Redirection de tous les liens vers go.google

Logfile of random's system information tool 1.05 (written by random/random)
Run by Jean Trawalter at 2009-01-09 02:26:38
Microsoft Windows XP …dition familiale Service Pack 3
System drive C: has 24 GB (33%) free of 74 GB
Total RAM: 895 MB (60% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-12-17 1878872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-06 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A30C59-3A50-49E6-9DAF-4923C4EA3C23}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-20 657904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-06 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-06 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3}
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HControl"=C:\WINDOWS\ATK0100\HControl.exe [2005-05-12 102400]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-04-14 77824]
"NB Probe"=C:\Program Files\ASUS\NB Probe\NBProbe.exe [2005-06-09 765952]
"RemoteControl"=C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe [2004-11-02 32768]
"Power_Gear"=C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe [2004-09-21 81920]
"CTCheck"=C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe [2007-11-06 397312]
"mxomssmenu"=C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe [2007-09-06 169264]
"PowerStrip"=c:\program files\powerstrip\pstrip.exe [2008-11-19 737312]
"SiSPower"=C:\WINDOWS\system32\SiSPower.dll [2008-03-20 53248]
"AppleSyncNotifier"=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-11-07 111936]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-11-04 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-01-23 101136]
"Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-01-23 101136]
""= []
"Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2008-04-23 483328]
"EasyPHP"=C:\Program Files\EasyPHP\EasyPHP.exe [2006-11-19 176128]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-06 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"=C:\Program Files\Rainlendar2\Rainlendar2.exe [2007-01-01 986112]
"CTSyncU.exe"=C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe [2007-07-17 868352]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"TomTomHOME.exe"=C:\Program Files\TomTom HOME 2\HOMERunner.exe [2008-12-09 234856]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-12-17 2107224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
C:\Program Files\eMule\emule.exe [2008-08-01 5480448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Instafinder]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-11-04 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboTask]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
[]

C:\Documents and Settings\All Users\Menu DÈmarrer\Programmes\DÈmarrage
Lancement rapide d'Adobe Acrobat.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-0000003D0002}\SC_Acrobat.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="acaptuser32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Asus\ASUS Live Update\LiveUpdt.exe"="C:\Program Files\Asus\ASUS Live Update\LiveUpdt.exe:*:Enabled:LiveUpdt"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Kazaa\kazaa.exe"="C:\Program Files\Kazaa\kazaa.exe:*:Enabled:Kazaa"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe"="C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe"="C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3152960e-7998-11dd-a5ae-001731c2e852}]
shell\AutoRun\command - .\Encryption Tool\MaxtorEncryption.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f15de6f-1911-11db-b99d-806d6172696f}]
shell\AutoRun\command - D:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{85b95e90-d4ff-11dd-a601-001731c2e852}]
shell\AutoRun\command - D:\InstallTomTomHOME.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b4102d99-1913-11db-b99f-001731c2e852}]
shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ee0e5266-e950-11dc-bc92-001731c2e852}]
shell\Auto\command - D:\AdobeR.exe e
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e


======File associations======

.reg - open - regedit.exe "%1" %*
.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-01-09 02:26:40 ----D---- C:\Program Files\trend micro
2009-01-09 02:26:38 ----D---- C:\rsit
2009-01-09 01:04:55 ----A---- C:\lopR.txt
2009-01-09 01:04:16 ----D---- C:\Lop SD
2009-01-09 00:42:12 ----D---- C:\Program Files\Windows Live Safety Center
2009-01-09 00:18:43 ----D---- C:\WINDOWS\BDOSCAN8
2009-01-09 00:07:55 ----A---- C:\WINDOWS\ntbtlog.txt
2009-01-08 23:43:59 ----A---- C:\rapport_clean.txt
2009-01-08 23:42:11 ----A---- C:\resultat_clean.txt
2009-01-08 23:25:33 ----D---- C:\WINDOWS\system32\Kaspersky Lab
2009-01-08 22:38:54 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-01-08 22:20:46 ----D---- C:\JULIA_V_ALLEMANDE
2009-01-08 20:35:06 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-01-08 19:07:37 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\Malwarebytes
2009-01-08 17:38:19 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-01-08 16:24:31 ----D---- C:\Program Files\a-squared Free
2009-01-08 16:20:32 ----A---- C:\m.exe
2009-01-06 13:16:49 ----A---- C:\WINDOWS\system32\javaws.exe
2009-01-06 13:16:49 ----A---- C:\WINDOWS\system32\javaw.exe
2009-01-06 13:16:48 ----A---- C:\WINDOWS\system32\java.exe
2009-01-04 20:55:29 ----D---- C:\Program Files\iolo
2009-01-04 20:55:08 ----A---- C:\WINDOWS\system32\mfc45.dll
2009-01-04 20:53:26 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\iolo
2009-01-04 20:53:26 ----D---- C:\Documents and Settings\All Users\Application Data\iolo
2008-12-31 15:59:51 ----D---- C:\Documents and Settings\All Users\Application Data\TomTom
2008-12-31 15:58:13 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\TomTom
2008-12-31 15:57:00 ----D---- C:\Program Files\TomTom HOME 2
2008-12-29 11:11:09 ----D---- C:\Program Files\Network Stumbler
2008-12-28 17:50:01 ----D---- C:\Program Files\TomTom DesktopSuite
2008-12-25 19:02:57 ----A---- C:\LISTING.TXT
2008-12-23 20:44:09 ----D---- C:\Program Files\Bonjour
2008-12-18 20:25:39 ----A---- C:\Nouveau.txt
2008-12-15 14:16:20 ----D---- C:\Program Files\EasyPHP
2008-12-15 14:10:00 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\PSpad
2008-12-15 14:09:51 ----D---- C:\Program Files\PSPad editor
2008-12-13 18:07:38 ----D---- C:\Program Files\PostgreSQL
2008-12-13 17:54:21 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\postgresql
2008-12-13 17:30:21 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\udig
2008-12-13 17:29:08 ----D---- C:\Program Files\uDig
2008-12-12 11:18:16 ----A---- C:\WINDOWS\system32\dns-sd.exe
2008-12-12 11:11:46 ----A---- C:\WINDOWS\system32\dnssd.dll

======List of files/folders modified in the last 1 months======

2009-01-09 02:26:40 ----D---- C:\Program Files
2009-01-09 02:14:18 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-01-09 02:11:24 ----D---- C:\Program Files\Mozilla Firefox
2009-01-09 02:04:58 ----D---- C:\WINDOWS\system32\CatRoot2
2009-01-09 02:02:47 ----D---- C:\WINDOWS\Temp
2009-01-09 02:02:15 ----D---- C:\WINDOWS
2009-01-09 01:43:27 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\U3
2009-01-09 01:42:14 ----D---- C:\WINDOWS\Prefetch
2009-01-09 00:51:28 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2009-01-09 00:43:46 ----HD---- C:\WINDOWS\inf
2009-01-08 23:48:05 ----D---- C:\WINDOWS\system32
2009-01-08 23:45:18 ----A---- C:\Documents and Settings\Jean Trawalter\Application Data\QuickZip45.ini
2009-01-08 23:09:48 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-08 23:07:27 ----D---- C:\WINDOWS\system32\drivers
2009-01-08 22:44:26 ----D---- C:\WINDOWS\system32\oodag
2009-01-08 21:59:34 ----RSD---- C:\WINDOWS\Fonts
2009-01-08 20:28:47 ----SHD---- C:\WINDOWS\Installer
2009-01-08 17:33:24 ----SHD---- C:\RECYCLER
2009-01-08 17:33:24 ----D---- C:\WINDOWS\Debug
2009-01-08 17:30:16 ----D---- C:\Documents and Settings
2009-01-08 16:47:24 ----D---- C:\Program Files\Mozilla Thunderbird
2009-01-07 11:41:46 ----D---- C:\Documents and Settings\Jean Trawalter\Application Data\OpenOffice.org2
2009-01-06 13:16:29 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-01-06 13:16:25 ----D---- C:\Program Files\Java
2008-12-26 23:57:44 ----D---- C:\Program Files\The GodFather
2008-12-26 09:40:01 ----A---- C:\WINDOWS\NeroDigital.ini
2008-12-18 17:21:10 ----RSHD---- C:\WINDOWS\system32\dllcache
2008-12-18 17:21:06 ----D---- C:\WINDOWS\ie7updates
2008-12-18 17:20:07 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-18 13:44:15 ----D---- C:\WINDOWS\Help
2008-12-13 07:37:56 ----A---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Pilote de processeur AMD Athlon64; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2004-11-23 38912]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-11-25 75072]
R1 FileDisk;FileDisk; C:\WINDOWS\system32\drivers\FileDisk.sys [2008-04-17 9341]
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\drivers\PQNTDrv.sys [2002-09-16 4228]
R1 sdcplh;sdcplh; C:\WINDOWS\System32\drivers\sdcplh.sys [2005-12-06 55168]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2008-03-20 18944]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 vcdrom;Virtual CD-ROM Device Driver; \??\C:\WINDOWS\system32\VCdRom.sys []
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2002-07-17 16877]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys []
R2 irda;Protocole IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.9; C:\WINDOWS\system32\DRIVERS\mdc8021x.sys [2006-07-07 15781]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-16 13059]
R2 Prvflder;Prvflder; C:\WINDOWS\system32\DRIVERS\prvflder.sys [2006-04-21 70912]
R2 PStrip;PStrip; C:\WINDOWS\system32\drivers\pstrip.sys [2007-07-15 27992]
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2006-03-14 90176]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-04-18 2317504]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ASNDIS5;ASNDIS5 Protocol Driver; \??\C:\WINDOWS\ATK0100\ASNDIS5.SYS []
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 BCM43XX;Pilote pour carte rÈseau ASUS 802.11; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
R3 CmBatt;Pilote d'adaptateur secteur Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2004-05-12 1037056]
R3 HSFHWSIS;HSFHWSIS; C:\WINDOWS\system32\DRIVERS\HSFHWSIS.sys [2004-06-17 193280]
R3 irsir;Pilote sÈrie infrarouge Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2007-01-23 62992]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-01-23 34576]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-01-23 33296]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2007-01-23 78864]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2007-01-23 28176]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2005-02-17 5632]
R3 NIC1394;Pilote rÈseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-08 14604]
R3 Rasirda;Miniport rÈseau Ètendu (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-08-09 70144]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2008-03-20 323072]
R3 usbehci;Pilote miniport de contrÙleur d'hÙte amÈliorÈ Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Pilote miniport de contrÙleur hÙte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2004-05-12 685312]
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 ad6811d1-cfc0-4925-9cd6-497872307997;ad6811d1-cfc0-4925-9cd6-497872307997; \??\E:\Player\cds300.dll []
S3 Asushwio;Asushwio; \??\C:\WINDOWS\system32\drivers\Asushwio.sys []
S3 bDMusicb;bDMusicb; \??\C:\DOCUME~1\JEANTR~1\LOCALS~1\Temp\bDMusicb.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-12-14 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-12-14 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-12-14 21744]
S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-01-23 20496]
S3 MXOPSWD;Maxtor OneTouch Security Driver; C:\WINDOWS\system32\DRIVERS\mxopswd.sys [2007-05-03 22152]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\NSNDIS5.SYS []
S3 RT73;ASUS USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-09-07 347776]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys []
S3 usbccgp;Pilote parent gÈnÈrique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2008-12-17 419448]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032]
R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 168432]
R2 ioloFileInfoList;iolo FileInfoList Service; C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2008-05-13 566120]
R2 ioloSystemService;iolo System Service; C:\Program Files\iolo\common\lib\ioloServiceManager.exe [2008-05-13 566120]
R2 Irmon;Moniteur infrarouge; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-06 152984]
R2 Maxtor Sync Service;Maxtor Service; C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 156976]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-06-28 1049856]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]
R2 prfldsvc;Private Folder Service; C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe [2006-04-21 69632]
R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2005-04-20 118784]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;Service de líiPod; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-11-23 69632]
S3 aspnet_state;Service d'Ètat ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe [2008-12-04 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FolderSize;Folder Size; C:\Program Files\FolderSize\FolderSizeSvc.exe [2007-11-14 131072]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 SandraDataSrv;SiSoftware Database Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe [2007-12-12 213176]
S3 SandraTheSrv;SiSoftware Sandra Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe [2007-12-12 1253568]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-05-30 572416]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Service Partage rÈseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.05 2009-01-09 02:27:06

======Uninstall list======

-->"C:\Program Files\Creative Installation Information\CD_RIPPER_UNICODE_2\Setup.exe" /remove /l0x040c
-->"C:\Program Files\Creative Installation Information\CREATIVE_SYNC_MANAGER_U\Setup.exe" /remove /l0x040c
-->"C:\Program Files\Creative Installation Information\CREATIVE_VIDEO_CONVERTER\Setup.exe" /remove /l0x040c
-->"C:\Program Files\Creative Installation Information\ZEN_MTP_MEDIA_EXPLORER\Setup.exe" /remove /l0x040c
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E06E4F4E-72D6-4497-BFFD-BCB43077C2F4}\setup.exe" -l0x40c -uninst
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 3D 7.1.0-->msiexec /I {AC76BA86-1033-F400-7760-0000003D0002}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Color Common Settings-->C:\Program Files\Fichiers communs\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe ExtendScript Toolkit 2-->C:\Program Files\Fichiers communs\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Advanced Administrative Tools-->C:\PROGRA~1\ADVANC~1\UNWISE.EXE C:\PROGRA~1\ADVANC~1\INSTALL.LOG
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ASIO4ALL v2-->C:\Program Files\ASIO4ALL v2\uninstall.exe
a-squared Free 4.0-->"C:\Program Files\a-squared Free\unins000.exe"
Asus ChkMail-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Asus\Asus ChkMail\Uninst.isu"
ASUS WLAN Card Utilities/Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8F722FA9-B994-4C9B-B292-FD32D6206EDF}\SETUP.EXE" -l0x40c
Asus_A6_ScreenSaver-->C:\WINDOWS\Asus_A6_ScreenSaver.scr /u
ASUSDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
ATK0100 ACPI UTILITY-->C:\WINDOWS\ATK0100\XPunin.exe
AutoCAD 2009 - FranÁais-->C:\Program Files\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-040C-0002-0060B0CE6BBA} /M ACAD
Autodesk DWF Viewer-->C:\PROGRA~1\Autodesk\AUTODE~2\Setup.exe /remove
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Briberry 1.2-->"C:\Program Files\Astase\Briberry\unins000.exe"
burnatonce-->"C:\Program Files\burnatonce\unins000.exe"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Creative System Information-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c /remove
Creative ZEN-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1B2DBF55-05D4-4072-87D8-689141E262BD}\SETUP.EXE" -l0x40c /remove
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DivXG400-->"C:\WINDOWS\IPUI_DivXG400.exe" /U /D
DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
EasyPHP 2.0b1-->"C:\Program Files\EasyPHP\unins000.exe"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Exchanger XML Lite 3.2-->"C:\Program Files\Exchanger XML Lite 3.2\Uninstall_Exchanger XML Lite 3.2\Uninstall Exchanger XML Lite 3.2.exe"
FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe"
Folder Size for Windows-->MsiExec.exe /I{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}
fxpansion!DR005-->C:\UNWISE.EXE C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\Synths\FXPANS~1\INSTALL.LOG
Google Earth-->MsiExec.exe /I{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}
GPL Ghostscript 8.61-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\gs8.61\uninstal.txt"
GPL Ghostscript Fonts-->C:\Program Files\gs\uninstgs.exe "C:\Program Files\gs\fonts\uninstal.txt"
Hotfix for Microsoft .NET Framework 3.0 (KB932471)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Image Zone Express-->MsiExec.exe /X{8F7A4D82-B168-4F89-99C2-B9873EC877AF}
Instafinder-->"C:\Program Files\Instafinder\uninstall.exe"
iolo technologies' Search and Recover-->"C:\Program Files\iolo\Search and Recover\unins000.exe"
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) SE Development Kit 6 Update 6-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160060}
JCreator LE 3.50-->"C:\Program Files\JCreatorV3LE\unins000.exe"
Kaspersky Online Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
Kaspersky On-line Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
KhalSetup-->MsiExec.exe /I{C89C8D86-4423-4A58-AA40-DD259ACE07C1}
K-Lite Codec Pack 2.72 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media†11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Logitech SetPoint-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x40c -removeonly
Maxtor Manager-->"C:\Program Files\InstallShield Installation Information\{ED01D958-AEDC-40C8-93FD-0C08E8AA9530}\setup.exe" -runfromtemp -l0x040c -removeonly
Maxtor Manager-->MsiExec.exe /I{ED01D958-AEDC-40C8-93FD-0C08E8AA9530}
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Private Folder 1.0-->MsiExec.exe /I{644EA08F-87D2-48C0-AE94-B327D1C85A97}
Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mise ‡ jour de sÈcuritÈ pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Lecteur Windows Media 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise ‡ jour de sÈcuritÈ pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise ‡ jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise ‡ jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise ‡ jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
MixMeister BPM Analyzer 1.0-->"C:\Program Files\MixMeister BPM Analyzer\unins000.exe"
MobileMe Control Panel-->MsiExec.exe /I{924EB80F-C2BB-4B9F-8412-88BBA937393F}
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du franÁais de Microsoft .NET Framework†3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
MozBackup 1.4.4-->"C:\Program Files\MozBackup\unins000.exe"
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.19)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
mst MD5-->MsiExec.exe /I{6FDF6EF5-935C-4179-A21A-EDD48D32AF63}
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
NB Probe-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}\setup.exe" -l0x9
Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Network Stumbler 0.4.0 (remove only)-->"C:\Program Files\Network Stumbler\uninst.exe"
O&O Defrag Professional Edition-->MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
OpenOffice.org 2.1-->MsiExec.exe /I{E18551C0-0EE7-48D4-B970-9C23C17CA63A}
Outil de mise ‡ jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Package de base Microsoft de service de chiffrement pour cartes ‡ puce-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
PC Connectivity Solution-->MsiExec.exe /I{9C7C8898-DC29-4E8B-9E77-55A77C3250F6}
PDFCreator-->"C:\Program Files\PDFCreator\unins000.exe"
PHPEdit-->C:\PROGRA~1\PHPEdit\UNWISE.EXE C:\PROGRA~1\PHPEdit\INSTALL.LOG
Power4 Gear-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4462AD13-F2AA-4CBD-9F95-293C38EED870}\setup.exe" -l0x9
PowerQuest PartitionMagic 8.0-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}
PowerStrip 3 (remove only)-->C:\Program Files\PowerStrip\uninstal.exe
PSPad editor-->"C:\Program Files\PSPad editor\Uninst\unins000.exe"
Quick Zip 4.60.019-->"C:\Program Files\QuickZip4\unins000.exe"
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
Rainlendar2 (remove only)-->"C:\Program Files\Rainlendar2\uninst.exe"
Real Alternative 1.51-->"C:\Program Files\Real Alternative\unins000.exe"
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
RecordPad Sound Recorder-->C:\Program Files\NCH Swift Sound\RecordPad\uninst.exe
RGBÈditor-->C:\Program Files\rgbeditor\Uninstal.exe
Rippack v3 beta 16.1-->"C:\Program Files\Rippackv3\Uninstall.exe" "C:\Program Files\Rippackv3\install.log"
Sentinel Protection Installer 7.2.2-->MsiExec.exe /I{6DC0632A-A838-4B34-AC19-0FA18E1C533C}
SiS VGA Utilities-->Rundll32 SiSInst.dll,Uninstall VGA,R,oem3.inf
SiSAGP driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC226AC9-0314-496C-BE6A-B6A132628466}\SETUP.EXE" -l0x40c
SiSoftware Sandra Lite XII.SP1-->"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\unins000.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SubSync-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\SubSync\ST6UNST.LOG"
Sun(TM) Download Manager 2.0-->C:\Program Files\SDM20\Uninstal.exe
Synactis PIC-2-PDF version 1.0-->C:\Program Files\Fichiers communs\Synactis\Uninstall.exe Synactis_PIC-2-PDF
THE Rename 2.1.6-->"C:\Program Files\THE Rename\unins000.exe"
TimeCore-->"C:\Program Files\TimeCore\Solo\unins000.exe"
TomTom HOME 2.5.2.60-->C:\Program Files\TomTom HOME 2\Uninstall TomTom HOME.exe
VC_MergeModuleToMSI-->MsiExec.exe /I{900A92BA-19EF-4A34-86CF-7B6C85BDD971}
Version 0.75c-->"C:\Program Files\DVD slideshow GUI\unins000.exe"
VobSub v2.22 (Remove Only)-->"C:\Program Files\VobSub\uninstall.exe"
WavePad Uninstall-->C:\Program Files\NCH Swift Sound\WavePad\uninst.exe
Winamp Toolbar for Firefox-->"C:\Documents and Settings\Jean Trawalter\Application Data\Mozilla\Firefox\Profiles\pywbb2p7.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\uninstall.exe"
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows XP Service Pack†3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinFlash-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE10AB76-4756-4913-BE25-55D1C1051F9A}\Setup.exe" -l0x9
WMHelp XMLPad-->MsiExec.exe /I{682C8779-5941-4E98-B039-87A192491B5A}
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Your Freedom-->"C:\Program Files\Your Freedom\uninstall.exe"
ZENcast Organizer-->"C:\Program Files\Creative Installation Information\ZENCAST_ORGANIZER\Setup.exe" /remove /l0x040c

======Hosts File======

127.0.0.1 local-www.jeanvie.com

======Security center information======

AV: Avira AntiVir PersonalEdition (disabled)

System event log

Computer Name: VANETTE
Event Code: 7023
Message: Le service Gestion d'applications s'est arrÍtÈ avec l'erreur†:
Le module spÈcifiÈ est introuvable.


Record Number: 137119
Source Name: Service Control Manager
Time Written: 20090106131226.000000+060
Event Type: erreur
User:

Computer Name: VANETTE
Event Code: 7036
Message: Le service Gestion d'applications est entrÈ dans l'Ètat : arrÍtÈ.

Record Number: 137118
Source Name: Service Control Manager
Time Written: 20090106131226.000000+060
Event Type: Informations
User:

Computer Name: VANETTE
Event Code: 7035
Message: Un contrÙle DÈmarrer a correctement ÈtÈ envoyÈ au service Gestion d'applications.

Record Number: 137117
Source Name: Service Control Manager
Time Written: 20090106131226.000000+060
Event Type: Informations
User: VANETTE\Jean Trawalter

Computer Name: VANETTE
Event Code: 7023
Message: Le service Gestion d'applications s'est arrÍtÈ avec l'erreur†:
Le module spÈcifiÈ est introuvable.


Record Number: 137116
Source Name: Service Control Manager
Time Written: 20090106131225.000000+060
Event Type: erreur
User:

Computer Name: VANETTE
Event Code: 7036
Message: Le service Gestion d'applications est entrÈ dans l'Ètat : arrÍtÈ.

Record Number: 137115
Source Name: Service Control Manager
Time Written: 20090106131225.000000+060
Event Type: Informations
User:

Application event log

Computer Name: VANETTE
Event Code: 1
Message:
Record Number: 3112
Source Name: Avg7UpdSvc
Time Written: 20070920183153.000000+120
Event Type: Informations
User:

Computer Name: VANETTE
Event Code: 0
Message:
Record Number: 3111
Source Name: iPod Service
Time Written: 20070920114500.000000+120
Event Type: Informations
User:

Computer Name: VANETTE
Event Code: 1800
Message: Le service Centre de sÈcuritÈ Windows a dÈmarrÈ.

Record Number: 3110
Source Name: SecurityCenter
Time Written: 20070920114309.000000+120
Event Type: Informations
User:

Computer Name: VANETTE
Event Code: 1
Message:
Record Number: 3109
Source Name: AVGEMS
Time Written: 20070920114302.000000+120
Event Type: Informations
User:

Computer Name: VANETTE
Event Code: 1
Message:
Record Number: 3108
Source Name: Avg7UpdSvc
Time Written: 20070920114258.000000+120
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"INPUTRC"=c:\ruby\bin\inputrc.euro
"NUMBER_OF_PROCESSORS"=1
"OS"=Windows_NT
"Path"=C:\Perl\site\bin;C:\Perl\bin;C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\PROGRA~1\FICHIE~1\AUTODE~1\GIS\IMPORT~1\2.0;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
"PROCESSOR_LEVEL"=15
"PROCESSOR_REVISION"=2c02
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"RUBYOPT"=-rubygems
"SAN_DIR"=C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"windir"=%SystemRoot%
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------

-------------- UsbFix V2.413.9 ---------------

* User : Jean Trawalter - VANETTE
* Outils mis a jours le 05/01/2009 par Chiquitine29 et Chimay8
* Recherche effectuÈe ‡ 2:59:51 le 09/01/2009
* Windows Xp - Internet Explorer 7.0.5730.11


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\wudfhost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

F: - Lecteur de CD-ROM

G: - Lecteur amovible


+- Contenu de l'autorun : F:\autorun.inf

[AutoRun]
open=LaunchU3.exe
icon=LaunchU3.exe,0

[Definitions]
Launchpad=LaunchPad.exe

[CopyFiles]
FileNumber=1
File1=LaunchPad.zip


--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe


+- Listing des fichiers prÈsents :

[09/12/2008 18:34][--a------] C:\AUTOEXEC.BAT
[05/08/2004 13:00][-rahs----] C:\NTDETECT.COM
[24/11/2003 14:44][--a------] C:\Crack.exe
[24/11/2003 14:44][--a------] C:\m.exe
[24/11/2003 14:44][--a------] C:\UNWISE.EXE
[04/04/2007 11:36][--a------] C:\ASWL2K.ini
[04/04/2007 11:36][--a------] C:\boot.ini
[04/04/2007 11:36][--a------] C:\CTMeasureTiming.ini
[25/12/2008 19:14][--a------] C:\LISTING.TXT
[25/12/2008 19:14][--a------] C:\lopR.txt
[25/12/2008 19:14][--a------] C:\Nouveau.txt
[25/12/2008 19:14][--a------] C:\rapport_clean.txt
[25/12/2008 19:14][--a------] C:\resultat_clean.txt
[25/12/2008 19:14][--a------] C:\UsbFix.txt
[07/07/2006 00:13][--a------] C:\CONFIG.SYS
[07/07/2006 00:13][--a------] C:\hiberfil.sys
[07/07/2006 00:13][--a------] C:\IO.SYS
[07/07/2006 00:13][--a------] C:\MSDOS.SYS
[07/07/2006 00:13][--a------] C:\pagefile.sys

--------------- [ Lecteur F ] ----------------

F: - Lecteur de CD-ROM


+- Listing des fichiers prÈsents :

[30/08/2005 09:33][-r-------] F:\LaunchU3.exe
[30/08/2005 09:33][-r-------] F:\autorun.inf

--------------- [ Lecteur G ] ----------------

G: - Lecteur amovible


+- Listing des fichiers prÈsents :

[01/02/1980 23:05][--a------] G:\a2FreeSetup.exe
[01/02/1980 23:05][--a------] G:\mbam-setup.exe
[01/02/1980 23:05][--a------] G:\spybotsd-1.6.1.41.exe
[01/02/1980 23:05][--a------] G:\mbam-rules.exe
[01/02/1980 23:05][--a------] G:\LopSD.exe
[01/02/1980 23:05][--a------] G:\SDFix.exe
[01/02/1980 23:05][--a------] G:\ComboFix.exe
[01/02/1980 23:05][--a------] G:\LaunchU3.exe

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.google.com"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
Rainlendar2=C:\Program Files\Rainlendar2\Rainlendar2.exe
CTSyncU.exe="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
TomTomHOME.exe="C:\Program Files\TomTom HOME 2\HOMERunner.exe"
SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
HControl=C:\WINDOWS\ATK0100\HControl.exe
SoundMan=SOUNDMAN.EXE
NB Probe=C:\Program Files\ASUS\NB Probe\NBProbe.exe
RemoteControl="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
Power_Gear=C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
CTCheck=C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
mxomssmenu="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
PowerStrip=c:\program files\powerstrip\pstrip.exe
SiSPower=Rundll32.exe SiSPower.dll,ModeAgent
AppleSyncNotifier=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
Kernel and Hardware Abstraction Layer=KHALMNPR.EXE
Logitech Hardware Abstraction Layer=KHALMNPR.EXE
<NO NAME>=
Acrobat Assistant 7.0="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
EasyPHP="C:\Program Files\EasyPHP\EasyPHP.exe"
SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
<NO NAME>=

--------------- [ Registre / Mountpoint2 ] ----------------

SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\Shell\AutoRun\command
SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\Shell\AutoRun\command
SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3152960e-7998-11dd-a5ae-001731c2e852}\Shell\AutoRun\command
SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5f15de6f-1911-11db-b99d-806d6172696f}\Shell\AutoRun\command
SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{85b95e90-d4ff-11dd-a601-001731c2e852}\Shell\AutoRun\command
SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b4102d99-1913-11db-b99f-001731c2e852}\Shell\AutoRun\command
SupprimÈ ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee0e5266-e950-11dc-bc92-001731c2e852}\Shell\AutoRun\command

--------------- [ Nettoyage des disques ] ----------------

SupprimÈ ! - [01/02/1980 23:00][--a------] C:\m.exe
Echec de la supression !! - [30/08/2005 09:33] F:\autorun.inf
Echec de la supression !! - [30/08/2005 09:33] F:\autorun.inf
Echec de la supression !! - [30/08/2005 09:33] F:\autorun.inf

--------------- [ ResumÈ ] ----------------

-> /!\ Le resultat doit etre [http://www.virustotal.com/fr/ interprÈtÈ] par un spÈcialiste /!\

[09/12/2008 18:34][--a------] C:\AUTOEXEC.BAT
[05/08/2004 13:00][-rahs----] C:\NTDETECT.COM
[24/11/2003 14:44][--a------] C:\Crack.exe
[24/11/2003 14:44][--a------] C:\UNWISE.EXE
[04/04/2007 11:36][--a------] C:\ASWL2K.ini
[04/04/2007 11:36][--a------] C:\boot.ini
[04/04/2007 11:36][--a------] C:\CTMeasureTiming.ini
[30/08/2005 09:33][-r-------] F:\LaunchU3.exe
[30/08/2005 09:33][-r-------] F:\autorun.inf
[01/02/1980 23:05][--a------] G:\a2FreeSetup.exe
[01/02/1980 23:05][--a------] G:\mbam-setup.exe
[01/02/1980 23:05][--a------] G:\spybotsd-1.6.1.41.exe
[01/02/1980 23:05][--a------] G:\mbam-rules.exe
[01/02/1980 23:05][--a------] G:\LopSD.exe
[01/02/1980 23:05][--a------] G:\SDFix.exe
[01/02/1980 23:05][--a------] G:\ComboFix.exe
[01/02/1980 23:05][--a------] G:\LaunchU3.exe

--------------- [ Vaccination ] ----------------

C:\autorun.inf -> Dossier autorun.inf crÈe par UsbFix !
Echec de la supression !! - [30/08/2005 09:33] F:\autorun.inf
Echec de la supression !! - [30/08/2005 09:33] F:\autorun.inf
G:\autorun.inf -> Dossier autorun.inf crÈe par UsbFix !

--------------- ! Fin du rapport ! ----------------

********************************************************************************
* *
* FixIEDef Log *
* Version 1.7.20.7261 *
* *
********************************************************************************

Created at 03:29:12 on Friday, January 09, 2009

Time Zone :

Logged On User : Jean Trawalter

Operating System : Microsoft Windows XP Édition familiale Service Pack 3
OS Version : 5.1.2600
System Langauge : French (Standard)
Keyboard Layout : French (Standard)
Processor : X86 Mobile AMD Sempron(tm) Processor 3300+

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

System Drive Type : Fixed
System Drive Status : READY
System Drive Label :
System Drive Size : 74.41 GB
System Drive Free : 24.17 GB

Total Physical Memory: 895 MB
Free Physical Memory : 428 MB
Total Page File : 895 MB
Free Page File : 1655 MB
Total Virtual Memory : 2048 MB
Free Virtual Memory : 1962 MB

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! userinit.exe is Clean !!!

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

C:\WINDOWS\system32\LuResult.txt
C:\WINDOWS\system32\OODBS.lor

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done

ShadowPuterDude

Safe Surfing!!!

------- Logfile of AD-Remover 1.0.8.7 by C_XX | ONLY XP/VISTA -------

# START at: 3:57:24 | Ven 09/01/2009 | Microsoft® Windows XP™ SP3 (v5.1.2600)
# BOOT MODE: Normal
# OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
# PC: VANETTE | USER: Jean Trawalter ( Current user is an administrator)
# DRIVE(S):
- C:\ (File System: NTFS)
# Internet Explorer v7.0.5730.11

# RUNNING PROCESSES: 60

+-----------------------| Boonty/Boonty Games Elements found :

.
.

+-----------------------| Eorezo Elements found :

.
.

+-----------------------| Everest Poker Elements found :

.
.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

.
HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
.

+-----------------------| It's TV Elements found :

.

+-----------------------| Sweetim Elements found :

.
.

+-----------------------| ADDED SCAN :


+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

..\pywbb2p7.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.5 ~~~~

* Browser Search Default Engine: "Google"
* Browser Search Selected Engine: "Google"
* Browser Search Default Url: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="

.

+---------------------------------------------------------------------------+


+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

[~1676 bytes] - "C:\AD-report-Scan-09.01.2009.log"

# END at: 3:59:37 | 09/01/2009 - Time elapsed: 2 minutes, 12 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 41 lines ]
+---------------------------------------------------------------------------+

------- Logfile of AD-Remover 1.0.8.7 by C_XX | ONLY XP/VISTA -------

*** Limited to ***

Funwebproduct/MyWay/MyWebsearch

******************

# START at: 4:15:15 | Ven 09/01/2009 | Microsoft® Windows XP™ SP3 (v5.1.2600)
# BOOT MODE: Normal
# OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
# PC: VANETTE | USER: Jean Trawalter ( Current user is an administrator)
# DRIVE(S):
- C:\ (File System: NTFS)
- F:\ (File System: CDFS)
- G:\ (File System: FAT)
# Internet Explorer v7.0.5730.11

# RUNNING PROCESSES: 60

(!) ---- IE start pages reset

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted :

.
HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
.

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+-----------------------| ADDED SCAN :


+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

..\pywbb2p7.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.5 ~~~~

* Browser Search Default Engine: "Google"
* Browser Search Selected Engine: "Google"
* Browser Search Default Url: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="

.

+---------------------------------------------------------------------------+


+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

[~1601 bytes] - "C:\AD-report-Clean-09.01.2009.log"
[~2019 bytes] - "C:\AD-report-Scan-09.01.2009.log"

# END at: 4:18:15 | 09/01/2009 - Time elapsed: 2 minutes, 59 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 35 lines ]
+---------------------------------------------------------------------------+

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:59:44, on 09/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ASUS\NB Probe\NBProbe.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\program files\powerstrip\pstrip.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\EasyPHP\EasyPHP.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Fichiers communs\Logitech\khalshared\KHALMNPR.EXE
C:\PROGRA~1\EasyPHP\Apache\bin\apache.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\EasyPHP\Apache\bin\apache.exe
C:\PROGRA~1\EasyPHP\MySql\bin\mysqld.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.asus.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=localhost:8080;gopher=localhost:8080;http=localhost:8080;https=localhost:8080;socks=localhost:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NB Probe] C:\Program Files\ASUS\NB Probe\NBProbe.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [EasyPHP] "C:\Program Files\EasyPHP\EasyPHP.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} -
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Private Folder Service (prfldsvc) - Unknown owner - C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 12826 bytes

"Jean Trawalter" - 2009-01-09 10:06:26 Service Pack 3
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\Jean Trawalter\Bureau\"


((((((((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 ))))))))))))))))))))))))))))))))))


2009-01-09 03:56 <REP> d-------- C:\Program Files\Ad-remover
2009-01-09 03:28 <REP> d-------- C:\WINDOWS\ERUNT
2009-01-09 03:28 <REP> d-------- C:\!FixIEDef
2009-01-09 03:06 <REP> d--h----- C:\autorun.inf
2009-01-09 02:48 <REP> d-------- C:\Program Files\UsbFix
2009-01-09 02:26 <REP> d-------- C:\rsit
2009-01-09 02:26 <REP> d-------- C:\Program Files\trend micro
2009-01-09 01:04 <REP> d-------- C:\Lop SD
2009-01-09 00:42 <REP> d-------- C:\Program Files\Windows Live Safety Center
2009-01-09 00:18 <REP> d-------- C:\WINDOWS\BDOSCAN8
2009-01-08 23:25 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2009-01-08 22:38 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-01-08 22:20 <REP> d-------- C:\JULIA_V_ALLEMANDE
2009-01-08 19:07 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\Malwarebytes
2009-01-08 17:30 1,048,576 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Mes documents
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Favoris
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\WINDOWS
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2009-01-08 16:24 <REP> d-------- C:\Program Files\a-squared Free
2009-01-04 20:55 9,341 --a------ C:\WINDOWS\system32\drivers\filedisk.sys
2009-01-04 20:55 74,703 --a------ C:\WINDOWS\system32\mfc45.dll
2009-01-04 20:55 <REP> d-------- C:\Program Files\iolo
2009-01-04 20:55 <REP> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\iolo
2009-01-04 20:53 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\iolo
2009-01-04 20:53 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo
2008-12-31 15:59 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2008-12-31 15:58 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\TomTom
2008-12-31 15:57 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-12-29 11:11 <REP> d-------- C:\Program Files\Network Stumbler
2008-12-28 17:50 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-12-23 20:44 <REP> d-------- C:\Program Files\Bonjour
2008-12-15 14:16 <REP> d-------- C:\Program Files\EasyPHP
2008-12-15 14:10 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\PSpad
2008-12-15 14:09 <REP> d-------- C:\Program Files\PSPad editor
2008-12-13 18:07 <REP> d-------- C:\Program Files\PostgreSQL
2008-12-13 17:54 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\postgresql
2008-12-13 17:30 <REP> d-------- C:\Documents and Settings\JEANTR~1\uDig
2008-12-13 17:30 <REP> d-------- C:\DOCUME~1\JEANTR~1\uDig
2008-12-13 17:30 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\udig
2008-12-13 17:29 <REP> d-------- C:\Program Files\uDig
2008-12-13 15:47 524,288 --ah----- C:\DOCUME~1\postgres\NTUSER.DAT
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Mes documents
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Menu D‚marrer
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Favoris
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\Voisinage r‚seau
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\Voisinage d'impression
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\ModŠles
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\WINDOWS
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\Bureau
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\APPLIC~1\Symantec
2008-12-12 11:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe
2008-12-12 11:11 61,440 --a------ C:\WINDOWS\system32\dnssd.dll
2008-12-09 18:15 <REP> d-------- C:\Program Files\CCleaner


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-01-09 08:21:40 -------- d-----w C:\Program Files\Mozilla Thunderbird
2009-01-09 01:47:02 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\U3
2009-01-07 10:41:46 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\OpenOffice.org2
2009-01-06 12:16:29 410,984 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-12-26 22:57:44 -------- d-----w C:\Program Files\The GodFather
2008-12-09 17:42:20 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\Autodesk
2008-12-09 17:34:53 26 ----a-w C:\AUTOEXEC.BAT
2008-12-07 16:24:05 -------- d-----w C:\Program Files\eMule
2008-12-04 20:25:23 -------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-12-04 20:23:21 -------- d-----w C:\Program Files\AutoCAD 2009
2008-12-04 17:07:20 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\AdobeUM
2008-12-03 19:08:24 -------- d-----w C:\Program Files\Autodesk
2008-12-01 22:20:59 -------- d-----w C:\Program Files\TimeCore
2008-11-23 22:58:21 -------- d-----w C:\Program Files\VobSub
2008-11-23 20:17:29 -------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-11-22 21:41:55 -------- d-----w C:\Program Files\DivX
2008-11-22 16:13:29 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\Logitech
2008-11-22 16:10:02 -------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-11-22 16:08:51 -------- d-----w C:\Program Files\Logitech
2008-11-22 16:08:50 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-22 15:36:07 -------- d-----w C:\Program Files\Avira
2008-11-22 15:30:16 -------- d-----w C:\Program Files\QuickZip4
2008-11-21 18:03:57 -------- d-----w C:\Program Files\iTunes
2008-11-21 18:03:25 -------- d-----w C:\Program Files\iPod
2008-11-21 18:03:25 -------- d-----w C:\Program Files\Fichiers communs\Apple
2008-11-21 17:59:23 -------- d-----w C:\Program Files\QuickTime
2008-11-21 17:57:15 -------- d-----w C:\Program Files\Apple Software Update
2008-11-21 17:42:47 -------- d-----w C:\Program Files\Free Audio Pack
2008-11-20 20:49:11 -------- d-----w C:\Program Files\SiS VGA Utilities V3.84
2008-11-20 20:49:05 -------- d-----w C:\Program Files\sisagp
2008-11-20 19:11:33 -------- d-----w C:\Program Files\PowerStrip
2008-11-20 19:08:37 -------- d-----w C:\Program Files\SiS VGA Utilities V3.65g
2008-11-20 18:49:31 85,256 ----a-w C:\WINDOWS\system32\perfc00C.dat
2008-11-20 18:49:31 511,392 ----a-w C:\WINDOWS\system32\perfh00C.dat
2008-11-20 18:34:32 -------- d-----w C:\Program Files\Asus
2008-11-20 17:34:50 -------- d-----w C:\Program Files\Messenger
2008-11-20 17:29:29 -------- d-----w C:\Program Files\Movie Maker
2008-11-20 17:22:07 -------- d-----w C:\Program Files\Windows NT
2008-11-20 17:10:25 -------- d-----w C:\Program Files\audible
2008-10-28 22:36:00 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-10-28 22:36:00 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-10-28 22:35:58 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-10-28 22:35:58 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-10-28 22:35:56 684,032 ----a-w C:\WINDOWS\system32\DivX.dll
2008-10-23 12:36:51 286,720 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-10-16 13:13:40 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 13:13:40 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 13:12:22 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 13:12:20 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 13:09:44 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 13:09:44 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 13:09:44 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 13:08:58 34,328 ----a-w C:\WINDOWS\system32\wups.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-12-17 23:22]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-06 13:16]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-20 19:50]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-06 13:16]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-06 13:16]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" []
"NB Probe"="C:\Program Files\ASUS\NB Probe\NBProbe.exe" [2005-06-09 10:50]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 19:24]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 15:55]
"CTCheck"="C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 10:08]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 13:53]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-11-19 22:26]
"SiSPower"="SiSPower.dll" [2008-03-20 18:58 C:\WINDOWS\system32\SiSPower.dll]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 14:16]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-11-04 10:30]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-11-20 13:20]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"@"="" []
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08]
"EasyPHP"="C:\Program Files\EasyPHP\EasyPHP.exe" [2006-11-19 22:16]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-01-06 13:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-01-01 14:31]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 10:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:33]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 11:12]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-12-17 23:23]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
C:\Program Files\eMule\emule.exe -AutoStart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Instafinder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent


Contents of the 'Scheduled Tasks' folder
2009-01-06 19:43:03 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 10:10:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = acaptuser32.dll??

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\JavaQuickStarterService]
"ImagePath"="\"C:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSrfdc.sys"

Completion time: 2009-01-09 10:12:11

--- E O F ---

KillAll::

Driver::
TDSSserv
TDSSrfdc

File::
c:\windows\system32\drivers\TDSSrfdc.sys

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]

"Jean Trawalter" - 2009-01-09 12:56:05 Service Pack 3 [SAFE MODE]
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\Jean Trawalter\"
Command switches used :: ""C:\Documents and Settings\Jean Trawalter\Bureau\CFScript.txt""


((((((((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 ))))))))))))))))))))))))))))))))))


2009-01-09 11:32 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-01-09 11:32 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2009-01-09 11:32 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-09 10:12 49,152 --a------ C:\WINDOWS\nircmd.exe
2009-01-09 03:56 <REP> d-------- C:\Program Files\Ad-remover
2009-01-09 03:28 <REP> d-------- C:\WINDOWS\ERUNT
2009-01-09 03:28 <REP> d-------- C:\!FixIEDef
2009-01-09 03:06 <REP> d--h----- C:\autorun.inf
2009-01-09 02:48 <REP> d-------- C:\Program Files\UsbFix
2009-01-09 02:26 <REP> d-------- C:\rsit
2009-01-09 02:26 <REP> d-------- C:\Program Files\trend micro
2009-01-09 01:04 <REP> d-------- C:\Lop SD
2009-01-09 00:42 <REP> d-------- C:\Program Files\Windows Live Safety Center
2009-01-09 00:18 <REP> d-------- C:\WINDOWS\BDOSCAN8
2009-01-08 23:25 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2009-01-08 22:38 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-01-08 22:20 <REP> d-------- C:\JULIA_V_ALLEMANDE
2009-01-08 19:07 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\Malwarebytes
2009-01-08 17:30 1,048,576 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Mes documents
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Favoris
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\WINDOWS
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2009-01-08 16:24 <REP> d-------- C:\Program Files\a-squared Free
2009-01-04 20:55 9,341 --a------ C:\WINDOWS\system32\drivers\filedisk.sys
2009-01-04 20:55 74,703 --a------ C:\WINDOWS\system32\mfc45.dll
2009-01-04 20:55 <REP> d-------- C:\Program Files\iolo
2009-01-04 20:55 <REP> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\iolo
2009-01-04 20:53 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\iolo
2009-01-04 20:53 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo
2008-12-31 15:59 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2008-12-31 15:58 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\TomTom
2008-12-31 15:57 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-12-29 11:11 <REP> d-------- C:\Program Files\Network Stumbler
2008-12-28 17:50 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-12-23 20:44 <REP> d-------- C:\Program Files\Bonjour
2008-12-15 14:16 <REP> d-------- C:\Program Files\EasyPHP
2008-12-15 14:10 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\PSpad
2008-12-15 14:09 <REP> d-------- C:\Program Files\PSPad editor
2008-12-13 18:07 <REP> d-------- C:\Program Files\PostgreSQL
2008-12-13 17:54 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\postgresql
2008-12-13 17:30 <REP> d-------- C:\Documents and Settings\JEANTR~1\uDig
2008-12-13 17:30 <REP> d-------- C:\DOCUME~1\JEANTR~1\uDig
2008-12-13 17:30 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\udig
2008-12-13 17:29 <REP> d-------- C:\Program Files\uDig
2008-12-13 15:47 524,288 --ah----- C:\DOCUME~1\postgres\NTUSER.DAT
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Mes documents
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Menu D‚marrer
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Favoris
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\Voisinage r‚seau
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\Voisinage d'impression
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\ModŠles
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\WINDOWS
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\Bureau
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\APPLIC~1\Symantec
2008-12-12 11:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe
2008-12-12 11:11 61,440 --a------ C:\WINDOWS\system32\dnssd.dll
2008-12-09 18:15 <REP> d-------- C:\Program Files\CCleaner


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-01-09 09:16:09 -------- d-----w C:\Program Files\Mozilla Thunderbird
2009-01-09 01:47:02 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\U3
2009-01-07 10:41:46 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\OpenOffice.org2
2009-01-06 12:16:29 410,984 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-12-26 22:57:44 -------- d-----w C:\Program Files\The GodFather
2008-12-09 17:42:20 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\Autodesk
2008-12-09 17:34:53 26 ----a-w C:\AUTOEXEC.BAT
2008-12-07 16:24:05 -------- d-----w C:\Program Files\eMule
2008-12-04 20:25:23 -------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-12-04 20:23:21 -------- d-----w C:\Program Files\AutoCAD 2009
2008-12-04 17:07:20 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\AdobeUM
2008-12-03 19:08:24 -------- d-----w C:\Program Files\Autodesk
2008-12-01 22:20:59 -------- d-----w C:\Program Files\TimeCore
2008-11-23 22:58:21 -------- d-----w C:\Program Files\VobSub
2008-11-23 20:17:29 -------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-11-22 21:41:55 -------- d-----w C:\Program Files\DivX
2008-11-22 16:13:29 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\Logitech
2008-11-22 16:10:02 -------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-11-22 16:08:51 -------- d-----w C:\Program Files\Logitech
2008-11-22 16:08:50 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-22 15:36:07 -------- d-----w C:\Program Files\Avira
2008-11-22 15:30:16 -------- d-----w C:\Program Files\QuickZip4
2008-11-21 18:03:57 -------- d-----w C:\Program Files\iTunes
2008-11-21 18:03:25 -------- d-----w C:\Program Files\iPod
2008-11-21 18:03:25 -------- d-----w C:\Program Files\Fichiers communs\Apple
2008-11-21 17:59:23 -------- d-----w C:\Program Files\QuickTime
2008-11-21 17:57:15 -------- d-----w C:\Program Files\Apple Software Update
2008-11-21 17:42:47 -------- d-----w C:\Program Files\Free Audio Pack
2008-11-20 20:49:11 -------- d-----w C:\Program Files\SiS VGA Utilities V3.84
2008-11-20 20:49:05 -------- d-----w C:\Program Files\sisagp
2008-11-20 19:11:33 -------- d-----w C:\Program Files\PowerStrip
2008-11-20 19:08:37 -------- d-----w C:\Program Files\SiS VGA Utilities V3.65g
2008-11-20 18:49:31 85,256 ----a-w C:\WINDOWS\system32\perfc00C.dat
2008-11-20 18:49:31 511,392 ----a-w C:\WINDOWS\system32\perfh00C.dat
2008-11-20 18:34:32 -------- d-----w C:\Program Files\Asus
2008-11-20 17:34:50 -------- d-----w C:\Program Files\Messenger
2008-11-20 17:29:29 -------- d-----w C:\Program Files\Movie Maker
2008-11-20 17:22:07 -------- d-----w C:\Program Files\Windows NT
2008-11-20 17:10:25 -------- d-----w C:\Program Files\audible
2008-10-28 22:36:00 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-10-28 22:36:00 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-10-28 22:35:58 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-10-28 22:35:58 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-10-28 22:35:56 684,032 ----a-w C:\WINDOWS\system32\DivX.dll
2008-10-23 12:36:51 286,720 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-10-16 13:13:40 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 13:13:40 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 13:12:22 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 13:12:20 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 13:09:44 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 13:09:44 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 13:09:44 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 13:08:58 34,328 ----a-w C:\WINDOWS\system32\wups.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-12-17 23:22]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-06 13:16]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-20 19:50]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-06 13:16]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-06 13:16]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" []
"NB Probe"="C:\Program Files\ASUS\NB Probe\NBProbe.exe" [2005-06-09 10:50]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 19:24]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 15:55]
"CTCheck"="C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 10:08]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 13:53]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-11-19 22:26]
"SiSPower"="SiSPower.dll" [2008-03-20 18:58 C:\WINDOWS\system32\SiSPower.dll]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 14:16]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-11-04 10:30]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-11-20 13:20]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"@"="" []
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08]
"EasyPHP"="C:\Program Files\EasyPHP\EasyPHP.exe" [2006-11-19 22:16]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-01-06 13:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-01-01 14:31]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 10:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:33]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 11:12]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-12-17 23:23]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
C:\Program Files\eMule\emule.exe -AutoStart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Instafinder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe


Contents of the 'Scheduled Tasks' folder
2009-01-06 19:43:03 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 12:59:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = acaptuser32.dll??

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\JavaQuickStarterService]
"ImagePath"="\"C:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSrfdc.sys"

Completion time: 2009-01-09 13:01:26
C:\ComboFix2.txt ... 2009-01-09 10:12

--- E O F ---

"Jean Trawalter" - 2009-01-09 13:19:30 Service Pack 3
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\Jean Trawalter\"
Command switches used :: ""C:\Documents and Settings\Jean Trawalter\Bureau\CFScript.txt""


((((((((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 ))))))))))))))))))))))))))))))))))


2009-01-09 11:32 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-01-09 11:32 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2009-01-09 11:32 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-09 10:12 49,152 --a------ C:\WINDOWS\nircmd.exe
2009-01-09 03:56 <REP> d-------- C:\Program Files\Ad-remover
2009-01-09 03:28 <REP> d-------- C:\WINDOWS\ERUNT
2009-01-09 03:28 <REP> d-------- C:\!FixIEDef
2009-01-09 03:06 <REP> d--h----- C:\autorun.inf
2009-01-09 02:48 <REP> d-------- C:\Program Files\UsbFix
2009-01-09 02:26 <REP> d-------- C:\rsit
2009-01-09 02:26 <REP> d-------- C:\Program Files\trend micro
2009-01-09 01:04 <REP> d-------- C:\Lop SD
2009-01-09 00:42 <REP> d-------- C:\Program Files\Windows Live Safety Center
2009-01-09 00:18 <REP> d-------- C:\WINDOWS\BDOSCAN8
2009-01-08 23:25 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2009-01-08 22:38 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-01-08 22:20 <REP> d-------- C:\JULIA_V_ALLEMANDE
2009-01-08 19:07 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\Malwarebytes
2009-01-08 17:30 1,048,576 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Mes documents
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2009-01-08 17:30 <REP> dr------- C:\DOCUME~1\ADMINI~1\Favoris
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2009-01-08 17:30 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\WINDOWS
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2009-01-08 17:30 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2009-01-08 16:24 <REP> d-------- C:\Program Files\a-squared Free
2009-01-04 20:55 9,341 --a------ C:\WINDOWS\system32\drivers\filedisk.sys
2009-01-04 20:55 74,703 --a------ C:\WINDOWS\system32\mfc45.dll
2009-01-04 20:55 <REP> d-------- C:\Program Files\iolo
2009-01-04 20:55 <REP> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\iolo
2009-01-04 20:53 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\iolo
2009-01-04 20:53 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo
2008-12-31 15:59 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
2008-12-31 15:58 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\TomTom
2008-12-31 15:57 <REP> d-------- C:\Program Files\TomTom HOME 2
2008-12-29 11:11 <REP> d-------- C:\Program Files\Network Stumbler
2008-12-28 17:50 <REP> d-------- C:\Program Files\TomTom DesktopSuite
2008-12-23 20:44 <REP> d-------- C:\Program Files\Bonjour
2008-12-15 14:16 <REP> d-------- C:\Program Files\EasyPHP
2008-12-15 14:10 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\PSpad
2008-12-15 14:09 <REP> d-------- C:\Program Files\PSPad editor
2008-12-13 18:07 <REP> d-------- C:\Program Files\PostgreSQL
2008-12-13 17:54 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\postgresql
2008-12-13 17:30 <REP> d-------- C:\Documents and Settings\JEANTR~1\uDig
2008-12-13 17:30 <REP> d-------- C:\DOCUME~1\JEANTR~1\uDig
2008-12-13 17:30 <REP> d-------- C:\DOCUME~1\JEANTR~1\APPLIC~1\udig
2008-12-13 17:29 <REP> d-------- C:\Program Files\uDig
2008-12-13 15:47 524,288 --ah----- C:\DOCUME~1\postgres\NTUSER.DAT
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Mes documents
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Menu D‚marrer
2008-12-13 15:47 <REP> dr------- C:\DOCUME~1\postgres\Favoris
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\Voisinage r‚seau
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\Voisinage d'impression
2008-12-13 15:47 <REP> d--h----- C:\DOCUME~1\postgres\ModŠles
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\WINDOWS
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\Bureau
2008-12-13 15:47 <REP> d-------- C:\DOCUME~1\postgres\APPLIC~1\Symantec
2008-12-12 11:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe
2008-12-12 11:11 61,440 --a------ C:\WINDOWS\system32\dnssd.dll
2008-12-09 18:15 <REP> d-------- C:\Program Files\CCleaner


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-01-09 09:16:09 -------- d-----w C:\Program Files\Mozilla Thunderbird
2009-01-09 01:47:02 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\U3
2009-01-07 10:41:46 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\OpenOffice.org2
2009-01-06 12:16:29 410,984 ----a-w C:\WINDOWS\system32\deploytk.dll
2008-12-26 22:57:44 -------- d-----w C:\Program Files\The GodFather
2008-12-09 17:42:20 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\Autodesk
2008-12-09 17:34:53 26 ----a-w C:\AUTOEXEC.BAT
2008-12-07 16:24:05 -------- d-----w C:\Program Files\eMule
2008-12-04 20:25:23 -------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-12-04 20:23:21 -------- d-----w C:\Program Files\AutoCAD 2009
2008-12-04 17:07:20 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\AdobeUM
2008-12-03 19:08:24 -------- d-----w C:\Program Files\Autodesk
2008-12-01 22:20:59 -------- d-----w C:\Program Files\TimeCore
2008-11-23 22:58:21 -------- d-----w C:\Program Files\VobSub
2008-11-23 20:17:29 -------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared
2008-11-22 21:41:55 -------- d-----w C:\Program Files\DivX
2008-11-22 16:13:29 -------- d-----w C:\DOCUME~1\JEANTR~1\APPLIC~1\Logitech
2008-11-22 16:10:02 -------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-11-22 16:08:51 -------- d-----w C:\Program Files\Logitech
2008-11-22 16:08:50 -------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-22 15:36:07 -------- d-----w C:\Program Files\Avira
2008-11-22 15:30:16 -------- d-----w C:\Program Files\QuickZip4
2008-11-21 18:03:57 -------- d-----w C:\Program Files\iTunes
2008-11-21 18:03:25 -------- d-----w C:\Program Files\iPod
2008-11-21 18:03:25 -------- d-----w C:\Program Files\Fichiers communs\Apple
2008-11-21 17:59:23 -------- d-----w C:\Program Files\QuickTime
2008-11-21 17:57:15 -------- d-----w C:\Program Files\Apple Software Update
2008-11-21 17:42:47 -------- d-----w C:\Program Files\Free Audio Pack
2008-11-20 20:49:11 -------- d-----w C:\Program Files\SiS VGA Utilities V3.84
2008-11-20 20:49:05 -------- d-----w C:\Program Files\sisagp
2008-11-20 19:11:33 -------- d-----w C:\Program Files\PowerStrip
2008-11-20 19:08:37 -------- d-----w C:\Program Files\SiS VGA Utilities V3.65g
2008-11-20 18:49:31 85,256 ----a-w C:\WINDOWS\system32\perfc00C.dat
2008-11-20 18:49:31 511,392 ----a-w C:\WINDOWS\system32\perfh00C.dat
2008-11-20 18:34:32 -------- d-----w C:\Program Files\Asus
2008-11-20 17:34:50 -------- d-----w C:\Program Files\Messenger
2008-11-20 17:29:29 -------- d-----w C:\Program Files\Movie Maker
2008-11-20 17:22:07 -------- d-----w C:\Program Files\Windows NT
2008-11-20 17:10:25 -------- d-----w C:\Program Files\audible
2008-10-28 22:36:00 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-10-28 22:36:00 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-10-28 22:35:58 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-10-28 22:35:58 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-10-28 22:35:56 684,032 ----a-w C:\WINDOWS\system32\DivX.dll
2008-10-23 12:36:51 286,720 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-10-16 13:13:40 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 13:13:40 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 13:12:22 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 13:12:20 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 13:09:44 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 13:09:44 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 13:09:44 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 13:08:58 34,328 ----a-w C:\WINDOWS\system32\wups.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-12-17 23:22]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-06 13:16]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-20 19:50]
{DBC80044-A445-435b-BC74-9C25C1C588A9}=C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-06 13:16]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}=C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-06 13:16]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" []
"NB Probe"="C:\Program Files\ASUS\NB Probe\NBProbe.exe" [2005-06-09 10:50]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 19:24]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 15:55]
"CTCheck"="C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 10:08]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 13:53]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2008-11-19 22:26]
"SiSPower"="SiSPower.dll" [2008-03-20 18:58 C:\WINDOWS\system32\SiSPower.dll]
"AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 14:16]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-11-04 10:30]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-11-20 13:20]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" []
"@"="" []
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08]
"EasyPHP"="C:\Program Files\EasyPHP\EasyPHP.exe" [2006-11-19 22:16]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-01-06 13:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-01-01 14:31]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 10:03]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:33]
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2008-12-09 11:12]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-12-17 23:23]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=acaptuser32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eMuleAutoStart]
C:\Program Files\eMule\emule.exe -AutoStart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Instafinder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\LaunchU3.exe


Contents of the 'Scheduled Tasks' folder
2009-01-06 19:43:03 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 13:21:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = acaptuser32.dll??

scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\JavaQuickStarterService]
"ImagePath"="\"C:\Program Files\Java\jre6\bin\jqs.exe\" -service -config \"C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSrfdc.sys"

Completion time: 2009-01-09 13:23:02
C:\ComboFix2.txt ... 2009-01-09 13:18
C:\ComboFix3.txt ... 2009-01-09 13:01

--- E O F ---

mike Says:
November 17th, 2008 at 11:21 pm
heres what i found
i got the go.google removed from browser and running malware bytes sw…
i feel i am on my way to solving this!

Go to Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.

Then search for “TDSSserv.sys”

Right click on it, and select “Disable”

Note: If you select Uninstall, it will install itself again when you reboot the system, so DON’T select Uninstall.

Restart your pc.

You can now update your Antirus/Malware/Rootkit softwares and the go.google rubbish will stop.

Its now up to the Anti-Virus/Malware/Spyware companies to make an effort to stop this, and not rely on simple basic home PC user’s like myself to save the world

In simple terms, TDSSserv.sys is a service/server redirecting all software updates to 127.0.0.1 (your own computer) so they won’t update.