless LAN Driver; C:\WINDOWS\system32\DRIVERS\rt​2500usb.sys [2004-08-13 140544]
 S3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SY​MDNS.SYS []
 S3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SY​MFW.SYS []
 S3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SY​MIDS.SYS []
 S3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SY​MNDIS.SYS []
 S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SY​MREDRV.SYS []
 S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\us​baudio.sys [2004-08-03 59264]
 S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\us​bccgp.sys [2004-08-03 31616]
 S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\us​bscan.sys [2004-08-03 15104]
 S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\US​BSTOR.SYS [2004-08-04 26496]
 S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\In​telIde.sys []

 ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.e​xe [2009-08-14 602112]
 R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
 S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.e​xe [2009-08-13 593920]
 S2 Intelligent Transfer Service;Windows InstallService; C:\WINDOWS\system32\servtie.ex​e []
 S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Frame​work\v2.0.50727\aspnet_state.e​xe [2005-09-23 29896]
 S3 clr_optimization_v2.0.50727_32​;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Frame​work\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
 S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
 S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
 S4 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSv​c.exe [2008-12-01 33752]
 S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWSer​vice.exe []

 -----------------EOF----------​-------













 info.txt logfile of random's system information tool 1.06 2009-11-16 20:24:55

 ======Uninstall list======

-->MsiExec.exe /X{E9F81423-211E-46B6-9AE0-385​68BC5CF6F}
 -->rundll32.exe setupapi.dll,InstallHinfSectio​n DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
 3114 SATARAID5-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8E4CF4E6-062E-11D​8-BCF1-005004748D87}\Setup.exe​" -l0x9
 Adobe AIR-->c:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Ado​be AIR Updater.exe -arp:uninstall
 Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FD​C93386723}
 Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\​Macromed\Flash\uninstall_activ​eX.exe
 Adobe Reader 9.1.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91​000000001}
 AMD Dual-Core Optimizer-->MsiExec.exe /X{886C92E6-4AF1-4290-BB86-4B5​064A1BB7D}
 AmpliTube Fender-->C:\Program Files\InstallShield Installation Information\{B178BACA-880B-4D2​0-85F9-522F7F2DECBE}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
 AmpliTube2-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\Professional\RunTime\0701​\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB6691DA-66D3-412​E-9853-641CF7D0C35A}\Setup.exe​" -l0x9  uninstall
 Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
 Arturia.Minimoog.V.v1.5-DAC-->​F:\musique\MINIMO~1\UNWISE.EXE F:\musique\MINIMO~1\INSTALL.LO​G
 Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18​E473546C7}
 ASUS WL-167g WLAN Card Manuals-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5F03943F-D486-47C​3-962C-74A70EE38042}\Setup.exe​" -l0x9
 ASUS WLAN Card Utilities/Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8F722FA9-B994-4C9​B-B292-FD32D6206EDF}\Setup.exe​" -l0x9
 ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiC​imUn.exe
 ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\Professional\RunTime\09\0​1\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A​7-ABFF-507B966405D8}\setup.exe​" -l0x0
 ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.d​ll,_InfEngUnInstallINFFile_Run​DLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
 ATI HYDRAVISION-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\engine\6\Intel 32\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46F​B-A6C6-4F8862742947}\setup.exe​"
 ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B​99309BDC7}
 BS.Player FREE-->"C:\Program Files\Webteh\BSplayer\uninstal​l.exe"
 BSPlayer-->"C:\Program Files\Webteh\BSplayer\uninstal​l.exe"
 Catalyst Control Center - Branding-->MsiExec.exe /I{CF929EEB-CE39-4F06-B1BF-F51​FC617A2B2}
 CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
 CloneCD-->"C:\Program Files\SlySoft\CloneCD\ccd-unin​st.exe" /D="C:\Program Files\SlySoft\CloneCD"
 CloneDVD2-->"C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-unin​st.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2"
 ConvertXtoDVD 2.0.11-->"C:\Program Files\vso\ConvertXtoDVD\unins0​00.exe"
 Correctif pour Windows XP (KB914440)-->"C:\WINDOWS\$NtUn​installKB914440$\spuninst\spun​inst.exe"
 discoDSP Discovery Pro-->"F:\musique\Vstplugins\d​iscoDSP\unins000.exe"
 East West EWQLSO Gold Edition-->F:\musique\EWQLSO~1\​UNWISE.EXE F:\musique\EWQLSO~1\INSTALL.LO​G
 East West Symphonic Choirs-->F:\musique\SYMPHO~1\U​NWISE.EXE F:\musique\SYMPHO~1\INSTALL.LO​G
 eMule-->"C:\Program Files\eMule\Uninstall.exe"
 Everest Poker (Remove Only)-->C:\Program Files\Everest Poker\cstart.exe /uninstall
 EZdrummer-->MsiExec.exe /I{43E8D9E7-AFC9-4BA3-8106-B95​E02B87AB7}
 EZXCocktail-->MsiExec.exe /I{147567F0-8575-4BE0-B5B3-627​06C67FA5A}
 Feu Vert pour le permis de conduire-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{26284E06-C005-4C6​A-ADA6-1E99D843B08E}\Setup.exe​"  -uninst
 FileZilla Client 3.2.6.1-->C:\Program Files\FileZilla FTP Client\uninstall.exe
 FreeCall-->"C:\Program Files\FreeCall.com\FreeCall\un​ins000.exe"
 Full Tilt Poker-->C:\Program Files\Full Tilt Poker\uninstall.exe
 getPlus(R) for Adobe-->"C:\Program Files\NOS\bin\getPlus_HelperSv​c.exe" /UninstallGet1
 Half-Life 2: Deathmatch-->"D:\jeux\steam\st​eam.exe" steam://uninstall/320
 Half-Life 2: Lost Coast-->"D:\jeux\steam\steam.e​xe" steam://uninstall/340
 HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.ex​e" /uninstall
 Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUn​installKB915865$\spuninst\spun​inst.exe"
 Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
 Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C​063A63F31}
 J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B​0D0150060}
 Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B​0D0160020}
 Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B​0D0160030}
 K-Lite Codec Pack 2.71 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
 KORG USB-MIDI Driver Tools for Windows-->MsiExec.exe /I{C962EF10-7539-477A-A0AD-F8C​BD0E9F7E5}
 KORG X50 Editor-->MsiExec.exe /I{FC41140A-22CA-4309-B806-F70​B0CA31A17}
 KORG X50 Plug-In Editor RTAS-->MsiExec.exe /I{B7876739-CC64-417F-A5C9-B99​7003259E1}
 KORG X50 Plug-In Editor VST-->MsiExec.exe /I{0BBE28FE-227A-4D34-A069-0EE​3AC622850}
 Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
 Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
 Marvell Miniport Driver-->C:\Program Files\Marvell\Miniport Driver\Uninst.exe
 Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET​\Framework\v2.0.50727\Microsof​t .NET Framework 2.0\install.exe
 Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C​8A0C4D570}
 Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServiceP​ackUninstallIDNMitigationAPIs$​\spuninst\spuninst.exe"
 Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServiceP​ackUninstallNLSDownlevelMappin​g$\spuninst\spuninst.exe"
 Microsoft Office 2003 Dutch User Interface Pack-->MsiExec.exe /I{901E0413-6000-11D3-8CFE-015​0048383C9}
 Microsoft Office 2003 French User Interface Pack-->MsiExec.exe /I{901E040C-6000-11D3-8CFE-015​0048383C9}
 Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-000​0000FF1CE}
 Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-000​0000FF1CE}
 Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-000​0000FF1CE}
 Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-000​0000FF1CE}
 Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-000​0000FF1CE}
 Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-015​0048383C9}
 Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
 Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-000​0000FF1CE}
 Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-000​0000FF1CE}
 Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-000​0000FF1CE}
 Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-000​0000FF1CE}
 Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-000​0000FF1CE}
 Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-000​0000FF1CE}
 Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-000​0000FF1CE}
 Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-000​0000FF1CE}
 Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-000​0000FF1CE}
 Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-000​0000FF1CE}
 Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-000​0000FF1CE}
 Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-181​8da5d550d}
 mIRC-->"C:\Program Files\mIRC\mirc.exe" -uninstall
 Mise à jour pour Windows XP (KB904942)-->"C:\WINDOWS\$NtUn​installKB904942$\spuninst\spun​inst.exe"
 MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5​E3257BD94}
 Mumble and Murmur-->C:\Program Files\Mumble\Uninstall.exe
 MusicLab RealGuitar 2.0-->"F:\musique\realguitar2\​Uninstall.exe" "F:\musique\realguitar2\instal​l.log"
 Native Instruments Battery 3-->C:\PROGRA~1\Native Instruments\Battery 3\UNWISE.EXE C:\PROGRA~1\Native Instruments\Battery 3\INSTALL.LOG
 Native.Instruments.Kontakt.v2.​0.2.007-->F:\musique\KONTAK~1\​UNWISE.EXE F:\musique\KONTAK~1\INSTALL.LO​G
 Nero 6 Ultra Edition-->C:\Program Files\Ahead\nero\uninstall\UNN​ERO.exe /UNINSTALL
 NVIDIA Drivers-->C:\WINDOWS\system32\​nvuninst.exe UninstallGUI
 NvMixer-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7A6C517-11F2-419​F-B5BB-27772B939698}\Setup.exe​"  -uninstall
 Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A0​93F35A238}
 PDF Password Remover v3.0-->"C:\Program Files\PDF Password Remover v3.0\unins000.exe"
 Pianoteq Trial v2.1.0-->"F:\musique\Pianoteq 2.1 Trial\uninstall.exe"
 Pianoteq v2.2.0-->"C:\Program Files\Pianoteq 2.2\uninstall.exe"
 Poker 770-->"C:\Poker\Poker 770\_SetupCasino_4d21.exe" /uninstall
 PokerStars-->"C:\Program Files\PokerStars\PokerStarsUni​nstall.exe" /u:PokerStars
 Promedia DVD-->c:\Program Files\PromediaDVD\uninstal.exe
 QuickTime-->MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1​961C7767A}
 RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1punin​st.exe RealNetworks|RealPlayer|12.0
 RealStrat 1.0-->"F:\musique\realstrat\Un​install.exe" "F:\musique\realstrat\install.​log" -u
 Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\InstallSh​ield\Professional\RunTime\11\5​0\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-410​8-B7DD-039E11FBC27E}\setup.exe​" -l0x40c  -removeonly
 Reason 4.0-->"D:\Reason\Reason4\Unins​tall Reason\unins000.exe"
 Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F​8D1E69FB7}
 SONAR 6 Producer Edition-->"F:\musique\SONAR 6 Producer Edition\unins000.exe"
 SpeedSim-->D:\Mes documents\santos\ogame\SpeedSi​m\uninst.exe
 Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900​000000004}
 Spybot - Search & Destroy 1.5.2.20-->"C:\WINDOWS\unins00​0.exe"
 Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
 Steam-->D:\jeux\steam\UNWISE.E​XE D:\jeux\steam\INSTALL.LOG
 Steinberg Virtual Guitarist Electric Edition-->C:\PROGRA~1\VstPlugi​ns\\VIRTUA~1\UNINST~1.EXE C:\PROGRA~1\VstPlugins\\VIRTUA​~1\INSTALL.LOG
 StylusRMX-->C:\WINDOWS\unvise3​2.exe f:\musique\vstplugins\uninstal​.log
 Synth1-->"F:\musique\synth\set​up.exe" /u
 TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.​exe"
 Trilogy-->F:\musique\Trilogy\u​nins000.exe
 TVAnts 1.0-->C:\PROGRA~1\TVAnts\UNWIS​E.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
 Tzim's Lite Codec Pack (NT Only) (07/03/2006)-->C:\Program Files\CodecPack\uninst.exe
 Unibet-->C:\MicroGaming\Poker\​unibetpokerMPP\install.exe -uninstall
 Unreal-->MsiExec.exe /I{8FDBE1E8-2922-4750-9E4B-6B2​8CA67DBBB}
 Ventrilo-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D​498CE069F}
 VIA Register Tool-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Your Company Name\VIA Register Tool\Uninst.isu"
 VideoLAN VLC media player 0.8.6h-->C:\Program Files\VideoLAN\VLC\uninstall.e​xe
 Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5​D14231E27}
 Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\sys​tem32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D1​4231E27} /qb+ REBOOTPROMPT=""
 Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI3​1Uninstall_KB893803v2$\spunins​t\spuninst.exe"
 Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD​3A3F9DF41}
 Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189​800823F52}
 Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8​525FFA3B1}
 Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
 WordBuilder-->MsiExec.exe /I{68B0CD06-006B-444E-BB91-FEF​2A2CAC3C6}
 WordBuilder-->MsiExec.exe /I{91C36BDB-B77C-4C2D-B278-3CF​1D1005C8F}
 Zattoo 3.3.1 Beta-->C:\Program Files\Zattoo\uninst.exe

 =====HijackThis Backups=====

 O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWSer​vice.exe (file missing) [2009-07-25]
 R1 - HKLM\Software\Microsoft\Intern​et Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 [2009-07-25]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ioio\HIDEC.exe" "C:\ioio\SWREG.EXE" ACL "HKEY_LOCAL_MACHINE\System\Cur​rentControlSet\Enum\Root\LEGAC​Y_Beep" /RESET /Q (file missing) [2009-08-01]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ioio\HIDEC.exe" "C:\ioio\SWREG.EXE" ACL "HKEY_LOCAL_MACHINE\System\Cur​rentControlSet\Enum\Root\LEGAC​Y_Beep" /RESET /Q (file missing) [2009-08-03]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ioio\HIDEC.exe" "C:\ioio\SWREG.EXE" ACL "HKEY_LOCAL_MACHINE\System\Cur​rentControlSet\Enum\Root\LEGAC​Y_Beep" /RESET /Q (file missing) [2009-08-19]
 O23 - Service: Windows InstallService (Intelligent Transfer Service) - Unknown owner - C:\WINDOWS\system32\servtie.ex​e (file missing) [2009-08-19]
 O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A25​5F085E1} - C:\Program Files\PartyGaming\PartyPoker\R​unApp.exe [2009-08-22]
 O9 - Extra button: Unibet - {00000000-0000-0000-0000-00000​0000000} - C:\MicroGaming\Poker\unibetpok​erMPP\MPPoker.exe (HKCU) [2009-08-22]
 O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A25​5F085E1} - (no file) [2009-08-25]
 O9 - Extra button: PokerTime - {00000000-0000-0000-0000-00000​0000000} - C:\MicroGaming\Poker\PokerTime​MPP\MPPoker.exe (HKCU) [2009-08-25]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ioio\HIDEC.exe" "C:\ioio\SWREG.EXE" ACL "HKEY_LOCAL_MACHINE\System\Cur​rentControlSet\Enum\Root\LEGAC​Y_Beep" /RESET /Q (file missing) [2009-08-29]
 R1 - HKCU\Software\Microsoft\Window​s\CurrentVersion\Internet Settings,ProxyOverride = local [2009-09-07]
 O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/ADMINI~1/L​OCALS~1/Temp/msohtmlclip1/01/c​lip_image002.jpg [2009-09-07]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ComboFix\HIDEC.exe" "C:\WINDOWS\system32\CF19134.e​xe" /c RD /S/Q C:\$RECYCLE.bin C:\RECYCLER C:\RECYCLED (file missing) [2009-09-07]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ComboFix\HIDEC.exe" "C:\WINDOWS\system32\CF19134.e​xe" /c RD /S/Q C:\$RECYCLE.bin C:\RECYCLER C:\RECYCLED (file missing) [2009-09-07]
 O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B​87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab [2009-09-08]
 O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988​571CECB} - (no file) [2009-10-07]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ComboFix\HIDEC.exe" "C:\WINDOWS\system32\CF19134.e​xe" /c RD /S/Q C:\$RECYCLE.bin C:\RECYCLER C:\RECYCLED (file missing) [2009-10-07]
 R1 - HKLM\Software\Microsoft\Intern​et Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 [2009-10-07]
 O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSv​c.exe [2009-10-07]
 O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ComboFix\HIDEC.exe" "C:\WINDOWS\system32\CF19134.e​xe" /c RD /S/Q C:\$RECYCLE.bin C:\RECYCLER C:\RECYCLED (file missing) [2009-10-23]
 O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A25​5F085E1} - C:\Program Files\PartyGaming\PartyPoker\R​unApp.exe [2009-11-02]
 O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A25​5F085E1} - C:\Program Files\PartyGaming\PartyPoker\R​unApp.exe [2009-11-02]
 O21 - SSODL: UpdateCheck - {C9CBDA2C-FA46-4C16-9120-5B089​04D6AFA} - C:\WINDOWS\system32\panim.dll [2009-11-05]
 O9 - Extra 'Tools' menuitem: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F​87ABD16} - C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\UltimateBe​t\UltimateBet.lnk (file missing) (HKCU) [2009-11-16]
 O9 - Extra button: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F​87ABD16} - C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\UltimateBe​t\UltimateBet.lnk (file missing) (HKCU) [2009-11-16]
 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsch​ed.exe"  -osboot [2009-11-16]

 ======System event log======

 Computer Name: TITANIUM
 Event Code: 1003
 Message: Votre ordinateur n'a pas pu renouveler son adresse à partir du réseau (à partir
 du serveur DHCP) pour la carte réseau dont l'adresse réseau est 0015F29F3D48. Il s'est
 produit l'erreur suivante :
 Le délai de temporisation de sémaphore a expiré.
 .
 Votre ordinateur va continuer à essayer d'obtenir sa propre adresse auprès du
 serveur d'adresse réseau (DHCP).

 Record Number: 5
 Source Name: Dhcp
 Time Written: 20091116171249.000000+060
 Event Type: Avertissement
 User:

 Computer Name: TITANIUM
 Event Code: 9
 Message: RegisterTscDrift()

 Node[ 0 ] Core[ 1 ] Cpu[ 1 ] Affinity[ 0x2 ]

 Thread registered succesfully: SamplingRate(ms)[ 1000 ]

 Record Number: 4
 Source Name: AmdTools
 Time Written: 20091116171225.000000+060
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 9
 Message: RegisterTscDrift()

 Node[ 0 ] Core[ 0 ] Cpu[ 0 ] Affinity[ 0x1 ]

 Thread registered succesfully: SamplingRate(ms)[ 1000 ]

 Record Number: 3
 Source Name: AmdTools
 Time Written: 20091116171225.000000+060
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 6005
 Message: Le service d'Enregistrement d'événement a démarré.

 Record Number: 2
 Source Name: EventLog
 Time Written: 20091116171222.000000+060
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 6009
 Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

 Record Number: 1
 Source Name: EventLog
 Time Written: 20091116171222.000000+060
 Event Type: Informations
 User:

 =====Application event log=====

 Computer Name: TITANIUM
 Event Code: 103
 Message: msnmsgr (2176) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\radzi​nskis@hotmail.com\SharingMetad​ata\Working\database_9874_BF66​_74BF_45B2\dfsr.db: Le moteur de base de données a arrêté une instance (0).

 Record Number: 7920
 Source Name: ESENT
 Time Written: 20090803131736.000000+120
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 102
 Message: msnmsgr (2176) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\radzi​nskis@hotmail.com\SharingMetad​ata\Working\database_9874_BF66​_74BF_45B2\dfsr.db: Le moteur de base de données a démarré une nouvelle instance (0).

 Record Number: 7919
 Source Name: ESENT
 Time Written: 20090803131030.000000+120
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 100
 Message: msnmsgr (2176) Le moteur de base de données 5.01.2600.2180 est démarré.

 Record Number: 7918
 Source Name: ESENT
 Time Written: 20090803131030.000000+120
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 101
 Message: msnmsgr (2620) Le moteur de base de données est arrêté.

 Record Number: 7917
 Source Name: ESENT
 Time Written: 20090803130019.000000+120
 Event Type: Informations
 User:

 Computer Name: TITANIUM
 Event Code: 103
 Message: msnmsgr (2620) \\.\C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Messenger\radzi​nskis@hotmail.com\SharingMetad​ata\Working\database_9874_BF66​_74BF_45B2\dfsr.db: Le moteur de base de données a arrêté une instance (0).

 Record Number: 7916
 Source Name: ESENT
 Time Written: 20090803130019.000000+120
 Event Type: Informations
 User:

 ======Environment variables======

 "ComSpec"=%SystemRoot%\system3​2\cmd.exe
 "Path"=%SystemRoot%\system32;%​SystemRoot%;%SystemRoot%\syste​m32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Pr​ogram;C:\Program Files\ATI Technologies\ATI.ACE\Core-Stat​ic
 "windir"=%SystemRoot%
 "FP_NO_HOST_CHECK"=NO
 "OS"=Windows_NT
 "PROCESSOR_ARCHITECTURE"=x86
 "PROCESSOR_LEVEL"=15
 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 43 Stepping 1, AuthenticAMD
 "PROCESSOR_REVISION"=2b01
 "NUMBER_OF_PROCESSORS"=2
 "PATHEXT"=.COM;.EXE;.BAT;.CMD;​.VBS;.VBE;.JS;.JSE;.WSF;.WSH
 "TEMP"=%SystemRoot%\TEMP
 "TMP"=%SystemRoot%\TEMP
 "DEVMGR_SHOW_DETAILS"=1
 "CLASSPATH"=.;C:\Program Files\Java\jre1.5.0_06\lib\ext​\QTJava.zip
 "QTJAVA"=C:\Program Files\Java\jre1.5.0_06\lib\ext​\QTJava.zip

 -----------------EOF----------​-------

Salut radzinskis


 C'est bien ce que je pensais, une version pirate (TITANIUM) de Windows XP.

 Comme tu peux tant rendre compte, sans les mise à jour de Windows ton PC est une vrai passoire pour les virus et autre malware. Tu devrais passé avec une version légal de Windows pour réglé ton souci.

 Selon la charte je doit arrêter l'aide et faire fermé ce poste.


 @++