[OK] Petit souci avec Trojan Vrtumondo récalcitrant

[nickW]

Bonsoir,

Il faudrait effectuer l'étape 8 ci-dessus de façon à créer un nouveau fichier OTL.Txt que tu enverras sur le forum.

A suivre,

[dahu74]

Bonjour,
Voilà le bébé......
Depuis hier je n'ai plus de fenêtre tentant de s'ouvrir avec firefox, ton intervention a déjà réglé les principaux problèmes.

OTL logfile created on: 16/11/2010 10:23:02 - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Christophe\Bureau
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 74,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 23,79 Gb Total Space | 6,14 Gb Free Space | 25,82% Space Free | Partition Type: NTFS
Drive D: | 218,23 Gb Total Space | 105,65 Gb Free Space | 48,41% Space Free | Partition Type: NTFS
Drive F: | 209,96 Gb Total Space | 69,01 Gb Free Space | 32,87% Space Free | Partition Type: NTFS
Drive G: | 14,65 Gb Total Space | 14,21 Gb Free Space | 96,98% Space Free | Partition Type: NTFS
Drive L: | 931,51 Gb Total Space | 423,60 Gb Free Space | 45,47% Space Free | Partition Type: NTFS
Drive M: | 465,76 Gb Total Space | 42,57 Gb Free Space | 9,14% Space Free | Partition Type: NTFS

Computer Name: ANTEC | User Name: Christophe | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/12 02:13:50 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Christophe\Bureau\OTL.exe
PRC - [2010/10/31 18:25:51 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/10/31 18:25:49 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/10/31 18:23:35 | 012,487,856 | ---- | M] (Mozilla Messaging) -- C:\Program Files\Mozilla Thunderbird\thunderbird.exe
PRC - [2010/09/02 08:41:06 | 000,307,200 | ---- | M] (philippe734 - Vous devez exécuter le programme en tant qu'administrateur) -- C:\Program Files\VPN Lifeguard\VpnLifeguard.exe
PRC - [2009/11/25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast4\ashDisp.exe
PRC - [2009/11/25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast4\ashServ.exe
PRC - [2009/11/25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast4\ashMaiSv.exe
PRC - [2009/11/25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast4\ashWebSv.exe
PRC - [2009/11/25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Avast4\aswUpdSv.exe
PRC - [2009/08/29 07:00:12 | 000,966,656 | ---- | M] () -- C:\Documents and Settings\Christophe\Local Settings\Apps\F.lux\flux.exe
PRC - [2008/05/02 05:15:46 | 000,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe
PRC - [2008/04/14 03:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/12/18 14:34:36 | 000,868,352 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2006/07/13 16:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
PRC - [2006/07/13 16:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
PRC - [2006/07/13 07:12:26 | 000,729,088 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
PRC - [2006/04/03 18:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
PRC - [2001/10/16 18:38:16 | 000,077,824 | ---- | M] (http://www.reseau.org/keymap) -- C:\Program Files\KeyMap\Keymap.exe


========== Modules (SafeList) ==========

MOD - [2010/11/12 02:13:50 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Christophe\Bureau\OTL.exe
MOD - [2010/08/23 17:12:39 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2008/05/02 05:15:35 | 000,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll
MOD - [2007/12/05 00:41:00 | 001,474,560 | ---- | M] () -- C:\WINDOWS\system32\nview.dll
MOD - [2007/12/05 00:41:00 | 000,327,680 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvwrsfr.dll
MOD - [2007/12/05 00:41:00 | 000,081,920 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvwddi.dll
MOD - [2006/05/03 22:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll
MOD - [2001/10/16 18:52:36 | 000,053,248 | ---- | M] (http://www.reseau.org/keymap) -- C:\Program Files\KeyMap\MAP.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/11/25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009/11/25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009/11/25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009/11/25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2008/04/16 00:21:52 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2007/06/27 18:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006/07/13 16:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)
SRV - [2006/07/13 16:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)
SRV - [2006/04/03 18:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface)
SRV - [2005/04/04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/07/29 02:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose)


========== Driver Services (SafeList) ==========

DRV - [2009/12/12 00:48:04 | 000,025,984 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2009/11/25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009/11/25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2009/11/25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009/11/25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009/11/25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009/11/25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009/10/04 22:33:14 | 000,115,312 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\keyscrambler.sys -- (KeyScrambler)
DRV - [2009/08/05 19:01:34 | 000,104,512 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2009/02/17 18:11:30 | 000,024,232 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV - [2009/01/21 14:25:22 | 000,137,384 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cbfs32.sys -- (CbFs)
DRV - [2009/01/20 21:31:31 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008/11/05 16:05:59 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/04/13 17:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/12/05 00:41:00 | 007,435,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2007/07/03 18:10:12 | 000,132,904 | ---- | M] (Ahead Software AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\imagesrv.sys -- (imagesrv)
DRV - [2007/07/03 18:10:10 | 000,011,304 | ---- | M] (Ahead Software AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\imagedrv.sys -- (imagedrv)
DRV - [2007/01/16 02:09:06 | 000,293,888 | R--- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV - [2006/08/14 07:51:28 | 000,105,344 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2006/07/11 14:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/07/11 14:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006/03/17 10:18:58 | 000,392,960 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
DRV - [2005/12/12 20:12:01 | 000,049,664 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync04.sys -- (sfsync04) StarForce Protection Synchronization Driver (version 4.x)
DRV - [2005/11/21 06:48:21 | 000,016,512 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [2005/08/30 01:49:38 | 000,094,000 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssm_mdm.sys -- (ssm_mdm)
DRV - [2005/08/30 01:49:34 | 000,008,336 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssm_mdfl.sys -- (ssm_mdfl)
DRV - [2005/08/30 01:47:38 | 000,058,320 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssm_bus.sys -- (ssm_bus) SAMSUNG Mobile USB Device II 1.0 driver (WDM)
DRV - [2005/08/10 13:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005/05/16 14:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/08/13 03:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2003/12/05 19:46:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2003/05/07 14:54:38 | 000,008,960 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbbc2.sys -- (PLUsbbc2)
DRV - [2002/09/16 18:07:24 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\PQNTDRV.sys -- (PQNTDrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "google.fr"
FF - prefs.js..browser.search.defaultenginename: "google.fr"
FF - prefs.js..browser.search.order.1: "google.fr"
FF - prefs.js..browser.search.selectedEngine: "Google France - France"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.torrent411.com/browse.php?c9=1&c34=1&c30=1&c77=1&c110=1&c92=1&c94=1&submit.x=88&submit.y=16|http://www.demonoid.com/error_messages.php?error_id=7|http://www.rue89.com/|http://www.liberation.fr/|http://tempsreel.nouvelobs.com/index.html|http://www.marianne2.fr/|http://www.rhone-alpesolidaires.org/offres_emploi|http://www.creai-ra.com/|http://www.ca-des-savoie.fr/|http://www.actuchomage.org/|http://assiste.forum.free.fr/viewtopic.php?t=27142"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: uploader@adblockfilters.mozdev.org:2.1
FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19
FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:1.0.5
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.2
FF - prefs.js..extensions.enabledItems: {6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}:0.9.1
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:3.3.5
FF - prefs.js..extensions.enabledItems: {340c2bbc-ce74-4362-90b5-7c26312808ef}:1.5.1
FF - prefs.js..extensions.enabledItems: {9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}:3.0.5
FF - prefs.js..extensions.enabledItems: {6614d11d-d21d-b211-ae23-815234e1ebb5}:1.0.21
FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.14.2
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.5.1
FF - prefs.js..extensions.enabledItems: {3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}:0.8.19
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 8118
FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"
FF - prefs.js..network.proxy.socks: "127.0.0.1"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.ssl: "127.0.0.1"
FF - prefs.js..network.proxy.ssl_port: 8118


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/11 21:56:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/12 10:05:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/10/31 18:23:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010/10/09 11:56:10 | 000,000,000 | ---D | M]

[2010/01/08 23:15:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Extensions
[2010/01/08 23:15:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/11/15 13:40:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions
[2010/11/13 14:16:59 | 000,000,000 | ---D | M] (Firefox Sync) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
[2010/11/12 03:12:42 | 000,000,000 | ---D | M] (Flashblock) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2010/11/12 03:12:42 | 000,000,000 | ---D | M] (ShowIP) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}
[2010/11/12 03:12:42 | 000,000,000 | ---D | M] (Dr.Web anti-virus link checker) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2010/07/27 11:14:41 | 000,000,000 | ---D | M] (Google Analytics Opt-out Browser Add-on) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}
[2010/11/12 03:12:42 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/09/29 09:29:17 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010/11/12 03:12:42 | 000,000,000 | ---D | M] (CookieSafe) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}
[2010/11/12 03:12:42 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/11/12 23:09:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010/01/31 19:08:46 | 000,000,000 | ---D | M] (Ecosia (eco-friendly search engine)) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}
[2010/11/05 07:58:20 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2008/12/06 17:10:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2010/09/30 09:40:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\foxmarks@kei.com
[2010/11/13 14:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\extensions\uploader@adblockfilters.mozdev.org
[2009/09/21 11:20:08 | 000,001,423 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\bittorrent.xml
[2009/09/21 11:20:08 | 000,001,945 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\ciao.xml
[2008/11/05 16:42:16 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\daemon-search.xml
[2009/09/21 11:20:08 | 000,001,943 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\divxovore.xml
[2009/09/21 11:20:08 | 000,002,494 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\google-france---france.xml
[2009/09/21 11:20:08 | 000,002,183 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\google-maps-france.xml
[2009/09/21 11:20:09 | 000,001,364 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\kelkoo.xml
[2008/08/28 22:45:26 | 000,001,103 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\meteofrance.xml
[2008/05/30 09:39:49 | 000,001,206 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\mininova.xml
[2008/04/16 22:28:11 | 000,002,520 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\mozilla-add-ons.xml
[2009/09/21 11:20:10 | 000,001,984 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\mycroft-project.xml
[2009/09/21 11:20:07 | 000,002,643 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\pc-astuces.xml
[2008/11/16 11:25:52 | 000,000,862 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\rechercher-dans-quidfr.xml
[2009/12/05 16:07:05 | 000,001,859 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\searchgeek.xml
[2009/09/21 11:20:09 | 000,001,774 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\sherlock-cherche.xml
[2009/09/21 11:20:10 | 000,004,578 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\smartorrent.xml
[2008/05/30 09:39:49 | 000,001,110 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\the-pirate-bay.xml
[2010/04/13 14:10:26 | 000,000,402 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\veosearch.xml
[2009/09/21 11:20:10 | 000,001,103 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\viamichelin---francais.xml
[2010/05/20 16:55:38 | 000,001,244 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\winamp-search.xml
[2010/11/12 03:16:32 | 000,002,306 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Mozilla\Firefox\Profiles\y1vsywve.default\searchplugins\wot-safe-search.xml
[2010/11/15 13:40:13 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2008/11/04 18:02:50 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
[2010/07/12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
[2007/03/10 00:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
[2010/10/05 08:50:28 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2010/10/05 08:50:28 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/10/05 08:50:28 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2008/08/25 21:28:47 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml
[2010/10/05 08:50:28 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2010/10/05 08:50:28 | 000,000,956 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2009/09/11 18:17:29 | 000,927,264 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 www.abx4.com #[Adware.ABXToolbar]
O1 - Hosts: 127.0.0.1 acezip.net #[SiteAdvisor.acezip.net]
O1 - Hosts: 127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
O1 - Hosts: 127.0.0.1 phpadsnew.abac.com
O1 - Hosts: 127.0.0.1 a.abnad.net
O1 - Hosts: 127.0.0.1 b.abnad.net
O1 - Hosts: 127.0.0.1 c.abnad.net #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 d.abnad.net
O1 - Hosts: 127.0.0.1 e.abnad.net
O1 - Hosts: 127.0.0.1 t.abnad.net
O1 - Hosts: 127.0.0.1 banners.absolpublisher.com
O1 - Hosts: 127.0.0.1 tracking.absolstats.com
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 gtb5.acecounter.com
O1 - Hosts: 127.0.0.1 gtcc1.acecounter.com
O1 - Hosts: 127.0.0.1 gtp1.acecounter.com #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 acestats.com
O1 - Hosts: 127.0.0.1 www.acestats.com
O1 - Hosts: 26612 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [avast!] C:\Program Files\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKCU..\Run: [F.lux] C:\Documents and Settings\Christophe\Local Settings\Apps\F.lux\flux.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\KeyMap.lnk = C:\Program Files\KeyMap\Keymap.exe (http://www.reseau.org/keymap)
O4 - Startup: C:\Documents and Settings\Christophe\Menu Démarrer\Programmes\Démarrage\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Christophe\Menu Démarrer\Programmes\Démarrage\VPN Lifeguard.lnk = C:\Program Files\VPN Lifeguard\VpnLifeguard.exe (philippe734 - Vous devez exécuter le programme en tant qu'administrateur)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\MDIEEx.dll (Tomato)
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\MDIEEx.dll (Tomato)
O8 - Extra context menu item: Download with Xilisoft Dailymotion Vidéo Convertisseur - C:\Program Files\Dailymotion Video Converter\upod_link.HTM ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Christophe\Application Data\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\MDIEEx.dll (Tomato)
O9 - Extra 'Tools' menuitem : Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\MDIEEx.dll (Tomato)
O9 - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/ ... ontrol.cab (Reg Error: Key error.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... vc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://www.zebulon.fr/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_17)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/01/24 09:43:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/05/20 11:38:24 | 000,000,000 | ---D | M] - F:\Autoplay -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/16 00:46:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/11/15 11:19:14 | 000,000,000 | ---D | C] -- C:\Program Files\GPLGS
[2010/11/15 10:37:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Christophe\Application Data\Office Genuine Advantage
[2010/11/15 10:12:17 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/11/14 12:40:16 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/14 12:40:15 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/14 12:40:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/14 00:38:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010/11/14 00:30:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas
[2010/11/14 00:30:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr
[2010/11/14 00:30:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits
[2010/11/14 00:28:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic
[2010/11/14 00:26:44 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[2010/11/13 22:51:59 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes
[2010/11/13 10:37:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
[2010/11/13 10:18:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
[2010/11/13 10:18:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
[2010/11/12 23:09:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Christophe\Application Data\DVDVideoSoftIEHelpers
[2010/11/12 23:09:21 | 000,000,000 | ---D | C] -- F:\DVDVideoSoft
[2010/11/12 23:09:08 | 000,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\DVDVideoSoft
[2010/11/12 23:09:07 | 000,000,000 | ---D | C] -- C:\Program Files\Free YouTube to MP3 Converter
[2010/11/12 16:08:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Christophe\Application Data\Spamihilator
[2010/11/12 16:08:00 | 000,000,000 | ---D | C] -- C:\Program Files\Spamihilator
[2010/11/12 13:27:24 | 000,000,000 | ---D | C] -- C:\Program Files\Directory Lister
[2010/11/12 13:03:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Christophe\Application Data\Spyware Terminator
[2010/11/12 13:03:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2010/11/12 03:45:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie7updates
[2010/11/12 03:43:07 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2010/11/12 03:37:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2010/11/12 03:36:22 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2010/11/12 03:22:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2010/11/12 02:18:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/11/12 02:15:53 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/11/12 02:13:48 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Christophe\Bureau\OTL.exe
[2010/11/12 01:20:30 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis
[2010/11/11 19:24:01 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2010/11/11 19:24:01 | 000,000,000 | ---D | C] -- C:\rsit
[2010/11/11 18:10:29 | 000,000,000 | ---D | C] -- C:\Program Files\Virtu Monde Removal Tool
[2010/11/11 18:06:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/11/08 15:35:08 | 000,000,000 | ---D | C] -- C:\Program Files\Winamp Detect
[2010/10/23 22:22:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2010/08/31 21:18:50 | 000,455,888 | ---- | C] ( ) -- C:\Program Files\Fichiers communs\PredictAdInstaller.exe
[2008/07/19 00:10:12 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Christophe\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/11/16 10:19:00 | 000,001,062 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/16 09:53:38 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job
[2010/11/16 09:53:35 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2010/11/16 09:51:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/15 20:00:00 | 000,000,444 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Synchro temporaire fichiers travail Caro.job
[2010/11/15 18:00:21 | 000,000,432 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Synchro docs Caro Toshiba et Antec.job
[2010/11/15 14:30:08 | 000,000,436 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Synchro videos entre Antec et MyBook.job
[2010/11/15 14:16:52 | 000,000,442 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Sauvegarde Documents d'Antec sur MyBook.job
[2010/11/15 14:06:36 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack BAL sauvegarde antec vers mybook.job
[2010/11/15 11:00:08 | 000,000,382 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Bookmarks.job
[2010/11/15 10:38:02 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/14 22:40:22 | 000,161,723 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/11/14 19:59:10 | 001,044,696 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/14 18:07:52 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/11/14 18:05:40 | 000,500,814 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2010/11/14 18:05:40 | 000,432,670 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/14 18:05:40 | 000,080,856 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2010/11/14 18:05:40 | 000,067,626 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/14 12:40:19 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2010/11/14 01:52:58 | 000,003,119 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/11/14 00:39:07 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/11/14 00:27:53 | 000,252,240 | RHS- | M] () -- C:\ntldr
[2010/11/13 22:46:40 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Microsoft\Internet Explorer\Quick Launch\Bureau.scf
[2010/11/13 22:45:10 | 000,000,230 | RHS- | M] () -- C:\boot.ini
[2010/11/13 22:34:37 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\Christophe\defogger_reenable
[2010/11/13 22:26:18 | 000,364,032 | ---- | M] () -- C:\Documents and Settings\Christophe\Bureau\rkill.com
[2010/11/13 22:24:10 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Christophe\Bureau\Defogger.exe
[2010/11/12 02:16:03 | 000,000,767 | ---- | M] () -- C:\Documents and Settings\Christophe\Menu Démarrer\Programmes\Démarrage\ERUNT AutoBackup.lnk
[2010/11/12 02:14:10 | 000,000,383 | ---- | M] () -- C:\Documents and Settings\Christophe\Bureau\scan.zip
[2010/11/12 02:13:50 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Christophe\Bureau\OTL.exe
[2010/11/12 01:06:51 | 000,000,425 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/11/09 14:00:21 | 000,000,436 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Synchro photos entre Antec et MyBook.job
[2010/11/09 11:30:33 | 000,000,438 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Synchro musique entre Antec et MyBook.job
[2010/11/08 15:35:08 | 000,000,672 | ---- | M] () -- C:\Documents and Settings\Christophe\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
[2010/11/02 13:13:26 | 000,137,216 | ---- | M] () -- C:\Documents and Settings\Christophe\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2010/11/15 11:18:45 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2010/11/14 12:40:19 | 000,000,714 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2010/11/14 00:14:29 | 000,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img
[2010/11/14 00:14:23 | 000,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2010/11/14 00:14:12 | 000,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod
[2010/11/13 22:34:31 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\Christophe\defogger_reenable
[2010/11/13 22:26:09 | 000,364,032 | ---- | C] () -- C:\Documents and Settings\Christophe\Bureau\rkill.com
[2010/11/13 22:24:09 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Christophe\Bureau\Defogger.exe
[2010/11/13 10:18:39 | 000,000,236 | ---- | C] () -- C:\WINDOWS\tasks\OGALogon.job
[2010/11/12 02:16:03 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\Christophe\Menu Démarrer\Programmes\Démarrage\ERUNT AutoBackup.lnk
[2010/11/12 02:14:10 | 000,000,383 | ---- | C] () -- C:\Documents and Settings\Christophe\Bureau\scan.zip
[2010/11/11 15:16:17 | 000,000,425 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/06/10 22:58:41 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\CP30FW.DLL
[2010/05/17 17:16:40 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/06/19 08:02:48 | 000,001,208 | ---- | C] () -- C:\WINDOWS\Radio_Fr.ini
[2009/01/20 21:12:12 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2008/12/02 20:29:26 | 000,000,067 | ---- | C] () -- C:\WINDOWS\My Video Converter.INI
[2008/11/06 10:32:15 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2008/09/14 16:59:27 | 000,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe
[2008/08/26 05:24:26 | 000,000,050 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/07/19 00:10:15 | 000,000,033 | ---- | C] () -- C:\Documents and Settings\Christophe\Application Data\pcouffin.log
[2008/07/19 00:10:12 | 000,081,920 | ---- | C] () -- C:\Documents and Settings\Christophe\Application Data\ezpinst.exe
[2008/07/19 00:10:12 | 000,007,176 | ---- | C] () -- C:\Documents and Settings\Christophe\Application Data\pcouffin.cat
[2008/07/19 00:10:12 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Christophe\Application Data\pcouffin.inf
[2008/06/15 23:29:12 | 000,000,046 | ---- | C] () -- C:\WINDOWS\3D Text Factory.INI
[2008/06/01 17:30:51 | 000,006,461 | ---- | C] () -- C:\WINDOWS\easyc.ini
[2008/06/01 17:30:40 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL
[2008/06/01 17:30:40 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2008/05/09 00:14:03 | 000,000,525 | ---- | C] () -- C:\WINDOWS\Viewer.INI
[2008/04/21 23:13:42 | 000,000,025 | -H-- | C] () -- C:\WINDOWS\vbmgsext.ini
[2008/04/21 23:13:42 | 000,000,025 | -H-- | C] () -- C:\WINDOWS\vbmgsent.ini
[2008/04/21 19:09:16 | 000,000,103 | ---- | C] () -- C:\WINDOWS\NAVIGMA.INI
[2008/04/16 02:01:11 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/04/16 02:01:11 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/04/16 01:40:13 | 000,000,419 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2008/04/16 00:32:35 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/04/15 18:25:07 | 000,137,216 | ---- | C] () -- C:\Documents and Settings\Christophe\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/01/24 11:19:09 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/01/24 10:21:33 | 000,013,919 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2008/01/24 10:12:30 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/01/24 09:54:12 | 000,000,804 | R--- | C] () -- C:\WINDOWS\System32\AsusSetup.ini
[2008/01/24 09:54:12 | 000,000,276 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2008/01/24 09:49:28 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2008/01/24 09:49:27 | 000,013,881 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008/01/24 09:49:08 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007/08/12 15:49:54 | 002,080,256 | ---- | C] () -- C:\WINDOWS\System32\QtCore4.dll
[2007/08/07 15:01:32 | 000,842,752 | ---- | C] () -- C:\WINDOWS\System32\QtNetwork4.dll
[2007/08/07 15:00:22 | 009,100,288 | ---- | C] () -- C:\WINDOWS\System32\QtGui4.dll
[2007/04/12 16:44:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/04/12 16:44:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/04/12 16:44:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/04/12 16:44:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/04/12 16:44:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005/04/28 05:22:34 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/04/28 05:22:34 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2005/03/14 13:38:28 | 000,000,469 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2005/01/20 09:03:22 | 000,007,494 | ---- | C] () -- C:\WINDOWS\System32\mingwm10.dll
[2000/01/20 10:42:08 | 000,334,848 | ---- | C] () -- C:\WINDOWS\System32\PCONVERTOR.DLL

========== LOP Check ==========

[2008/11/05 19:43:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2008/06/02 09:10:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BSD
[2008/04/16 01:09:13 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/12/30 13:55:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2008/04/16 01:40:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/10/12 20:31:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ServeurFax
[2010/02/23 16:54:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2010/11/12 13:03:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2008/05/08 18:47:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Super X Studios
[2010/08/31 20:59:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/11/13 22:47:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/11/08 00:20:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WDGold Lite
[2010/09/01 23:11:35 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2008/12/02 20:32:06 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Christophe\Application Data\.#
[2008/08/21 12:52:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Ace
[2008/06/02 09:10:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\BSD
[2008/06/01 18:11:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\BSD Concept
[2008/06/02 09:39:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\BSDh9
[2010/09/14 22:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Canon
[2009/02/27 19:06:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\CoSoSys
[2010/05/20 16:49:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\COWON
[2008/11/05 16:05:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\DAEMON Tools
[2009/01/20 19:05:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\dBpoweramp
[2010/11/12 23:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\DVDVideoSoftIEHelpers
[2010/02/27 12:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\GlarySoft
[2010/05/20 17:35:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\HyperLyrics
[2008/10/19 14:30:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\InterTrust
[2009/10/30 12:21:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\iPodder
[2009/02/11 19:58:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\LogProtect
[2009/07/16 23:40:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\OnlineStorage
[2009/01/20 21:39:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Samsung
[2008/04/16 01:40:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\ScanSoft
[2008/05/08 16:18:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Shareaza
[2010/11/12 21:36:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Spamihilator
[2010/11/09 19:11:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Spotify
[2010/11/12 13:03:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Spyware Terminator
[2010/01/08 23:14:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Thunderbird
[2010/08/31 21:10:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Tomato
[2010/09/01 23:14:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\TuneUp Software
[2010/05/25 23:48:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\uTorrent
[2008/07/19 00:22:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Vso
[2010/10/12 20:31:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\WDGold Lite
[2010/08/31 21:39:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\Xilisoft
[2010/09/05 14:03:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christophe\Application Data\XnView
[2010/11/16 09:53:38 | 000,000,322 | ---- | M] () -- C:\WINDOWS\Tasks\GlaryInitialize.job
[2010/11/16 09:53:35 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
[2010/11/15 14:06:36 | 000,000,428 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack BAL sauvegarde antec vers mybook.job
[2010/11/15 11:00:08 | 000,000,382 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Bookmarks.job
[2010/11/15 14:16:52 | 000,000,442 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Sauvegarde Documents d'Antec sur MyBook.job
[2010/11/15 18:00:21 | 000,000,432 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Synchro docs Caro Toshiba et Antec.job
[2010/11/09 11:30:33 | 000,000,438 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Synchro musique entre Antec et MyBook.job
[2010/11/09 14:00:21 | 000,000,436 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Synchro photos entre Antec et MyBook.job
[2010/11/15 20:00:00 | 000,000,444 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Synchro temporaire fichiers travail Caro.job
[2010/11/15 14:30:08 | 000,000,436 | ---- | M] () -- C:\WINDOWS\Tasks\SyncBack Synchro videos entre Antec et MyBook.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A66A990E

<End>

[nickW]

Bonsoir,

Si le PC ne présente plus de symptômes d'infection, voici quelques conseils supplémentaires (sécurisation & optimisation) à appliquer:

Un conseil important:
Il faut créer un nouveau point de restauration système.
Après nettoyage du PC, il faut vider les fichiers stockés dans les dossiers de la Restauration système, puis créer un nouveau point de restauration qui sera utilisable en cas de problème.
Méthode:
Désactiver la restauration système, réactiver la restauration système, puis créer un nouveau point de restauration.
Explications détaillées:
http://assiste.com.free.fr/p/comment/co ... ation.html


Un conseil très important:
Il faut mettre à jour Windows XP.
Depuis le 13/07/2010, Microsoft ne fournit plus aucun support pour Windows XP sans SP3.
http://windows.microsoft.com/fr-FR/wind ... acks?os=xp
http://windows.microsoft.com/fr-FR/wind ... pport-mean


Un conseil très important:
Il faut mettre à jour Internet Explorer.
IE 8 est sorti en mars 2009.


Un conseil important:
Java de Oracle
Installer la dernièree version de Java de Oracle.

Version actuelle: Java SE Runtime Environment (JRE) 6 Update 22 - JRE 6 Update 22
*- http://www.oracle.com/technetwork/java/ ... index.html

Dans le paragraphe "Java Platform, Standard Edition", cliquer sur Download JRE.

Sur la page suivante, dans le paragraphe "Select Platform and Language for your download", choisir la plateforme (Windows/Windows x64), cocher la case située devant "I agree to the Java SE Runtime Environment 6u21 with JavaFX 1 License Agreement.", puis cliquer sur le bouton Continue >>

Sur la nouvelle page, sous "Windows Offline Installation", télécharger le fichier jre-6u22-windows-i586.exe, 15,33 MB
Fermer tous les navigateurs (Internet Explorer, Firefox, etc), puis faire un double clic sur jre-6u22-windows-i586.exe pour lancer l'installation.

Après l'installation de la nouvelle version, il est impératif de désinstaller toutes les versions obsolètes dont les failles sont utilisées par les "malveillants".
Pour ce faire:
JavaRa (de Fred de Vries et Paul McLain)
Aller sur le site http://raproducts.org/
Cliquer sur l'onglet Software
Télécharger JavaRa: Dans le paragraphe JavaRa, cliquer sur Download Windows Binary (.zip file).
Enregistrer le fichier JavaRa.zip sur le Bureau.
Créer un nouveau dossier nommé JavaRa et y décompresser la totalité de l'archive (clic droit, puis Extraire tout).
Ouvrir le dossier JavaRa puis faire un double clic sur JavaRa.exe pour lancer l'outil.

Sous "Select the language of your choice below" choisir (via la liste déroulante) Français et cliquer sur le bouton Select.

Cliquer sur le bouton Effacer les anciennes versions et valider ce choix en cliquant sur Oui ("Êtes-vous sûr de vouloir poursuivre?").

Cliquer deux fois sur OK.
Un rapport va s'afficher dans le Bloc-notes. Fermer le Bloc-notes.
Fermer JavaRa.


Un conseil important:
Il est indispensable de mettre à niveau ton antivirus. avast! 4 est une véritable passoire.
avast! 5 : http://www.avast.com/fr-fr/index


Un conseil important:
L'Observateur d'événements signale une erreur matérielle sur un des disques:
Le pilote a détecté une erreur du contrôleur sur \Device\Harddisk4\D
Il faudrait utiliser l'utilitaire de diagnostic spécifique fourni par le fabricant du disque dur.


Un conseil:
Désactiver la fonction de lancement automatique ("autorun") sur les lecteurs amovibles.
Voir ce sujet de Gof:
Guide sécurisation Windows face aux menaces infectieuses USB
http://assiste.forum.free.fr/viewtopic.php?t=25228
Le fichier de désactivation est téléchargeable depuis ce lien


Un conseil important:
Une partition est presque pleine.
Drive M: | 465,76 Gb Total Space | 42,91 Gb Free Space | 9,21% Space Free | Partition Type: NTFS
En dessous de 15% d'espace libre, toute défragmentation via Windows est impossible.
Il faut absolument "faire le ménage".


Un conseil:
Erunt permet de faire une sauvegarde du Registre.
Il est intéressant de l'utiliser avant d'installer un nouveau programme (en cas de problème, il permettra de revenir en arrière).


Un conseil:
La version gratuite de MBAM (Malwarebytes' Anti-Malware) reste utilisable pour effectuer des analyses à la demande.
Tu peux donc choisir de la laisser installée, et de l'utiliser de temps en temps (pour faire du "nettoyage") en faisant une mise à jour manuelle avant de demander l'examen.


Defogger (de jpshortstuff), ré-activation des émulateurs de CD
Lancer Defogger par un double clic sur Defogger.exe

Fermer toutes les fenêtres de programme ouvertes autres que Defogger (navigateur, traitement de texte, etc...): un redémarrage du PC va se produire.

L'écran de Defogger s'affiche:


Cliquer sur Re-enable afin de ré-activer les pilotes d'émulateurs de CD.

Cliquer sur Yes/Oui pour continuer.

Lors de l'apparition du message Finished!, cliquer sur OK.

Defogger annonce que le PC va redémarrer, cliquer sur OK.


Un conseil:
Il est préférable de supprimer OTL (fichier téléchargé OTL.exe et fichiers résultats OTL.Txt et Extras.Txt situés sur le Bureau, ainsi que, s'ils existent, les fichiers de travail fix.txt et scan.txt).
Note: S'il existe, le dossier SystemDrive\_OTL contient des sauvegardes. Après avoir vérifié que tous les logiciels du PC fonctionnent correctement, il sera possible de supprimer ce dossier.
Il est préférable de supprimer Defogger (fichier téléchargé Defogger.exe).
Il est préférable de supprimer rkill (fichier rkill téléchargé, situé sur le Bureau, et fichier rapport %SystemDrive%/rkill.log).
Vider les quarantaines de l'antivirus et de l'anti-spyware.


TeaTimer (de Spybot-S&D), ré-activation
Réactiver TeaTimer de Spybot-S&D selon la méthode ci-dessous:
Note: [%SystemDrive% représente la partition sur laquelle est installé le système, généralement C:]

• Supprimer tous les clichés du Registre créés par TeaTimer de Spybot-S&D
  Aller avec l'Explorateur Windows jusqu'au dossier:
  %SystemDrive%\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2
  Mettre dans une archive (fichier .zip) tous les fichiers qui s'y trouvent pour les sauvegarder, puis supprimer tous ces fichiers (ne conserver que l'archive de sauvegarde).
• Supprimer tous les refus/autorisations de modification enregistrés par TeaTimer de Spybot-S&D
  Aller avec l'Explorateur Windows jusqu'au dossier:
  %SystemDrive%\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes
  Mettre dans une archive (fichier .zip) s'ils existent les fichiers ProcWhite.sbe, ProcBlack.sbe, RegKeyWhite.sbe et RegKeyBlack.sbe pour les sauvegarder, puis supprimer ces quatre fichiers (conserver l'archive de sauvegarde).
  
• Re-lancer TeaTimer de Spybot-S&D.
  Aller avec l'Explorateur Windows jusqu'au dossier d'installation de Spybot-S&D, par défaut %SystemDrive%\Program Files\Spybot - Search & Destroy.
  Faire un double clic sur TeaTimer.exe pour le lancer.
• Arrêter TeaTimer de Spybot-S&D de façon à enregistrer de nouveaux clichés du Registre.
  Dans la barre système (à coté de l'horloge), faire un clic droit sur l'icône de Résident de Spybot-SD puis choisir Quitter Résident de Spybot-S&D.
  Lors de cette procédure d'arrêt, il y a sauvegarde des clichés du Registre créés par TeaTimer de Spybot-S&D.
• Re-lancer TeaTimer de Spybot-S&D.
  Aller avec l'Explorateur Windows jusqu'au dossier d'installation de Spybot-S&D, par défaut %SystemDrive%\Program Files\Spybot - Search & Destroy.
  Faire un double clic sur TeaTimer.exe pour le lancer.
• Réactiver le lancement automatique de TeaTimer.
  Lancer Spybot-S&D, Mode avancé, Outils, Résident, cocher la case située devant TeaTimer. Fermer Spybot-S&D.

Voilì, voilò, voilà.

Salut,

PS:
Si tu considères que ce sujet est clos, peux-tu mettre [OK] devant le titre du premier message. Voir ICI.
Merci.

[dahu74]

Je suis impressionné par ton professionnalisme, la méthode et le résultat sont impeccables.
Soulagé aussi de ne pas avoir à formater puis réinstaller tous les programmes.
Merci énormément pour ton assistance!
J'ai bien noté la liste de courses, je m'y emploie de sitôt.
Cordialement,
Christophe