[Résolu]Deconnexion Internet + Windows: pas de disque

Bonjour,

J’ai chopper une salo… !!
L’origine: ??

Conséquences: ralentissement énorme de IE7 et deconnexion au bout de 2 mn (ça laisse peu de temps pour laisser ce message !!)

Ca correspond à l’apparition de ce nouveau message :
« Windows pas de disque
Exception processing Message c0000013 Parameters 75 etc…… »

Par ailleurs (est-ce lié ?) j’ai le message Generic Host System for Win32 Services qui est récurent ; et depuis ma dernière connexion un nouveau message sous la même forme que celui de Generic Host System mais qui débute, je crois, par Nga Tray (ou WgaTray).

Du coup, voilà où j’en suis :

1. j’ai scanné avec Antivir
2. Puis Ccleaner
3. SmitfraudFix – option 1 => rapport 1
4. HijackThis => rapport 2
5. En mode sans échec : SmitfraudFix – option 2 puis rapport 3
6. Je reviens à une cession normale : HijackThis => rapport 4

J'espère que vous aurez une piste !!

Voici les rapports :

Rapport1 :
SmitFraudFix v2.423

Rapport fait à 8:54:25.06, 06/09/2009
Executé à partir de D:\Documents and Settings\William\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\msdriver32.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ntvdm.exe
D:\Program Files\0_LesProgrammes\Office2003\OFFICE11\WINWORD.EXE
D:\Documents and Settings\William\Bureau\SmitfraudFix\Policies.exe
D:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» D:\
»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» D:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\William
»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\William\LOCALS~1\Temp
»»»»»»»»»»»»»»»»»»»»»»»» D:\Documents and Settings\William\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» D:\DOCUME~1\William\Favoris
»»»»»»»»»»»»»»»»»»»»»»»» Bureau
»»»»»»»»»»»»»»»»»»»»»»»» D:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="D:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Carte réseau Fast Ethernet PCI Realtek RTL8139 Family - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A9F69ACD-84B9-4A8C-B2C6-6E4A6141C3DB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A9F69ACD-84B9-4A8C-B2C6-6E4A6141C3DB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A9F69ACD-84B9-4A8C-B2C6-6E4A6141C3DB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin


Rapport2 :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:57:31, on 06/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\msdriver32.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\ntvdm.exe
D:\Program Files\0_LesProgrammes\Office2003\OFFICE11\WINWORD.EXE
D:\Documents and Settings\William\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\0_LesProgrammes\Java\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Microsoft Driver Setup] D:\WINDOWS\msdriver32.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] D:\WINDOWS\msdriver32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://D:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\0_LESP~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\0_LESP~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/control [...] oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/Driv [...] eqlab3.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSR System Service (msrsys) - Unknown owner - D:\WINDOWS\system\msrsys32.exe (file missing)
O23 - Service: NBService - Nero AG - D:\Program Files\0_LesProgrammes\Nero installation&désinstall\Nero120408\Nero 7\Nero BackItUp\NBService.exe

--
End of file - 4434 bytes

Rapport3
SmitFraudFix v2.423

Rapport fait à 10:08:18.31, 06/09/2009
Executé à partir de D:\Documents and Settings\William\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A9F69ACD-84B9-4A8C-B2C6-6E4A6141C3DB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A9F69ACD-84B9-4A8C-B2C6-6E4A6141C3DB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A9F69ACD-84B9-4A8C-B2C6-6E4A6141C3DB}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Rapport4
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:21, on 06/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\msdriver32.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\0_LesProgrammes\Office2003\OFFICE11\WINWORD.EXE
D:\Documents and Settings\William\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\0_LesProgrammes\Java\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Microsoft Driver Setup] D:\WINDOWS\msdriver32.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] D:\WINDOWS\msdriver32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://D:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\0_LESP~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\0_LESP~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/control [...] oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/Driv [...] eqlab3.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSR System Service (msrsys) - Unknown owner - D:\WINDOWS\system\msrsys32.exe (file missing)
O23 - Service: NBService - Nero AG - D:\Program Files\0_LesProgrammes\Nero installation&désinstall\Nero120408\Nero 7\Nero BackItUp\NBService.exe

--
End of file - 4315 bytes

Merci pour ce retour rapide Destrio5,
De mon coté, impossible de poster quoique se soit….Pas pratique !

Du coup, je ne peux poster que ce matin :

Voici les deux rapports :

1er rapport :
Logfile of random's system information tool 1.06 (written by random/random)
Run by William at 2009-09-06 20:25:55
Microsoft Windows XP Professionnel Service Pack 2
System drive D: has 5 GB (15%) free of 35 GB
Total RAM: 1023 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:25:59, on 06/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\msdriver32.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\0_LesProgrammes\Office2003\OFFICE11\WINWORD.EXE
D:\Program Files\0_LesProgrammes\Anti-virus&spyware&analyse\RSIT.exe
D:\Documents and Settings\William\Bureau\William.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\0_LesProgrammes\Java\bin\ssv.dll
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Microsoft Driver Setup] D:\WINDOWS\msdriver32.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] D:\WINDOWS\msdriver32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://D:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\0_LESP~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\0_LESP~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/control [...] oader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/Driv [...] eqlab3.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MSR System Service (msrsys) - Unknown owner - D:\WINDOWS\system\msrsys32.exe (file missing)
O23 - Service: NBService - Nero AG - D:\Program Files\0_LesProgrammes\Nero installation&désinstall\Nero120408\Nero 7\Nero BackItUp\NBService.exe

--
End of file - 4382 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - D:\Program Files\0_LesProgrammes\Java\bin\ssv.dll [2006-11-09 440056]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-18 266497]
"Microsoft Driver Setup"=D:\WINDOWS\msdriver32.exe [2009-09-03 57344]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Microsoft Driver Setup"=D:\WINDOWS\msdriver32.exe [2009-09-03 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
D:\Program Files\0_LesProgrammes\Adobe Acrobat\Reader\Reader_sl.exe [2007-05-11 40048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
D:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
D:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [2006-10-09 139264]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
D:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2008-03-17 1848648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
D:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2008-03-10 689488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
D:\WINDOWS\system32\ctfmon.exe [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo RX500]
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE /P24 EPSON Stylus Photo RX500 /O6 USB001 /M Stylus Photo RX500 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
D:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NavRegReminder]
D:\WINDOWS\temp\NavBrowser.exe [2001-09-12 212992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
D:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
D:\Program Files\0_LesProgrammes\Picasa2\PicasaMediaDetector.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
D:\WINDOWS\RTHDCPL.EXE [2006-09-12 16264192]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
D:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
D:\Program Files\0_LesProgrammes\Java\bin\jusched.exe [2006-11-09 49263]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
D:\PROGRA~1\FICHIE~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2000-08-24 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2
"wscsvc"=2
"Dnscache"=2

D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Kaspersky Anti-Hacker.lnk - D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\KAVPF.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
D:\WINDOWS\system32\WgaLogon.dll [2007-10-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\wpdshserviceobj.dll [2007-10-15 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\msrsys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\msrsys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\WINDOWS\system\msrsys32.exe"="D:\WINDOWS\system\msrsys32.exe:*:msrsys"
"%windir%"="msdriver32.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2009-09-06 20:25:55 ----D---- D:\rsit
2009-09-06 09:00:43 ----A---- D:\WINDOWS\ntbtlog.txt
2009-09-05 15:47:31 ----D---- D:\Program Files\Panda Security
2009-09-05 11:45:42 ----A---- D:\WINDOWS\system32\4new.exe
2009-09-03 14:30:28 ----RSH---- D:\WINDOWS\msdriver32.exe

======List of files/folders modified in the last 1 months======

2009-09-06 20:21:58 ----D---- D:\Program Files\0_LesProgrammes
2009-09-06 20:21:04 ----D---- D:\WINDOWS\Temp
2009-09-06 20:21:03 ----D---- D:\WINDOWS\Prefetch
2009-09-06 12:50:52 ----A---- D:\WINDOWS\SchedLgU.Txt
2009-09-06 11:12:29 ----A---- D:\WINDOWS\NeroDigital.ini
2009-09-06 10:15:38 ----D---- D:\WINDOWS
2009-09-06 10:12:32 ----D---- D:\WINDOWS\system32
2009-09-06 10:11:45 ----A---- D:\rapport.txt
2009-09-06 10:08:24 ----A---- D:\WINDOWS\system32\tmp.txt
2009-09-06 08:52:04 ----HD---- D:\Program Files\InstallShield Installation Information
2009-09-06 08:51:37 ----D---- D:\Program Files\Smart Panel
2009-09-06 08:50:25 ----D---- D:\WINDOWS\twain_32
2009-09-06 08:50:22 ----D---- D:\Program Files\EPSON
2009-09-06 08:50:19 ----HD---- D:\WINDOWS\inf
2009-09-06 08:49:11 ----D---- D:\WINDOWS\system32\CatRoot2
2009-09-06 08:48:21 ----D---- D:\WINDOWS\system32\drivers
2009-09-06 08:48:19 ----SD---- D:\WINDOWS\Downloaded Program Files
2009-09-05 18:42:01 ----A---- D:\WINDOWS\win.ini
2009-09-05 18:42:01 ----A---- D:\WINDOWS\system.ini
2009-09-05 15:47:31 ----RD---- D:\Program Files
2009-09-04 18:35:52 ----D---- D:\WINDOWS\Network Diagnostic
2009-08-12 22:44:23 ----D---- D:\Documents and Settings\William\Application Data\Azureus

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; D:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-05-27 75096]
R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-19 40320]
R1 Klif;Klif; D:\WINDOWS\System32\drivers\klif.sys [2005-08-04 129808]
R1 ssmdrv;ssmdrv; D:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R3 Arp1394;Protocole client ARP 1394; D:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-10-15 60800]
R3 avgntflt;avgntflt; \??\D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; D:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-03-15 43008]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2007-10-15 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); D:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-09-12 4381184]
R3 NIC1394;Pilote réseau 1394; D:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-10-15 61824]
R3 nv;nv; D:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
R3 pcouffin;VSO Software pcouffin; D:\WINDOWS\System32\Drivers\pcouffin.sys [2009-01-10 47360]
R3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); D:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; D:\WINDOWS\system32\DRIVERS\usbehci.sys [2007-10-15 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbhub.sys [2007-10-15 59264]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbohci.sys [2007-10-15 17152]
R3 USBSTOR;Pilote de stockage de masse USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2007-10-15 20608]
S3 61883;Pilote d'unité 61883; D:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-04 48128]
S3 Avc;Périphérique AVC; D:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-04 38912]
S3 CCDECODE;Décodeur sous-titre fermé; D:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 DSDrv4;DSDrv4; FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; D:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 MSDV;Microsoft DV Camera and VCR; D:\WINDOWS\system32\DRIVERS\msdv.sys [2004-08-04 51328]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; D:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; D:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 SLIP;Détrameur décalage BDA; D:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); D:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; D:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbccgp;Pilote parent générique USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Classe d'imprimantes USB Microsoft; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;Pilote de scanneur USB; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WSTCODEC;Codec Teletext standard; D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2007-10-15 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2007-10-15 82944]
S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler; D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-25 68865]
R2 AntiVirService;AntiVir PersonalEdition Classic Guard; D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-25 151297]
S2 msrsys;MSR System Service; D:\WINDOWS\system\msrsys32.exe []
S3 gusvc;Google Updater Service; D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 NBService;NBService; D:\Program Files\0_LesProgrammes\Nero installation&désinstall\Nero120408\Nero 7\Nero BackItUp\NBService.exe [2006-10-09 724992]
S3 ose;Office Source Engine; D:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; D:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2004-08-19 14336]

-----------------EOF-----------------


2d rapport :
info.txt logfile of random's system information tool 1.06 2009-09-06 20:26:01

======Uninstall list======

#1 Video Converter 4.1.44-->"D:\Program Files\0_LesProgrammes\VideoTOX Converter\NO1 Video Converter\unins000.exe"
-->D:\Program Files\0_LesProgrammes\Nero installation&désinstall\Nero120408\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->D:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->D:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->D:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->D:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->D:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 D:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 5.0 Sprint Plus-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
Adobe Flash Player ActiveX-->D:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->D:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop 7.0-->D:\WINDOWS\ISUN040C.EXE -f"D:\Program Files\0_LesProgrammes\Adobe Photoshop\Uninst.isu" -c"D:\Program Files\0_LesProgrammes\Adobe Photoshop\Uninst.dll"
Adobe Premiere 6.0-->D:\WINDOWS\UNIN040C.EXE -f"d:\program files\0_lesprogrammes\adobe-premiere\DeIsL1.isu" -c"d:\program files\0_lesprogrammes\adobe-premiere\Uninst.dll"
Adobe Reader 8.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81000000003}
adsl TV-->D:\Program Files\0_LesProgrammes\ADSLTV\Uninstal.exe
Archiveur WinRAR-->D:\Program Files\0_LesProgrammes\Winrar\uninstall.exe
ArcSoft Software Suite-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{66C8BE35-8BBB-472B-96C7-C7C9A499F988}\SETUP.EXE" -l0x40c
AutoScreenShot-->D:\Program Files\0_LesProgrammes\AutoScreenShot\uninstall.exe
Avira AntiVir Personal - Free Antivirus-->D:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Azureus-->D:\Program Files\0_LesProgrammes\Azureus\Uninstall.exe
Canon MP Navigator EX 2.0-->"D:\Program Files\Canon\MP Navigator EX 2.0\Maint.exe" /UninstallRemove D:\Program Files\Canon\MP Navigator EX 2.0\uninst.ini
Canon MP540 series MP Drivers-->"D:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series /L0x000c
Canon Utilities Easy-PhotoPrint EX-->D:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe uninst.ini
Canon Utilities My Printer-->D:\Program Files\Canon\MyPrinter\uninst.exe uninst.ini
Canon Utilities Solution Menu-->D:\Program Files\Canon\SolutionMenu\uninst.exe uninst.ini
CCleaner (remove only)-->"D:\Program Files\0_LesProgrammes\Ccleaner\uninst.exe"
Cleaner 5 EZ-->D:\WINDOWS\unvise32.exe D:\PROGRAM FILES\0_LESPROGRAMMES\CLEANER5EZ(INSTALAPARTIRADOBEPREMIERE)\uninstal.log
ConvertXtoDVD 3.3.4.106e-->"D:\Program Files\0_LesProgrammes\VSO_ConvertToDVD\3\unins000.exe"
dBpoweramp Music Converter-->"D:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>D:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat
dBpoweramp Ogg Vorbis Codec-->"D:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>D:\WINDOWS\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat
DVD Shrink 3.2-->"D:\Program Files\0_LesProgrammes\DVDshrink\DVD Shrink\unins000.exe"
Enregistrement utilisateur de Canon MP540 series-->D:\Program Files\Canon\IJEREG\MP540 series\UNINST.EXE
EVEREST Home Edition v2.20-->"D:\Program Files\0_LesProgrammes\Everest a conserver !\EVEREST Home Edition\unins000.exe"
FileZilla Client 3.0.1-->D:\Program Files\0_LesProgrammes\FileZilla Client\uninstall.exe
HijackThis 2.0.2-->"D:\Documents and Settings\William\Bureau\HijackThis.exe" /uninstall
HomePlayer 1.5.4-->D:\Program Files\HomePlayer1.5.4\uninst.exe
HP L1740 Driver Software-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{B7799EB2-9F02-4C55-BD63-109501FB321E}\Setup.exe" -l0x40c
IsoBuster 1.9.1-->"D:\Program Files\0_LesProgrammes\IsoBuster\Uninst\unins000.exe"
IZArc 3.4.1.5-->"D:\Program Files\0_LesProgrammes\IZArc\unins000.exe"
J2SE Development Kit 5.0 Update 10-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0150100}
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
Kaspersky Anti-Hacker-->"D:\Program Files\0_LesProgrammes\Kaspersky Anti-Hacker\uninstall.exe"
Lame ACM MP3 Codec-->D:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_LameMP3 132 D:\WINDOWS\INF\LameACM.inf
Macromedia Flash Player 8-->MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Micro Application - PrintPratic 4-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{EC79B672-686B-4C0A-9402-12EA1A04A99C}\Setup.exe" -l0x40c
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{1787603C-E6E3-42D4-8034-55F358486F1D}
Nero 7 Ultra Edition-->MsiExec.exe /I{F14B8ECC-BDA0-4987-9201-D7B7DBE11036}
PhotoFiltre-->"D:\Program Files\0_LesProgrammes\PhotoFiltre\Uninst.exe"
Picasa 3-->"D:\Program Files\0_LesProgrammes\PICASA\Picasa3\Uninstall.exe"
PIF DESIGNER2.1-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{23B59B9F-C360-11D7-875B-0090CC005647}\SETUP.EXE" -l0x40c anything
Realtek High Definition Audio Driver-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
ScanToWeb-->RunDll32 D:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "D:\Program Files\InstallShield Installation Information\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}\SETUP.EXE" ADDREMOVEDLG
SpeedFan (remove only)-->"D:\Program Files\0_LesProgrammes\SpeedFan\uninstall.exe"
System Requirements Lab-->D:\Program Files\SystemRequirementsLab\Uninstall.exe
TeLL me More-->"D:\PROGRAM FILES\0_LESPROGRAMMES\TELLMEMORE_APPRENDREANGLAIS\TELL ME MORE NV\BIN\unsetup.exe" -file "D:\PROGRAM FILES\0_LESPROGRAMMES\TELLMEMORE_APPRENDREANGLAIS\TELL ME MORE NV\unsetup.aui"
THE Rename 2.1.6-->"D:\Program Files\0_LesProgrammes\The Rename 2.1.6\unins000.exe"
Total Video Converter 3.14 080930-->"D:\Program Files\0_LesProgrammes\Total Video Converter 3.14 With Working Code Original Serial No. & Portable Total Video Converter 3.14 [Portable]\Total Video Converter\unins000.exe"
VIA Platform Device Manager-->D:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
VIA Rhine-Family Fast Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VSO Image Resizer 1.3.4-->"D:\Program Files\0_LesProgrammes\VSO IMAGE RESIZER 1.2.1\Image Resizer\unins000.exe"
Xvid 1.1.2 final uninstall-->"D:\Program Files\0_LesProgrammes\Codecs\XVid\Xvid\unins000.exe"

======Security center information======

AV: Avira AntiVir PersonalEdition (outdated)
FW: Kaspersky Anti-Hacker

======System event log======

Computer Name: THEK
Event Code: 7036
Message: Le service Détection matériel noyau est entré dans l'état : en cours d'exécution.

Record Number: 20611
Source Name: Service Control Manager
Time Written: 20090705153328.000000+120
Event Type: Informations
User:

Computer Name: THEK
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Détection matériel noyau.

Record Number: 20610
Source Name: Service Control Manager
Time Written: 20090705153328.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: THEK
Event Code: 7011
Message: Délai (30000 millisecondes) d'attente pour une réponse du service stisvc à une transaction.

Record Number: 20609
Source Name: Service Control Manager
Time Written: 20090705153328.000000+120
Event Type: erreur
User:

Computer Name: THEK
Event Code: 7036
Message: Le service NLA (Network Location Awareness) est entré dans l'état : en cours d'exécution.

Record Number: 20608
Source Name: Service Control Manager
Time Written: 20090705152822.000000+120
Event Type: Informations
User:

Computer Name: THEK
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service NLA (Network Location Awareness).

Record Number: 20607
Source Name: Service Control Manager
Time Written: 20090705152822.000000+120
Event Type: Informations
User: THEK\William

=====Application event log=====

Computer Name: THEK
Event Code: 4096
Message:
Record Number: 1626
Source Name: Avira AntiVir
Time Written: 20090525133037.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: THEK
Event Code: 1000
Message: Application défaillante svchost.exe, version 5.1.2600.2180, module défaillant unknown, version 0.0.0.0, adresse de défaillance 0x001f1cb0.

Record Number: 1625
Source Name: Application Error
Time Written: 20090525090713.000000+120
Event Type: erreur
User:

Computer Name: THEK
Event Code: 4096
Message:
Record Number: 1624
Source Name: Avira AntiVir
Time Written: 20090525082301.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: THEK
Event Code: 4096
Message:
Record Number: 1623
Source Name: Avira AntiVir
Time Written: 20090524224905.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: THEK
Event Code: 4113
Message:
Record Number: 1622
Source Name: Avira AntiVir
Time Written: 20090521092632.000000+120
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0f02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Bonjour (et encore merci DESTRIO pour ton suivi).

A noter: je n'ai eu hier que le temps d'effectuer les opérations décrites. Je n'ai pas refait de tentatives de connexion à internet. Toutefois, n'ayant pas encore debuter de nettoyage, je ne vois pas pq cela marcherait mieux !!


Voici le rapport:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========

Service\Driver msrsys deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\D:\WINDOWS\system\msrsys32.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\%windir% deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\msrsys\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\msrsys\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\\Microsoft Driver Setup deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Microsoft Driver Setup deleted successfully.
========== FILES ==========
File/Folder D:\WINDOWS\system\msrsys32.exe not found.
D:\WINDOWS\system32\tmp.txt moved successfully.
D:\WINDOWS\msdriver32.exe moved successfully.
D:\WINDOWS\system32\4new.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 138642 bytes

User: William
File delete failed. D:\Documents and Settings\William\Local Settings\Temp\BCG1.tmp scheduled to be deleted on reboot.
->Temp folder emptied: 647006352 bytes
->Temporary Internet Files folder emptied: 161246 bytes
->Java cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114013 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 733920 bytes
RecycleBin emptied: 8751 bytes

Total Files Cleaned = 620.11 mb


OTM by OldTimer - Version 3.0.0.6 log created on 09072009_203432

Files moved on Reboot...
File D:\Documents and Settings\William\Local Settings\Temp\BCG1.tmp not found!

Registry entries deleted on Reboot...

Juste une précision Destrio: j'ai deconnecté ma connexion internet: je dois la rebrancher pour effectuer les OP ci-dessus (car je vois que tu me demandes de fermer les navigateurs) ?

Dac o dac: à ce soir....ou plus vraisemblablement: à demain

--> La manip' avec OTM ?

Tu as une ancienne version d'AntiVir.

• Désinstalle AntiVir.

• Installe AntiVir et mets-le à jour.
• Double-clique sur l'icône d'AntiVir (Parapluie) dans la barre des tâches.
• Dans AntiVir, choisis Outils puis Configuration.
• Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages puis valide.
• Fais un scan complet, clique sur Tout réparer si AntiVir trouve quelque chose et poste le rapport.

Tutoriel : Scanner le(s) disque(s) dur(s)

• Mets à jour Java.

• Mets à jour Adobe Reader.

Plus de souci ?