RunDll Module introuvable [Résolu]

Hello! J'ai fait 1 rapport de mon ordi avec highjack this, et je sais pas ce que jdois faire ensuite! Jdois le poster sur le forum...mais à qui? Comment çà se passe? Merci de me répondre Svp

Ok merci! Voila mon rapport.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:27:31, on 13/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Users\Farid\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\Farid\AppData\Local\kwmccaa.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Users\Farid\Program Files\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ig?sourceid=n [...] r&ie=UTF-8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/i [...] .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/i [...] .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/i [...] .yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\nnnoMFvV.dll,#1
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Netlog 24] "C:\Program Files\Netlog 24\Notifier\Netlog24Notifier.exe"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Farid\AppData\Local\Temp\xxyayYsT.dll,c
O4 - HKCU\..\Run: [6eb6c5de] rundll32.exe "C:\Users\Farid\AppData\Local\Temp\qkqgxyhs.dll",b
O4 - HKCU\..\Run: [BM6d85f642] Rundll32.exe "C:\Users\Farid\AppData\Local\Temp\woudgceh.dll",s
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Farid\AppData\Local\Temp\xxyXrSIX.dll,#1
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Farid\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kwmccaa] "c:\users\farid\appdata\local\kwmccaa.exe" kwmccaa
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/ [...] rtdgi1.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/control [...] oader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.c [...] oader5.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/g [...] ection.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/bina [...] b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Reg [...] lashax.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate1c9889a470598a0) (gupdate1c9889a470598a0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 13860 bytes

C'état vraiment long! Je suis désolé!....Voilà le rapport du scan Navilog1

Search Navipromo version 3.7.5 commencé le 13/03/2009 à 15:40:55,14

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 26.02.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz )
BIOS : Ver 1.00PARTTBL
USER : Farid ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1229 [VPS 081129-0] 4.8.1229 (Activated)


C:\ (Local Disk) - NTFS - Total:225 Go (Free:15 Go)
D:\ (Local Disk) - NTFS - Total:7 Go (Free:2 Go)
E:\ (CD or DVD)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***

...\Instant Access trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\farid\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\Farid\AppData\Local\virtualstore\Program Files" ***



*** Recherche dossiers dans "C:\Users\Farid\AppData\Local" ***




*** Recherche dossiers dans "C:\Users\Farid\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\Farid\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\Farid\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\Farid\AppData\Local" *



*** Recherche fichiers ***


C:\Windows\dialerexe.ini trouvé !
C:\Windows\system32\nvs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kwmccaa"="\"c:\\users\\farid\\appdata\\local\\kwmccaa.exe\" kwmccaa"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\Farid\AppData\Local\Microsoft" :


* Dans "C:\Users\Farid\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\Farid\AppData\Local" :

kwmccaa.exe trouvé !
kwmccaa.dat trouvé !
kwmccaa_nav.dat trouvé !
kwmccaa_navps.dat trouvé !
qguqc.dat trouvé !
qguqc_nav.dat trouvé !
qguqc_navps.dat trouvé !
qguqc_navup.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 13/03/2009 à 16:03:02,68 ***

Voilà le rapport apres avoir fait l'option 2.

Clean Navipromo version 3.7.5 commencé le 13/03/2009 à 16:25:00,49

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 26.02.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz )
BIOS : Ver 1.00PARTTBL
USER : Farid ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1229 [VPS 081129-0] 4.8.1229 (Activated)


C:\ (Local Disk) - NTFS - Total:225 Go (Free:15 Go)
D:\ (Local Disk) - NTFS - Total:7 Go (Free:2 Go)
E:\ (CD or DVD)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\Farid\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\Farid\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\Farid\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***

...\Instant Access ...suppression...
...\Instant Access supprimé !


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\farid\appdata\roaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\Farid\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\Farid\AppData\Local" ***


*** Suppression dossiers dans "C:\Users\Farid\AppData\Roaming" ***



*** Suppression fichiers ***

C:\Windows\dialerexe.ini supprimé !
C:\Windows\system32\nvs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\Farid\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *



* Dans "C:\Users\Farid\AppData\Local\Microsoft" *



* Dans "C:\Users\Farid\AppData\Local\virtualstore\windows\system32" *



* Dans "C:\Users\Farid\AppData\Local" *


kwmccaa.exe trouvé !
Copie kwmccaa.exe réalisée avec succès !
kwmccaa.exe supprimé !

kwmccaa.dat trouvé !
Copie kwmccaa.dat réalisée avec succès !
kwmccaa.dat supprimé !

kwmccaa_nav.dat trouvé !
Copie kwmccaa_nav.dat réalisée avec succès !
kwmccaa_nav.dat supprimé !

kwmccaa_navps.dat trouvé !
Copie kwmccaa_navps.dat réalisée avec succès !
kwmccaa_navps.dat supprimé !

qguqc.dat trouvé !
Copie qguqc.dat réalisée avec succès !
qguqc.dat supprimé !

qguqc_nav.dat trouvé !
Copie qguqc_nav.dat réalisée avec succès !
qguqc_nav.dat supprimé !

qguqc_navps.dat trouvé !
Copie qguqc_navps.dat réalisée avec succès !
qguqc_navps.dat supprimé !

qguqc_navup.dat trouvé !
Copie qguqc_navup.dat réalisée avec succès !
qguqc_navup.dat supprimé !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 13/03/2009 à 16:43:41,16 ***

ComboFix 09-03-12.01 - Farid 2009-03-13 17:00:46.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2046.1271 [GMT 1:00]
Lancé depuis: c:\users\Farid\Program Files\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ShoppingReport

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-13 au 2009-03-13 ))))))))))))))))))))))))))))))))))))
.

2009-03-13 15:39 . 2009-03-13 16:54 <REP> d-------- c:\program files\Navilog1
2009-03-13 15:14 . 2009-03-13 15:14 <REP> d-------- c:\users\Farid\AppData\Roaming\Malwarebytes
2009-03-13 15:13 . 2009-03-13 15:13 <REP> d-------- c:\users\All Users\Malwarebytes
2009-03-13 15:13 . 2009-03-13 15:13 <REP> d-------- c:\programdata\Malwarebytes
2009-03-12 00:15 . 2009-03-12 00:15 <REP> d-------- c:\users\All Users\NVIDIA
2009-03-12 00:15 . 2009-03-12 00:15 <REP> d-------- c:\programdata\NVIDIA
2009-03-11 23:47 . 2009-03-13 16:57 27,839 --a------ c:\users\All Users\nvModes.dat
2009-03-11 23:47 . 2009-03-13 16:57 27,839 --a------ c:\programdata\nvModes.dat
2009-03-11 23:31 . 2008-06-20 02:14 781,344 --a------ c:\windows\System32\PresentationNative_v0300.dll
2009-03-11 23:31 . 2008-06-20 02:14 622,080 --a------ c:\windows\System32\icardagt.exe
2009-03-11 23:31 . 2008-06-20 02:14 326,160 --a------ c:\windows\System32\PresentationHost.exe
2009-03-11 23:31 . 2008-06-20 02:14 105,016 --a------ c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll
2009-03-11 23:31 . 2008-06-20 02:14 97,800 --a------ c:\windows\System32\infocardapi.dll
2009-03-11 23:31 . 2008-06-20 02:14 43,544 --a------ c:\windows\System32\PresentationHostProxy.dll
2009-03-11 23:31 . 2008-06-20 02:14 37,384 --a------ c:\windows\System32\infocardcpl.cpl
2009-03-11 23:31 . 2008-06-20 02:14 11,264 --a------ c:\windows\System32\icardres.dll
2009-03-11 23:25 . 2008-07-27 19:03 282,112 --a------ c:\windows\System32\mscoree.dll
2009-03-11 23:25 . 2008-07-27 19:03 158,720 --a------ c:\windows\System32\mscorier.dll
2009-03-11 23:25 . 2008-07-27 19:03 96,760 --a------ c:\windows\System32\dfshim.dll
2009-03-11 23:25 . 2008-07-27 19:03 41,984 --a------ c:\windows\System32\netfxperf.dll
2009-03-11 23:24 . 2008-07-27 19:03 83,968 --a------ c:\windows\System32\mscories.dll
2009-03-11 09:36 . 2008-12-16 04:29 8,147,456 --a------ c:\windows\System32\wmploc.DLL
2009-03-11 09:36 . 2008-12-16 06:31 7,680 --a------ c:\windows\System32\spwmp.dll
2009-03-11 09:36 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\msdxm.ocx
2009-03-11 09:36 . 2008-12-16 06:31 4,096 --a------ c:\windows\System32\dxmasf.dll
2009-03-11 09:35 . 2009-02-09 04:10 2,033,152 --a------ c:\windows\System32\win32k.sys
2009-03-11 09:35 . 2008-11-27 05:43 268,288 --a------ c:\windows\System32\schannel.dll
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Videos
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Searches
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Saved Games
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Pictures
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Links
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Downloads
2009-03-05 22:28 . 2009-03-05 22:28 <REP> dr------- c:\windows\System32\config\systemprofile\Documents
2009-02-28 16:03 . 2009-02-28 16:03 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-02-28 15:54 . 2009-02-28 15:54 <REP> d-------- c:\program files\DivX
2009-02-20 21:08 . 2009-02-20 21:22 <REP> d-------- c:\program files\TrackMania Nations ESWC
2009-02-15 22:23 . 2008-12-05 05:32 428,544 --a------ c:\windows\System32\EncDec.dll
2009-02-15 22:22 . 2008-12-05 05:32 293,376 --a------ c:\windows\System32\psisdecd.dll
2009-02-15 22:22 . 2008-12-05 05:31 217,088 --a------ c:\windows\System32\psisrndr.ax
2009-02-15 22:22 . 2008-12-05 05:31 177,664 --a------ c:\windows\System32\mpg2splt.ax
2009-02-15 22:22 . 2008-12-05 05:31 80,896 --a------ c:\windows\System32\MSNP.ax

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-13 15:53 --------- d-----w c:\users\Farid\AppData\Roaming\DNA
2009-03-13 15:43 --------- d-----w c:\program files\DNA
2009-03-12 20:27 --------- d-----w c:\programdata\Google Updater
2009-03-11 18:30 --------- d-----w c:\program files\Windows Mail
2009-03-10 19:39 27,335 ----a-w c:\users\Farid\AppData\Roaming\nvModes.dat
2009-03-10 19:16 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-10 19:16 --------- d-----w c:\program files\Ubisoft
2009-03-08 01:01 --------- d-----w c:\users\Farid\AppData\Roaming\BitTorrent
2009-03-05 21:34 --------- d-----w c:\program files\Common Files\Roxio Shared
2009-03-05 21:33 --------- d-----w c:\programdata\Roxio
2009-03-05 21:27 --------- d-----w c:\program files\Roxio
2009-03-05 21:21 --------- d-----w c:\program files\Google
2009-02-26 18:24 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-22 16:27 --------- d-----w c:\program files\adslTV
2009-02-22 16:20 --------- d-----w c:\users\Farid\AppData\Roaming\vlc
2009-02-20 11:25 --------- d-----w c:\program files\Windows Live
2009-02-15 00:03 --------- d-----w c:\program files\CAPCOM
2009-02-09 19:48 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-07 00:24 --------- d-----w c:\program files\RX14
2009-02-06 18:39 308,600 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 17:52 49,504 ----a-w c:\windows\System32\sirenacm.dll
2009-02-03 15:39 63,096 ----a-w c:\windows\system32\drivers\sfdrv01a.sys
2009-02-03 15:36 59,000 ----a-w c:\windows\system32\drivers\sfdrv01.sys
2009-02-01 16:56 --------- d-----w c:\program files\Winamp
2009-01-29 21:38 --------- d-----w c:\program files\DVDVideoSoft
2009-01-29 21:38 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-01-29 21:24 --------- d-----w c:\program files\Common Files\AVSMedia
2009-01-29 21:24 --------- d-----w c:\program files\AVS4YOU
2009-01-29 21:20 --------- d-----w c:\program files\MIKSOFT
2009-01-28 21:55 --------- d-----w c:\users\Farid\AppData\Roaming\AVS4YOU
2009-01-28 21:55 --------- d-----w c:\programdata\AVS4YOU
2009-01-25 00:57 --------- d-----w c:\program files\SEGA
2009-01-24 23:43 --------- d-----w c:\programdata\Media Center Programs
2009-01-15 06:11 827,392 ----a-w c:\windows\System32\wininet.dll
2008-06-16 14:37 174 --sha-w c:\program files\desktop.ini
2008-03-02 20:09 32 ----a-w c:\users\All Users\ezsid.dat
2008-03-02 20:09 32 ----a-w c:\programdata\ezsid.dat
2008-07-25 22:00 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-07-25 22:00 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-07-25 22:00 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2008-01-30 17:58 22 --sha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-03-13 342848]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2003-04-14 1491216]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{385886E8-F959-405D-AEA8-53E522F0198F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7F62BBC5-75E4-4939-B914-21991D03E0E3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{77BE45C3-9CE5-46CF-866A-F628CA4E7CF2}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{57F8BBBF-005C-4CAD-94DA-B7C508017205}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{9C02AE9D-B3EC-4449-ACBD-B0195EA61831}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B77B41D2-CB48-4A57-863F-E4AF93417670}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{5B9EE9F8-7E12-4434-88CA-23B84FD16FFF}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{EF43D9AD-4B49-4C5A-A16F-EFDB894E0551}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{BBCE25EB-A198-4FDD-8348-5A6CB5E40A25}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{61EC426E-EA7B-41F4-9389-E5E173147376}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"TCP Query User{700D5E29-371C-4E53-89A3-72B9A5F074BC}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{481A001A-5FB8-43E1-9288-D0E36B201857}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{29923571-EB60-400E-B837-8F8D5559D391}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{6627B0CE-32B1-4AC3-B0EA-960F54A7A884}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{CDF209D4-9992-46BE-98BE-BA3DA1EE01EE}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{3AA1C21F-3695-4B77-AB30-F1B6C6B5E203}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"TCP Query User{E0123BCC-F5D1-43C9-990B-ECAD571B428E}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{BA406458-615C-4ABA-982E-ECF9D819F95D}c:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:c:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"{5B0826AA-9460-4411-B862-EC837252C4DC}"= UDP:c:\program files\DNA\btdna.exeNA
"{ACEB822F-A789-4B9C-A332-15D25E023D6C}"= TCP:c:\program files\DNA\btdna.exeNA
"{03C222C1-0B28-403B-96D0-3DA6954CB6C5}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{625A5EC1-47F5-4EE0-BB54-35F2A78A5555}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{76B9944B-5B87-442E-9DA8-8930ACE7E2EE}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{CB68C7F0-00A3-41D8-8E7B-9AC38D829AB8}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{2F713354-0700-4E21-8814-28A6D70186D1}c:\\users\\farid\\program files\\dna\\btdna.exe"= UDP:c:\users\farid\program files\dna\btdna.exe:btdna.exe
"UDP Query User{B89C2D6A-3B64-490A-82F4-42FA370048EF}c:\\users\\farid\\program files\\dna\\btdna.exe"= TCP:c:\users\farid\program files\dna\btdna.exe:btdna.exe
"{7A32DE15-F179-451C-812F-B18215E4A4C3}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{70FC4F48-095F-4C83-8297-9E4C0C294675}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{D197D80A-80CF-4003-8AD3-5D7FFD025F72}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent
"UDP Query User{578740BB-FC7E-4BA9-BD90-A5C9DF3C02BC}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent
"TCP Query User{B21FD324-37B3-427A-99C7-E7AA44D5CBB8}c:\\users\\farid\\program files\\dna\\btdna.exe"= UDP:c:\users\farid\program files\dna\btdna.exe:btdna.exe
"UDP Query User{1C12D7E5-1FA9-4793-B7A2-648D6465CCC7}c:\\users\\farid\\program files\\dna\\btdna.exe"= TCP:c:\users\farid\program files\dna\btdna.exe:btdna.exe
"TCP Query User{654D6565-3EB6-456D-847F-EAC883A21E15}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{0AF8184A-F556-4036-9671-F11F8DC6520E}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{E16B4B51-9907-4CDA-9524-B6F9D745D874}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{BB1EB1A8-99CB-45A5-829C-63EBDB6067B6}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{5DE1D8D6-C1D9-42DC-9255-DF18BA793544}c:\\program files\\emule\\emule49b\\emule\\emule.exe"= UDP:c:\program files\emule\emule49b\emule\emule.exe:eMule
"UDP Query User{3339D312-2F58-4482-9969-3F239E6DFA40}c:\\program files\\emule\\emule49b\\emule\\emule.exe"= TCP:c:\program files\emule\emule49b\emule\emule.exe:eMule
"{D2F8A084-F25C-47DA-B8F4-DCF567791233}"= UDP:c:\program files\Winamp Remote\bin\Orb.exerb
"{5886DF0E-7195-44B9-BF1D-6C21F17019A8}"= TCP:c:\program files\Winamp Remote\bin\Orb.exerb
"{68CBECC3-244D-48C9-9D3F-9AA315C9BC8B}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exerbTray
"{0E8DB733-A9A1-4329-BBA7-C043FD3146C9}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exerbTray
"{F9D7E3A1-336A-4915-88D8-E3BE8083C99D}"= UDP:c:\program files\Winamp Remote\bin\OrbIR.exerbIR
"{443F5F0B-605F-49FC-9C46-E23A83C7CA9B}"= TCP:c:\program files\Winamp Remote\bin\OrbIR.exerbIR
"{C84862A2-22FD-4B5D-861B-2E516AEE73D8}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exerb Stream Client
"{3ABA5B57-F2F3-413B-BEEA-DA1925E1E872}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exerb Stream Client
"TCP Query User{F3E69F3D-4FCD-4B8F-9169-90D4E4BEB4A1}c:\\program files\\adsltv\\adsltv.exe"= UDP:c:\program files\adsltv\adsltv.exe:adsltv
"UDP Query User{3B420DC1-FBA9-45A5-8418-88C6160FF3FA}c:\\program files\\adsltv\\adsltv.exe"= TCP:c:\program files\adsltv\adsltv.exe:adsltv
"TCP Query User{50AC9A00-3736-4546-B651-2CC7D4ECCFF1}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{DDCA7DE5-B628-4959-83F0-EA5479BECEF5}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{15C7A9F2-7D38-41EE-9C34-88E8C4308285}c:\\program files\\adsltv\\vlc.exe"= UDP:c:\program files\adsltv\vlc.exe:VLC media player
"UDP Query User{8C38A1F3-31B1-4C9B-89A7-697D3D2E30E8}c:\\program files\\adsltv\\vlc.exe"= TCP:c:\program files\adsltv\vlc.exe:VLC media player
"TCP Query User{D06C16E1-8E38-4142-97C0-AAF1809C2068}c:\\program files\\windows sidebar\\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{0425384E-7CFC-4798-96B6-5121C7C5ED02}c:\\program files\\windows sidebar\\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"TCP Query User{BFB2F6FD-D0E9-4792-9CDD-31B321F5CF5C}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{F885B519-4555-48F4-8560-3364B0A845B1}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"{C3B0544B-A5AF-46D5-8932-4118E98BBCEC}"= UDP:c:\program files\Empire Interactive\FlatOut Ultimate Carnage\Fouc.exe:FlatOut Ultimate Carnage
"{F3A8FD11-1CBC-48AF-A9EE-AB589EBD4658}"= TCP:c:\program files\Empire Interactive\FlatOut Ultimate Carnage\Fouc.exe:FlatOut Ultimate Carnage
"TCP Query User{96EEA69B-1146-46B3-9B59-7B99594D682C}c:\\program files\\metin2_france\\metin2.bin"= UDP:c:\program files\metin2_france\metin2.bin:metin2
"UDP Query User{81788CA6-7460-4BB4-9761-E47875882F9D}c:\\program files\\metin2_france\\metin2.bin"= TCP:c:\program files\metin2_france\metin2.bin:metin2
"TCP Query User{DBC24381-DA4A-4BC4-8DB2-07E60AE488C2}c:\\program files\\emule\\emule49b\\emule\\emule.exe"= UDP:c:\program files\emule\emule49b\emule\emule.exe:eMule
"UDP Query User{04166E35-A90B-4743-A255-6043CD8EF13B}c:\\program files\\emule\\emule49b\\emule\\emule.exe"= TCP:c:\program files\emule\emule49b\emule\emule.exe:eMule
"TCP Query User{E23E2F0F-9674-4769-B2B7-93738AF561C0}c:\\program files\\adsltv\\adsltv.exe"= UDP:c:\program files\adsltv\adsltv.exe:adsltv
"UDP Query User{128C9150-3781-4CFA-B1AA-776B87514764}c:\\program files\\adsltv\\adsltv.exe"= TCP:c:\program files\adsltv\adsltv.exe:adsltv
"TCP Query User{1B06079D-A2BE-400F-863B-E3718A44B329}c:\\program files\\adsltv\\vlc.exe"= UDP:c:\program files\adsltv\vlc.exe:VLC media player
"UDP Query User{E7C99007-3842-4796-8298-343E05AF55BC}c:\\program files\\adsltv\\vlc.exe"= TCP:c:\program files\adsltv\vlc.exe:VLC media player
"TCP Query User{6B6C1B09-FD3E-4FB2-9B86-FE82C81F9EA8}c:\\program files\\windows sidebar\\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{84E1221A-29DE-4A5B-9B6A-9FB95FFBC860}c:\\program files\\windows sidebar\\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"TCP Query User{70F5590A-1E2A-4CF4-BC2E-5F0379FBB477}c:\\users\\farid\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\users\farid\program files\bittorrent\bittorrent.exe:bittorrent.exe
"UDP Query User{25EDD185-4F9E-440F-823E-5DD7813B4FF6}c:\\users\\farid\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\users\farid\program files\bittorrent\bittorrent.exe:bittorrent.exe
"{1DC3A087-CA2D-40A7-864B-05D237456686}"= UDP:c:\program files\Winamp Remote\bin\Orb.exerb
"{BFB8EC6D-221D-4715-A045-350589C9D64C}"= TCP:c:\program files\Winamp Remote\bin\Orb.exerb
"{CA28CA95-3110-4278-9E20-B6B1C320DBD2}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exerbTray
"{ADE5A2E6-ADDE-4DB9-8182-9AA742D72D26}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exerbTray
"{8F46A42B-9E02-47C0-8EF8-4350F89338A5}"= UDP:c:\program files\Winamp Remote\bin\OrbIR.exerbIR
"{D851B41B-561E-4C54-B48D-B3C529BA1128}"= TCP:c:\program files\Winamp Remote\bin\OrbIR.exerbIR
"{C78F3F0A-1C69-411D-9375-2DE300FC7578}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exerb Stream Client
"{C9520917-3A58-4E48-96DF-817A3306707C}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exerb Stream Client
"{4F84DB41-5B6A-43FD-A32C-299465A27A5F}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"TCP Query User{2332E5D1-31D4-45CD-B80E-25F68FCBD402}c:\\program files\\free download manager\\fdm.exe"= UDP:c:\program files\free download manager\fdm.exe:Free Download Manager
"UDP Query User{BC785F5B-D557-4D69-883B-D6FC82F1D042}c:\\program files\\free download manager\\fdm.exe"= TCP:c:\program files\free download manager\fdm.exe:Free Download Manager
"{3FB3832B-8FDB-4AD0-8C5D-6E1078B4DE6F}"= UDP:c:\program files\DNA\btdna.exeNA (TCP-In)
"{95CAA5F4-3873-4CE5-A5D6-943CCA1EEF42}"= TCP:c:\program files\DNA\btdna.exeNA (UDP-In)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"mW[íµˆÖ¾`=µú¾˜v%S8’ÿÙêé>grl>­Ý\†Ð=ŸàÛ±Þ"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\program files\\bcd_installed.exe"= c:\program files\bcd_installed.exe:*:Enabled:Windows Application Service

R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [2008-11-17 3668480]
S2 gupdate1c9889a470598a0;Google Update Service (gupdate1c9889a470598a0);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-06 133104]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\System32\drivers\fbxusb32.sys [2008-02-13 21344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\shell\AutoRun\command - F:\autorun.exe
\shell\setup\command - F:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7496385a-79e5-11dd-9798-001b24ed5410}]
\shell\AutoRun\command - G:\CdAutoRun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contenu du dossier 'Tâches planifiées'

2009-03-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-06 21:31]

2009-03-13 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-06 21:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-Netlog 24 - c:\program files\Netlog 24\Notifier\Netlog24Notifier.exe
HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
ShellExecuteHooks-{D0790168-28C6-42AB-8858-92B956D46B1C} - c:\windows\system32\nnnoMFvV.dll


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/ig?sourceid=navclient&hl=fr&ie=UTF-8
mStart Page = hxxp://home.sweetim.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://fr.search.yahoo.com
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: mektoube.fr\www
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-13 17:03:33
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-03-13 17:05:46
ComboFix-quarantined-files.txt 2009-03-13 16:05:42

Avant-CF: 21 655 416 832 octets libres
Après-CF: 21,665,931,264 octets libres

281 --- E O F --- 2009-03-13 11:59:19

le rapport mbam??

Ben c'est que je l'ai supprimé! Et le rapport avec! Mais là je viens de le réinstaller....mais 1 fois installé, je fais 1 examen(scan) rapide ou complet de l'ordinateur?

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1845
Windows 6.0.6001 Service Pack 1

13/03/2009 19:34:18
mbam-log-2009-03-13 (19-34-04).txt

Type de recherche: Examen rapide
Eléments examinés: 58587
Temps écoulé: 2 minute(s), 36 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bd4f7a6d-0107-4bdf-b72b-021b717b06ce} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\wga.exe (Trojan.Agent) -> No action taken.

C'est bon c'est fait! Et désolé Destrio5 pour le retard! Je devais aller rapidement faire quelques courses.

---> Je viens juste de revenir également, j'étais chez le médecin.

• Menu Démarrer > Exécuter > Tape combofix /u et valide.

• Relance MBAM, va dans Quarantaine et supprime tout.

• Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
• Double-clique sur RSIT.exe afin de lancer le programme.
• Clique sur Continue à l'écran Disclaimer.
• Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

On va supprimer les traces d'EoRezo/EoEngine.

• Télécharge Ad-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

• Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).
• Double-clique sur le raccourci d'Ad-Remover situé sur ton Bureau.

(Sous Vista, il faut cliquer droit sur le raccourci d'Ad-Remover et choisir Exécuter en tant qu'administrateur)

• Au menu principal, choisis l'option A.
• Poste le rapport qui apparaît à la fin (C:\Ad-report(date).log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

• Double-clique sur le raccourci d'Ad-Remover pour le lancer.

(Sous Vista, il faut cliquer droit sur le raccourci d'Ad-Remover et choisir Exécuter en tant qu'administrateur)

• Au menu principal, choisis l'option B.

• Coche A à l'écran de sélection :

• Puis choisis S, le programme va travailler.

• Poste le rapport qui apparaît à la fin (C:\Ad-report.log).

/!\ Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide /!\

• Désinstalle Ad-Remover et Java SE Runtime Environment 6.

• Mets à jour Java.

• Mets à jour Adobe Reader.

Quel est ton antivirus ?

• Supprime les traces de Symantec avec ceci.

Tu comptes remplacer Avast ?

• Installe Antivir et mets-le à jour.
• Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches.
• Dans Antivir, choisis Outils puis Configuration.
• Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.
• Fais un scan complet et poste le rapport.

Tutoriel : Scanner le(s) disque(s) dur(s)

Ton PC va comment ?

• Refais un scan avec RSIT et poste le rapport log.

Logfile of random's system information tool 1.05 (written by random/random)
Run by Farid at 2009-03-13 23:50:16
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 20 GB (9%) free of 231 GB
Total RAM: 2046 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:50:21, on 13/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Users\Farid\Program Files\RSIT.exe
C:\Program Files\trend micro\Farid.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/i [...] .yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/J [...] 586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate1c9889a470598a0) (gupdate1c9889a470598a0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 9698 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader - C:\Program Files\Winamp Toolbar\winamptb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2008-12-04 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-25 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2009-01-25 657904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-01-25 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-13 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-25 251504]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-09 4390912]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-13 148888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2009-03-13 342848]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2003-04-14 1491216]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-02-14 68856]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableChangePassword"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoLogoff"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"c:\program files\bcd_installed.exe"="c:\program files\bcd_installed.exe:*:Enabled:Windows Application Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\autorun.exe
shell\setup\command - F:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7496385a-79e5-11dd-9798-001b24ed5410}]
shell\AutoRun\command - G:\CdAutoRun.exe


======File associations======

.txt - open -

======List of files/folders created in the last 1 months======

2009-03-13 22:29:04 ----D---- C:\ProgramData\Avira
2009-03-13 22:29:04 ----D---- C:\Program Files\Avira
2009-03-13 22:07:43 ----D---- C:\ProgramData\NortonInstaller
2009-03-13 21:50:07 ----D---- C:\ProgramData\NOS
2009-03-13 21:50:07 ----D---- C:\Program Files\NOS
2009-03-13 21:39:17 ----D---- C:\Windows\Sun
2009-03-13 21:38:34 ----A---- C:\Windows\system32\javaws.exe
2009-03-13 21:38:34 ----A---- C:\Windows\system32\javaw.exe
2009-03-13 21:38:34 ----A---- C:\Windows\system32\java.exe
2009-03-13 21:38:34 ----A---- C:\Windows\system32\deploytk.dll
2009-03-13 21:38:19 ----D---- C:\Program Files\Java
2009-03-13 21:35:24 ----SHD---- C:\Config.Msi
2009-03-13 20:46:56 ----D---- C:\Program Files\Ad-remover
2009-03-13 20:20:30 ----D---- C:\Program Files\trend micro
2009-03-13 20:20:29 ----D---- C:\rsit
2009-03-13 20:10:19 ----D---- C:\Windows\temp
2009-03-13 20:10:18 ----A---- C:\ComboFix.txt
2009-03-13 20:05:19 ----D---- C:\ComboFix
2009-03-13 17:37:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-03-13 16:58:14 ----A---- C:\Windows\zip.exe
2009-03-13 16:58:14 ----A---- C:\Windows\VFIND.exe
2009-03-13 16:58:14 ----A---- C:\Windows\SWXCACLS.exe
2009-03-13 16:58:14 ----A---- C:\Windows\SWSC.exe
2009-03-13 16:58:14 ----A---- C:\Windows\SWREG.exe
2009-03-13 16:58:14 ----A---- C:\Windows\sed.exe
2009-03-13 16:58:14 ----A---- C:\Windows\NIRCMD.exe
2009-03-13 16:58:14 ----A---- C:\Windows\grep.exe
2009-03-13 16:58:14 ----A---- C:\Windows\fdsv.exe
2009-03-13 16:58:08 ----D---- C:\Windows\ERDNT
2009-03-13 16:55:58 ----D---- C:\Qoobox
2009-03-13 16:25:00 ----A---- C:\cleannavi.txt
2009-03-13 15:40:55 ----A---- C:\fixnavi.txt
2009-03-13 15:39:28 ----D---- C:\Program Files\Navilog1
2009-03-13 15:14:03 ----D---- C:\Users\Farid\AppData\Roaming\Malwarebytes
2009-03-13 15:13:58 ----D---- C:\ProgramData\Malwarebytes
2009-03-12 00:15:25 ----D---- C:\ProgramData\NVIDIA
2009-03-11 23:31:45 ----A---- C:\Windows\system32\infocardapi.dll
2009-03-11 23:31:44 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-03-11 23:31:41 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-03-11 23:31:41 ----A---- C:\Windows\system32\icardres.dll
2009-03-11 23:31:41 ----A---- C:\Windows\system32\icardagt.exe
2009-03-11 23:31:37 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-03-11 23:31:32 ----A---- C:\Windows\system32\PresentationHost.exe
2009-03-11 23:25:34 ----A---- C:\Windows\system32\dfshim.dll
2009-03-11 23:25:28 ----A---- C:\Windows\system32\mscoree.dll
2009-03-11 23:25:24 ----A---- C:\Windows\system32\netfxperf.dll
2009-03-11 23:25:04 ----A---- C:\Windows\system32\mscorier.dll
2009-03-11 23:24:55 ----A---- C:\Windows\system32\mscories.dll
2009-03-11 09:36:30 ----A---- C:\Windows\system32\wmp.dll
2009-03-11 09:36:28 ----A---- C:\Windows\system32\wmploc.DLL
2009-03-11 09:36:28 ----A---- C:\Windows\system32\spwmp.dll
2009-03-11 09:36:28 ----A---- C:\Windows\system32\dxmasf.dll
2009-03-11 09:35:39 ----A---- C:\Windows\system32\schannel.dll
2009-02-28 16:03:21 ----D---- C:\Program Files\K-Lite Codec Pack
2009-02-28 15:54:31 ----D---- C:\Program Files\DivX
2009-02-20 21:08:05 ----D---- C:\Program Files\TrackMania Nations ESWC
2009-02-15 22:23:00 ----A---- C:\Windows\system32\EncDec.dll
2009-02-15 22:22:57 ----A---- C:\Windows\system32\psisdecd.dll

======List of files/folders modified in the last 1 months======

2009-03-13 23:40:59 ----D---- C:\Users\Farid\AppData\Roaming\DNA
2009-03-13 22:29:10 ----D---- C:\Windows\SMINST
2009-03-13 22:29:05 ----D---- C:\Windows\system32\drivers
2009-03-13 22:29:04 ----RD---- C:\Program Files
2009-03-13 22:29:04 ----HD---- C:\ProgramData
2009-03-13 22:28:22 ----D---- C:\Windows\Tasks
2009-03-13 22:28:14 ----D---- C:\ProgramData\Google Updater
2009-03-13 22:27:57 ----SHD---- C:\System Volume Information
2009-03-13 22:20:51 ----D---- C:\Program Files\DNA
2009-03-13 22:20:48 ----SD---- C:\Windows\Downloaded Program Files
2009-03-13 22:09:05 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-03-13 22:07:53 ----SHD---- C:\Windows\Installer
2009-03-13 21:56:20 ----D---- C:\ProgramData\Adobe
2009-03-13 21:55:21 ----D---- C:\Program Files\Common Files\Adobe
2009-03-13 21:55:12 ----D---- C:\Program Files\Adobe
2009-03-13 21:54:07 ----D---- C:\Windows\System32
2009-03-13 21:39:17 ----D---- C:\Windows
2009-03-13 21:35:43 ----D---- C:\Program Files\Common Files
2009-03-13 21:31:36 ----D---- C:\Windows\Prefetch
2009-03-13 21:03:30 ----D---- C:\Windows\system32\FlashAX
2009-03-13 20:10:21 ----D---- C:\Windows\system32\fr-FR
2009-03-13 20:08:09 ----A---- C:\Windows\system.ini
2009-03-13 20:07:24 ----D---- C:\Windows\AppPatch
2009-03-13 16:43:14 ----D---- C:\Windows\system32\WDI
2009-03-12 09:33:05 ----D---- C:\Windows\rescache
2009-03-12 00:00:51 ----D---- C:\Windows\Microsoft.NET
2009-03-12 00:00:44 ----RSD---- C:\Windows\assembly
2009-03-11 23:52:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-03-11 23:49:01 ----D---- C:\Windows\system32\catroot2
2009-03-11 23:48:21 ----D---- C:\Windows\system32\XPSViewer
2009-03-11 23:48:21 ----D---- C:\Windows\system32\wbem
2009-03-11 23:48:21 ----D---- C:\Windows\system32\en-US
2009-03-11 23:46:03 ----D---- C:\Windows\system32\catroot
2009-03-11 23:46:02 ----D---- C:\Windows\inf
2009-03-11 23:42:57 ----D---- C:\Windows\winsxs
2009-03-11 19:30:15 ----D---- C:\Program Files\Windows Media Player
2009-03-11 19:30:15 ----D---- C:\Program Files\Windows Mail
2009-03-10 20:16:18 ----D---- C:\Program Files\Ubisoft
2009-03-10 20:16:14 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-08 20:24:56 ----SD---- C:\Users\Farid\AppData\Roaming\Microsoft
2009-03-08 02:01:41 ----D---- C:\Users\Farid\AppData\Roaming\BitTorrent
2009-03-05 22:34:44 ----D---- C:\Program Files\Common Files\Roxio Shared
2009-03-05 22:34:28 ----RSD---- C:\Windows\Fonts
2009-03-05 22:33:40 ----D---- C:\ProgramData\Roxio
2009-03-05 22:27:51 ----D---- C:\Program Files\Roxio
2009-03-05 22:21:19 ----D---- C:\Program Files\Google
2009-03-01 03:55:19 ----D---- C:\Windows\system32\Tasks
2009-03-01 01:15:59 ----D---- C:\Downloads
2009-02-26 19:24:52 ----D---- C:\Program Files\Microsoft Silverlight
2009-02-25 12:55:00 ----A---- C:\Windows\system32\mrt.exe
2009-02-22 17:27:35 ----D---- C:\Program Files\adslTV
2009-02-22 17:20:13 ----D---- C:\Users\Farid\AppData\Roaming\vlc
2009-02-20 12:25:15 ----D---- C:\Program Files\Windows Live
2009-02-20 12:24:46 ----SD---- C:\ProgramData\Microsoft
2009-02-20 12:22:01 ----D---- C:\Program Files\Common Files\microsoft shared
2009-02-15 22:34:11 ----D---- C:\Windows\ehome
2009-02-15 01:03:20 ----D---- C:\Program Files\CAPCOM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys [2007-02-27 11840]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2008-10-30 75072]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [2008-05-20 52032]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-12 1747936]
R3 KMWDFILTER;HIDUASDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2008-10-09 17408]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-04 7606688]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-03-05 76288]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-10-09 981504]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 BCM43XV;Pilote de la carte réseau extensible Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 E100B;Pilote de carte Intel (R) PRO; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 fbxusb;Carte réseau virtuelle FreeBox USB; C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 21344]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-31 2252800]
S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Planificateur Avira AntiVir Personal - Free Antivirus; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2007-02-12 355096]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-04 203296]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S2 gupdate1c9889a470598a0;Google Update Service (gupdate1c9889a470598a0); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-06 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-06 182768]
S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe []
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe []

-----------------EOF-----------------

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Unable to stop service Planificateur LiveUpdate automatique .
Unable to stop service stllssvr .
========== FILES ==========
File/Folder c:\program files\bcd_installed.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\c:\program files\bcd_installed.exe not found.
========== COMMANDS ==========
File delete failed. C:\Users\Farid\AppData\Local\Temp\ehmsas.txt scheduled to be deleted on reboot.
File delete failed. C:\Users\Farid\AppData\Local\Temp\~DF57CE.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\Farid\AppData\Local\Temp\~DF9D80.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\Farid\AppData\Local\Temp\~DF9DAF.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03142009_003205

Files moved on Reboot...
C:\Users\Farid\AppData\Local\Temp\ehmsas.txt moved successfully.
C:\Users\Farid\AppData\Local\Temp\~DF57CE.tmp moved successfully.
File C:\Users\Farid\AppData\Local\Temp\~DF9D80.tmp not found!
File C:\Users\Farid\AppData\Local\Temp\~DF9DAF.tmp not found!

Logfile of random's system information tool 1.05 (written by random/random)
Run by Farid at 2009-03-14 11:21:17
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 21 GB (9%) free of 231 GB
Total RAM: 2046 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:19, on 14/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Farid\Program Files\DNA\btdna.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Users\Farid\Program Files\RSIT.exe
C:\Program Files\trend micro\Farid.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/i [...] .yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Farid\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/J [...] 586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ [...] wflash.cab
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate1c9889a470598a0) (gupdate1c9889a470598a0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 9623 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader - C:\Program Files\Winamp Toolbar\winamptb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2008-12-04 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-25 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2009-01-25 657904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-01-25 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-13 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-01-25 251504]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-09 4390912]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-13 148888]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"BitTorrent DNA"=C:\Users\Farid\Program Files\DNA\btdna.exe [2008-12-19 342848]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2003-04-14 1491216]
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-07-11 223984]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-02-14 68856]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableChangePassword"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoLogoff"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\autorun.exe
shell\setup\command - F:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7496385a-79e5-11dd-9798-001b24ed5410}]
shell\AutoRun\command - G:\CdAutoRun.exe


======File associations======

.txt - open -

======List of files/folders created in the last 1 months======

2009-03-14 00:13:47 ----D---- C:\_OTMoveIt
2009-03-13 22:29:04 ----D---- C:\ProgramData\Avira
2009-03-13 22:29:04 ----D---- C:\Program Files\Avira
2009-03-13 22:07:43 ----D---- C:\ProgramData\NortonInstaller
2009-03-13 21:50:07 ----D---- C:\ProgramData\NOS
2009-03-13 21:50:07 ----D---- C:\Program Files\NOS
2009-03-13 21:39:17 ----D---- C:\Windows\Sun
2009-03-13 21:38:34 ----A---- C:\Windows\system32\javaws.exe
2009-03-13 21:38:34 ----A---- C:\Windows\system32\javaw.exe
2009-03-13 21:38:34 ----A---- C:\Windows\system32\java.exe
2009-03-13 21:38:34 ----A---- C:\Windows\system32\deploytk.dll
2009-03-13 21:38:19 ----D---- C:\Program Files\Java
2009-03-13 21:35:24 ----SHD---- C:\Config.Msi
2009-03-13 20:46:56 ----D---- C:\Program Files\Ad-remover
2009-03-13 20:20:30 ----D---- C:\Program Files\trend micro
2009-03-13 20:20:29 ----D---- C:\rsit
2009-03-13 20:10:19 ----D---- C:\Windows\temp
2009-03-13 20:10:18 ----A---- C:\ComboFix.txt
2009-03-13 20:05:19 ----D---- C:\ComboFix
2009-03-13 17:37:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-03-13 16:58:14 ----A---- C:\Windows\zip.exe
2009-03-13 16:58:14 ----A---- C:\Windows\VFIND.exe
2009-03-13 16:58:14 ----A---- C:\Windows\SWXCACLS.exe
2009-03-13 16:58:14 ----A---- C:\Windows\SWSC.exe
2009-03-13 16:58:14 ----A---- C:\Windows\SWREG.exe
2009-03-13 16:58:14 ----A---- C:\Windows\sed.exe
2009-03-13 16:58:14 ----A---- C:\Windows\NIRCMD.exe
2009-03-13 16:58:14 ----A---- C:\Windows\grep.exe
2009-03-13 16:58:14 ----A---- C:\Windows\fdsv.exe
2009-03-13 16:58:08 ----D---- C:\Windows\ERDNT
2009-03-13 16:55:58 ----D---- C:\Qoobox
2009-03-13 16:25:00 ----A---- C:\cleannavi.txt
2009-03-13 15:40:55 ----A---- C:\fixnavi.txt
2009-03-13 15:39:28 ----D---- C:\Program Files\Navilog1
2009-03-13 15:14:03 ----D---- C:\Users\Farid\AppData\Roaming\Malwarebytes
2009-03-13 15:13:58 ----D---- C:\ProgramData\Malwarebytes
2009-03-12 00:15:25 ----D---- C:\ProgramData\NVIDIA
2009-03-11 23:31:45 ----A---- C:\Windows\system32\infocardapi.dll
2009-03-11 23:31:44 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-03-11 23:31:41 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-03-11 23:31:41 ----A---- C:\Windows\system32\icardres.dll
2009-03-11 23:31:41 ----A---- C:\Windows\system32\icardagt.exe
2009-03-11 23:31:37 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-03-11 23:31:32 ----A---- C:\Windows\system32\PresentationHost.exe
2009-03-11 23:25:34 ----A---- C:\Windows\system32\dfshim.dll
2009-03-11 23:25:28 ----A---- C:\Windows\system32\mscoree.dll
2009-03-11 23:25:24 ----A---- C:\Windows\system32\netfxperf.dll
2009-03-11 23:25:04 ----A---- C:\Windows\system32\mscorier.dll
2009-03-11 23:24:55 ----A---- C:\Windows\system32\mscories.dll
2009-03-11 09:36:30 ----A---- C:\Windows\system32\wmp.dll
2009-03-11 09:36:28 ----A---- C:\Windows\system32\wmploc.DLL
2009-03-11 09:36:28 ----A---- C:\Windows\system32\spwmp.dll
2009-03-11 09:36:28 ----A---- C:\Windows\system32\dxmasf.dll
2009-03-11 09:35:39 ----A---- C:\Windows\system32\schannel.dll
2009-02-28 16:03:21 ----D---- C:\Program Files\K-Lite Codec Pack
2009-02-28 15:54:31 ----D---- C:\Program Files\DivX
2009-02-20 21:08:05 ----D---- C:\Program Files\TrackMania Nations ESWC
2009-02-15 22:23:00 ----A---- C:\Windows\system32\EncDec.dll
2009-02-15 22:22:57 ----A---- C:\Windows\system32\psisdecd.dll

======List of files/folders modified in the last 1 months======

2009-03-14 11:20:02 ----D---- C:\Users\Farid\AppData\Roaming\DNA
2009-03-14 10:28:10 ----D---- C:\Windows\Tasks
2009-03-14 10:09:49 ----D---- C:\Windows\SMINST
2009-03-14 00:36:07 ----D---- C:\Program Files\DNA
2009-03-13 22:29:05 ----D---- C:\Windows\system32\drivers
2009-03-13 22:29:04 ----RD---- C:\Program Files
2009-03-13 22:29:04 ----HD---- C:\ProgramData
2009-03-13 22:28:14 ----D---- C:\ProgramData\Google Updater
2009-03-13 22:27:57 ----SHD---- C:\System Volume Information
2009-03-13 22:20:48 ----SD---- C:\Windows\Downloaded Program Files
2009-03-13 22:09:05 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-03-13 22:07:53 ----SHD---- C:\Windows\Installer
2009-03-13 21:56:20 ----D---- C:\ProgramData\Adobe
2009-03-13 21:55:21 ----D---- C:\Program Files\Common Files\Adobe
2009-03-13 21:55:12 ----D---- C:\Program Files\Adobe
2009-03-13 21:54:07 ----D---- C:\Windows\System32
2009-03-13 21:39:17 ----D---- C:\Windows
2009-03-13 21:35:43 ----D---- C:\Program Files\Common Files
2009-03-13 21:31:36 ----D---- C:\Windows\Prefetch
2009-03-13 21:03:30 ----D---- C:\Windows\system32\FlashAX
2009-03-13 20:10:21 ----D---- C:\Windows\system32\fr-FR
2009-03-13 20:08:09 ----A---- C:\Windows\system.ini
2009-03-13 20:07:24 ----D---- C:\Windows\AppPatch
2009-03-13 16:43:14 ----D---- C:\Windows\system32\WDI
2009-03-12 09:33:05 ----D---- C:\Windows\rescache
2009-03-12 00:00:51 ----D---- C:\Windows\Microsoft.NET
2009-03-12 00:00:44 ----RSD---- C:\Windows\assembly
2009-03-11 23:52:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-03-11 23:49:01 ----D---- C:\Windows\system32\catroot2
2009-03-11 23:48:21 ----D---- C:\Windows\system32\XPSViewer
2009-03-11 23:48:21 ----D---- C:\Windows\system32\wbem
2009-03-11 23:48:21 ----D---- C:\Windows\system32\en-US
2009-03-11 23:46:03 ----D---- C:\Windows\system32\catroot
2009-03-11 23:46:02 ----D---- C:\Windows\inf
2009-03-11 23:42:57 ----D---- C:\Windows\winsxs
2009-03-11 19:30:15 ----D---- C:\Program Files\Windows Media Player
2009-03-11 19:30:15 ----D---- C:\Program Files\Windows Mail
2009-03-10 20:16:18 ----D---- C:\Program Files\Ubisoft
2009-03-10 20:16:14 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-08 20:24:56 ----SD---- C:\Users\Farid\AppData\Roaming\Microsoft
2009-03-08 02:01:41 ----D---- C:\Users\Farid\AppData\Roaming\BitTorrent
2009-03-05 22:34:44 ----D---- C:\Program Files\Common Files\Roxio Shared
2009-03-05 22:34:28 ----RSD---- C:\Windows\Fonts
2009-03-05 22:33:40 ----D---- C:\ProgramData\Roxio
2009-03-05 22:27:51 ----D---- C:\Program Files\Roxio
2009-03-05 22:21:19 ----D---- C:\Program Files\Google
2009-03-01 03:55:19 ----D---- C:\Windows\system32\Tasks
2009-03-01 01:15:59 ----D---- C:\Downloads
2009-02-26 19:24:52 ----D---- C:\Program Files\Microsoft Silverlight
2009-02-25 12:55:00 ----A---- C:\Windows\system32\mrt.exe
2009-02-22 17:27:35 ----D---- C:\Program Files\adslTV
2009-02-22 17:20:13 ----D---- C:\Users\Farid\AppData\Roaming\vlc
2009-02-20 12:25:15 ----D---- C:\Program Files\Windows Live
2009-02-20 12:24:46 ----SD---- C:\ProgramData\Microsoft
2009-02-20 12:22:01 ----D---- C:\Program Files\Common Files\microsoft shared
2009-02-15 22:34:11 ----D---- C:\Windows\ehome
2009-02-15 01:03:20 ----D---- C:\Program Files\CAPCOM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys [2007-02-27 11840]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2008-10-30 75072]
R1 eabfiltr;eabfiltr; C:\Windows\system32\DRIVERS\eabfiltr.sys [2006-11-30 8192]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-01-23 37376]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [2008-05-20 52032]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 HBtnKey;HBtnKey; C:\Windows\system32\DRIVERS\cpqbttn.sys [2006-06-28 9472]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-12 1747936]
R3 KMWDFILTER;HIDUASDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2008-10-09 17408]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-04 7606688]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-03-05 76288]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-10-09 981504]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472]
R3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 BCM43XV;Pilote de la carte réseau extensible Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 E100B;Pilote de carte Intel (R) PRO; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 fbxusb;Carte réseau virtuelle FreeBox USB; C:\Windows\system32\DRIVERS\fbxusb32.sys [2004-10-20 21344]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-10-31 2252800]
S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2006-11-02 654336]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Planificateur Avira AntiVir Personal - Free Antivirus; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 CLCapSvc;CyberLink Background Capture Service (CBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [2007-04-23 262243]
R2 CLSched;CyberLink Task Scheduler (CTS); C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [2007-04-23 106593]
R2 HP Health Check Service;HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-03-14 62984]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2007-02-12 355096]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-04 203296]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S2 gupdate1c9889a470598a0;Google Update Service (gupdate1c9889a470598a0); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-06 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-06 182768]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-01-09 110592]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

Apres avoir désactiver lEt pour réactiver la restauration du systeme, je coche le disque C: ou le disque D:HP Recovery?

C'est parfait!! Tout est nickel! Excellent travail Destrio5! Tu es trop puissant! Merci énormément!

Merci à toi aussi!