site qui souvre tout seul (résolu)

bonjour jais des site qui souvre tout seul ; de tout genre (astrologie;jeux ;de vente exx) .
vista 32 b internet explorer 8

phiphi2009


Télécharges RSIT (de random/random) sur le bureau ici :

http://images.malwareremoval.com/random/RSIT.exe

- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur Continue dans la fenêtre
- RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenu de log.txt plus info.txt (réduit ds la barre de taches) à la fin de l’analyse .

Les rapports sont dans le dossier ici C:\rsit
a+

ogfile of random's system information tool 1.06 (written by random/random)
Run by philippe at 2009-05-21 08:40:33
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 98 GB (41%) free of 237 GB
Total RAM: 2029 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:40:49, on 21/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\philippe\AppData\Local\mekeq.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\philippe\Desktop\RSIT.exe
C:\Program Files\trend micro\philippe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cooxer.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [mekeq] "c:\users\philippe\appdata\local\mekeq.exe" mekeq
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.ca(...)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\System32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 7024 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Maintenance en 1 clic.job
C:\Windows\tasks\Norton Internet Security - philippe - Analyse complète du système.job
C:\Windows\tasks\User_Feed_Synchronization-{2191248F-7AF4-4F2F-BF62-0D72751D3439}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-02-27 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL [2009-04-12 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-07-02 442467]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"mekeq"=c:\users\philippe\appdata\local\mekeq.exe [2009-05-20 290304]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Notification de cadeaux MSN.lnk - C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\Windows\system32\Ati2evxx.dll [2009-02-25 278528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81287bf2-e3d4-11dd-a7fb-0019d16365c9}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\NoLimit.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-21 08:17:06 ----D---- C:\Program Files\trend micro
2009-05-21 08:17:03 ----D---- C:\rsit
2009-05-20 21:01:32 ----D---- C:\Program Files\BitDefender
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files\BitDefender
2009-05-20 20:53:03 ----D---- C:\Windows\BDOSCAN8
2009-05-12 19:56:18 ----D---- C:\Program Files\Sun
2009-05-11 20:56:24 ----D---- C:\Program Files\QUAD Utilities
2009-05-10 18:39:49 ----D---- C:\Users\philippe\AppData\Roaming\Mozilla
2009-05-10 17:26:51 ----D---- C:\Program Files\Livre Album Fuji Photo
2009-05-09 21:33:45 ----A---- C:\Windows\system32\uxtuneup.dll
2009-05-09 21:33:45 ----A---- C:\Windows\system32\authuitu.dll
2009-05-09 21:33:41 ----A---- C:\Windows\system32\TuneUpDefragService.exe
2009-05-09 15:51:19 ----D---- C:\Users\philippe\AppData\Roaming\Download Manager
2009-05-08 19:16:45 ----D---- C:\ProgramData\ATI
2009-05-08 18:55:44 ----D---- C:\Users\philippe\AppData\Roaming\PC Updater
2009-05-08 18:55:37 ----D---- C:\Program Files\PC Updater
2009-05-07 21:48:30 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-05-07 21:48:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-05-06 18:31:30 ----D---- C:\Program Files\Devomaxx
2009-05-06 18:30:54 ----D---- C:\Windows\Downloaded Installations
2009-04-29 21:54:25 ----D---- C:\Program Files\Lecteur CANALPLAY
2009-04-27 20:39:20 ----A---- C:\Windows\system32\VBoxNetFltNotify.dll
2009-04-24 09:23:43 ----D---- C:\Users\philippe\AppData\Roaming\SoundSpectrum
2009-04-24 09:22:47 ----D---- C:\Program Files\SoundSpectrum
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaws.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaw.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-05-21 08:40:35 ----D---- C:\Windows\Temp
2009-05-21 08:17:06 ----RD---- C:\Program Files
2009-05-20 21:19:26 ----HD---- C:\Config.Msi
2009-05-20 21:15:59 ----SHD---- C:\Windows\Installer
2009-05-20 21:15:50 ----D---- C:\Windows\System32
2009-05-20 21:15:36 ----HD---- C:\ProgramData
2009-05-20 21:12:15 ----SHD---- C:\System Volume Information
2009-05-20 21:02:54 ----D---- C:\Windows\winsxs
2009-05-20 21:02:27 ----D---- C:\Windows\system32\drivers
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files
2009-05-20 20:53:06 ----SD---- C:\Windows\Downloaded Program Files
2009-05-20 20:53:04 ----D---- C:\Windows
2009-05-19 10:39:53 ----D---- C:\Windows\system32\catroot2
2009-05-17 19:16:31 ----D---- C:\Windows\inf
2009-05-17 19:16:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-13 12:22:57 ----D---- C:\Windows\system32\catroot
2009-05-13 12:22:51 ----D---- C:\Program Files\Windows Mail
2009-05-12 20:01:08 ----DC---- C:\Windows\system32\DRVSTORE
2009-05-11 20:56:31 ----D---- C:\Windows\system32\Tasks
2009-05-10 11:46:44 ----D---- C:\Users\philippe\AppData\Roaming\Image Zone Express
2009-05-09 21:35:51 ----D---- C:\Windows\Tasks
2009-05-09 21:33:47 ----A---- C:\Windows\system32\TUProgSt.exe
2009-05-09 21:33:32 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-05-09 10:34:56 ----D---- C:\Program Files\ATI
2009-05-08 19:12:06 ----RSD---- C:\Windows\assembly
2009-05-08 19:11:16 ----D---- C:\Program Files\ATI Technologies
2009-05-08 10:05:10 ----D---- C:\ProgramData\ma-config.com
2009-05-08 10:05:10 ----D---- C:\Program Files\ma-config.com
2009-05-07 22:04:17 ----D---- C:\Program Files\Common Files\LogiShrd
2009-05-07 22:03:45 ----D---- C:\Program Files\Internet Explorer
2009-05-07 20:20:50 ----D---- C:\Program Files\Logitech
2009-05-07 20:20:36 ----D---- C:\ProgramData\LogiShrd
2009-05-07 09:16:29 ----A---- C:\Windows\system32\mrt.exe
2009-05-04 21:01:47 ----D---- C:\Windows\Prefetch
2009-05-01 23:19:41 ----D---- C:\Program Files\QuickTime
2009-05-01 23:19:20 ----D---- C:\ProgramData\Apple Computer
2009-04-30 14:08:37 ----D---- C:\Program Files\Windows Media Player
2009-04-30 13:52:22 ----SD---- C:\ProgramData\Microsoft
2009-04-30 13:17:43 ----SD---- C:\Users\philippe\AppData\Roaming\Microsoft
2009-04-30 09:42:03 ----D---- C:\Program Files\Microsoft
2009-04-30 09:34:07 ----RSD---- C:\Windows\Fonts
2009-04-29 21:54:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-28 15:31:57 ----A---- C:\Windows\win.ini
2009-04-28 15:31:14 ----D---- C:\Windows\twain_32
2009-04-25 19:13:26 ----D---- C:\Windows\Logs
2009-04-25 18:56:58 ----D---- C:\Users\philippe\AppData\Roaming\Micro Application
2009-04-24 07:49:01 ----D---- C:\Program Files\Java
2009-04-22 22:33:23 ----SHD---- C:\$Recycle.Bin
2009-04-22 22:32:40 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\BHDrvx86.sys [2009-04-12 258608]
R1 ccHP;Symantec Hash Provider; \??\C:\Windows\system32\drivers\NIS\1005000.086\ccHPx86.sys [2009-04-12 482352]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-04-12 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090513.001\IDSvix86.sys [2009-04-12 292912]
R1 SRTSP;Symantec Real Time Storage Protection; \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSP.SYS [2009-04-12 307760]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSPX.SYS [2009-04-12 43696]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2009-04-12 25136]
R1 SYMTDI;Symantec Network Dispatch Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMTDI.SYS [2009-04-12 217392]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2009-04-27 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2009-04-27 41424]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-26 4385792]
R3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
R3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-12-04 217728]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-04-12 101936]
R3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
R3 LVUVC;Logitech QuickCam S5500(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.034\NAVENG.SYS [2009-04-12 89104]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.034\NAVEX15.SYS [2009-04-12 876144]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-07-02 381440]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-04-12 124464]
R3 SYMFW;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMFW.SYS [2009-04-12 89776]
R3 SYMNDISV;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMNDISV.SYS [2009-04-12 39984]
R3 TPM;Module de plateforme sécurisée (TPM); C:\Windows\system32\drivers\tpm.sys [2008-01-19 45624]
R3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
R3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2009-04-27 79888]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2009-04-27 87696]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ati2mtag;ati2mtag; C:\Windows\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2009-04-21 14336]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NAL;Nal Service ; \??\C:\Windows\system32\Drivers\iqvw32.sys [2008-11-26 30816]
S3 QCMerced;Logitech QuickCam Communicate; C:\Windows\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe [2009-04-12 115560]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe [2008-07-02 221273]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-05-09 604416]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 ATI Smart;ATI Smart; C:\Windows\System32\ati2sgag.exe [2006-12-20 520192]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 Symantec RemoteAssist;Symantec RemoteAssist; C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe [2008-01-29 394704]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-05-09 361216]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

ogfile of random's system information tool 1.06 (written by random/random)
Run by philippe at 2009-05-21 08:40:33
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 98 GB (41%) free of 237 GB
Total RAM: 2029 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:40:49, on 21/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\philippe\AppData\Local\mekeq.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\philippe\Desktop\RSIT.exe
C:\Program Files\trend micro\philippe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cooxer.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [mekeq] "c:\users\philippe\appdata\local\mekeq.exe" mekeq
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.ca(...)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\System32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 7024 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Maintenance en 1 clic.job
C:\Windows\tasks\Norton Internet Security - philippe - Analyse complète du système.job
C:\Windows\tasks\User_Feed_Synchronization-{2191248F-7AF4-4F2F-BF62-0D72751D3439}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-02-27 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL [2009-04-12 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-07-02 442467]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"mekeq"=c:\users\philippe\appdata\local\mekeq.exe [2009-05-20 290304]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Notification de cadeaux MSN.lnk - C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\Windows\system32\Ati2evxx.dll [2009-02-25 278528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81287bf2-e3d4-11dd-a7fb-0019d16365c9}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\NoLimit.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-21 08:17:06 ----D---- C:\Program Files\trend micro
2009-05-21 08:17:03 ----D---- C:\rsit
2009-05-20 21:01:32 ----D---- C:\Program Files\BitDefender
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files\BitDefender
2009-05-20 20:53:03 ----D---- C:\Windows\BDOSCAN8
2009-05-12 19:56:18 ----D---- C:\Program Files\Sun
2009-05-11 20:56:24 ----D---- C:\Program Files\QUAD Utilities
2009-05-10 18:39:49 ----D---- C:\Users\philippe\AppData\Roaming\Mozilla
2009-05-10 17:26:51 ----D---- C:\Program Files\Livre Album Fuji Photo
2009-05-09 21:33:45 ----A---- C:\Windows\system32\uxtuneup.dll
2009-05-09 21:33:45 ----A---- C:\Windows\system32\authuitu.dll
2009-05-09 21:33:41 ----A---- C:\Windows\system32\TuneUpDefragService.exe
2009-05-09 15:51:19 ----D---- C:\Users\philippe\AppData\Roaming\Download Manager
2009-05-08 19:16:45 ----D---- C:\ProgramData\ATI
2009-05-08 18:55:44 ----D---- C:\Users\philippe\AppData\Roaming\PC Updater
2009-05-08 18:55:37 ----D---- C:\Program Files\PC Updater
2009-05-07 21:48:30 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-05-07 21:48:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-05-06 18:31:30 ----D---- C:\Program Files\Devomaxx
2009-05-06 18:30:54 ----D---- C:\Windows\Downloaded Installations
2009-04-29 21:54:25 ----D---- C:\Program Files\Lecteur CANALPLAY
2009-04-27 20:39:20 ----A---- C:\Windows\system32\VBoxNetFltNotify.dll
2009-04-24 09:23:43 ----D---- C:\Users\philippe\AppData\Roaming\SoundSpectrum
2009-04-24 09:22:47 ----D---- C:\Program Files\SoundSpectrum
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaws.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaw.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-05-21 08:40:35 ----D---- C:\Windows\Temp
2009-05-21 08:17:06 ----RD---- C:\Program Files
2009-05-20 21:19:26 ----HD---- C:\Config.Msi
2009-05-20 21:15:59 ----SHD---- C:\Windows\Installer
2009-05-20 21:15:50 ----D---- C:\Windows\System32
2009-05-20 21:15:36 ----HD---- C:\ProgramData
2009-05-20 21:12:15 ----SHD---- C:\System Volume Information
2009-05-20 21:02:54 ----D---- C:\Windows\winsxs
2009-05-20 21:02:27 ----D---- C:\Windows\system32\drivers
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files
2009-05-20 20:53:06 ----SD---- C:\Windows\Downloaded Program Files
2009-05-20 20:53:04 ----D---- C:\Windows
2009-05-19 10:39:53 ----D---- C:\Windows\system32\catroot2
2009-05-17 19:16:31 ----D---- C:\Windows\inf
2009-05-17 19:16:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-13 12:22:57 ----D---- C:\Windows\system32\catroot
2009-05-13 12:22:51 ----D---- C:\Program Files\Windows Mail
2009-05-12 20:01:08 ----DC---- C:\Windows\system32\DRVSTORE
2009-05-11 20:56:31 ----D---- C:\Windows\system32\Tasks
2009-05-10 11:46:44 ----D---- C:\Users\philippe\AppData\Roaming\Image Zone Express
2009-05-09 21:35:51 ----D---- C:\Windows\Tasks
2009-05-09 21:33:47 ----A---- C:\Windows\system32\TUProgSt.exe
2009-05-09 21:33:32 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-05-09 10:34:56 ----D---- C:\Program Files\ATI
2009-05-08 19:12:06 ----RSD---- C:\Windows\assembly
2009-05-08 19:11:16 ----D---- C:\Program Files\ATI Technologies
2009-05-08 10:05:10 ----D---- C:\ProgramData\ma-config.com
2009-05-08 10:05:10 ----D---- C:\Program Files\ma-config.com
2009-05-07 22:04:17 ----D---- C:\Program Files\Common Files\LogiShrd
2009-05-07 22:03:45 ----D---- C:\Program Files\Internet Explorer
2009-05-07 20:20:50 ----D---- C:\Program Files\Logitech
2009-05-07 20:20:36 ----D---- C:\ProgramData\LogiShrd
2009-05-07 09:16:29 ----A---- C:\Windows\system32\mrt.exe
2009-05-04 21:01:47 ----D---- C:\Windows\Prefetch
2009-05-01 23:19:41 ----D---- C:\Program Files\QuickTime
2009-05-01 23:19:20 ----D---- C:\ProgramData\Apple Computer
2009-04-30 14:08:37 ----D---- C:\Program Files\Windows Media Player
2009-04-30 13:52:22 ----SD---- C:\ProgramData\Microsoft
2009-04-30 13:17:43 ----SD---- C:\Users\philippe\AppData\Roaming\Microsoft
2009-04-30 09:42:03 ----D---- C:\Program Files\Microsoft
2009-04-30 09:34:07 ----RSD---- C:\Windows\Fonts
2009-04-29 21:54:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-28 15:31:57 ----A---- C:\Windows\win.ini
2009-04-28 15:31:14 ----D---- C:\Windows\twain_32
2009-04-25 19:13:26 ----D---- C:\Windows\Logs
2009-04-25 18:56:58 ----D---- C:\Users\philippe\AppData\Roaming\Micro Application
2009-04-24 07:49:01 ----D---- C:\Program Files\Java
2009-04-22 22:33:23 ----SHD---- C:\$Recycle.Bin
2009-04-22 22:32:40 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\BHDrvx86.sys [2009-04-12 258608]
R1 ccHP;Symantec Hash Provider; \??\C:\Windows\system32\drivers\NIS\1005000.086\ccHPx86.sys [2009-04-12 482352]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-04-12 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090513.001\IDSvix86.sys [2009-04-12 292912]
R1 SRTSP;Symantec Real Time Storage Protection; \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSP.SYS [2009-04-12 307760]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSPX.SYS [2009-04-12 43696]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2009-04-12 25136]
R1 SYMTDI;Symantec Network Dispatch Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMTDI.SYS [2009-04-12 217392]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2009-04-27 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2009-04-27 41424]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-26 4385792]
R3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
R3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-12-04 217728]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-04-12 101936]
R3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
R3 LVUVC;Logitech QuickCam S5500(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.034\NAVENG.SYS [2009-04-12 89104]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.034\NAVEX15.SYS [2009-04-12 876144]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-07-02 381440]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-04-12 124464]
R3 SYMFW;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMFW.SYS [2009-04-12 89776]
R3 SYMNDISV;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMNDISV.SYS [2009-04-12 39984]
R3 TPM;Module de plateforme sécurisée (TPM); C:\Windows\system32\drivers\tpm.sys [2008-01-19 45624]
R3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
R3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2009-04-27 79888]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2009-04-27 87696]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ati2mtag;ati2mtag; C:\Windows\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2009-04-21 14336]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NAL;Nal Service ; \??\C:\Windows\system32\Drivers\iqvw32.sys [2008-11-26 30816]
S3 QCMerced;Logitech QuickCam Communicate; C:\Windows\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe [2009-04-12 115560]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe [2008-07-02 221273]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-05-09 604416]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 ATI Smart;ATI Smart; C:\Windows\System32\ati2sgag.exe [2006-12-20 520192]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 Symantec RemoteAssist;Symantec RemoteAssist; C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe [2008-01-29 394704]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-05-09 361216]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

Impératif sous vista:

desactives tes comptes d'utilisateur:
http://forum.malekal.com/viewtopic.php?f=59&t=65

Télécharges maintenant Navilog1 depuis-ce lien :

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter

en tant qu'administrateur".
Au menu principal, Fais le choix 1
Laisse toi guider et patiente.
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche le blocnote va s'ouvrir.
Copie-colle l'intégralité du rapport dans une réponse.
Referme le blocnote
Poste le rapport.

a+

Search Navipromo version 3.7.7 commencé le 21/05/2009 à 10:04:12,48

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 12.05.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Default System BIOS
USER : philippe ( Not Administrator ! )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:231 Go (Free:94 Go)
D:\ (CD or DVD)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)


Recherche executé en mode normal


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\philippe\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\philippe\AppData\Local\virtualstore\Program Files" ***

...\Live-Player trouvé !


*** Recherche dossiers dans "C:\Users\philippe\AppData\Local" ***



*** Recherche dossiers dans "C:\Users\INVIT~1\AppData\Local" ***




*** Recherche dossiers dans "C:\Users\philippe\AppData\Roaming" ***


*** Recherche dossiers dans "C:\Users\INVIT~1\appdata\roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\philippe\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\philippe\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\philippe\AppData\Local" *

* Recherche dans "C:\Users\INVIT~1\AppData\Local" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mekeq"="\"c:\\users\\philippe\\appdata\\local\\mekeq.exe\" mekeq"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\philippe\AppData\Local\Microsoft" :


* Dans "C:\Users\philippe\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\philippe\AppData\Local" :

mekeq.exe trouvé !
mekeq.dat trouvé !
mekeq_nav.dat trouvé !
mekeq_navps.dat trouvé !
uisua.dat trouvé !
uisua_nav.dat trouvé !
uisua_navps.dat trouvé !

* Dans "C:\Users\INVIT~1\AppData\Local" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 21/05/2009 à 10:24:13,07 ***

1)
****
Tu cliques sur le raccourci Navilog1 présent sur le bureau et laisse-toi guider.
Au menu principal, choisis 2 et valide.
(ne fais pas le choix ,3 ou 4 sans notre avis/accord)

Le fix va t'informer qu'il va alors redémarrer ton PC
Fermes toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuies sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle.

Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le bloc-notes va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Referme le bloc-notes. Ton bureau va réapparaitre

PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.

Poste le rapport

2)
****
Relances RSIT et postes le rapport stp.


a+

ean Navipromo version 3.7.7 commencé le 21/05/2009 à 10:57:18,52

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 12.05.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Default System BIOS
USER : philippe ( Not Administrator ! )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:231 Go (Free:94 Go)
D:\ (CD or DVD)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\philippe\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\philippe\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\philippe\AppData\Local" *


* Suppression dans "C:\Users\INVIT~1\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\philippe\appdata\roaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\INVIT~1\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "C:\Users\philippe\AppData\Local\virtualstore\Program Files" ***

...\Live-Player ...suppression...
...\Live-Player supprimé !


*** Suppression dossiers dans "C:\Users\philippe\AppData\Local" ***


*** Suppression dossiers dans "C:\Users\INVIT~1\AppData\Local" ***


*** Suppression dossiers dans "C:\Users\philippe\AppData\Roaming" ***


*** Suppression dossiers dans "C:\Users\INVIT~1\appdata\roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\philippe\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *



* Dans "C:\Users\philippe\AppData\Local\Microsoft" *



* Dans "C:\Users\philippe\AppData\Local\virtualstore\windows\system32" *



* Dans "C:\Users\philippe\AppData\Local" *


mekeq.exe trouvé !
Copie mekeq.exe réalisée avec succès !
mekeq.exe supprimé !

mekeq.dat trouvé !
Copie mekeq.dat réalisée avec succès !
mekeq.dat supprimé !

mekeq_nav.dat trouvé !
Copie mekeq_nav.dat réalisée avec succès !
mekeq_nav.dat supprimé !

mekeq_navps.dat trouvé !
Copie mekeq_navps.dat réalisée avec succès !
mekeq_navps.dat supprimé !

uisua.dat trouvé !
Copie uisua.dat réalisée avec succès !
uisua.dat supprimé !

uisua_nav.dat trouvé !
Copie uisua_nav.dat réalisée avec succès !
uisua_nav.dat supprimé !

uisua_navps.dat trouvé !
Copie uisua_navps.dat réalisée avec succès !
uisua_navps.dat supprimé !


* Dans "C:\Users\INVIT~1\AppData\Local" *



*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !


*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 21/05/2009 à 11:01:46,72 ***

Bien...
Le RSIT maintenant stp...

a+

Search Navipromo version 3.7.7 commencé le 21/05/2009 à 11:07:47,68

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 12.05.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Default System BIOS
USER : philippe ( Not Administrator ! )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:231 Go (Free:94 Go)
D:\ (CD or DVD)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)


Recherche executé en mode normal


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\philippe\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\philippe\AppData\Local\virtualstore\Program Files" ***



*** Recherche dossiers dans "C:\Users\philippe\AppData\Local" ***



*** Recherche dossiers dans "C:\Users\INVIT~1\AppData\Local" ***




*** Recherche dossiers dans "C:\Users\philippe\AppData\Roaming" ***


*** Recherche dossiers dans "C:\Users\INVIT~1\appdata\roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\philippe\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\philippe\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\philippe\AppData\Local" *

* Recherche dans "C:\Users\INVIT~1\AppData\Local" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\philippe\AppData\Local\Microsoft" :


* Dans "C:\Users\philippe\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\philippe\AppData\Local" :


* Dans "C:\Users\INVIT~1\AppData\Local" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 21/05/2009 à 11:26:07,52 ***

DSL,phiphi2009 je t'ai demandé RSIT...(comme sur le deuxieme message du topic)

a+

ogfile of random's system information tool 1.06 (written by random/random)
Run by philippe at 2009-05-21 11:49:08
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 96 GB (41%) free of 237 GB
Total RAM: 2029 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:25, on 21/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Users\philippe\AppData\Roaming\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\philippe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZ7MJUXX\RSIT[1].exe
C:\Program Files\trend micro\philippe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cooxer.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\RunOnce: [SoftwareHelper] C:\Users\philippe\AppData\Roaming\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe -runonce
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/fr-fr/wlscctrl2.ca(...)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.ca(...)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\System32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 7475 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Maintenance en 1 clic.job
C:\Windows\tasks\Norton Internet Security - philippe - Analyse complète du système.job
C:\Windows\tasks\User_Feed_Synchronization-{2191248F-7AF4-4F2F-BF62-0D72751D3439}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-02-27 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL [2009-04-12 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-07-02 442467]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]
"EoEngine"= []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SoftwareHelper"=C:\Users\philippe\AppData\Roaming\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe [2008-12-09 368224]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Notification de cadeaux MSN.lnk - C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\Windows\system32\Ati2evxx.dll [2009-02-25 278528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81287bf2-e3d4-11dd-a7fb-0019d16365c9}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\NoLimit.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-21 11:04:04 ----A---- C:\raport.txt
2009-05-21 10:57:18 ----A---- C:\cleannavi.txt
2009-05-21 10:23:01 ----A---- C:\Windows\system32\gnc.exe
2009-05-21 10:04:12 ----A---- C:\fixnavi.txt
2009-05-21 10:01:41 ----D---- C:\Program Files\Navilog1
2009-05-21 09:33:54 ----D---- C:\Program Files\Windows Live Safety Center
2009-05-21 08:58:05 ----D---- C:\Windows\system32\Kaspersky Lab
2009-05-21 08:54:58 ----D---- C:\Program Files\Panda Security
2009-05-21 08:48:36 ----D---- C:\Users\philippe\AppData\Roaming\EoRezo
2009-05-21 08:17:06 ----D---- C:\Program Files\trend micro
2009-05-21 08:17:03 ----D---- C:\rsit
2009-05-20 21:01:32 ----D---- C:\Program Files\BitDefender
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files\BitDefender
2009-05-20 20:53:03 ----D---- C:\Windows\BDOSCAN8
2009-05-12 19:56:18 ----D---- C:\Program Files\Sun
2009-05-11 20:56:24 ----D---- C:\Program Files\QUAD Utilities
2009-05-10 18:39:49 ----D---- C:\Users\philippe\AppData\Roaming\Mozilla
2009-05-10 17:26:51 ----D---- C:\Program Files\Livre Album Fuji Photo
2009-05-09 21:33:45 ----A---- C:\Windows\system32\uxtuneup.dll
2009-05-09 21:33:45 ----A---- C:\Windows\system32\authuitu.dll
2009-05-09 21:33:41 ----A---- C:\Windows\system32\TuneUpDefragService.exe
2009-05-09 15:51:19 ----D---- C:\Users\philippe\AppData\Roaming\Download Manager
2009-05-08 19:16:45 ----D---- C:\ProgramData\ATI
2009-05-08 18:55:44 ----D---- C:\Users\philippe\AppData\Roaming\PC Updater
2009-05-08 18:55:37 ----D---- C:\Program Files\PC Updater
2009-05-07 21:48:30 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-05-07 21:48:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-05-06 18:31:30 ----D---- C:\Program Files\Devomaxx
2009-05-06 18:30:54 ----D---- C:\Windows\Downloaded Installations
2009-04-29 21:54:25 ----D---- C:\Program Files\Lecteur CANALPLAY
2009-04-27 20:39:20 ----A---- C:\Windows\system32\VBoxNetFltNotify.dll
2009-04-24 09:23:43 ----D---- C:\Users\philippe\AppData\Roaming\SoundSpectrum
2009-04-24 09:22:47 ----D---- C:\Program Files\SoundSpectrum
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaws.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaw.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-05-21 11:49:10 ----D---- C:\Windows\Temp
2009-05-21 10:23:01 ----D---- C:\Windows\System32
2009-05-21 10:01:41 ----RD---- C:\Program Files
2009-05-21 09:33:54 ----SD---- C:\Windows\Downloaded Program Files
2009-05-21 09:28:12 ----SHD---- C:\System Volume Information
2009-05-21 08:55:00 ----D---- C:\Windows\system32\drivers
2009-05-20 21:19:26 ----HD---- C:\Config.Msi
2009-05-20 21:15:59 ----SHD---- C:\Windows\Installer
2009-05-20 21:15:36 ----HD---- C:\ProgramData
2009-05-20 21:02:54 ----D---- C:\Windows\winsxs
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files
2009-05-20 20:53:04 ----D---- C:\Windows
2009-05-19 10:39:53 ----D---- C:\Windows\system32\catroot2
2009-05-17 19:16:31 ----D---- C:\Windows\inf
2009-05-17 19:16:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-13 12:22:57 ----D---- C:\Windows\system32\catroot
2009-05-13 12:22:51 ----D---- C:\Program Files\Windows Mail
2009-05-12 20:01:08 ----DC---- C:\Windows\system32\DRVSTORE
2009-05-11 20:56:31 ----D---- C:\Windows\system32\Tasks
2009-05-10 11:46:44 ----D---- C:\Users\philippe\AppData\Roaming\Image Zone Express
2009-05-09 21:35:51 ----D---- C:\Windows\Tasks
2009-05-09 21:33:47 ----A---- C:\Windows\system32\TUProgSt.exe
2009-05-09 21:33:32 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-05-09 10:34:56 ----D---- C:\Program Files\ATI
2009-05-08 19:12:06 ----RSD---- C:\Windows\assembly
2009-05-08 19:11:16 ----D---- C:\Program Files\ATI Technologies
2009-05-08 10:05:10 ----D---- C:\ProgramData\ma-config.com
2009-05-08 10:05:10 ----D---- C:\Program Files\ma-config.com
2009-05-07 22:04:17 ----D---- C:\Program Files\Common Files\LogiShrd
2009-05-07 22:03:45 ----D---- C:\Program Files\Internet Explorer
2009-05-07 20:20:50 ----D---- C:\Program Files\Logitech
2009-05-07 20:20:36 ----D---- C:\ProgramData\LogiShrd
2009-05-07 09:16:29 ----A---- C:\Windows\system32\mrt.exe
2009-05-04 21:01:47 ----D---- C:\Windows\Prefetch
2009-05-01 23:19:41 ----D---- C:\Program Files\QuickTime
2009-05-01 23:19:20 ----D---- C:\ProgramData\Apple Computer
2009-04-30 14:08:37 ----D---- C:\Program Files\Windows Media Player
2009-04-30 13:52:22 ----SD---- C:\ProgramData\Microsoft
2009-04-30 13:17:43 ----SD---- C:\Users\philippe\AppData\Roaming\Microsoft
2009-04-30 09:42:03 ----D---- C:\Program Files\Microsoft
2009-04-30 09:34:07 ----RSD---- C:\Windows\Fonts
2009-04-29 21:54:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-28 15:31:57 ----A---- C:\Windows\win.ini
2009-04-28 15:31:14 ----D---- C:\Windows\twain_32
2009-04-25 19:13:26 ----D---- C:\Windows\Logs
2009-04-25 18:56:58 ----D---- C:\Users\philippe\AppData\Roaming\Micro Application
2009-04-24 07:49:01 ----D---- C:\Program Files\Java
2009-04-22 22:33:23 ----SHD---- C:\$Recycle.Bin
2009-04-22 22:32:40 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\BHDrvx86.sys [2009-04-12 258608]
R1 ccHP;Symantec Hash Provider; \??\C:\Windows\system32\drivers\NIS\1005000.086\ccHPx86.sys [2009-04-12 482352]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-04-12 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090513.001\IDSvix86.sys [2009-04-12 292912]
R1 SRTSP;Symantec Real Time Storage Protection; \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSP.SYS [2009-04-12 307760]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSPX.SYS [2009-04-12 43696]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2009-04-12 25136]
R1 SYMTDI;Symantec Network Dispatch Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMTDI.SYS [2009-04-12 217392]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2009-04-27 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2009-04-27 41424]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-26 4385792]
R3 catchme;catchme; \??\C:\Users\philippe\AppData\Local\Temp\catchme.sys []
R3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
R3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-12-04 217728]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-04-12 101936]
R3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
R3 LVUVC;Logitech QuickCam S5500(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.054\NAVENG.SYS [2009-04-12 89104]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.054\NAVEX15.SYS [2009-04-12 876144]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-07-02 381440]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-04-12 124464]
R3 SYMFW;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMFW.SYS [2009-04-12 89776]
R3 SYMNDISV;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMNDISV.SYS [2009-04-12 39984]
R3 TPM;Module de plateforme sécurisée (TPM); C:\Windows\system32\drivers\tpm.sys [2008-01-19 45624]
R3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
R3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2009-04-27 79888]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2009-04-27 87696]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ati2mtag;ati2mtag; C:\Windows\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2009-04-21 14336]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NAL;Nal Service ; \??\C:\Windows\system32\Drivers\iqvw32.sys [2008-11-26 30816]
S3 QCMerced;Logitech QuickCam Communicate; C:\Windows\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe [2009-04-12 115560]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe [2008-07-02 221273]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-05-09 604416]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 ATI Smart;ATI Smart; C:\Windows\System32\ati2sgag.exe [2006-12-20 520192]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 Symantec RemoteAssist;Symantec RemoteAssist; C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe [2008-01-29 394704]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-05-09 361216]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

Fais un scan avec cet antispyware :
Telecharges malwarebytes + tutoriel :

-> http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

Tu l´installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l´onglet recherche et coche la case : "executer un examen rapide".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "oui".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copies et colles le rapport stp.

********

Ensuite:

********




Télécharges AD-Remover
( de Cyrildu17 / C_XX ) sur ton bureau :
http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe
! Déconnectes toi et fermes toutes applications en cours !

* Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )
* Ouvre le dossier Ad-remover présent sur ton bureau, et double clique sur Ad-remover.bat.
* Au menu principal choisi l'option "A"
--> Postes le rapport qui apparait à la fin .

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

a+

----- LOGFILE OF AD-REMOVER 1.1.4.1 | ONLY XP/VISTA -------

Updated by C_XX on 19/05/2009 at 18:40
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

Start at: 13:04:36, 21/05/2009 | Boot mode: Normal Boot
Option: Scan | Executed from: C:\Program Files\Ad-remover\
Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
Computer Name: PC-DE-PHILIPPE
Current User: philippe - Administrator


============ Known Adwares Found ============

.
.
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@bs.serving-sys[1].txt

+-----------------| Eorezo Elements Found:

HKCU\Software\EoRezo
HKLM\Software\EoRezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1
HKU\S-1-5-21-2049829373-3373954969-4169219370-1000\Software\Eorezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Softwarehelper
.
C:\Users\philippe\AppData\Roaming\EoRezo
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@ads.eorezo[2].txt
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@dl.eorezo[1].txt
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@eorezo[1].txt
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@mir1.eorezo[1].txt

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\Registry\User\S-1-5-21-2049829373-3373954969-4169219370-1000\Software\Sweetim
.

+-----------------| Added Scan:

---- Mozilla FireFox Version [Unable to get version] ----

ProfilePath: dtuld9hc.default (philippe)
.
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://y.lo.st");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.10");
.
(Prefs.js) Found: user_pref("browser.startup.homepage", "hxxp://y.lo.st");

---- Internet Explorer Version 8.0.6001.18702 ----

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Start Page: hxxp://www.google.fr/ig

[HKEY_USERS\S-1-5-21-2049829373-3373954969-4169219370-1000\..\Internet Explorer\Main]

Start Page: hxxp://www.google.fr/ig

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://www.cooxer.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://y.lo.st

=========== Suspicious ==========

C:\Users\philippe\Documents\patchv2[1]\patch.exe
[813056 Byte(s)|--a------|30/04/2009 17:31|HashMD5: be4159b29b7d62278267beac0c38a030 |CRC32: bc816347]


+---------------------------------------------------------------------------+

3226 Byte(s) - C:\Ad-Report-Scan-21.05.2009.log

1 File(s) - C:\Program Files\Ad-remover\BACKUP
0 File(s) - C:\Program Files\Ad-remover\QUARANTINE

End at: 13:08:15 | 21/05/2009
.
+-----------------| E.O.F
.

OK....
La suite stp....

a+

la suite? jais pas tour faits?

cela dits ; j'ais plus de pub depuis un petit moment et le pc a une vitesse resonable car il etait lent .apres si tu peux me redier la suite . merci

NON.....

je t'avais demandé MBAM (malwarebytes) avant AD-REMOVER...
Relis le message....

Pas grave:

--------

On continue:

! Déconnectes toi et fermes toutes applications en cours !

* Relances "Ad-remover" : au menu principal choisi l'option "B" .

* Choisis A (tout supprimer)
* Puis S et valides...

--> le programme va travailler ...

* Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

----------

ENSUITE:

Fais un scan avec cet antispyware :
Telecharges malwarebytes + tutoriel :

-> http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

Tu l´installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l´onglet recherche et coche la case : "executer un examen rapide".
Puis click sur "rechercher".
Laisse le scanner le pc...
Si des elements on ete trouvés > click sur supprimer la selection.
si il t´es demandé de redemarrer > click sur "oui".
A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copies et colles le rapport stp.


a+

- LOGFILE OF AD-REMOVER 1.1.4.1 | ONLY XP/VISTA -------

Updated by C_XX on 19/05/2009 at 18:40
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

**** LIMITED TO ****

Known Adwares
Eorezo
It's TV
Sweetim

********************

Start at: 14:55:47, 21/05/2009 | Boot mode: Normal Boot
Option: Clean | Executed from: C:\Program Files\Ad-remover\
Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 v6.0.6001
Computer Name: PC-DE-PHILIPPE
Current User: philippe - Administrator


(!) -- IE start pages/Tabs reset

============ Known Adwares Deleted ============

.
.
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@bs.serving-sys[2].txt

+-----------------| Eorezo Elements Deleted :

HKCU\Software\EoRezo
HKLM\Software\EoRezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdate_is1
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Softwarehelper
.
C:\Users\philippe\AppData\Roaming\EoRezo
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@ads.eorezo[2].txt
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@dl.eorezo[1].txt
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@eorezo[1].txt
C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Cookies\philippe@mir1.eorezo[1].txt

+-----------------| It's TV Elements Deleted :

.

+-----------------| Sweetim Elements Deleted :

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Internetregistry\Registry\User\S-1-5-21-2049829373-3373954969-4169219370-1000\Software\Sweetim
.

(!) -- Temp files deleted.
(!) -- Recycle bin emptied in all drives.



+-----------------| Added Scan:

---- Mozilla FireFox Version [Unable to get version] ----

ProfilePath: dtuld9hc.default (philippe)
.
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://y.lo.st");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.10");
.
(Prefs.js) Removed: user_pref("browser.startup.homepage", "hxxp://y.lo.st");

---- Internet Explorer Version 8.0.6001.18702 ----

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_USERS\S-1-5-21-2049829373-3373954969-4169219370-1000\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

=========== Suspicious ==========

C:\Users\philippe\Documents\patchv2[1]\patch.exe
[813056 Byte(s)|--a------|30/04/2009 17:31|HashMD5: be4159b29b7d62278267beac0c38a030 |CRC32: bc816347]


+---------------------------------------------------------------------------+

4008 Byte(s) - C:\Ad-Report-Clean-21.05.2009.log
3443 Byte(s) - C:\Ad-Report-Scan-21.05.2009.log

21 File(s) - C:\Program Files\Ad-remover\BACKUP
5 File(s) - C:\Program Files\Ad-remover\QUARANTINE

End at: 15:02:17 | 21/05/2009
.
+-----------------| E.O.F
.

Logfile of random's system information tool 1.06 (written by random/random)
Run by philippe at 2009-05-21 15:05:57
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 96 GB (41%) free of 237 GB
Total RAM: 2029 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:06:32, on 21/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\explorer.exe
C:\Windows\system32\notepad.exe
C:\Users\philippe\Desktop\RSIT.exe
C:\Program Files\trend micro\philippe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\System32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service Google Update (gupdate1c9da0fedbbd0bd) (gupdate1c9da0fedbbd0bd) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 6501 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachine.job
C:\Windows\tasks\Maintenance en 1 clic.job
C:\Windows\tasks\Norton Internet Security - philippe - Analyse complète du système.job
C:\Windows\tasks\User_Feed_Synchronization-{2191248F-7AF4-4F2F-BF62-0D72751D3439}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-02-27 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL [2009-04-12 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-21 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-07-02 442467]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Notification de cadeaux MSN.lnk - C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\Windows\system32\Ati2evxx.dll [2009-02-25 278528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81287bf2-e3d4-11dd-a7fb-0019d16365c9}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\NoLimit.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-21 14:28:55 ----D---- C:\ProgramData\Google Updater
2009-05-21 12:59:17 ----D---- C:\Program Files\Ad-remover
2009-05-21 12:46:15 ----D---- C:\Users\philippe\AppData\Roaming\Malwarebytes
2009-05-21 12:46:09 ----D---- C:\ProgramData\Malwarebytes
2009-05-21 12:46:09 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-05-21 11:04:04 ----A---- C:\raport.txt
2009-05-21 10:57:18 ----A---- C:\cleannavi.txt
2009-05-21 10:23:01 ----A---- C:\Windows\system32\gnc.exe
2009-05-21 10:04:12 ----A---- C:\fixnavi.txt
2009-05-21 10:01:41 ----D---- C:\Program Files\Navilog1
2009-05-21 08:58:05 ----D---- C:\Windows\system32\Kaspersky Lab
2009-05-21 08:54:58 ----D---- C:\Program Files\Panda Security
2009-05-21 08:17:06 ----D---- C:\Program Files\trend micro
2009-05-21 08:17:03 ----D---- C:\rsit
2009-05-20 21:01:32 ----D---- C:\Program Files\BitDefender
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files\BitDefender
2009-05-20 20:53:03 ----D---- C:\Windows\BDOSCAN8
2009-05-12 19:56:18 ----D---- C:\Program Files\Sun
2009-05-11 20:56:24 ----D---- C:\Program Files\QUAD Utilities
2009-05-10 18:39:49 ----D---- C:\Users\philippe\AppData\Roaming\Mozilla
2009-05-10 17:26:51 ----D---- C:\Program Files\Livre Album Fuji Photo
2009-05-09 21:33:45 ----A---- C:\Windows\system32\uxtuneup.dll
2009-05-09 21:33:45 ----A---- C:\Windows\system32\authuitu.dll
2009-05-09 21:33:41 ----A---- C:\Windows\system32\TuneUpDefragService.exe
2009-05-09 15:51:19 ----D---- C:\Users\philippe\AppData\Roaming\Download Manager
2009-05-08 19:16:45 ----D---- C:\ProgramData\ATI
2009-05-08 18:55:44 ----D---- C:\Users\philippe\AppData\Roaming\PC Updater
2009-05-08 18:55:37 ----D---- C:\Program Files\PC Updater
2009-05-07 21:48:30 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-05-07 21:48:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-05-06 18:31:30 ----D---- C:\Program Files\Devomaxx
2009-05-06 18:30:54 ----D---- C:\Windows\Downloaded Installations
2009-04-29 21:54:25 ----D---- C:\Program Files\Lecteur CANALPLAY
2009-04-27 20:39:20 ----A---- C:\Windows\system32\VBoxNetFltNotify.dll
2009-04-24 09:23:43 ----D---- C:\Users\philippe\AppData\Roaming\SoundSpectrum
2009-04-24 09:22:47 ----D---- C:\Program Files\SoundSpectrum
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaws.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaw.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-05-21 15:03:07 ----D---- C:\Windows\Temp
2009-05-21 15:02:02 ----SD---- C:\Windows\Downloaded Program Files
2009-05-21 15:02:00 ----RD---- C:\Program Files
2009-05-21 14:51:41 ----D---- C:\Windows\Tasks
2009-05-21 14:44:16 ----SHD---- C:\Windows\Installer
2009-05-21 14:31:35 ----HD---- C:\Config.Msi
2009-05-21 14:31:06 ----D---- C:\Windows
2009-05-21 14:30:54 ----D---- C:\Program Files\Google
2009-05-21 14:30:30 ----D---- C:\Windows\system32\Tasks
2009-05-21 14:28:55 ----HD---- C:\ProgramData
2009-05-21 12:46:13 ----D---- C:\Windows\system32\drivers
2009-05-21 12:03:56 ----HD---- C:\Windows\system32\GroupPolicy
2009-05-21 10:23:01 ----D---- C:\Windows\System32
2009-05-21 09:28:12 ----SHD---- C:\System Volume Information
2009-05-20 21:02:54 ----D---- C:\Windows\winsxs
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files
2009-05-19 10:39:53 ----D---- C:\Windows\system32\catroot2
2009-05-17 19:16:31 ----D---- C:\Windows\inf
2009-05-17 19:16:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-13 12:22:57 ----D---- C:\Windows\system32\catroot
2009-05-13 12:22:51 ----D---- C:\Program Files\Windows Mail
2009-05-12 20:01:08 ----DC---- C:\Windows\system32\DRVSTORE
2009-05-10 11:46:44 ----D---- C:\Users\philippe\AppData\Roaming\Image Zone Express
2009-05-09 21:33:47 ----A---- C:\Windows\system32\TUProgSt.exe
2009-05-09 21:33:32 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-05-09 10:34:56 ----D---- C:\Program Files\ATI
2009-05-08 19:12:06 ----RSD---- C:\Windows\assembly
2009-05-08 19:11:16 ----D---- C:\Program Files\ATI Technologies
2009-05-08 10:05:10 ----D---- C:\ProgramData\ma-config.com
2009-05-08 10:05:10 ----D---- C:\Program Files\ma-config.com
2009-05-07 22:04:17 ----D---- C:\Program Files\Common Files\LogiShrd
2009-05-07 22:03:45 ----D---- C:\Program Files\Internet Explorer
2009-05-07 20:20:50 ----D---- C:\Program Files\Logitech
2009-05-07 20:20:36 ----D---- C:\ProgramData\LogiShrd
2009-05-07 09:16:29 ----A---- C:\Windows\system32\mrt.exe
2009-05-04 21:01:47 ----D---- C:\Windows\Prefetch
2009-05-01 23:19:41 ----D---- C:\Program Files\QuickTime
2009-05-01 23:19:20 ----D---- C:\ProgramData\Apple Computer
2009-04-30 14:08:37 ----D---- C:\Program Files\Windows Media Player
2009-04-30 13:52:22 ----SD---- C:\ProgramData\Microsoft
2009-04-30 13:17:43 ----SD---- C:\Users\philippe\AppData\Roaming\Microsoft
2009-04-30 09:42:03 ----D---- C:\Program Files\Microsoft
2009-04-30 09:34:07 ----RSD---- C:\Windows\Fonts
2009-04-29 21:54:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-28 15:31:57 ----A---- C:\Windows\win.ini
2009-04-28 15:31:14 ----D---- C:\Windows\twain_32
2009-04-25 19:13:26 ----D---- C:\Windows\Logs
2009-04-25 18:56:58 ----D---- C:\Users\philippe\AppData\Roaming\Micro Application
2009-04-24 07:49:01 ----D---- C:\Program Files\Java
2009-04-22 22:33:23 ----SHD---- C:\$Recycle.Bin
2009-04-22 22:32:40 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\BHDrvx86.sys [2009-04-12 258608]
R1 ccHP;Symantec Hash Provider; \??\C:\Windows\system32\drivers\NIS\1005000.086\ccHPx86.sys [2009-04-12 482352]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-04-12 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090513.001\IDSvix86.sys [2009-04-12 292912]
R1 SRTSP;Symantec Real Time Storage Protection; \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSP.SYS [2009-04-12 307760]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSPX.SYS [2009-04-12 43696]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2009-04-12 25136]
R1 SYMTDI;Symantec Network Dispatch Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMTDI.SYS [2009-04-12 217392]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2009-04-27 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2009-04-27 41424]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-26 4385792]
R3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
R3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-12-04 217728]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-04-12 101936]
R3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
R3 LVUVC;Logitech QuickCam S5500(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.054\NAVENG.SYS [2009-04-12 89104]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.054\NAVEX15.SYS [2009-04-12 876144]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-07-02 381440]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-04-12 124464]
R3 SYMFW;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMFW.SYS [2009-04-12 89776]
R3 SYMNDISV;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMNDISV.SYS [2009-04-12 39984]
R3 TPM;Module de plateforme sécurisée (TPM); C:\Windows\system32\drivers\tpm.sys [2008-01-19 45624]
R3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
R3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2009-04-27 79888]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2009-04-27 87696]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ati2mtag;ati2mtag; C:\Windows\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
S3 catchme;catchme; \??\C:\Users\philippe\AppData\Local\Temp\catchme.sys []
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2009-04-21 14336]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NAL;Nal Service ; \??\C:\Windows\system32\Drivers\iqvw32.sys [2008-11-26 30816]
S3 QCMerced;Logitech QuickCam Communicate; C:\Windows\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe [2009-04-12 115560]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe [2008-07-02 221273]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-05-09 604416]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 ATI Smart;ATI Smart; C:\Windows\System32\ati2sgag.exe [2006-12-20 520192]
S2 gupdate1c9da0fedbbd0bd;Service Google Update (gupdate1c9da0fedbbd0bd); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-21 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-21 183280]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 Symantec RemoteAssist;Symantec RemoteAssist; C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe [2008-01-29 394704]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-05-09 361216]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

alwarebytes' Anti-Malware 1.36
Version de la base de données: 2162
Windows 6.0.6001 Service Pack 1

21/05/2009 15:18:31
mbam-log-2009-05-21 (15-18-31).txt

Type de recherche: Examen rapide
Eléments examinés: 74441
Temps écoulé: 4 minute(s), 10 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

je regarde....

a+

ok

Télécharge >>OTMoveIt3<< (de Old_Timer) sur ton Bureau.

Pour VISTA : Clic-droit et choisis "Exécuter en tant qu'administrateur".


Double-clique sur OTMoveIt3.exe pour le lancer.

Copie la liste qui se trouve en citation ci-dessous:



:Files
c:\windows\system32\gnc.exe



:Commands
[purity]
[emptytemp]
[Reboot]

et colle-la dans le cadre de gauche de OTMoveIt3



Clique sur pour lancer la suppression.
attendre la fin du travail de l'outil puis fermer OTMoveIt3.

Le résultat apparaitra dans le cadre Results.
Clique sur Exit pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles\*******_******.log


NB: Il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Oui/Yes.

a+

========= FILES ==========
c:\windows\system32\gnc.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\Users\philippe\AppData\Local\Temp\~DF4DC9.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Windows\temp\JETB8B1.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05212009_160204

Files moved on Reboot...
C:\Users\philippe\AppData\Local\Temp\~DF4DC9.tmp moved successfully.
File C:\Windows\temp\JETB8B1.tmp not found!

Un nouveau RSITpour controle stp..
Dis moi ensuite comment va le pc...

a+

ogfile of random's system information tool 1.06 (written by random/random)
Run by philippe at 2009-05-21 16:32:08
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 96 GB (41%) free of 237 GB
Total RAM: 2029 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:32:32, on 21/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\philippe\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\99H0OS27\RSIT[1].exe
C:\Program Files\trend micro\philippe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\Windows\System32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service Google Update (gupdate1c9da0fedbbd0bd) (gupdate1c9da0fedbbd0bd) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 6882 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachine.job
C:\Windows\tasks\Maintenance en 1 clic.job
C:\Windows\tasks\Norton Internet Security - philippe - Analyse complète du système.job
C:\Windows\tasks\User_Feed_Synchronization-{2191248F-7AF4-4F2F-BF62-0D72751D3439}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-02-27 61816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\IPSBHO.DLL [2009-04-12 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-21 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.5.0.134\coIEPlg.dll [2009-04-12 372592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-07-02 442467]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Notification de cadeaux MSN.lnk - C:\Users\philippe\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\Windows\system32\Ati2evxx.dll [2009-02-25 278528]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81287bf2-e3d4-11dd-a7fb-0019d16365c9}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\NoLimit.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-21 16:02:04 ----D---- C:\_OTMoveIt
2009-05-21 14:28:55 ----D---- C:\ProgramData\Google Updater
2009-05-21 12:59:17 ----D---- C:\Program Files\Ad-remover
2009-05-21 12:46:15 ----D---- C:\Users\philippe\AppData\Roaming\Malwarebytes
2009-05-21 12:46:09 ----D---- C:\ProgramData\Malwarebytes
2009-05-21 12:46:09 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-05-21 11:04:04 ----A---- C:\raport.txt
2009-05-21 10:57:18 ----A---- C:\cleannavi.txt
2009-05-21 10:04:12 ----A---- C:\fixnavi.txt
2009-05-21 10:01:41 ----D---- C:\Program Files\Navilog1
2009-05-21 08:58:05 ----D---- C:\Windows\system32\Kaspersky Lab
2009-05-21 08:54:58 ----D---- C:\Program Files\Panda Security
2009-05-21 08:17:06 ----D---- C:\Program Files\trend micro
2009-05-21 08:17:03 ----D---- C:\rsit
2009-05-20 21:01:32 ----D---- C:\Program Files\BitDefender
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files\BitDefender
2009-05-20 20:53:03 ----D---- C:\Windows\BDOSCAN8
2009-05-12 19:56:18 ----D---- C:\Program Files\Sun
2009-05-11 20:56:24 ----D---- C:\Program Files\QUAD Utilities
2009-05-10 18:39:49 ----D---- C:\Users\philippe\AppData\Roaming\Mozilla
2009-05-10 17:26:51 ----D---- C:\Program Files\Livre Album Fuji Photo
2009-05-09 21:33:45 ----A---- C:\Windows\system32\uxtuneup.dll
2009-05-09 21:33:45 ----A---- C:\Windows\system32\authuitu.dll
2009-05-09 21:33:41 ----A---- C:\Windows\system32\TuneUpDefragService.exe
2009-05-09 15:51:19 ----D---- C:\Users\philippe\AppData\Roaming\Download Manager
2009-05-08 19:16:45 ----D---- C:\ProgramData\ATI
2009-05-08 18:55:44 ----D---- C:\Users\philippe\AppData\Roaming\PC Updater
2009-05-08 18:55:37 ----D---- C:\Program Files\PC Updater
2009-05-07 21:48:30 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-05-07 21:48:30 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-05-06 18:31:30 ----D---- C:\Program Files\Devomaxx
2009-05-06 18:30:54 ----D---- C:\Windows\Downloaded Installations
2009-04-29 21:54:25 ----D---- C:\Program Files\Lecteur CANALPLAY
2009-04-27 20:39:20 ----A---- C:\Windows\system32\VBoxNetFltNotify.dll
2009-04-24 09:23:43 ----D---- C:\Users\philippe\AppData\Roaming\SoundSpectrum
2009-04-24 09:22:47 ----D---- C:\Program Files\SoundSpectrum
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaws.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\javaw.exe
2009-04-24 07:49:04 ----A---- C:\Windows\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-05-21 16:32:10 ----D---- C:\Windows\Temp
2009-05-21 16:06:48 ----D---- C:\Windows\Tasks
2009-05-21 16:02:04 ----D---- C:\Windows\System32
2009-05-21 15:13:48 ----D---- C:\Windows\system32\drivers
2009-05-21 15:02:03 ----SD---- C:\Windows\Downloaded Program Files
2009-05-21 15:02:00 ----RD---- C:\Program Files
2009-05-21 14:44:16 ----SHD---- C:\Windows\Installer
2009-05-21 14:31:35 ----HD---- C:\Config.Msi
2009-05-21 14:31:06 ----D---- C:\Windows
2009-05-21 14:30:54 ----D---- C:\Program Files\Google
2009-05-21 14:30:30 ----D---- C:\Windows\system32\Tasks
2009-05-21 14:28:55 ----HD---- C:\ProgramData
2009-05-21 12:03:56 ----HD---- C:\Windows\system32\GroupPolicy
2009-05-21 09:28:12 ----SHD---- C:\System Volume Information
2009-05-20 21:02:54 ----D---- C:\Windows\winsxs
2009-05-20 21:00:44 ----D---- C:\Program Files\Common Files
2009-05-19 10:39:53 ----D---- C:\Windows\system32\catroot2
2009-05-17 19:16:31 ----D---- C:\Windows\inf
2009-05-17 19:16:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-13 12:22:57 ----D---- C:\Windows\system32\catroot
2009-05-13 12:22:51 ----D---- C:\Program Files\Windows Mail
2009-05-12 20:01:08 ----DC---- C:\Windows\system32\DRVSTORE
2009-05-10 11:46:44 ----D---- C:\Users\philippe\AppData\Roaming\Image Zone Express
2009-05-09 21:33:47 ----A---- C:\Windows\system32\TUProgSt.exe
2009-05-09 21:33:32 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-05-09 10:34:56 ----D---- C:\Program Files\ATI
2009-05-08 19:12:06 ----RSD---- C:\Windows\assembly
2009-05-08 19:11:16 ----D---- C:\Program Files\ATI Technologies
2009-05-08 10:05:10 ----D---- C:\ProgramData\ma-config.com
2009-05-08 10:05:10 ----D---- C:\Program Files\ma-config.com
2009-05-07 22:04:17 ----D---- C:\Program Files\Common Files\LogiShrd
2009-05-07 22:03:45 ----D---- C:\Program Files\Internet Explorer
2009-05-07 20:20:50 ----D---- C:\Program Files\Logitech
2009-05-07 20:20:36 ----D---- C:\ProgramData\LogiShrd
2009-05-07 09:16:29 ----A---- C:\Windows\system32\mrt.exe
2009-05-04 21:01:47 ----D---- C:\Windows\Prefetch
2009-05-01 23:19:41 ----D---- C:\Program Files\QuickTime
2009-05-01 23:19:20 ----D---- C:\ProgramData\Apple Computer
2009-04-30 14:08:37 ----D---- C:\Program Files\Windows Media Player
2009-04-30 13:52:22 ----SD---- C:\ProgramData\Microsoft
2009-04-30 13:17:43 ----SD---- C:\Users\philippe\AppData\Roaming\Microsoft
2009-04-30 09:42:03 ----D---- C:\Program Files\Microsoft
2009-04-30 09:34:07 ----RSD---- C:\Windows\Fonts
2009-04-29 21:54:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-28 15:31:57 ----A---- C:\Windows\win.ini
2009-04-28 15:31:14 ----D---- C:\Windows\twain_32
2009-04-25 19:13:26 ----D---- C:\Windows\Logs
2009-04-25 18:56:58 ----D---- C:\Users\philippe\AppData\Roaming\Micro Application
2009-04-24 07:49:01 ----D---- C:\Program Files\Java
2009-04-22 22:33:23 ----SHD---- C:\$Recycle.Bin
2009-04-22 22:32:40 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\BHDrvx86.sys [2009-04-12 258608]
R1 ccHP;Symantec Hash Provider; \??\C:\Windows\system32\drivers\NIS\1005000.086\ccHPx86.sys [2009-04-12 482352]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-04-12 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090513.001\IDSvix86.sys [2009-04-12 292912]
R1 SRTSP;Symantec Real Time Storage Protection; \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSP.SYS [2009-04-12 307760]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); \??\C:\Windows\system32\drivers\NIS\1005000.086\SRTSPX.SYS [2009-04-12 43696]
R1 SymIM;Symantec Network Security Intermediate Filter Driver; C:\Windows\system32\DRIVERS\SymIMv.sys [2009-04-12 25136]
R1 SYMTDI;Symantec Network Dispatch Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMTDI.SYS [2009-04-12 217392]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2009-04-27 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2009-04-27 41424]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-02-26 4385792]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-12-04 217728]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-04-12 101936]
R3 LVRS;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
R3 LVUVC;Logitech QuickCam S5500(UVC); C:\Windows\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.054\NAVENG.SYS [2009-04-12 89104]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090520.054\NAVEX15.SYS [2009-04-12 876144]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2008-07-02 381440]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2009-04-12 124464]
R3 SYMFW;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMFW.SYS [2009-04-12 89776]
R3 SYMNDISV;Symantec Network Filter Driver; \??\C:\Windows\system32\drivers\NIS\1005000.086\SYMNDISV.SYS [2009-04-12 39984]
R3 TPM;Module de plateforme sécurisée (TPM); C:\Windows\system32\drivers\tpm.sys [2008-01-19 45624]
R3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2009-04-27 79888]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2009-04-27 87696]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 ati2mtag;ati2mtag; C:\Windows\system32\DRIVERS\ati2mtag.sys [2006-12-17 1918464]
S3 catchme;catchme; \??\C:\Users\philippe\AppData\Local\Temp\catchme.sys []
S3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2009-04-21 14336]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NAL;Nal Service ; \??\C:\Windows\system32\Drivers\iqvw32.sys [2008-11-26 30816]
S3 QCMerced;Logitech QuickCam Communicate; C:\Windows\system32\DRIVERS\LVCM.sys [2005-05-27 1317152]
S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\Windows\system32\Ati2evxx.exe [2009-02-25 733184]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.5.0.134\ccSvcHst.exe [2009-04-12 115560]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_ccb55eb4\STacSV.exe [2008-07-02 221273]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-05-09 604416]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 ATI Smart;ATI Smart; C:\Windows\System32\ati2sgag.exe [2006-12-20 520192]
S2 gupdate1c9da0fedbbd0bd;Service Google Update (gupdate1c9da0fedbbd0bd); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-21 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-21 183280]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-04-21 216232]
S3 Symantec RemoteAssist;Symantec RemoteAssist; C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe [2008-01-29 394704]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-05-09 361216]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

ben moi jais plus de fenetre qui souvre .le pc et + rapide tout va
ça roulle pour moi .merci

Tout est propre...

Pour desinstaller les outils utilisés

Telecharge ToolsCleaner2
--> http://pc-system.fr/TC/ToolsCleaner2.exe
-Une fois téléchargé, installe-le et lance-le
-Clique sur Recherche et laisse le scan se terminer
-Clique sur SUPPRESSION
-Clique sur Quitter pour que le rapport puisse se créer
-Poste moi le rapport se trouvant ici--> C:\TCleaner.txt


puis

---> Télécharge et installe CCleaner
(N'installe pas la Yahoo Toolbar) :

http://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs(...)

* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.
* Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse(Sauvegarde la base de registre).
* Décoche la case plus vieux que 48 h



---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
XP:
http://www.tayo.fr/desactiver-restauration-systeme-sur-windows-xp-tutoriel.ph(...)
VISTA:
http://www.tayo.fr/desactiver-restauration-windows-vista-tutoriel.php

a+

petite coursse a faire .ok je fait tout sa .

voilas sais fait mais jais pas eu le rapporet T cleaner acces refuser.
mais sa marche bien .

Remontes à ton premier message
Clic sur "éditer"(en bas a droite)
Remplaces le titre par ceci:

==> Puis envoyer.


a+

merci j'ais le cerveaux qui va exploser "lol"

a+

Mais non.....
Regardes...il est toujours là:


a+

A+