le gestionnaire des taches a ete desactivé......

bonjour

mon problème commence par: ( le gestionnaire des taches a été déactive par votre admin)alors que je n'ai pas une session admin , j'ai cherché sur net une solution et j'ai trouvé que je dois aller sur : regedit mais c impossible d'y accéder et j'ai ce message ( la modification du registre a été désactivé par votre admin; j'ai encore cherché sur le net et j'ai trouver une solution qui m'oblige a installer kaspersky et trojan remover et quand j'ai essayé d'installer kaspersky soit sa coupe pendant l'installation soit quand l'installation est fini kaspersky ne demarre pas. autre chose j'ai utilisé Smidfrodfix qui demande un scan sous mode sans échec et là j'apperçoi que le PC ne demarre plus sous le mode sans echec

aidez moi s'il vous plais

Salut ahmedsandra


On va vérifier cela, télécharge RSIT (de random/random) sur le bureau ici :
http://images.malwareremoval.com/random/RSIT.exe

- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur Continue dans la fenêtre
- RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenue des deux rapports, log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

Les rapports sont dans le dossier ici C:\rsit


@++

bonjour merci de votre aide et voici les rapports :
log.txt
Logfile of random's system information tool 1.06 (written by random/random)
Run by wasatis at 2009-05-11 14:10:23
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 36 GB (61%) free of 60 GB
Total RAM: 503 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:10:43, on 11/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\freebird\Record Center\CRDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\toonel.net\0.65\jre\bin\toonelw32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\wasatis\LOCALS~1\Temp\buop.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\kiax\kiax.exe
C:\Documents and Settings\wasatis\Bureau\RSIT.exe
C:\Program Files\trend micro\wasatis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\tbMin0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 ME\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\tbMin0.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\tbMin0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [CM108Sound] RunDll32 CM108.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SeePassword] C:\Program Files\SeePassword\SeePassword.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CRDaemon] C:\Program Files\freebird\Record Center\CRDaemon.exe /autorun
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [idefisk.exe] "C:\Documents and Settings\wasatis\Mes documents\idefisk_137\idefisk.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: toonel.lnk = C:\Program Files\toonel.net\0.65\toonel.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer = 193.95.66.11
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.84,85.255.112.80
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.84,85.255.112.80
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.84,85.255.112.80
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9b462fd7333b0) (gupdate1c9b462fd7333b0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8077 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 ME\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-03 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-07 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-07 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-05-07 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
Mininova-Vuze Toolbar - C:\Program Files\Mininova-Vuze\tbMin0.dll [2008-09-15 1784856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-08 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-08 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{d51d388b-f5dc-471a-a1ce-5e2d671091c0} - Mininova-Vuze Toolbar - C:\Program Files\Mininova-Vuze\tbMin0.dll [2008-09-15 1784856]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-07 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CM108Sound"=RunDll32 CM108.cpl,CMICtrlWnd []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-03 275984]
"SeePassword"=C:\Program Files\SeePassword\SeePassword.exe []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 516096]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 444712]
"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-04-24 30192]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-09-20 94208]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-09-20 155648]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-09-20 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-05-08 222616]
"CRDaemon"=C:\Program Files\freebird\Record Center\CRDaemon.exe [2007-04-28 290816]
"TrojanScanner"=C:\Program Files\Trojan Remover\Trjscan.exe [2009-03-30 1213320]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2008-11-11 206088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]
"idefisk.exe"=C:\Documents and Settings\wasatis\Mes documents\idefisk_137\idefisk.exe []
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-06 146680]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^wasatis^Menu Démarrer^Programmes^Démarrage^toonel.lnk]
C:\PROGRA~1\toonel.net\0.65\toonel.exe [2007-04-12 122880]

C:\Documents and Settings\wasatis\Menu Démarrer\Programmes\Démarrage
toonel.lnk - C:\Program Files\toonel.net\0.65\toonel.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-09-20 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\kiax\kiax.exe"="C:\Program Files\kiax\kiax.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\javaw.exe"="C:\WINDOWS\system32\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"E:\frhkou.exe"="E:\frhkou.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpiwxfx.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpiwxfx.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winoicg.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winoicg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\nxeml.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\nxeml.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsjvd.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsjvd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpyie.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpyie.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\dxml.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\dxml.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\vcqvko.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\vcqvko.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\etgq.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\etgq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winssjq.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winssjq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\windpiwyq.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\windpiwyq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winmpgr.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winmpgr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wineaesm.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wineaesm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winjcpx.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winjcpx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winogpx.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winogpx.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\nwiz.exe"="C:\WINDOWS\system32\nwiz.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winvohmj.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winvohmj.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\userinit.exe"="C:\WINDOWS\system32\userinit.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\RUNDLL32.EXE"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\cxho.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\cxho.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\jciqqo.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\jciqqo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winordmj.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winordmj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\axcsy.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\axcsy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winqphrh.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winqphrh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winovrb.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winovrb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wdes.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wdes.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winddfd.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winddfd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfbgipp.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfbgipp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\nhoyb.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\nhoyb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpuoeu.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpuoeu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winvsvjey.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winvsvjey.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winqgmahh.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winqgmahh.exe:*:Enabled:ipsec"
"C:\Program Files\iTunes\iTunesHelper.exe"="C:\Program Files\iTunes\iTunesHelper.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\eoxtdy.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\eoxtdy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winheoheu.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winheoheu.exe:*:Enabled:ipsec"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winjvbf.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winjvbf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winluil.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winluil.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\fomv.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\fomv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsnkd.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsnkd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfmlk.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfmlk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbotk.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbotk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsgwvd.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsgwvd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winyacd.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winyacd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\iqjg.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\iqjg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\lkyc.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\lkyc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winkxcxw.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winkxcxw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winhdlb.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winhdlb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\iybtx.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\iybtx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wingnojj.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wingnojj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\chubmi.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\chubmi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\octf.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\octf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\jwta.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\jwta.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\blrhpu.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\blrhpu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wincanub.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wincanub.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winyvkda.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winyvkda.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\ejjf.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\ejjf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wingwppty.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wingwppty.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winhirxij.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winhirxij.exe:*:Enabled:ipsec"
"C:\Program Files\toonel.net\0.65\toonel.exe"="C:\Program Files\toonel.net\0.65\toonel.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\netsh.exe"="C:\WINDOWS\system32\netsh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfrng.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfrng.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\hdpsd.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\hdpsd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\cmdcg.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\cmdcg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbawtxy.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbawtxy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\fgkv.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\fgkv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winqlciuw.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winqlciuw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wljslk.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wljslk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wingqvpv.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wingqvpv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbbwu.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbbwu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsobwp.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winsobwp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\ibieku.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\ibieku.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winxsxhqy.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winxsxhqy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winkwgjo.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winkwgjo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpbjfk.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpbjfk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\ruhih.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\ruhih.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe:*:Enabled:ipsec"
"C:\Program Files\Java\jre6\bin\jusched.exe"="C:\Program Files\Java\jre6\bin\jusched.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winkpdu.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winkpdu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winycamk.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winycamk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winyktbu.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winyktbu.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\mjui.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\mjui.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\linun.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\linun.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\utggh.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\utggh.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winacqhdp.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winacqhdp.exe:*:Enabled:ipsec"
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\windvcpe.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\windvcpe.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\yysql.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\yysql.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winuabqv.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winuabqv.exe:*:Enabled:ipsec"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\onver.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\onver.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wincjscf.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wincjscf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\wineoke.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\wineoke.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58471396-1de1-11de-aba1-0019660a9480}]
shell\AutoRun\command - E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sysfix.exe
shell\open\command - E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sysfix.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eecae510-1ab2-11de-a4e5-806d6172696f}]
shell\AutoRun\command - E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorun.exe
shell\OpEn\command - E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\autorun.exe


======List of files/folders created in the last 1 months======

2009-05-11 14:10:25 ----D---- C:\Program Files\trend micro
2009-05-11 14:10:23 ----D---- C:\rsit
2009-05-11 13:02:49 ----A---- C:\CF-RC.txt
2009-05-11 13:02:40 ----A---- C:\Boot.bak
2009-05-11 13:02:34 ----RASHD---- C:\cmdcons
2009-05-11 12:57:44 ----A---- C:\WINDOWS\zip.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\vFind.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\SWSC.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\SWREG.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\sed.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\grep.exe
2009-05-11 12:57:38 ----D---- C:\WINDOWS\ERDNT
2009-05-11 12:57:37 ----D---- C:\ComboFix
2009-05-11 12:57:34 ----D---- C:\Qoobox
2009-05-11 12:46:47 ----A---- C:\FindyKill.txt
2009-05-11 12:40:54 ----D---- C:\FindyKill
2009-05-11 11:50:58 ----D---- C:\Program Files\Kaspersky Lab
2009-05-11 11:50:57 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-05-11 11:39:44 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-11 10:53:40 ----A---- C:\WINDOWS\ntbtlog.txt
2009-05-11 10:28:07 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\ztvunrar36.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\ztvunace26.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\ztvcabinet.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\UNRAR3.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\unacev2.dll
2009-05-11 10:21:21 ----D---- C:\Program Files\Trojan Remover
2009-05-11 10:21:21 ----D---- C:\Documents and Settings\wasatis\Application Data\Simply Super Software
2009-05-11 10:21:21 ----D---- C:\Documents and Settings\All Users\Application Data\Simply Super Software
2009-05-11 10:04:27 ----D---- C:\Program Files\ExpressVids
2009-05-09 11:40:58 ----D---- C:\Documents and Settings\All Users\Application Data\InstallShield
2009-05-09 11:02:04 ----A---- C:\WINDOWS\system32\tmp.txt
2009-05-09 11:02:00 ----A---- C:\rapport.txt
2009-05-09 11:01:01 ----A---- C:\WINDOWS\system32\o4Patch.exe
2009-05-09 11:01:01 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
2009-05-09 11:01:01 ----A---- C:\WINDOWS\system32\Agent.OMZ.Fix.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\WS2Fix.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\VCCLSID.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\VACFix.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\swsc.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\SrchSTS.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\Process.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\IEDFix.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\dumphive.exe
2009-05-09 11:01:00 ----A---- C:\WINDOWS\system32\404Fix.exe
2009-05-09 09:57:28 ----A---- C:\WINDOWS\VEmotion.INI
2009-05-08 16:03:53 ----D---- C:\Documents and Settings\wasatis\Application Data\123 Free Solitaire
2009-05-08 16:03:41 ----D---- C:\Program Files\123 Free Solitaire
2009-05-08 10:43:20 ----D---- C:\Program Files\freebird
2009-05-08 10:29:37 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 10:05:26 ----A---- C:\WINDOWS\system32\igfxres.dll
2009-05-08 10:03:14 ----D---- C:\WINDOWS\Prefetch
2009-05-08 09:56:31 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-05-08 09:53:10 ----A---- C:\WINDOWS\pnplog.txt
2009-05-08 09:50:10 ----A---- C:\WINDOWS\system32\usbui.dll
2009-05-08 09:34:23 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-05-08 09:34:23 ----A---- C:\WINDOWS\system32\irclass.dll
2009-05-08 09:34:01 ----RA---- C:\WINDOWS\SET3A.tmp
2009-05-08 09:33:57 ----RA---- C:\WINDOWS\SET2E.tmp
2009-05-08 09:33:55 ----RA---- C:\WINDOWS\SET2B.tmp
2009-05-08 09:22:43 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-05-08 09:20:18 ----A---- C:\WINDOWS\system32\javaws.exe
2009-05-08 09:20:18 ----A---- C:\WINDOWS\system32\javaw.exe
2009-05-08 09:20:18 ----A---- C:\WINDOWS\system32\java.exe
2009-05-07 14:28:45 ----D---- C:\Program Files\Common Files
2009-05-07 11:48:10 ----D---- C:\Program Files\Gpotato.eu
2009-05-06 17:08:03 ----D---- C:\Download
2009-05-06 08:47:25 ----A---- C:\WINDOWS\system32\iglicd32.dll
2009-05-06 08:47:25 ----A---- C:\WINDOWS\system32\igldev32.dll
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxzoom.exe
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxtray.exe
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxsrvc.exe
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxsrvc.dll
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxress.dll
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxpph.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxpers.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxext.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxexps.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxdo.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxdev.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxcfg.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuTRK.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuTHA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuSVE.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuRUS.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuPTG.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuPTB.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuPLK.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuNOR.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuNLD.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuKOR.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuJPN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuITA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuHUN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuHEB.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuFRC.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuFRA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuFIN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuESP.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuENG.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuELL.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmudlg.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuDEU.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuDAN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuCSY.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuCHT.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuCHS.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuARB.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuARA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmrnt5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmrem.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmdnt5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmdev5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmdd5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\iAlmCoIn_v4396.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\hkcmd.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\hccutils.dll
2009-05-05 12:24:41 ----D---- C:\Program Files\Audacity
2009-05-04 12:41:18 ----A---- C:\WINDOWS\welik.exe
2009-04-29 15:56:08 ----D---- C:\Documents and Settings\wasatis\Application Data\Google
2009-04-29 12:55:25 ----D---- C:\WINDOWS\system32\Adobe
2009-04-29 12:16:08 ----D---- C:\Program Files\Galaxy Online
2009-04-29 09:46:10 ----D---- C:\Documents and Settings\wasatis\Application Data\IDM
2009-04-29 09:46:07 ----D---- C:\Documents and Settings\wasatis\Application Data\DMCache
2009-04-29 09:45:46 ----D---- C:\Program Files\Internet Download Manager
2009-04-29 09:45:45 ----A---- C:\WINDOWS\system32\rundll93.exe.vir
2009-04-28 16:37:12 ----D---- C:\Documents and Settings\wasatis\Application Data\dvdcss
2009-04-27 14:28:51 ----D---- C:\Documents and Settings\wasatis\Application Data\vlc
2009-04-27 14:27:27 ----D---- C:\Program Files\VideoLAN
2009-04-27 14:26:44 ----D---- C:\Documents and Settings\wasatis\Application Data\Media Player Classic
2009-04-27 14:25:53 ----A---- C:\WINDOWS\system32\unrar.dll
2009-04-27 14:25:50 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-04-27 14:25:48 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2009-04-27 14:25:48 ----A---- C:\WINDOWS\system32\dpl100.dll
2009-04-27 14:25:46 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-04-27 14:25:46 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-04-27 14:25:45 ----A---- C:\WINDOWS\system32\pthreadGC2.dll
2009-04-27 14:25:44 ----D---- C:\Program Files\K-Lite Codec Pack
2009-04-24 10:27:05 ----D---- C:\Program Files\Torrent Harvester
2009-04-24 09:25:06 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-04-24 09:24:49 ----D---- C:\Program Files\iPod
2009-04-24 09:24:45 ----D---- C:\Program Files\iTunes
2009-04-24 09:24:45 ----D---- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-24 09:24:30 ----D---- C:\Program Files\Bonjour
2009-04-24 09:23:57 ----D---- C:\Program Files\QuickTime
2009-04-24 09:22:47 ----D---- C:\Program Files\Apple Software Update
2009-04-24 09:22:27 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-04-24 08:59:17 ----D---- C:\WINDOWS\system32\appmgmt
2009-04-24 08:59:16 ----D---- C:\WINDOWS\SxsCaPendDel
2009-04-23 14:23:59 ----D---- C:\Documents and Settings\wasatis\Application Data\Apple Computer
2009-04-23 14:21:51 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-04-23 14:20:50 ----D---- C:\Program Files\Fichiers communs\Apple
2009-04-23 12:51:09 ----D---- C:\Documents and Settings\All Users\Application Data\Azureus
2009-04-23 12:51:07 ----D---- C:\Program Files\Mininova-Vuze
2009-04-23 12:51:07 ----D---- C:\Program Files\Conduit
2009-04-23 12:51:07 ----D---- C:\Documents and Settings\wasatis\Application Data\Azureus
2009-04-23 12:50:31 ----D---- C:\Program Files\Vuze
2009-04-22 10:23:21 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-04-22 10:22:53 ----D---- C:\Program Files\IrfanView
2009-04-15 12:27:00 ----D---- C:\WINDOWS\pss
2009-04-13 14:46:20 ----HD---- C:\récupérations lau
2009-04-13 12:10:07 ----A---- C:\WINDOWS\system32\MFC71.dll
2009-04-13 12:10:03 ----D---- C:\Program Files\Alwil Software

======List of files/folders modified in the last 1 months======

2009-05-11 14:10:25 ----RD---- C:\Program Files
2009-05-11 13:02:55 ----D---- C:\WINDOWS
2009-05-11 13:02:50 ----D---- C:\WINDOWS\system32
2009-05-11 13:02:40 ----RASH---- C:\boot.ini
2009-05-11 12:59:03 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-11 12:56:55 ----D---- C:\WINDOWS\Temp
2009-05-11 12:55:07 ----D---- C:\Program Files\Mozilla Firefox
2009-05-11 12:55:00 ----D---- C:\WINDOWS\system32\drivers
2009-05-11 11:51:37 ----SHD---- C:\WINDOWS\Installer
2009-05-11 11:51:25 ----HD---- C:\WINDOWS\inf
2009-05-11 11:50:52 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-11 11:45:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-05-11 10:26:12 ----SHD---- C:\RECYCLER
2009-05-09 11:32:52 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-05-09 11:32:51 ----HD---- C:\Program Files\InstallShield Installation Information
2009-05-09 11:32:51 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-05-09 10:11:14 ----A---- C:\WINDOWS\win.ini
2009-05-09 09:57:50 ----D---- C:\Program Files\kiax
2009-05-09 09:36:29 ----D---- C:\Program Files\MSN Messenger
2009-05-09 09:36:29 ----D---- C:\Program Files\Messenger
2009-05-08 15:26:26 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-05-08 15:24:27 ----D---- C:\WINDOWS\security
2009-05-08 12:13:46 ----A---- C:\WINDOWS\ODBC.INI
2009-05-08 11:31:49 ----D---- C:\WINDOWS\system
2009-05-08 11:31:48 ----D---- C:\WINDOWS\system32\Setup
2009-05-08 11:31:46 ----D---- C:\WINDOWS\Help
2009-05-08 11:31:39 ----D---- C:\WINDOWS\system32\usmt
2009-05-08 11:31:28 ----D---- C:\WINDOWS\AppPatch
2009-05-08 11:31:27 ----D---- C:\WINDOWS\ime
2009-05-08 11:31:27 ----D---- C:\WINDOWS\ehome
2009-05-08 11:31:25 ----RSD---- C:\WINDOWS\Fonts
2009-05-08 11:31:25 ----D---- C:\WINDOWS\Media
2009-05-08 11:31:12 ----D---- C:\WINDOWS\PeerNet
2009-05-08 11:30:56 ----D---- C:\WINDOWS\system32\npp
2009-05-08 11:30:49 ----D---- C:\WINDOWS\msagent
2009-05-08 11:29:04 ----D---- C:\WINDOWS\system32\1036
2009-05-08 11:28:58 ----D---- C:\WINDOWS\twain_32
2009-05-08 11:28:43 ----D---- C:\WINDOWS\system32\icsxml
2009-05-08 11:28:11 ----D---- C:\WINDOWS\system32\1033
2009-05-08 11:27:13 ----D---- C:\WINDOWS\WinSxS
2009-05-08 11:27:13 ----D---- C:\WINDOWS\Driver Cache
2009-05-08 10:06:07 ----D---- C:\WINDOWS\Registration
2009-05-08 10:04:55 ----A---- C:\WINDOWS\setuplog.txt
2009-05-08 10:03:24 ----SHD---- C:\System Volume Information
2009-05-08 10:02:41 ----D---- C:\WINDOWS\system32\config
2009-05-08 09:57:35 ----A---- C:\WINDOWS\OEWABLog.txt
2009-05-08 09:57:30 ----A---- C:\WINDOWS\ODBCINST.INI
2009-05-08 09:57:08 ----D---- C:\WINDOWS\system32\ias
2009-05-08 09:56:34 ----RD---- C:\WINDOWS\Web
2009-05-08 09:56:24 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-05-08 09:56:08 ----D---- C:\WINDOWS\system32\oobe
2009-05-08 09:55:27 ----D---- C:\WINDOWS\system32\Com
2009-05-08 09:54:51 ----D---- C:\WINDOWS\system32\wbem
2009-05-08 09:35:41 ----D---- C:\WINDOWS\system32\CatRoot
2009-05-08 09:34:28 ----A---- C:\WINDOWS\system.ini
2009-05-08 09:34:13 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-05-08 09:23:35 ----D---- C:\WINDOWS\system32\Restore
2009-05-08 09:20:04 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-05-07 12:07:39 ----D---- C:\Program Files\Google
2009-05-07 11:04:51 ----D---- C:\Documents and Settings\wasatis\Application Data\Skype
2009-05-07 09:27:58 ----SD---- C:\WINDOWS\Tasks
2009-04-29 13:43:40 ----D---- C:\Documents and Settings\wasatis\Application Data\Adobe
2009-04-29 13:43:39 ----D---- C:\Documents and Settings\wasatis\Application Data\Macromedia
2009-04-29 13:43:38 ----D---- C:\WINDOWS\system32\Macromed
2009-04-24 10:37:31 ----D---- C:\Program Files\toonel.net
2009-04-24 09:25:06 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-04-23 14:20:50 ----D---- C:\Program Files\Fichiers communs
2009-04-23 12:35:41 ----D---- C:\Program Files\BitComet
2009-04-23 12:10:52 ----D---- C:\Downloads
2009-04-20 17:50:40 ----D---- C:\Documents and Settings\wasatis\Application Data\FileZilla
2009-04-15 11:47:44 ----SD---- C:\Documents and Settings\wasatis\Application Data\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-19 40320]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\poinhd.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-09-28 9600]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2009-01-21 118656]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 catchme;catchme; \??\C:\DOCUME~1\wasatis\LOCALS~1\Temp\catchme.sys []
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface; C:\WINDOWS\system32\drivers\CM108.sys [2006-12-22 1294336]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS []
S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-05-08 152984]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S2 gupdate1c9b462fd7333b0;Service Google Update (gupdate1c9b462fd7333b0); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-03 133104]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-04-24 30192]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-07 264688]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 166960]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 170864]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]

-----------------EOF-----------------




Info:
info.txt logfile of random's system information tool 1.06 2009-05-11 14:10:45

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
123 Free Solitaire 2008 v6.0-->"C:\Program Files\123 Free Solitaire\unins000.exe"
Adobe AIR-->C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Media Player-->MsiExec.exe /X{9455959E-D588-EFAE-329C-F66CC797F32A}
Adobe Reader 6.0.2 ME-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-6EA000000001}
Adobe Shockwave Player 11.5-->C:\WINDOWS\system32\Adobe\uninstaller.exe
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Audacity 1.2.0-->"C:\Program Files\Audacity\unins000.exe"
AVS Video Converter 4.3.1.371-->"C:\Program Files\AVSMedia\VideoConverter4\unins000.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
C-Media USB 108 Sound-->C:\WINDOWS\Cmi108Uninstall.exe C:\Program Files\C-Media USB 108 Sound#C-Media USB 108 Sound#C-Media USB 108 Sound#
Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
ExpressVids-->"C:\Program Files\ExpressVids\Uninstall.exe"
FileZilla Client 3.2.3.1-->C:\Program Files\FileZilla FTP Client\uninstall.exe
FindyKill-->C:\FindyKill\Uninstal.exe
Google Chrome-->"C:\Program Files\Google\Chrome\Application\1.0.154.65\Installer\setup.exe" --uninstall --system-level
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Intel(R) Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Kaspersky Anti-Virus 2009-->MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Kaspersky Anti-Virus 2009-->MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
K-Lite Codec Pack 4.7.5 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Mininova-Vuze Toolbar-->C:\PROGRA~1\MININO~1\UNWISE.EXE C:\PROGRA~1\MININO~1\INSTALL.LOG
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Rappelz-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01A8838A-9469-425F-A5FB-FC14D4CF93B9}\setup.exe" -l0x40c -removeonly
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -removeonly
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Torrent Harvester-->C:\Program Files\Torrent Harvester\uninstall.exe
Trojan Remover 6.7.8-->"C:\Program Files\Trojan Remover\unins000.exe"
vEmotion - VoIP audio assistant-->C:\Program Files\freebird\vEmotion\Uninstall.exe
vEmotion Call Record Center-->C:\Program Files\Freebird\Record Center\Uninstall.exe
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}

======Security center information======

AV: Kaspersky Anti-Virus (disabled) (outdated)

======System event log======

Computer Name: MKLSERVICES
Event Code: 64001
Message: Tentative de remplacement du fichier système protégé c:\program files\msn gaming zone\windows\zclientm.exe.
Ce fichier a été restauré en utilisant sa version initiale pour maintenir la stabilité du
système.
La version du fichier incorrect est 1.2.626.1, la version du fichier
système actuel est 1.2.626.1.

Record Number: 1143
Source Name: Windows File Protection
Time Written: 20090423115315.000000+120
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 64001
Message: Tentative de remplacement du fichier système protégé c:\program files\msn gaming zone\windows\zclientm.exe.
Ce fichier a été restauré en utilisant sa version initiale pour maintenir la stabilité du
système.
La version du fichier incorrect est 1.2.626.1, la version du fichier
système actuel est 1.2.626.1.

Record Number: 1142
Source Name: Windows File Protection
Time Written: 20090423114703.000000+120
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 64001
Message: Tentative de remplacement du fichier système protégé c:\program files\msn gaming zone\windows\zclientm.exe.
Ce fichier a été restauré en utilisant sa version initiale pour maintenir la stabilité du
système.
La version du fichier incorrect est 1.2.626.1, la version du fichier
système actuel est 1.2.626.1.

Record Number: 1141
Source Name: Windows File Protection
Time Written: 20090423114049.000000+120
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 64001
Message: Tentative de remplacement du fichier système protégé c:\program files\msn gaming zone\windows\zclientm.exe.
Ce fichier a été restauré en utilisant sa version initiale pour maintenir la stabilité du
système.
La version du fichier incorrect est 1.2.626.1, la version du fichier
système actuel est 1.2.626.1.

Record Number: 1140
Source Name: Windows File Protection
Time Written: 20090423113436.000000+120
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 64001
Message: Tentative de remplacement du fichier système protégé c:\program files\msn gaming zone\windows\zclientm.exe.
Ce fichier a été restauré en utilisant sa version initiale pour maintenir la stabilité du
système.
La version du fichier incorrect est 1.2.626.1, la version du fichier
système actuel est 1.2.626.1.

Record Number: 1139
Source Name: Windows File Protection
Time Written: 20090423112824.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service MSDTC (MSDTC) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090327100113.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090327100111.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090327095345.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service PSched (PSched) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090327095320.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090327095319.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=040a
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Salut ahmedsandra


Télécharge OTMoveIt3 (de Old_Timer) sur le bureau :

http://oldtimer.geekstogo.com/OTMoveIt3.exe

Double-clique sur OTMoveIt3.exe sur le bureau

- Assure toi que la case Unregister Dll's and Ocx's soit bien cochée

- Copie le texte qui se trouve en citation et colle le dans le cadre de gauche de OTMoveIt nommé Paste Instructions for Items to be Moved



- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTMoveIt3

Ton PC va redémarrer pour finir la suppression

Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.


-----


- Télécharge SmitfraudFix (de S!Ri, balltrap34 et moe31) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://siri.geekstogo.com/SmitfraudFix.exe

- Enregistre-le sur le bureau

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

- Un rapport sera généré, poste-le dans ta prochaine réponse.

Noteprocess.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix


@++

salut

voici le rapport de otmoveIt :


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\DOCUME~1\wasatis\LOCALS~1\Temp\buop.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\wasatis\LOCALS~1\Temp\etilqs_K5AU4UAMesFM9QmwMf5D scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2c4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\wasatis\Local Settings\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05112009_145135

voici le rapport donner par SmitfraudF :

SmitFraudFix v2.416

Rapport fait à 15:01:30,01, 11/05/2009
Executé à partir de C:\Documents and Settings\wasatis\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\wasatis\Bureau\OTMoveIt3.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\wasatis\LOCALS~1\Temp\winbnesd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\wasatis\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\wasatis


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\wasatis\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\wasatis\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\wasatis\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau



»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=dword:00000001
"AppInit_DLLs"="C:\\PROGRA~1\\KASPER~1\\KASPER~1\\mzvkbd.dll C:\\PROGRA~1\\KASPER~1\\KASPER~1\\mzvkbd3.dll C:\\PROGRA~1\\Google\\GOOGLE~2\\GoogleDesktopNetwork3.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 193.95.66.11

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

PS: a un certain moment quand SmitFraudFix fait la recherche; la fameuse fênetre < la modification du registre a ete desactivé par votre admin apparait.

merci pour votre aide a+

Salut ahmedsandra


Double clique sur le raccourci d'HijackThis sur ton Bureau, clique sur Do a scan system only coche la case devant la(les) ligne(s) suivante(s) si présente(s)
Si pas de raccourci sur le bureau :
C:\Program Files\trend micro\wasatis.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1


- Ferme les fenêtres en cours sauf HijackThis, clique sur Fix checked

- Quitte HijackThis


-----


- Double clique sur le dossier SmitfraudFix sur le bureau, double clique sur smitfraudfix.cmd

Sélectionne 5. Recherche et suppression détournement DNS

Poste le rapport


@++

salut dédétraqué et encore merci
voici le rapport :

SmitFraudFix v2.416

Rapport fait à 15:55:52,75, 11/05/2009
Executé à partir de C:\Documents and Settings\wasatis\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 193.95.66.11

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 193.95.66.11

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer=193.95.66.11
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.112.84,85.255.112.80

a+

Salut ahmedsandra


-Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's ici :
http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php


@++

salut

desole

j'ai installé MalwareByte's Anti-Malware et j'ai fais sa mise a jour

et quand je redemarre pour booter sous mode sans echec, le pc redemarre encore une foi donc je n'ai pas pu aller sur le mode sans echec

mreci

ahmedsandra

Salut ahmedsandra


Fais le scan en mode normal


@++

rebonjour

voici le rapport :

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2108
Windows 5.1.2600 Service Pack 2

11/05/2009 17:26:12
mbam-log-2009-05-11 (17-26-12).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 114420
Temps écoulé: 36 minute(s), 33 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 8
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 15

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08b0e5c0-4fcb-11cf-aax5-00401c608512} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ExpressVids (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ExpressVids (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\Nod32 Runtime (Backdoor.Rbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\Hotfix-KB5504305 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.84,85.255.112.80 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.84,85.255.112.80 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.84,85.255.112.80 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\ExpressVids (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\wasatis\Bureau\Trojan.Remover.6.7.8.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\ExpressVids\Uninstall.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\RECYCLER\S-4-9-95-100024237-100025577-100022788-5765.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP2\A0002987.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP2\A0003036.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP3\A0003082.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP4\A0004319.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP4\A0004454.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP4\A0004539.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{71015729-D63A-4349-9665-92A8FFFEFFEA}\RP4\A0004803.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.
D:\RECYCLER\S-4-9-95-100024237-100025577-100022788-5765.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.
D:\RECYCLER\S-6-0-50-100023292-100020900-100032276-8085.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gxvxccounter (Trojan.DNSchanger) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\gxvxclldyiudjbiqquwnkoewcpetoijeswubo.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Salut ahmedsandra


Télécharge combofix.exe (de sUBs) sur le bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Important Désactive ton Antivirus et antispyware avant le scan avec Combofix :
http://forum.pcastuces.com/desactiver_les_protections_residentes-f31s4.htm


==> Sauvegarde ton travail et ferme toutes les fenêtres actives, il peut y avoir un redémarrage du PC. Ne lance aucun programme tant que Combofix n’est pas fini. <==

Double clique sur combofix.exe, clique sur OUI et valide par Entrée

Il te sera demandé d’installer la console si elle n’est pas installer, clique sur NON

Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\ Combofix.txt

Combofix est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif, continue la procédure


@++

salut :

voici le rapport de combfix :

ComboFix 09-05-10.07 - wasatis 11/05/2009 17:55.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.503.219 [GMT 2:00]
Lancé depuis: c:\documents and settings\wasatis\Bureau\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated)
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\mpg4c32.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-11 au 2009-05-11 ))))))))))))))))))))))))))))))))))))
.

2009-05-11 14:16 . 2009-05-11 14:16 -------- d-----w c:\documents and settings\wasatis\Application Data\Malwarebytes
2009-05-11 14:16 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-11 14:16 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-11 14:16 . 2009-05-11 14:16 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-11 14:16 . 2009-05-11 14:16 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-11 12:51 . 2009-05-11 12:51 -------- d-----w C:\_OTMoveIt
2009-05-11 12:10 . 2009-05-11 13:55 -------- d-----w c:\program files\trend micro
2009-05-11 12:10 . 2009-05-11 12:10 -------- d-----w C:\rsit
2009-05-11 10:40 . 2009-05-11 10:49 -------- d-----w C:\FindyKill
2009-05-11 09:51 . 2009-05-11 09:51 96976 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-11 09:51 . 2009-05-11 09:51 87855 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-11 09:50 . 2009-05-11 09:54 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-11 09:50 . 2009-05-11 09:54 24608 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-11 09:50 . 2009-05-11 09:50 -------- d-----w c:\program files\Kaspersky Lab
2009-05-11 09:50 . 2009-05-11 09:50 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-11 09:39 . 2009-05-11 09:39 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-11 08:36 . 2009-05-11 08:36 66944 ----a-w c:\windows\system32\drivers\gxvxcrwemovcuhxidwyroblqvwdoaynhdqqhx.sys.vir
2009-05-11 08:28 . 2009-05-11 09:53 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-11 08:21 . 2005-08-25 23:50 77312 ----a-w c:\windows\system32\ztvunace26.dll
2009-05-11 08:21 . 2006-06-19 11:01 69632 ----a-w c:\windows\system32\ztvcabinet.dll
2009-05-11 08:21 . 2006-05-25 13:52 162304 ----a-w c:\windows\system32\ztvunrar36.dll
2009-05-11 08:21 . 2002-03-05 23:00 75264 ----a-w c:\windows\system32\unacev2.dll
2009-05-11 08:21 . 2003-02-02 18:06 153088 ----a-w c:\windows\system32\UNRAR3.dll
2009-05-11 08:21 . 2009-05-11 08:35 -------- d-----w c:\program files\Trojan Remover
2009-05-11 08:21 . 2009-05-11 08:21 -------- d-----w c:\documents and settings\wasatis\Application Data\Simply Super Software
2009-05-11 08:21 . 2009-05-11 08:21 -------- d-----w c:\documents and settings\All Users\Application Data\Simply Super Software
2009-05-11 07:55 . 2009-05-11 08:38 353 --sha-r C:\autorun.inf.vir
2009-05-09 09:40 . 2009-05-09 09:40 -------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-05-08 14:03 . 2009-05-08 14:19 -------- d-----w c:\documents and settings\wasatis\Application Data\123 Free Solitaire
2009-05-08 14:03 . 2009-05-08 14:03 -------- d-----w c:\program files\123 Free Solitaire
2009-05-08 08:43 . 2009-05-09 07:36 -------- d-----w c:\program files\freebird
2009-05-08 08:29 . 2009-05-11 09:47 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 08:05 . 2005-09-20 08:36 147456 ----a-w c:\windows\system32\igfxres.dll
2009-05-08 07:59 . 2001-09-28 12:00 98304 -c--a-w c:\windows\system32\dllcache\msir3jp.dll
2009-05-08 07:58 . 2004-08-19 14:09 42496 -c--a-w c:\windows\system32\dllcache\davcdata.exe
2009-05-08 07:50 . 2004-08-19 14:09 77312 ----a-w c:\windows\system32\usbui.dll
2009-05-08 07:34 . 2001-09-28 12:00 13312 -c--a-w c:\windows\system32\dllcache\irclass.dll
2009-05-08 07:34 . 2001-09-28 12:00 13312 ----a-w c:\windows\system32\irclass.dll
2009-05-08 07:34 . 2001-09-28 12:00 24661 -c--a-w c:\windows\system32\dllcache\spxcoins.dll
2009-05-08 07:34 . 2001-09-28 12:00 24661 ----a-w c:\windows\system32\spxcoins.dll
2009-05-07 12:28 . 2009-05-07 12:28 -------- d-----w c:\program files\Common Files
2009-05-07 12:26 . 2005-01-04 09:43 4682 ----a-w c:\windows\system32\npptNT2.sys
2009-05-07 09:48 . 2009-05-09 09:32 -------- d-----w c:\program files\Gpotato.eu
2009-05-06 15:08 . 2009-05-06 15:08 -------- d-----w C:\Download
2009-05-06 15:07 . 2009-05-06 15:07 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Kamuse
2009-05-05 10:24 . 2009-05-05 10:24 -------- d-----w c:\program files\Audacity
2009-05-04 10:41 . 2009-05-06 18:10 212992 ----a-w c:\windows\welik.exe
2009-04-29 10:55 . 2009-04-29 11:46 -------- d-----w c:\windows\system32\Adobe
2009-04-29 10:16 . 2009-05-07 09:20 -------- d-----w c:\program files\Galaxy Online
2009-04-29 07:46 . 2009-05-04 06:47 -------- d-----w c:\documents and settings\wasatis\Application Data\IDM
2009-04-29 07:46 . 2009-04-30 15:41 -------- d-----w c:\documents and settings\wasatis\Application Data\DMCache
2009-04-29 07:45 . 2009-05-04 06:47 -------- d-----w c:\program files\Internet Download Manager
2009-04-29 07:45 . 2009-04-29 07:45 139264 ----a-w c:\windows\system32\rundll93.exe.vir
2009-04-28 14:37 . 2009-04-28 14:37 -------- d-----w c:\documents and settings\wasatis\Application Data\dvdcss
2009-04-27 12:28 . 2009-04-27 12:28 -------- d-----w c:\documents and settings\wasatis\Application Data\vlc
2009-04-27 12:27 . 2009-04-27 12:27 -------- d-----w c:\program files\VideoLAN
2009-04-27 12:26 . 2009-04-27 12:26 -------- d-----w c:\documents and settings\wasatis\Application Data\Media Player Classic
2009-04-27 12:25 . 2008-09-16 19:23 168448 ----a-w c:\windows\system32\unrar.dll
2009-04-27 12:25 . 2004-01-25 16:18 217088 ----a-w c:\windows\system32\yv12vfw.dll
2009-04-27 12:25 . 2008-11-06 16:37 3596288 ----a-w c:\windows\system32\qt-dx331.dll
2009-04-27 12:25 . 2008-12-11 00:33 86016 ----a-w c:\windows\system32\dpl100.dll
2009-04-27 12:25 . 2009-03-02 18:10 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-04-27 12:25 . 2009-01-07 18:14 60273 ----a-w c:\windows\system32\pthreadGC2.dll
2009-04-27 12:25 . 2009-04-27 12:26 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-24 08:27 . 2009-04-24 08:27 -------- d-----w c:\program files\Torrent Harvester
2009-04-24 07:25 . 2009-03-19 14:32 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-24 07:25 . 2008-04-17 10:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-04-23 12:20 . 2009-04-23 12:23 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Apple Computer
2009-04-23 10:51 . 2009-04-23 10:51 -------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2009-04-23 10:51 . 2009-04-23 10:51 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Conduit
2009-04-23 10:51 . 2009-04-23 10:51 -------- d-----w c:\program files\Conduit
2009-04-23 10:51 . 2009-04-29 13:56 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Mininova-Vuze
2009-04-23 10:51 . 2009-05-11 09:47 -------- d-----w c:\documents and settings\wasatis\Application Data\Azureus
2009-04-23 10:51 . 2009-05-08 12:44 -------- d-----w c:\program files\Mininova-Vuze
2009-04-23 10:50 . 2009-05-08 12:48 -------- d-----w c:\program files\Vuze
2009-04-22 08:22 . 2009-04-27 11:53 -------- d-----w c:\program files\IrfanView
2009-04-13 12:46 . 2009-04-13 12:49 -------- d--h--w C:\récupérations lau
2009-04-13 10:10 . 2003-03-18 19:20 1060864 ----a-w c:\windows\system32\MFC71.dll
2009-04-13 10:10 . 2009-04-13 10:10 -------- d-----w c:\program files\Alwil Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 15:28 . 2001-09-28 12:00 71488 ----a-w c:\windows\system32\perfc00C.dat
2009-05-11 15:28 . 2001-09-28 12:00 458648 ----a-w c:\windows\system32\perfh00C.dat
2009-05-11 14:22 . 2009-03-27 09:14 42168 ----a-w c:\documents and settings\wasatis\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-11 09:54 . 2009-05-11 09:50 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-11 09:54 . 2009-05-11 09:50 1164 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-09 09:32 . 2009-03-27 10:06 -------- d-----w c:\program files\Fichiers communs\InstallShield
2009-05-09 09:32 . 2009-03-27 10:04 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-09 07:57 . 2009-04-01 12:29 -------- d-----w c:\program files\kiax
2009-05-09 07:36 . 2009-03-27 10:56 -------- d-----w c:\program files\MSN Messenger
2009-05-08 07:57 . 2001-09-28 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-08 07:55 . 2009-03-27 09:01 23032 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-08 07:20 . 2009-03-30 10:30 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-07 10:07 . 2009-04-03 13:49 -------- d-----w c:\program files\Google
2009-04-24 08:37 . 2009-04-03 08:30 -------- d-----w c:\program files\toonel.net
2009-04-24 07:25 . 2009-04-24 07:24 -------- d-----w c:\program files\iTunes
2009-04-24 07:24 . 2009-04-24 07:24 -------- d-----w c:\program files\iPod
2009-04-24 07:24 . 2009-04-23 12:20 -------- d-----w c:\program files\Fichiers communs\Apple
2009-04-24 07:24 . 2009-04-24 07:24 -------- d-----w c:\program files\Bonjour
2009-04-24 07:24 . 2009-04-24 07:23 -------- d-----w c:\program files\QuickTime
2009-04-24 07:22 . 2009-04-24 07:22 -------- d-----w c:\program files\Apple Software Update
2009-04-23 10:35 . 2009-04-03 10:19 -------- d-----w c:\program files\BitComet
2009-04-08 12:51 . 2009-04-08 12:51 -------- d-----w c:\program files\Fichiers communs\Macromedia
2009-04-07 10:15 . 2009-04-07 08:31 -------- d-----w c:\program files\NASA
2009-04-06 07:02 . 2009-04-06 07:02 -------- d-----w c:\program files\Fichiers communs\AVSMedia
2009-04-06 07:02 . 2009-04-06 07:02 -------- d-----w c:\program files\AVSMedia
2009-04-03 13:50 . 2009-04-03 13:50 -------- d-----w c:\program files\Fichiers communs\xing shared
2009-04-03 13:50 . 2009-04-03 13:50 -------- d-----w c:\program files\Fichiers communs\Real
2009-04-03 13:50 . 2009-04-03 13:50 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-03 13:50 . 2009-04-03 13:50 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-03 13:50 . 2009-04-03 13:50 -------- d-----w c:\program files\Real
2009-04-03 12:22 . 2009-04-03 12:22 -------- d-----r c:\program files\Skype
2009-04-03 12:05 . 2009-04-03 08:11 -------- d-----w c:\program files\Overbond
2009-04-02 10:57 . 2009-04-02 10:57 -------- d-----w c:\program files\Adobe Media Player
2009-04-02 10:57 . 2009-04-02 10:57 -------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-03-31 10:37 . 2009-03-31 10:37 -------- d-----w c:\program files\Microsoft.NET
2009-03-31 08:29 . 2009-03-27 09:34 -------- d-----w c:\program files\Fichiers communs\Adobe
2009-03-30 10:30 . 2009-03-30 10:30 -------- d-----w c:\program files\Java
2009-03-27 10:31 . 2009-03-27 10:31 -------- d-----w c:\program files\FileZilla FTP Client
2009-03-27 10:06 . 2009-03-27 10:06 -------- d-----w c:\program files\C-Media USB 108 Sound
2009-03-27 10:04 . 2009-03-27 10:04 -------- d-----w c:\program files\Realtek
2009-03-27 09:55 . 2009-03-27 09:55 -------- d-----w c:\program files\Intel
2009-03-27 09:30 . 2009-03-27 09:30 0 ----a-w c:\windows\nsreg.dat
2009-03-27 09:19 . 2009-03-27 09:19 -------- d-----w c:\program files\Driver-Soft
2009-03-27 09:15 . 2009-03-27 09:03 86331 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-27 09:05 . 2009-03-27 09:05 -------- d-----w c:\program files\microsoft frontpage
2009-03-27 09:03 . 2009-03-27 09:03 -------- d-----w c:\program files\Services en ligne
2009-04-24 09:07 . 2009-04-24 09:07 122880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMin0.dll" [2008-09-15 1784856]

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
2008-09-15 04:47 1784856 ----a-w c:\program files\Mininova-Vuze\tbMin0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMin0.dll" [2008-09-15 1784856]

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D51D388B-F5DC-471A-A1CE-5E2D671091C0}"= "c:\program files\Mininova-Vuze\tbMin0.dll" [2008-09-15 1784856]

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-06 146680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-04-03 275984]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 516096]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 444712]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-04-24 30192]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 163840]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 155648]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-08 222616]
"CRDaemon"="c:\program files\freebird\Record Center\CRDaemon.exe" [2007-04-28 290816]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-03-30 1213320]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-16 1708032]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\wasatis\Menu D‚marrer\Programmes\D‚marrage\
toonel.lnk - c:\program files\toonel.net\0.65\toonel.exe [2007-4-12 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^wasatis^Menu Démarrer^Programmes^Démarrage^toonel.lnk]
path=c:\documents and settings\wasatis\Menu Démarrer\Programmes\Démarrage\toonel.lnk
backup=c:\windows\pss\toonel.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\kiax\\kiax.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\toonel.net\\0.65\\toonel.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\Adobe\\Shockwave 11\\SwHelper_1150595.exe"=
"c:\\Program Files\\toonel.net\\0.65\\jre\\bin\\toonelw32.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\123 Free Solitaire\\123FreeSolitaire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13392:TCP"= 13392:TCP:BitComet 13392 TCP
"13392:UDP"= 13392:UDP:BitComet 13392 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 32784]
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\poinhd.sys --> c:\windows\system32\drivers\poinhd.sys [?]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S2 gupdate1c9b462fd7333b0;Service Google Update (gupdate1c9b462fd7333b0);c:\program files\Google\Update\GoogleUpdate.exe [03/04/2009 15:49 133104]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [27/03/2009 12:06 1294336]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [24/04/2009 11:07 30192]
.
Contenu du dossier 'Tâches planifiées'

2009-05-11 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-03 13:49]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-idefisk.exe - c:\documents and settings\wasatis\Mes documents\idefisk_137\idefisk.exe
HKLM-Run-SeePassword - c:\program files\SeePassword\SeePassword.exe
HKLM-Run-CM108Sound - CM108.cpl


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {9314EA91-3B0C-4309-8843-49532798A477} = 193.95.66.11
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\wasatis\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1978305&SearchSource=3&a(...)
FF - prefs.js: browser.search.selectedEngine - Mininova-Vuze Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://fr.mg41.mail.yahoo.com/dc/launch?.rand=ftqtrjdget4l9|http://www.wasatis.com/spip/spip.php?article132|http://www.google.fr/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-11 17:58
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\rundll32.exe
c:\program files\toonel.net\0.65\jre\bin\toonelw32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-05-11 18:01 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-11 16:01

Avant-CF: 37 691 449 344 octets libres
Après-CF: 37 615 255 552 octets libres

300
a+

Salut ahmedsandra


Tu étais méchamment infecté et reste encore des choses à faire, le téléchargement illégal est le principal facteur d’infection (µTorrent, BitTorrent, eMule, Limewire, etc..) Le danger des cracks !


- Clique sur le menu démarrer/Exécuter, tape notepad à l’invite de commande et OK.

- Copie/colle ce qui est en citation ci-dessous dans le Bloc-Notes :



- Enregistre ce fichier sur le bureau (Impératif)

-Nom du fichier : CFScript.txt
-Type du fichier : tous les fichiers

- Clique sur Enregistrer et quitte le Bloc Notes

Important Désactive ton Antivirus et antispyware avant de faire le glisser/déposer

- Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe sur le bureau, comme sur cette capture (l’icône est un lion) :



* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ ComboFix.txt


@++

bonjour détéraqué
je m'excuse pour l'abscance brutal d'hier; j'ai pas vue le temps passer au boulot
et voici le rapport de combofix :

ComboFix 09-05-11.03 - wasatis 12/05/2009 9:13.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.503.142 [GMT 2:00]
Lancé depuis: c:\documents and settings\wasatis\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\wasatis\Bureau\CFScript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated)

FILE ::
C:\autorun.inf.vir
c:\windows\system32\drivers\gxvxcrwemovcuhxidwyroblqvwdoaynhdqqhx.sys.vir
c:\windows\system32\rundll93.exe.vir
c:\windows\welik.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf.vir
c:\windows\system32\drivers\gxvxcrwemovcuhxidwyroblqvwdoaynhdqqhx.sys.vir
c:\windows\system32\rundll93.exe.vir
c:\windows\welik.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-12 au 2009-05-12 ))))))))))))))))))))))))))))))))))))
.

2009-05-11 14:16 . 2009-05-11 14:16 -------- d-----w c:\documents and settings\wasatis\Application Data\Malwarebytes
2009-05-11 14:16 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-11 14:16 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-11 14:16 . 2009-05-11 14:16 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-11 14:16 . 2009-05-11 14:16 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-11 12:51 . 2009-05-11 12:51 -------- d-----w C:\_OTMoveIt
2009-05-11 12:10 . 2009-05-11 13:55 -------- d-----w c:\program files\trend micro
2009-05-11 12:10 . 2009-05-11 12:10 -------- d-----w C:\rsit
2009-05-11 10:40 . 2009-05-11 10:49 -------- d-----w C:\FindyKill
2009-05-11 09:51 . 2009-05-11 09:51 96976 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-11 09:51 . 2009-05-11 09:51 87855 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-11 09:50 . 2009-05-11 09:54 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-11 09:50 . 2009-05-11 09:54 24608 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-11 09:50 . 2009-05-11 09:50 -------- d-----w c:\program files\Kaspersky Lab
2009-05-11 09:50 . 2009-05-11 09:50 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-11 09:39 . 2009-05-11 09:39 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-11 08:28 . 2009-05-11 09:53 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-11 08:21 . 2005-08-25 23:50 77312 ----a-w c:\windows\system32\ztvunace26.dll
2009-05-11 08:21 . 2006-06-19 11:01 69632 ----a-w c:\windows\system32\ztvcabinet.dll
2009-05-11 08:21 . 2006-05-25 13:52 162304 ----a-w c:\windows\system32\ztvunrar36.dll
2009-05-11 08:21 . 2002-03-05 23:00 75264 ----a-w c:\windows\system32\unacev2.dll
2009-05-11 08:21 . 2003-02-02 18:06 153088 ----a-w c:\windows\system32\UNRAR3.dll
2009-05-11 08:21 . 2009-05-11 08:35 -------- d-----w c:\program files\Trojan Remover
2009-05-11 08:21 . 2009-05-11 08:21 -------- d-----w c:\documents and settings\wasatis\Application Data\Simply Super Software
2009-05-11 08:21 . 2009-05-11 08:21 -------- d-----w c:\documents and settings\All Users\Application Data\Simply Super Software
2009-05-09 09:40 . 2009-05-09 09:40 -------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-05-08 14:03 . 2009-05-08 14:19 -------- d-----w c:\documents and settings\wasatis\Application Data\123 Free Solitaire
2009-05-08 14:03 . 2009-05-08 14:03 -------- d-----w c:\program files\123 Free Solitaire
2009-05-08 08:43 . 2009-05-09 07:36 -------- d-----w c:\program files\freebird
2009-05-08 08:29 . 2009-05-11 09:47 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 08:05 . 2005-09-20 08:36 147456 ----a-w c:\windows\system32\igfxres.dll
2009-05-08 07:59 . 2001-09-28 12:00 98304 -c--a-w c:\windows\system32\dllcache\msir3jp.dll
2009-05-08 07:58 . 2004-08-19 14:09 42496 -c--a-w c:\windows\system32\dllcache\davcdata.exe
2009-05-08 07:50 . 2004-08-19 14:09 77312 ----a-w c:\windows\system32\usbui.dll
2009-05-08 07:34 . 2001-09-28 12:00 13312 -c--a-w c:\windows\system32\dllcache\irclass.dll
2009-05-08 07:34 . 2001-09-28 12:00 13312 ----a-w c:\windows\system32\irclass.dll
2009-05-08 07:34 . 2001-09-28 12:00 24661 -c--a-w c:\windows\system32\dllcache\spxcoins.dll
2009-05-08 07:34 . 2001-09-28 12:00 24661 ----a-w c:\windows\system32\spxcoins.dll
2009-05-07 12:28 . 2009-05-07 12:28 -------- d-----w c:\program files\Common Files
2009-05-07 12:26 . 2005-01-04 09:43 4682 ----a-w c:\windows\system32\npptNT2.sys
2009-05-07 09:48 . 2009-05-09 09:32 -------- d-----w c:\program files\Gpotato.eu
2009-05-06 15:08 . 2009-05-06 15:08 -------- d-----w C:\Download
2009-05-06 15:07 . 2009-05-06 15:07 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Kamuse
2009-05-05 10:24 . 2009-05-05 10:24 -------- d-----w c:\program files\Audacity
2009-04-29 10:55 . 2009-04-29 11:46 -------- d-----w c:\windows\system32\Adobe
2009-04-29 10:16 . 2009-05-07 09:20 -------- d-----w c:\program files\Galaxy Online
2009-04-29 07:46 . 2009-05-04 06:47 -------- d-----w c:\documents and settings\wasatis\Application Data\IDM
2009-04-29 07:46 . 2009-04-30 15:41 -------- d-----w c:\documents and settings\wasatis\Application Data\DMCache
2009-04-29 07:45 . 2009-05-04 06:47 -------- d-----w c:\program files\Internet Download Manager
2009-04-28 14:37 . 2009-04-28 14:37 -------- d-----w c:\documents and settings\wasatis\Application Data\dvdcss
2009-04-27 12:28 . 2009-04-27 12:28 -------- d-----w c:\documents and settings\wasatis\Application Data\vlc
2009-04-27 12:27 . 2009-04-27 12:27 -------- d-----w c:\program files\VideoLAN
2009-04-27 12:26 . 2009-04-27 12:26 -------- d-----w c:\documents and settings\wasatis\Application Data\Media Player Classic
2009-04-27 12:25 . 2008-09-16 19:23 168448 ----a-w c:\windows\system32\unrar.dll
2009-04-27 12:25 . 2004-01-25 16:18 217088 ----a-w c:\windows\system32\yv12vfw.dll
2009-04-27 12:25 . 2008-11-06 16:37 3596288 ----a-w c:\windows\system32\qt-dx331.dll
2009-04-27 12:25 . 2008-12-11 00:33 86016 ----a-w c:\windows\system32\dpl100.dll
2009-04-27 12:25 . 2009-03-02 18:10 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-04-27 12:25 . 2009-01-07 18:14 60273 ----a-w c:\windows\system32\pthreadGC2.dll
2009-04-27 12:25 . 2009-04-27 12:26 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-24 08:27 . 2009-04-24 08:27 -------- d-----w c:\program files\Torrent Harvester
2009-04-24 07:25 . 2009-03-19 14:32 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-24 07:25 . 2008-04-17 10:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-04-23 12:20 . 2009-04-23 12:23 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Apple Computer
2009-04-23 10:51 . 2009-04-23 10:51 -------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2009-04-23 10:51 . 2009-04-23 10:51 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Conduit
2009-04-23 10:51 . 2009-04-23 10:51 -------- d-----w c:\program files\Conduit
2009-04-23 10:51 . 2009-04-29 13:56 -------- d-----w c:\documents and settings\wasatis\Local Settings\Application Data\Mininova-Vuze
2009-04-23 10:51 . 2009-05-11 09:47 -------- d-----w c:\documents and settings\wasatis\Application Data\Azureus
2009-04-23 10:51 . 2009-05-08 12:44 -------- d-----w c:\program files\Mininova-Vuze
2009-04-23 10:50 . 2009-05-08 12:48 -------- d-----w c:\program files\Vuze
2009-04-22 08:22 . 2009-04-27 11:53 -------- d-----w c:\program files\IrfanView
2009-04-13 12:46 . 2009-04-13 12:49 -------- d--h--w C:\récupérations lau
2009-04-13 10:10 . 2003-03-18 19:20 1060864 ----a-w c:\windows\system32\MFC71.dll
2009-04-13 10:10 . 2009-04-13 10:10 -------- d-----w c:\program files\Alwil Software

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 15:28 . 2001-09-28 12:00 71488 ----a-w c:\windows\system32\perfc00C.dat
2009-05-11 15:28 . 2001-09-28 12:00 458648 ----a-w c:\windows\system32\perfh00C.dat
2009-05-11 14:22 . 2009-03-27 09:14 42168 ----a-w c:\documents and settings\wasatis\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-11 09:54 . 2009-05-11 09:50 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-11 09:54 . 2009-05-11 09:50 1164 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-09 09:32 . 2009-03-27 10:06 -------- d-----w c:\program files\Fichiers communs\InstallShield
2009-05-09 09:32 . 2009-03-27 10:04 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-09 07:57 . 2009-04-01 12:29 -------- d-----w c:\program files\kiax
2009-05-09 07:36 . 2009-03-27 10:56 -------- d-----w c:\program files\MSN Messenger
2009-05-08 07:57 . 2001-09-28 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-08 07:55 . 2009-03-27 09:01 23032 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-08 07:20 . 2009-03-30 10:30 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-07 10:07 . 2009-04-03 13:49 -------- d-----w c:\program files\Google
2009-04-24 08:37 . 2009-04-03 08:30 -------- d-----w c:\program files\toonel.net
2009-04-24 07:25 . 2009-04-24 07:24 -------- d-----w c:\program files\iTunes
2009-04-24 07:24 . 2009-04-24 07:24 -------- d-----w c:\program files\iPod
2009-04-24 07:24 . 2009-04-23 12:20 -------- d-----w c:\program files\Fichiers communs\Apple
2009-04-24 07:24 . 2009-04-24 07:24 -------- d-----w c:\program files\Bonjour
2009-04-24 07:24 . 2009-04-24 07:23 -------- d-----w c:\program files\QuickTime
2009-04-24 07:22 . 2009-04-24 07:22 -------- d-----w c:\program files\Apple Software Update
2009-04-23 10:35 . 2009-04-03 10:19 -------- d-----w c:\program files\BitComet
2009-04-08 12:51 . 2009-04-08 12:51 -------- d-----w c:\program files\Fichiers communs\Macromedia
2009-04-07 10:15 . 2009-04-07 08:31 -------- d-----w c:\program files\NASA
2009-04-06 07:02 . 2009-04-06 07:02 -------- d-----w c:\program files\Fichiers communs\AVSMedia
2009-04-06 07:02 . 2009-04-06 07:02 -------- d-----w c:\program files\AVSMedia
2009-04-03 13:50 . 2009-04-03 13:50 -------- d-----w c:\program files\Fichiers communs\xing shared
2009-04-03 13:50 . 2009-04-03 13:50 -------- d-----w c:\program files\Fichiers communs\Real
2009-04-03 13:50 . 2009-04-03 13:50 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-03 13:50 . 2009-04-03 13:50 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-03 13:50 . 2009-04-03 13:50 -------- d-----w c:\program files\Real
2009-04-03 12:22 . 2009-04-03 12:22 -------- d-----r c:\program files\Skype
2009-04-03 12:05 . 2009-04-03 08:11 -------- d-----w c:\program files\Overbond
2009-04-02 10:57 . 2009-04-02 10:57 -------- d-----w c:\program files\Adobe Media Player
2009-04-02 10:57 . 2009-04-02 10:57 -------- d-----w c:\program files\Fichiers communs\Adobe AIR
2009-03-31 10:37 . 2009-03-31 10:37 -------- d-----w c:\program files\Microsoft.NET
2009-03-31 08:29 . 2009-03-27 09:34 -------- d-----w c:\program files\Fichiers communs\Adobe
2009-03-30 10:30 . 2009-03-30 10:30 -------- d-----w c:\program files\Java
2009-03-27 10:31 . 2009-03-27 10:31 -------- d-----w c:\program files\FileZilla FTP Client
2009-03-27 10:06 . 2009-03-27 10:06 -------- d-----w c:\program files\C-Media USB 108 Sound
2009-03-27 10:04 . 2009-03-27 10:04 -------- d-----w c:\program files\Realtek
2009-03-27 09:55 . 2009-03-27 09:55 -------- d-----w c:\program files\Intel
2009-03-27 09:30 . 2009-03-27 09:30 0 ----a-w c:\windows\nsreg.dat
2009-03-27 09:19 . 2009-03-27 09:19 -------- d-----w c:\program files\Driver-Soft
2009-03-27 09:15 . 2009-03-27 09:03 86331 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-27 09:05 . 2009-03-27 09:05 -------- d-----w c:\program files\microsoft frontpage
2009-03-27 09:03 . 2009-03-27 09:03 -------- d-----w c:\program files\Services en ligne
2009-04-24 09:07 . 2009-04-24 09:07 122880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-11_15.58.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-12 07:14 . 2009-05-12 07:14 16384 c:\windows\Temp\Perflib_Perfdata_da0.dat
+ 2009-05-12 07:16 . 2009-05-12 07:16 16384 c:\windows\Temp\Perflib_Perfdata_9e4.dat
+ 2009-05-12 07:16 . 2009-05-12 07:16 16384 c:\windows\Temp\Perflib_Perfdata_444.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMin0.dll" [2008-09-15 1784856]

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
2008-09-15 04:47 1784856 ----a-w c:\program files\Mininova-Vuze\tbMin0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "c:\program files\Mininova-Vuze\tbMin0.dll" [2008-09-15 1784856]

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D51D388B-F5DC-471A-A1CE-5E2D671091C0}"= "c:\program files\Mininova-Vuze\tbMin0.dll" [2008-09-15 1784856]

[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-06 146680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-04-03 275984]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 516096]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 444712]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-04-24 30192]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 163840]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 155648]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-08 222616]
"CRDaemon"="c:\program files\freebird\Record Center\CRDaemon.exe" [2007-04-28 290816]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-03-30 1213320]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-16 1708032]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\wasatis\Menu D‚marrer\Programmes\D‚marrage\
toonel.lnk - c:\program files\toonel.net\0.65\toonel.exe [2007-4-12 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^wasatis^Menu Démarrer^Programmes^Démarrage^toonel.lnk]
path=c:\documents and settings\wasatis\Menu Démarrer\Programmes\Démarrage\toonel.lnk
backup=c:\windows\pss\toonel.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\kiax\\kiax.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\toonel.net\\0.65\\toonel.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\Adobe\\Shockwave 11\\SwHelper_1150595.exe"=
"c:\\Program Files\\toonel.net\\0.65\\jre\\bin\\toonelw32.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\123 Free Solitaire\\123FreeSolitaire.exe"=
"c:\\WINDOWS\\system32\\CF29549.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13392:TCP"= 13392:TCP:BitComet 13392 TCP
"13392:UDP"= 13392:UDP:BitComet 13392 UDP

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 17:29 32784]
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\poinhd.sys --> c:\windows\system32\drivers\poinhd.sys [?]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 17:06 24592]
S2 gupdate1c9b462fd7333b0;Service Google Update (gupdate1c9b462fd7333b0);c:\program files\Google\Update\GoogleUpdate.exe [03/04/2009 15:49 133104]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [27/03/2009 12:06 1294336]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [24/04/2009 11:07 30192]
.
Contenu du dossier 'Tâches planifiées'

2009-05-12 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-03 13:49]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {9314EA91-3B0C-4309-8843-49532798A477} = 193.95.66.11
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\wasatis\Application Data\Mozilla\Firefox\Profiles\8avnb288.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1978305&SearchSource=3&a(...)
FF - prefs.js: browser.search.selectedEngine - Mininova-Vuze Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://fr.mg41.mail.yahoo.com/dc/launch?.rand=ftqtrjdget4l9|http://www.wasatis.com/spip/spip.php?article132|http://www.google.fr/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-12 09:16
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\toonel.net\0.65\jre\bin\toonelw32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Heure de fin: 2009-05-12 9:19 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-12 07:19
ComboFix2.txt 2009-05-11 16:01

Avant-CF: 37 572 808 704 octets libres
Après-CF: 37 519 532 032 octets libres

297


a+

Salut ahmedsandra


Télécharge SDFix par AndyManchesta sur le Bureau :

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe


Double clic sur SDFix.exe sur le bureau et clic sur Install , choisi le bureau pour l’intallation et un dossier sera créer sur le bureau.


Redémarre ton PC en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur.


Ouvre le dossier SDFix sur le bureau et double clique sur RunThis.bat, appuie sur Y pour lancer le nettoyage.

Il y aura redémarrage, quand Finished s’affichera appuie sur un touche pour terminer.

Poste le rapport qui se trouve dans le dossier SDFix sous le nom de Report.txt dans ta prochaine réponse.


-----


Supprime ce dossier C:\rsit

Refais un scan avec RSIT et poste les rapports log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

Les rapports sont dans le dossier ici C:\rsit


@++

re bonjour

je ne peux pas aller sur mode sans echec; le pc redemarre quand je choisi le mode sans echec

merci
a+

Salut ahmedsandra


- Télécharge SafeBoot.reg http://www.malekal.com/download/SafeBoot.reg Pour télécharger ce fichier fais un clic droit sur le lien qui est en bleu dans ma réponse choisis pour :

* Internet Explorer : Enregistrer la cible sous
* Firefox : Enregistrer la cible du lien sous

- Enregistre ce fichier sur le bureau
- Déconnecte ton PC du net

- Clic droit sur SafeBoot.reg choisis Fusionner dans la liste, accepte la fusion avec le registre

- Tente ensuite de redémarrer en mode sans échec.


@++

salut détéraqué

quand je fais fusionner il y a la fenetre qui souvre pour me dire :
la modification du registre a été désactivé par votre admin


merci a+

Salut ahmedsandra


Va sur ce lien, fait l'étape 2 :
http://supportep.fr/3/BD-2009-GreenV.pdf

- Exécute le logiciel ClearRegistrySecurity.exe
- Et Zeb-Restore


@++

salut

j'ai pas compris; desolé

j'ai installé BlacV et le net framework

mais je ne peux pas bouté sur le mode sans echec

encore desolé et merci

a+

Salut ahmedsandra


Fais le en mode normal


@++

salut
je l'ai fais en mode normal mais en vain

toujour la mem chose
et le mode sans echec est impossible d'y acceder



A++

Salut ahmedsandra


Supprime ce dossier C:\rsit

Refais un scan avec RSIT et poste les rapports log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

Les rapports sont dans le dossier ici C:\rsit


@++

salut dédétraqué

voici le log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by wasatis at 2009-05-12 17:21:36
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 38 GB (64%) free of 60 GB
Total RAM: 503 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:21:40, on 12/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\toonel.net\0.65\jre\bin\toonelw32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\123 Free Solitaire\123FreeSolitaire.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\wasatis\Bureau\RSIT.exe
C:\Program Files\trend micro\wasatis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\tbMin0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 ME\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\tbMin0.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Mininova-Vuze Toolbar - {d51d388b-f5dc-471a-a1ce-5e2d671091c0} - C:\Program Files\Mininova-Vuze\tbMin0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CRDaemon] C:\Program Files\freebird\Record Center\CRDaemon.exe /autorun
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: toonel.lnk = C:\Program Files\toonel.net\0.65\toonel.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9314EA91-3B0C-4309-8843-49532798A477}: NameServer = 193.95.66.11
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9b462fd7333b0) (gupdate1c9b462fd7333b0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7249 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 ME\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-04-03 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-07 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-07 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-05-07 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
Mininova-Vuze Toolbar - C:\Program Files\Mininova-Vuze\tbMin0.dll [2008-09-15 1784856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-08 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-08 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{d51d388b-f5dc-471a-a1ce-5e2d671091c0} - Mininova-Vuze Toolbar - C:\Program Files\Mininova-Vuze\tbMin0.dll [2008-09-15 1784856]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-05-07 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-04-03 275984]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 516096]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 444712]
"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-04-24 30192]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-09-20 163840]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-09-20 155648]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-09-20 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-05-08 222616]
"CRDaemon"=C:\Program Files\freebird\Record Center\CRDaemon.exe [2007-04-28 290816]
"TrojanScanner"=C:\Program Files\Trojan Remover\Trjscan.exe [2009-03-30 1213320]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-06 146680]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^wasatis^Menu Démarrer^Programmes^Démarrage^toonel.lnk]
C:\PROGRA~1\toonel.net\0.65\toonel.exe [2007-04-12 122880]

C:\Documents and Settings\wasatis\Menu Démarrer\Programmes\Démarrage
toonel.lnk - C:\Program Files\toonel.net\0.65\toonel.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-09-20 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"legalnoticecaption"=
"legalnoticetext"=
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\kiax\kiax.exe"="C:\Program Files\kiax\kiax.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\javaw.exe"="C:\WINDOWS\system32\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\nwiz.exe"="C:\WINDOWS\system32\nwiz.exe:*:Enabled:ipsec"
"C:\Program Files\iTunes\iTunesHelper.exe"="C:\Program Files\iTunes\iTunesHelper.exe:*:Enabled:ipsec"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\toonel.net\0.65\toonel.exe"="C:\Program Files\toonel.net\0.65\toonel.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\netsh.exe"="C:\WINDOWS\system32\netsh.exe:*:Enabled:ipsec"
"C:\Program Files\Java\jre6\bin\jusched.exe"="C:\Program Files\Java\jre6\bin\jusched.exe:*:Enabled:ipsec"
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe:*:Enabled:ipsec"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150595.exe"="C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150595.exe:*:Enabled:ipsec"
"C:\Program Files\toonel.net\0.65\jre\bin\toonelw32.exe"="C:\Program Files\toonel.net\0.65\jre\bin\toonelw32.exe:*:Enabled:ipsec"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\hkcmd.exe"="C:\WINDOWS\system32\hkcmd.exe:*:Enabled:ipsec"
"C:\Program Files\123 Free Solitaire\123FreeSolitaire.exe"="C:\Program Files\123 Free Solitaire\123FreeSolitaire.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\CF29549.exe"="C:\WINDOWS\system32\CF29549.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfkggr.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winfkggr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winanbiy.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winanbiy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpytjc.exe"="C:\DOCUME~1\wasatis\LOCALS~1\Temp\winpytjc.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe:*:Enabled:ipsec"
"C:\Program Files\Java\jre6\bin\jqsnotify.exe"="C:\Program Files\Java\jre6\bin\jqsnotify.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

======File associations======

.scr - config - "%1" /S

======List of files/folders created in the last 1 months======

2009-05-12 17:21:36 ----D---- C:\rsit
2009-05-12 16:23:39 ----D---- C:\GreenV
2009-05-12 16:14:35 ----A---- C:\WINDOWS\Alcrmv.exe
2009-05-12 16:14:33 ----A---- C:\WINDOWS\system32\RTLCPAPI.dll
2009-05-12 16:14:12 ----A---- C:\WINDOWS\system32\RTLCPL.EXE
2009-05-12 16:14:05 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2009-05-12 16:14:01 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-05-12 16:13:58 ----D---- C:\WINDOWS\LastGood
2009-05-12 15:36:40 ----A---- C:\WINDOWS\IsUn040c.exe
2009-05-12 15:28:30 ----D---- C:\WINDOWS\system32\URTTEMP
2009-05-12 15:20:08 ----D---- C:\BlackV
2009-05-12 15:12:17 ----D---- C:\Program Files\Realtek AC97
2009-05-12 15:04:28 ----A---- C:\WINDOWS\system32\ChCfg.exe
2009-05-12 15:03:44 ----A---- C:\WINDOWS\alcupd.exe
2009-05-12 14:14:43 ----D---- C:\SDFix
2009-05-12 13:54:09 ----A---- C:\WINDOWS\IsUninst.exe
2009-05-12 13:53:23 ----D---- C:\Program Files\PC Drivers HeadQuarters
2009-05-12 13:53:23 ----D---- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2009-05-12 13:43:50 ----D---- C:\Documents and Settings\wasatis\Application Data\GetRightToGo
2009-05-12 09:19:50 ----A---- C:\ComboFix.txt
2009-05-11 17:52:20 ----A---- C:\WINDOWS\NIRCMD.exe
2009-05-11 16:16:23 ----D---- C:\Documents and Settings\wasatis\Application Data\Malwarebytes
2009-05-11 16:16:18 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-05-11 16:16:18 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-05-11 14:51:35 ----D---- C:\_OTMoveIt
2009-05-11 14:10:25 ----D---- C:\Program Files\trend micro
2009-05-11 13:02:40 ----A---- C:\Boot.bak
2009-05-11 13:02:34 ----RASHD---- C:\cmdcons
2009-05-11 12:57:44 ----A---- C:\WINDOWS\zip.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\vFind.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\SWSC.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\SWREG.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\sed.exe
2009-05-11 12:57:44 ----A---- C:\WINDOWS\grep.exe
2009-05-11 12:57:38 ----D---- C:\WINDOWS\ERDNT
2009-05-11 12:57:34 ----D---- C:\Qoobox
2009-05-11 12:46:47 ----A---- C:\FindyKill.txt
2009-05-11 12:40:54 ----D---- C:\FindyKill
2009-05-11 11:50:58 ----D---- C:\Program Files\Kaspersky Lab
2009-05-11 11:50:57 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-05-11 11:39:44 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-11 10:53:40 ----A---- C:\WINDOWS\ntbtlog.txt
2009-05-11 10:28:07 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\ztvunrar36.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\ztvunace26.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\ztvcabinet.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\UNRAR3.dll
2009-05-11 10:21:23 ----A---- C:\WINDOWS\system32\unacev2.dll
2009-05-11 10:21:21 ----D---- C:\Program Files\Trojan Remover
2009-05-11 10:21:21 ----D---- C:\Documents and Settings\wasatis\Application Data\Simply Super Software
2009-05-11 10:21:21 ----D---- C:\Documents and Settings\All Users\Application Data\Simply Super Software
2009-05-09 11:40:58 ----D---- C:\Documents and Settings\All Users\Application Data\InstallShield
2009-05-09 11:02:04 ----A---- C:\WINDOWS\system32\tmp.txt
2009-05-09 11:02:00 ----A---- C:\rapport.txt
2009-05-09 09:57:28 ----A---- C:\WINDOWS\VEmotion.INI
2009-05-08 16:03:53 ----D---- C:\Documents and Settings\wasatis\Application Data\123 Free Solitaire
2009-05-08 16:03:41 ----D---- C:\Program Files\123 Free Solitaire
2009-05-08 10:43:20 ----D---- C:\Program Files\freebird
2009-05-08 10:29:37 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 10:05:26 ----A---- C:\WINDOWS\system32\igfxres.dll
2009-05-08 10:03:14 ----D---- C:\WINDOWS\Prefetch
2009-05-08 09:56:31 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-05-08 09:53:10 ----A---- C:\WINDOWS\pnplog.txt
2009-05-08 09:50:10 ----A---- C:\WINDOWS\system32\usbui.dll
2009-05-08 09:34:23 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-05-08 09:34:23 ----A---- C:\WINDOWS\system32\irclass.dll
2009-05-08 09:34:01 ----RA---- C:\WINDOWS\SET3A.tmp
2009-05-08 09:33:57 ----RA---- C:\WINDOWS\SET2E.tmp
2009-05-08 09:33:55 ----RA---- C:\WINDOWS\SET2B.tmp
2009-05-08 09:22:43 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-05-08 09:20:18 ----A---- C:\WINDOWS\system32\javaws.exe
2009-05-08 09:20:18 ----A---- C:\WINDOWS\system32\javaw.exe
2009-05-08 09:20:18 ----A---- C:\WINDOWS\system32\java.exe
2009-05-07 14:28:45 ----D---- C:\Program Files\Common Files
2009-05-07 11:48:10 ----D---- C:\Program Files\Gpotato.eu
2009-05-06 17:08:03 ----D---- C:\Download
2009-05-06 08:47:25 ----A---- C:\WINDOWS\system32\iglicd32.dll
2009-05-06 08:47:25 ----A---- C:\WINDOWS\system32\igldev32.dll
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxzoom.exe
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxtray.exe
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxsrvc.exe
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxsrvc.dll
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxress.dll
2009-05-06 08:47:24 ----A---- C:\WINDOWS\system32\igfxpph.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxpers.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxext.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxexps.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxdo.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxdev.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\igfxcfg.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuTRK.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuTHA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuSVE.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuRUS.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuPTG.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuPTB.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuPLK.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuNOR.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuNLD.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuKOR.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuJPN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuITA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuHUN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuHEB.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuFRC.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuFRA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuFIN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuESP.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuENG.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuELL.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmudlg.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuDEU.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuDAN.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuCSY.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuCHT.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuCHS.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuARB.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmuARA.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmrnt5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmrem.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmdnt5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmdev5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\ialmdd5.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\iAlmCoIn_v4396.dll
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\hkcmd.exe
2009-05-06 08:47:23 ----A---- C:\WINDOWS\system32\hccutils.dll
2009-05-05 12:24:41 ----D---- C:\Program Files\Audacity
2009-04-29 15:56:08 ----D---- C:\Documents and Settings\wasatis\Application Data\Google
2009-04-29 12:55:25 ----D---- C:\WINDOWS\system32\Adobe
2009-04-29 12:16:08 ----D---- C:\Program Files\Galaxy Online
2009-04-29 09:46:10 ----D---- C:\Documents and Settings\wasatis\Application Data\IDM
2009-04-29 09:46:07 ----D---- C:\Documents and Settings\wasatis\Application Data\DMCache
2009-04-29 09:45:46 ----D---- C:\Program Files\Internet Download Manager
2009-04-28 16:37:12 ----D---- C:\Documents and Settings\wasatis\Application Data\dvdcss
2009-04-27 14:28:51 ----D---- C:\Documents and Settings\wasatis\Application Data\vlc
2009-04-27 14:27:27 ----D---- C:\Program Files\VideoLAN
2009-04-27 14:26:44 ----D---- C:\Documents and Settings\wasatis\Application Data\Media Player Classic
2009-04-27 14:25:53 ----A---- C:\WINDOWS\system32\unrar.dll
2009-04-27 14:25:50 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-04-27 14:25:48 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2009-04-27 14:25:48 ----A---- C:\WINDOWS\system32\dpl100.dll
2009-04-27 14:25:46 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-04-27 14:25:46 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-04-27 14:25:45 ----A---- C:\WINDOWS\system32\pthreadGC2.dll
2009-04-27 14:25:44 ----D---- C:\Program Files\K-Lite Codec Pack
2009-04-24 10:27:05 ----D---- C:\Program Files\Torrent Harvester
2009-04-24 09:25:06 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-04-24 09:24:49 ----D---- C:\Program Files\iPod
2009-04-24 09:24:45 ----D---- C:\Program Files\iTunes
2009-04-24 09:24:45 ----D---- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-24 09:24:30 ----D---- C:\Program Files\Bonjour
2009-04-24 09:23:57 ----D---- C:\Program Files\QuickTime
2009-04-24 09:22:47 ----D---- C:\Program Files\Apple Software Update
2009-04-24 09:22:27 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-04-24 08:59:17 ----D---- C:\WINDOWS\system32\appmgmt
2009-04-24 08:59:16 ----D---- C:\WINDOWS\SxsCaPendDel
2009-04-23 14:23:59 ----D---- C:\Documents and Settings\wasatis\Application Data\Apple Computer
2009-04-23 14:21:51 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-04-23 14:20:50 ----D---- C:\Program Files\Fichiers communs\Apple
2009-04-23 12:51:09 ----D---- C:\Documents and Settings\All Users\Application Data\Azureus
2009-04-23 12:51:07 ----D---- C:\Program Files\Mininova-Vuze
2009-04-23 12:51:07 ----D---- C:\Program Files\Conduit
2009-04-23 12:51:07 ----D---- C:\Documents and Settings\wasatis\Application Data\Azureus
2009-04-23 12:50:31 ----D---- C:\Program Files\Vuze
2009-04-22 10:23:21 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-04-22 10:22:53 ----D---- C:\Program Files\IrfanView
2009-04-15 12:27:00 ----D---- C:\WINDOWS\pss
2009-04-13 14:46:20 ----HD---- C:\récupérations lau
2009-04-13 12:10:07 ----A---- C:\WINDOWS\system32\MFC71.dll
2009-04-13 12:10:03 ----D---- C:\Program Files\Alwil Software

======List of files/folders modified in the last 1 months======

2009-05-12 16:58:14 ----D---- C:\Program Files\Mozilla Firefox
2009-05-12 16:57:56 ----D---- C:\WINDOWS\system32\drivers
2009-05-12 16:57:53 ----D---- C:\WINDOWS\Temp
2009-05-12 16:56:05 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-12 16:55:32 ----SHD---- C:\System Volume Information
2009-05-12 16:55:32 ----HD---- C:\WINDOWS\inf
2009-05-12 16:55:32 ----D---- C:\WINDOWS\system32
2009-05-12 16:55:32 ----D---- C:\WINDOWS
2009-05-12 16:52:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-12 16:49:50 ----D---- C:\WINDOWS\system32\Restore
2009-05-12 16:14:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-05-12 15:29:30 ----D---- C:\WINDOWS\Registration
2009-05-12 15:29:15 ----RSD---- C:\WINDOWS\assembly
2009-05-12 15:29:09 ----SHD---- C:\WINDOWS\Installer
2009-05-12 15:29:08 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-05-12 15:12:17 ----RD---- C:\Program Files
2009-05-12 15:11:25 ----D---- C:\WINDOWS\SoftwareDistribution
2009-05-12 15:03:44 ----HD---- C:\Program Files\InstallShield Installation Information
2009-05-12 13:56:07 ----D---- C:\WINDOWS\Microsoft.NET
2009-05-12 09:16:37 ----A---- C:\WINDOWS\system.ini
2009-05-12 09:14:56 ----D---- C:\WINDOWS\AppPatch
2009-05-12 09:14:53 ----D---- C:\Program Files\Fichiers communs
2009-05-11 17:56:55 ----D---- C:\WINDOWS\system32\config
2009-05-11 13:02:40 ----RASH---- C:\boot.ini
2009-05-09 11:32:52 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-05-09 11:32:51 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-05-09 10:11:14 ----A---- C:\WINDOWS\win.ini
2009-05-09 09:57:50 ----D---- C:\Program Files\kiax
2009-05-09 09:36:29 ----D---- C:\Program Files\MSN Messenger
2009-05-09 09:36:29 ----D---- C:\Program Files\Messenger
2009-05-08 15:24:27 ----D---- C:\WINDOWS\security
2009-05-08 12:13:46 ----A---- C:\WINDOWS\ODBC.INI
2009-05-08 11:31:49 ----D---- C:\WINDOWS\system
2009-05-08 11:31:48 ----D---- C:\WINDOWS\system32\Setup
2009-05-08 11:31:46 ----D---- C:\WINDOWS\Help
2009-05-08 11:31:39 ----D---- C:\WINDOWS\system32\usmt
2009-05-08 11:31:27 ----D---- C:\WINDOWS\ime
2009-05-08 11:31:27 ----D---- C:\WINDOWS\ehome
2009-05-08 11:31:25 ----RSD---- C:\WINDOWS\Fonts
2009-05-08 11:31:25 ----D---- C:\WINDOWS\Media
2009-05-08 11:31:12 ----D---- C:\WINDOWS\PeerNet
2009-05-08 11:30:56 ----D---- C:\WINDOWS\system32\npp
2009-05-08 11:30:49 ----D---- C:\WINDOWS\msagent
2009-05-08 11:29:04 ----D---- C:\WINDOWS\system32\1036
2009-05-08 11:28:58 ----D---- C:\WINDOWS\twain_32
2009-05-08 11:28:43 ----D---- C:\WINDOWS\system32\icsxml
2009-05-08 11:28:11 ----D---- C:\WINDOWS\system32\1033
2009-05-08 11:27:13 ----D---- C:\WINDOWS\WinSxS
2009-05-08 11:27:13 ----D---- C:\WINDOWS\Driver Cache
2009-05-08 10:04:55 ----A---- C:\WINDOWS\setuplog.txt
2009-05-08 09:57:35 ----A---- C:\WINDOWS\OEWABLog.txt
2009-05-08 09:57:30 ----A---- C:\WINDOWS\ODBCINST.INI
2009-05-08 09:57:08 ----D---- C:\WINDOWS\system32\ias
2009-05-08 09:56:34 ----RD---- C:\WINDOWS\Web
2009-05-08 09:56:24 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-05-08 09:56:08 ----D---- C:\WINDOWS\system32\oobe
2009-05-08 09:55:27 ----D---- C:\WINDOWS\system32\Com
2009-05-08 09:54:51 ----D---- C:\WINDOWS\system32\wbem
2009-05-08 09:35:41 ----D---- C:\WINDOWS\system32\CatRoot
2009-05-08 09:34:13 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-05-08 09:20:04 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-05-07 12:07:39 ----D---- C:\Program Files\Google
2009-05-07 11:04:51 ----D---- C:\Documents and Settings\wasatis\Application Data\Skype
2009-05-07 09:27:58 ----SD---- C:\WINDOWS\Tasks
2009-04-29 13:43:40 ----D---- C:\Documents and Settings\wasatis\Application Data\Adobe
2009-04-29 13:43:39 ----D---- C:\Documents and Settings\wasatis\Application Data\Macromedia
2009-04-29 13:43:38 ----D---- C:\WINDOWS\system32\Macromed
2009-04-24 10:37:31 ----D---- C:\Program Files\toonel.net
2009-04-24 09:25:06 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-04-23 12:35:41 ----D---- C:\Program Files\BitComet
2009-04-23 12:10:52 ----D---- C:\Downloads
2009-04-20 17:50:40 ----D---- C:\Documents and Settings\wasatis\Application Data\FileZilla
2009-04-15 11:47:44 ----SD---- C:\Documents and Settings\wasatis\Application Data\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-19 40320]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\poinhd.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-09-28 9600]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-09-20 1302332]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2009-01-21 118656]
R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-09-24 4122368]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface; C:\WINDOWS\system32\drivers\CM108.sys [2006-12-22 1294336]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS []
S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-05-08 152984]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S2 gupdate1c9b462fd7333b0;Service Google Update (gupdate1c9b462fd7333b0); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-03 133104]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-04-24 30192]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-07 264688]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 166960]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 170864]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-19 14336]

-----------------EOF-----------------



et voici l'info :

info.txt logfile of random's system information tool 1.06 2009-05-12 17:21:42

======Uninstall list======

-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
123 Free Solitaire 2008 v6.0-->"C:\Program Files\123 Free Solitaire\unins000.exe"
Adobe AIR-->C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Media Player-->MsiExec.exe /X{9455959E-D588-EFAE-329C-F66CC797F32A}
Adobe Reader 6.0.2 ME-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-6EA000000001}
Adobe Shockwave Player 11.5-->C:\WINDOWS\system32\Adobe\uninstaller.exe
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Audacity 1.2.0-->"C:\Program Files\Audacity\unins000.exe"
AVS Video Converter 4.3.1.371-->"C:\Program Files\AVSMedia\VideoConverter4\unins000.exe"
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
C-Media USB 108 Sound-->C:\WINDOWS\Cmi108Uninstall.exe C:\Program Files\C-Media USB 108 Sound#C-Media USB 108 Sound#C-Media USB 108 Sound#
Driver Detective-->C:\Program Files\InstallShield Installation Information\{621C02EA-AAFF-4026-A903-165D59529A16}\setup.exe -runfromtemp -l0x0409
Driver Genius Professional Edition-->"C:\Program Files\Driver-Soft\DriverGenius\unins000.exe"
FileZilla Client 3.2.3.1-->C:\Program Files\FileZilla FTP Client\uninstall.exe
FindyKill-->C:\FindyKill\Uninstal.exe
Google Chrome-->"C:\Program Files\Google\Chrome\Application\1.0.154.65\Installer\setup.exe" --uninstall --system-level
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Intel(R) Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Kaspersky Anti-Virus 2009-->MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Kaspersky Anti-Virus 2009-->MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
K-Lite Codec Pack 4.7.5 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Mininova-Vuze Toolbar-->C:\PROGRA~1\MININO~1\UNWISE.EXE C:\PROGRA~1\MININO~1\INSTALL.LOG
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Rappelz-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01A8838A-9469-425F-A5FB-FC14D4CF93B9}\setup.exe" -l0x40c -removeonly
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->Alcrmv.exe -r -m
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -removeonly
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Smart PC Recorder - by freebird-->C:\Program Files\freebird\SmartRecorder\Uninstall.exe
Torrent Harvester-->C:\Program Files\Torrent Harvester\uninstall.exe
Trojan Remover 6.7.8-->"C:\Program Files\Trojan Remover\unins000.exe"
vEmotion - VoIP audio assistant-->C:\Program Files\freebird\vEmotion\Uninstall.exe
vEmotion Call Record Center-->C:\Program Files\Freebird\Record Center\Uninstall.exe
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}

=====HijackThis Backups=====

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 [2009-05-11]

======Security center information======

AV: Kaspersky Anti-Virus (disabled) (outdated)

======System event log======

Computer Name: MKLSERVICES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de découvertes SSDP.

Record Number: 1419
Source Name: Service Control Manager
Time Written: 20090427150616.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MKLSERVICES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 1418
Source Name: Service Control Manager
Time Written: 20090427150616.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MKLSERVICES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de transfert intelligent en arrière-plan.

Record Number: 1417
Source Name: Service Control Manager
Time Written: 20090427150616.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MKLSERVICES
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Compatibilité avec le Changement rapide d'utilisateur.

Record Number: 1416
Source Name: Service Control Manager
Time Written: 20090427150616.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: MKLSERVICES
Event Code: 7036
Message: Le service Compatibilité avec le Changement rapide d'utilisateur est entré dans l'état : en cours d'exécution.

Record Number: 1415
Source Name: Service Control Manager
Time Written: 20090427150616.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service MSDTC (MSDTC) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090327100113.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090327100111.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090327095345.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service PSched (PSched) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090327095320.000000+060
Event Type: Informations
User:

Computer Name: MKLSERVICES
Event Code: 1000
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090327095319.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 10, GenuineIntel
"PROCESSOR_REVISION"=040a
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip



-----------------EOF-----------------


A++

Salut ahmedsandra


Double clique sur le raccourci d'HijackThis sur ton Bureau, clique sur Do a scan system only coche la case devant la(les) ligne(s) suivante(s) si présente(s)

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1


- Ferme les fenêtres en cours sauf HijackThis, clique sur Fix checked

- Quitte HijackThis


-----


Télécharge FindyKill (de Chiquitine29) sur le bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

Fais un clic droit sur ce lien ci haut, pour Internet Explorer
- Choisi Enregistrer la cible sous ...
Pour Firefox
- Choisi Enregistrer la cible du lien sous...

- Et choisi le bureau comme lieu d'enregistrement, double clique sur FindyKill.exe sur le bureau pour lancer l’installation

Branche tous tes supports amovibles (clefs USB, disque dur externe, carte flash etc..).


Double clique sur le raccourci de FindyKill sur le bureau.
Au menu principal, choisis l'option 1 (Recherche).

Poste le rapport a la fin de la recherche, le rapport ce trouve ici C:\ FindyKill.txt


@++

salut

voila le rapport de findykill :


############################## [ FindyKill V4.728 ]

# User : wasatis (Administrateurs) # MKLSERVICES
# Update on 03/05/09 by Chiquitine29
# Start at: 17:55:28 | 12/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled
# AV : Kaspersky Anti-Virus 8.0.0.506 [ (!) Disabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 58,59 Go (37,57 Go free) # NTFS
# D:\ # Disque fixe local # 90,41 Go (90,07 Go free) # NTFS
# F:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\toonel.net\0.65\jre\bin\toonelw32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers / Dossiers infectieux ]


################## [ Infected Temp Files ]


################## [ Registre / Clés infectieuses ]



################## [ Recherche dans supports amovibles]


################## [ Registre / Mountpoints2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.728 ! ]




merci pour ton aide mais je dois m'en aller a demain et tres bonne soirée

bonjour dédétraqué

j'éspere que tu as vu le rapport findykill

merci et a++

Salut


Sur le bureau, relance FindyKill en double-cliquant sur le raccourci.
Au menu principal, choisis l'option 2 : (Suppression)
Il y aura 2 redémarrages du PC.
Laisse-le travailler jusqu' à l’apparition de : "Nettoyage effectué".
Un rapport va s'ouvrir. Copie/colle-le dans ta réponse.
PS : le rapport est aussi conservé à la racine du disque dur C:\FindyKill.txt.


@++