W32:rootkit-gen

laurentmouhot · le 28 Fév 2010 22:01

Bonjour,
JE poste ce message car je ne sais plus comment faire:
J'ai 2 portables en reseau le premier a eu differentes erreurs : pertes de windows ( Vista) / perte de patitions...
Avast a trouvé un virus W32:rootkit-gen . Depuis je ne peux plus redémarrer le PC ( ecran noir ) . Ce soir mon deuxième portable a des messages d'avast signalant W32:rootkit-gen. AVant de faire de nouvelles erreurs je voudrai savoir comment m'en débarasser. Avast a déttecté 74 infections
J'ai essayé de scaner le PC avec un anti virus en ligne (House Call) qui n'a trouvé qu'une menace.
EN lisant les post similaires voici le log de HIjack
Merci pour votre aide

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:00:26, on 28/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Temp\_ex-68.exe
C:\DOCUME~1\PATRIC~1\LOCALS~1\Temp\HouseCall\housecall.bin
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EDS] C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DMHotKey] C:\Program Files\Samsung\Easy Display Manager\DMLoader.exe
O4 - HKLM\..\Run: [BatteryManager] C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe
O4 - HKLM\..\Run: [MagicKeyboard] C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: winesm32.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

--
End of file - 7801 bytes

jeanmimigab · le 28 Fév 2010 22:36

hello,

fait cela stp...

* Télécharge >> OTL <<sur ton bureau.

* Fait un double-clic sur l'icône d'OTL pour le lancer

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Output" (en haut à droite) la case "minimal Output" soit cochée.

* Coches les case situées devant "Scan All Users", " LOP Check" et "Purity Check".

* Copier et colle le contenue de cette citation dans la partie inférieure d'OTL "Custom scanx/fixes"

netsvcs
%SYSTEMDRIVE%\WINDOWS\Prefetch\*.exe
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

* Cliques sur l'icône "RunScan" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).
* Copie et colle le ou les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

@++

laurentmouhot · le 01 Mar 2010 07:30

Bonjour voici le log de OTL

OTL logfile created on: 28/02/2010 22:58:20 - Run 1
OTL by OldTimer - Version 3.1.30.3 Folder = C:\Documents and Settings\Patricia MOUHOT\Mes documents\Téléchargements
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1 014,00 Mb Total Physical Memory | 580,00 Mb Available Physical Memory | 57,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 49,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92,04 Gb Total Space | 80,91 Gb Free Space | 87,90% Space Free | Partition Type: NTFS
Drive D: | 51,00 Gb Total Space | 50,91 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PATRICIA
Current User Name: Patricia MOUHOT
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Patricia MOUHOT\Mes documents\Téléchargements\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\Temp\_ex-68.exe ()
PRC - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Skype\Plugin Manager\skypePM.exe (Skype Technologies)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe ()
PRC - C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Samsung\MagicKBD\PerformanceManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung\MagicKBD\MagicKBD.exe (SAMSUNG Electronics Co., Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe (Samsung Electronics,.LTD)
PRC - C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Patricia MOUHOT\Mes documents\Téléchargements\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\BtMmHook.dll (Broadcom Corporation.)
MOD - C:\WINDOWS\system32\linkinfo.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (gupdate) Service Google Update (gupdate) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (gusvc) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (btwdins) -- C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (Samsung Update Plus) -- C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe ()

========== Driver Services (SafeList) ==========

DRV - (MEMSWEEP2) -- File not found
DRV - (aswTdi) -- C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aswMon2) -- C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (AR5416) -- C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (VMC326) -- C:\WINDOWS\system32\drivers\VMC326.sys (Vimicro Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (Changer) -- C:\WINDOWS\system32\drivers\changer.sys (Microsoft Corporation)
DRV - (lbrtfdc) -- C:\WINDOWS\system32\drivers\lbrtfdc.sys (Toshiba Corp.)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (DNSeFilter) -- C:\WINDOWS\system32\drivers\SamsungEDS.SYS (Samsung Electronics,.LTD)
DRV - (DOSMEMIO) -- C:\WINDOWS\system32\MEMIO.SYS ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain ... &bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain ... &bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain ... &bmod=SMSN
IE - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain ... &bmod=SMSN
IE - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\S-1-5-21-4067298374-275367959-1537749475-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.fr/ig?brand=SMSN&bmod=SMSN"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/28 22:46:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/28 22:46:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/10/24 21:31:29 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009/10/24 21:28:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Mozilla\Extensions
[2010/02/28 20:37:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Mozilla\Firefox\Profiles\l8n0pbol.default\extensions
[2010/02/17 13:37:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Mozilla\Firefox\Profiles\l8n0pbol.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/02/28 20:37:31 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/02/26 19:06:13 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/08/24 20:21:51 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2009/08/24 20:21:51 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
[2009/08/24 20:21:51 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2009/08/24 20:21:51 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2009/08/24 20:21:51 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2008/04/14 13:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [BatteryManager] C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe ()
O4 - HKLM..\Run: [DMHotKey] C:\Program Files\Samsung\Easy Display Manager\DMLoader.exe (SAMSUNG Electronics)
O4 - HKLM..\Run: [EDS] C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe (Samsung Electronics,.LTD)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [MagicKeyboard] C:\Program Files\Samsung\MagicKBD\PreMKbd.exe ()
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKU\S-1-5-21-4067298374-275367959-1537749475-1005..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKU\S-1-5-21-4067298374-275367959-1537749475-1005..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\Patricia MOUHOT\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Documents and Settings\Patricia MOUHOT\Menu Démarrer\Programmes\Démarrage\winesm32.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/ ... mvadvd.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinsta ... s-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - Unable to open key or key not present!
O32 - AutoRun File - [2009/02/12 12:51:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{44a8a6d0-c4e2-11de-8841-00245401d080}\Shell\AutoRun\command - "" = E:\setupSNK.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/02/28 22:08:48 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos
[2010/02/28 21:04:34 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/02/28 20:39:47 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys
[2010/02/28 20:39:47 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys
[2010/02/28 20:39:01 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys
[2010/02/28 20:38:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/02/28 20:38:04 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys
[2010/02/28 20:38:04 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys
[2010/02/28 20:33:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2010/02/27 14:01:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Temp
[2010/02/26 19:08:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\skypePM
[2010/02/26 19:06:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Skype
[2010/02/26 19:05:51 | 000,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\Skype
[2010/02/26 19:05:48 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2010/02/26 19:05:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2010/02/22 20:51:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\images ustensiles
[2010/02/22 18:17:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010/02/22 14:56:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/02/22 14:54:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique de l'oral
[2010/02/17 13:38:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\dwhelper
[2010/02/12 12:49:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Bureau\5 manuels
[2010/02/01 11:36:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\dvdcss
[2009/10/24 21:19:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/12 12:54:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/02/12 12:54:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/02/12 12:54:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[14 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/02/28 22:50:21 | 000,003,121 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/28 22:06:05 | 000,001,054 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/28 21:40:27 | 000,256,608 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Comment_supprimer_le_virus_Bagle_sous_XP.pdf
[2010/02/28 21:04:35 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\HijackThis.lnk
[2010/02/28 20:45:10 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\housecall.guid.cache
[2010/02/28 20:42:03 | 000,019,070 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\antivirus-en-ligne-1.gif
[2010/02/28 20:35:17 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
[2010/02/28 20:26:34 | 000,001,050 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/28 20:26:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/28 20:26:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/28 20:26:03 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010/02/28 13:04:13 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\NTUSER.DAT
[2010/02/28 13:04:13 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\ntuser.ini
[2010/02/26 22:04:40 | 006,937,110 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\IconCache.db
[2010/02/26 19:08:08 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/02/26 19:05:52 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2010/02/26 11:32:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/23 22:06:37 | 002,037,699 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images pour flash cards.odt
[2010/02/23 22:03:46 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique oral[1]-1.doc
[2010/02/22 21:04:55 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images ustensiles.doc
[2010/02/22 20:42:09 | 000,352,388 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\beh_24_2007.pdf
[2010/02/21 23:41:30 | 000,775,034 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/21 23:41:30 | 000,367,658 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2010/02/21 23:41:30 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/21 23:41:30 | 000,048,616 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2010/02/21 23:41:30 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/21 23:29:23 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\dossier madame Othman transcriptions dialogue.doc
[2010/02/21 23:09:01 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\dossier madame Othman transcriptions dialogue.doc
[2010/02/20 17:18:25 | 000,030,720 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison entre declic et belleville 2.doc
[2010/02/19 18:22:00 | 000,017,955 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc 3.odt
[2010/02/19 15:55:06 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/17 13:39:23 | 003,632,503 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Pate_a_crepe.flv
[2010/02/15 18:05:24 | 000,010,352 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\titres livres grammaire à emprunter.odt
[2010/02/12 08:34:44 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc
[2010/02/11 19:06:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/09 18:17:02 | 000,088,064 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\expos_ manuels-textew2003[1]-2.ppt
[2010/02/08 16:32:01 | 000,014,848 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\lettre motivation bourse de voyage.doc
[2010/02/04 22:37:29 | 000,002,407 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Play Camera.lnk
[2010/02/02 15:08:25 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\fiche pédagogique didiactique écrit apprenant.doc
[2010/02/02 14:10:36 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Fiche+péd..[2).doc
[2010/02/01 18:14:13 | 000,068,838 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Séquence+..[2]-1.odt
[14 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/02/28 21:40:14 | 000,256,608 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Comment_supprimer_le_virus_Bagle_sous_XP.pdf
[2010/02/28 21:04:35 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\HijackThis.lnk
[2010/02/28 20:45:10 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\housecall.guid.cache
[2010/02/28 20:42:03 | 000,019,070 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\antivirus-en-ligne-1.gif
[2010/02/28 20:35:45 | 000,000,016 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat
[2010/02/28 20:35:17 | 000,000,004 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
[2010/02/26 19:08:08 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/02/26 19:05:52 | 000,001,878 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2010/02/23 22:03:44 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique oral[1]-1.doc
[2010/02/23 21:44:24 | 002,037,699 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images pour flash cards.odt
[2010/02/22 21:04:53 | 000,061,952 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images ustensiles.doc
[2010/02/22 20:42:06 | 000,352,388 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\beh_24_2007.pdf
[2010/02/22 14:56:04 | 000,001,054 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/22 14:56:04 | 000,001,050 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/21 23:24:55 | 000,013,824 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\dossier madame Othman transcriptions dialogue.doc
[2010/02/21 22:32:29 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\dossier madame Othman transcriptions dialogue.doc
[2010/02/19 17:47:42 | 000,017,955 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc 3.odt
[2010/02/19 16:05:26 | 000,256,032 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 011.jpg
[2010/02/19 16:05:20 | 001,028,443 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 008.jpg
[2010/02/19 16:05:14 | 000,377,086 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 005.jpg
[2010/02/19 16:05:08 | 002,023,236 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 002.jpg
[2010/02/19 16:05:00 | 001,021,058 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 010.jpg
[2010/02/19 16:04:53 | 000,138,648 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 007.jpg
[2010/02/19 16:04:47 | 001,206,788 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 004.jpg
[2010/02/19 16:04:42 | 001,369,694 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 001.jpg
[2010/02/19 16:04:35 | 002,211,187 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 012.jpg
[2010/02/19 16:04:29 | 000,813,039 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 009.jpg
[2010/02/19 16:04:23 | 001,083,729 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 006.jpg
[2010/02/19 16:04:16 | 001,074,557 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic 003.jpg
[2010/02/19 15:56:48 | 001,716,410 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\declic.jpg
[2010/02/17 13:39:07 | 003,632,503 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Pate_a_crepe.flv
[2010/02/15 18:05:23 | 000,010,352 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\titres livres grammaire à emprunter.odt
[2010/02/09 18:16:58 | 000,088,064 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\expos_ manuels-textew2003[1]-2.ppt
[2010/02/08 17:23:05 | 000,030,720 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison entre declic et belleville 2.doc
[2010/02/03 14:49:49 | 000,014,848 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\lettre motivation bourse de voyage.doc
[2010/02/02 14:08:22 | 000,075,264 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Fiche+péd..[2).doc
[2010/02/01 18:36:26 | 000,064,000 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\fiche pédagogique didiactique écrit apprenant.doc
[2010/02/01 18:14:12 | 000,068,838 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Séquence+..[2]-1.odt
[2009/12/17 14:03:08 | 000,012,800 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/25 02:34:07 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Patricia MOUHOT_KBD.ini
[2009/10/24 21:42:41 | 000,000,085 | ---- | C] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\FASTWiz.log
[2009/07/16 18:15:20 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/03/23 17:40:06 | 002,854,976 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/02/12 20:30:24 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009/02/12 13:03:08 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\MagicKBD.INI
[2009/02/12 13:03:08 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Propriétaire_KBD.ini
[2009/02/12 13:03:05 | 000,003,425 | ---- | C] () -- C:\WINDOWS\System32\KBDR.INI
[2009/02/12 13:03:05 | 000,002,741 | ---- | C] () -- C:\WINDOWS\System32\KBDD.INI
[2009/02/12 13:03:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDO.INI
[2009/02/12 13:03:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDC.INI
[2009/02/12 13:03:05 | 000,002,606 | ---- | C] () -- C:\WINDOWS\System32\KBDB.INI
[2009/02/12 13:03:05 | 000,002,236 | ---- | C] () -- C:\WINDOWS\System32\KBDQ.INI
[2009/02/12 13:03:05 | 000,001,956 | ---- | C] () -- C:\WINDOWS\System32\KBDE.INI
[2009/02/12 13:03:05 | 000,001,885 | ---- | C] () -- C:\WINDOWS\System32\KBDP.INI
[2009/02/12 13:03:05 | 000,001,857 | ---- | C] () -- C:\WINDOWS\System32\KBDUU.INI
[2009/02/12 13:03:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDG.INI
[2009/02/12 13:03:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDA.INI
[2009/02/12 13:03:05 | 000,001,834 | ---- | C] () -- C:\WINDOWS\System32\KBDU.INI
[2009/02/12 13:03:05 | 000,001,819 | ---- | C] () -- C:\WINDOWS\System32\KBDN.INI
[2009/02/12 13:03:05 | 000,001,699 | ---- | C] () -- C:\WINDOWS\System32\KBDT.INI
[2009/02/12 13:03:05 | 000,001,697 | ---- | C] () -- C:\WINDOWS\System32\KBDV.INI
[2009/02/12 13:03:05 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\KBDS.INI
[2009/02/12 13:03:05 | 000,001,476 | ---- | C] () -- C:\WINDOWS\System32\KBDF.INI
[2009/02/12 13:01:02 | 000,000,135 | R--- | C] () -- C:\WINDOWS\System32\lngEng.ini
[2009/02/12 13:01:02 | 000,000,117 | ---- | C] () -- C:\WINDOWS\System32\lngKor.ini
[2009/02/12 12:57:57 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009/02/12 12:55:34 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS
[2005/02/17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2009/02/12 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLAN
[2009/10/24 22:22:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\OpenOffice.org
[2009/10/24 21:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Thunderbird

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 13:00:00 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 13:00:00 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >
< End of report >
[2010/02/28 22:50:21 | 000,003,121 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/28 22:46:39 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/02/28 22:29:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Skype
[2010/02/28 22:08:48 | 000,000,000 | ---D | M] -- C:\Program Files\Sophos
[2010/02/28 22:06:05 | 000,001,054 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/28 21:40:27 | 000,256,608 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Comment_supprimer_le_virus_Bagle_sous_XP.pdf
[2010/02/28 21:04:35 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\HijackThis.lnk
[2010/02/28 21:04:34 | 000,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2010/02/28 20:45:10 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\housecall.guid.cache
[2010/02/28 20:42:03 | 000,019,070 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\antivirus-en-ligne-1.gif
[2010/02/28 20:37:18 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Thunderbird
[2010/02/28 20:35:47 | 000,000,016 | ---- | M] () -- C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat
[2010/02/28 20:35:17 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
[2010/02/28 20:27:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\skypePM
[2010/02/28 20:26:34 | 000,001,050 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/28 20:26:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/28 20:26:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/28 13:04:13 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\NTUSER.DAT
[2010/02/28 13:04:13 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\ntuser.ini
[2010/02/27 14:01:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Temp
[2010/02/26 22:04:40 | 006,937,110 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\IconCache.db
[2010/02/26 19:08:08 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/02/26 19:06:12 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2010/02/26 19:05:52 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2010/02/26 19:05:51 | 000,000,000 | ---D | M] -- C:\Program Files\Fichiers communs\Skype
[2010/02/26 19:05:51 | 000,000,000 | ---D | M] -- C:\Program Files\Fichiers communs
[2010/02/26 19:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2010/02/26 11:32:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/23 22:06:37 | 002,037,699 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images pour flash cards.odt
[2010/02/23 22:03:46 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique oral[1]-1.doc
[2010/02/22 22:08:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Google
[2010/02/22 21:58:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\vlc
[2010/02/22 21:56:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\dvdcss
[2010/02/22 21:04:55 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images ustensiles.doc
[2010/02/22 20:42:09 | 000,352,388 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\beh_24_2007.pdf
[2010/02/22 18:17:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010/02/22 14:56:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/02/22 14:55:57 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/02/21 23:41:30 | 000,775,034 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/21 23:41:30 | 000,367,658 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2010/02/21 23:41:30 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/21 23:41:30 | 000,048,616 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2010/02/21 23:41:30 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/21 23:29:23 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\dossier madame Othman transcriptions dialogue.doc
[2010/02/21 23:09:01 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\dossier madame Othman transcriptions dialogue.doc
[2010/02/20 17:18:25 | 000,030,720 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison entre declic et belleville 2.doc
[2010/02/19 18:22:00 | 000,017,955 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc 3.odt
[2010/02/19 15:55:06 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/19 15:41:10 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2010/02/17 13:39:23 | 003,632,503 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Pate_a_crepe.flv
[2010/02/15 18:05:24 | 000,010,352 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\titres livres grammaire à emprunter.odt
[2010/02/12 08:34:44 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc
[2010/02/11 19:06:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/09 18:17:02 | 000,088,064 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\expos_ manuels-textew2003[1]-2.ppt
[2010/02/08 16:32:01 | 000,014,848 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\lettre motivation bourse de voyage.doc
[2010/02/04 22:37:29 | 000,002,407 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Play Camera.lnk
[2010/02/02 15:08:25 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\fiche pédagogique didiactique écrit apprenant.doc
[2010/02/02 14:10:36 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Fiche+péd..[2).doc
[2010/02/01 18:14:13 | 000,068,838 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Séquence+..[2]-1.odt
[2009/11/11 21:52:49 | 000,016,504 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/10/24 21:42:41 | 000,000,085 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\FASTWiz.log
[2009/10/24 21:19:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/12 13:43:57 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\desktop.ini
[2009/02/12 13:43:57 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2009/02/12 12:54:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/02/12 12:54:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/02/12 12:54:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[14 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/02/28 22:50:21 | 000,003,121 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/28 22:06:05 | 000,001,054 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/28 21:40:27 | 000,256,608 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Comment_supprimer_le_virus_Bagle_sous_XP.pdf
[2010/02/28 21:04:35 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\HijackThis.lnk
[2010/02/28 20:45:10 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\housecall.guid.cache
[2010/02/28 20:42:03 | 000,019,070 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\antivirus-en-ligne-1.gif
[2010/02/28 20:35:17 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
[2010/02/28 20:26:34 | 000,001,050 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/28 20:26:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/28 20:26:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/28 20:26:03 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010/02/28 13:04:13 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\NTUSER.DAT
[2010/02/28 13:04:13 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\ntuser.ini
[2010/02/26 22:04:40 | 006,937,110 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\IconCache.db
[2010/02/26 19:08:08 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/02/26 19:05:52 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2010/02/26 11:32:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/23 22:06:37 | 002,037,699 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images pour flash cards.odt
[2010/02/23 22:03:46 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique oral[1]-1.doc
[2010/02/22 21:04:55 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images ustensiles.doc
[2010/02/22 20:42:09 | 000,352,388 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\beh_24_2007.pdf
[2010/02/21 23:41:30 | 000,775,034 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/21 23:41:30 | 000,367,658 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2010/02/21 23:41:30 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/21 23:41:30 | 000,048,616 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2010/02/21 23:41:30 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/21 23:29:23 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\dossier madame Othman transcriptions dialogue.doc
[2010/02/21 23:09:01 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\dossier madame Othman transcriptions dialogue.doc
[2010/02/20 17:18:25 | 000,030,720 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison entre declic et belleville 2.doc
[2010/02/19 18:22:00 | 000,017,955 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc 3.odt
[2010/02/19 15:55:06 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/17 13:39:23 | 003,632,503 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Pate_a_crepe.flv
[2010/02/15 18:05:24 | 000,010,352 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\titres livres grammaire à emprunter.odt
[2010/02/12 08:34:44 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc
[2010/02/11 19:06:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/09 18:17:02 | 000,088,064 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\expos_ manuels-textew2003[1]-2.ppt
[2010/02/08 16:32:01 | 000,014,848 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\lettre motivation bourse de voyage.doc
[2010/02/04 22:37:29 | 000,002,407 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Play Camera.lnk
[2010/02/02 15:08:25 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\fiche pédagogique didiactique écrit apprenant.doc
[2010/02/02 14:10:36 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Fiche+péd..[2).doc
[2010/02/01 18:14:13 | 000,068,838 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Séquence+..[2]-1.odt
[14 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== LOP Check ==========

[2009/02/12 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLAN
[2009/10/24 22:22:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\OpenOffice.org
[2009/10/24 21:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Thunderbird

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 13:00:00 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 13:00:00 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< End of report >
[2010/02/28 23:06:06 | 000,001,054 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/28 22:46:39 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/02/28 22:29:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Skype
[2010/02/28 22:08:48 | 000,000,000 | ---D | M] -- C:\Program Files\Sophos
[2010/02/28 21:40:27 | 000,256,608 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Comment_supprimer_le_virus_Bagle_sous_XP.pdf
[2010/02/28 21:04:35 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\HijackThis.lnk
[2010/02/28 21:04:34 | 000,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2010/02/28 20:45:10 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\housecall.guid.cache
[2010/02/28 20:42:03 | 000,019,070 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\antivirus-en-ligne-1.gif
[2010/02/28 20:37:18 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Thunderbird
[2010/02/28 20:35:47 | 000,000,016 | ---- | M] () -- C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat
[2010/02/28 20:35:17 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
[2010/02/28 20:27:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\skypePM
[2010/02/28 20:26:34 | 000,001,050 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/28 20:26:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/28 20:26:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/28 13:04:13 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\NTUSER.DAT
[2010/02/28 13:04:13 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\ntuser.ini
[2010/02/27 14:01:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Temp
[2010/02/26 22:04:40 | 006,937,110 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\IconCache.db
[2010/02/26 19:06:12 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2010/02/26 19:05:52 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2010/02/26 19:05:51 | 000,000,000 | ---D | M] -- C:\Program Files\Fichiers communs\Skype
[2010/02/26 19:05:51 | 000,000,000 | ---D | M] -- C:\Program Files\Fichiers communs
[2010/02/26 19:05:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2010/02/26 11:32:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/23 22:06:37 | 002,037,699 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images pour flash cards.odt
[2010/02/23 22:03:46 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique oral[1]-1.doc
[2010/02/22 22:08:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\Google
[2010/02/22 21:58:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\vlc
[2010/02/22 21:56:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\dvdcss
[2010/02/22 21:04:55 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images ustensiles.doc
[2010/02/22 20:42:09 | 000,352,388 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\beh_24_2007.pdf
[2010/02/22 18:17:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010/02/22 14:56:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/02/22 14:55:57 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/02/21 23:41:30 | 000,775,034 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/21 23:41:30 | 000,367,658 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2010/02/21 23:41:30 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/21 23:41:30 | 000,048,616 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2010/02/21 23:41:30 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/21 23:29:23 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\dossier madame Othman transcriptions dialogue.doc
[2010/02/21 23:09:01 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\dossier madame Othman transcriptions dialogue.doc
[2010/02/20 17:18:25 | 000,030,720 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison entre declic et belleville 2.doc
[2010/02/19 18:22:00 | 000,017,955 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc 3.odt
[2010/02/19 15:55:06 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/19 15:41:10 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2010/02/17 13:39:23 | 003,632,503 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Pate_a_crepe.flv
[2010/02/15 18:05:24 | 000,010,352 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\titres livres grammaire à emprunter.odt
[2010/02/12 08:34:44 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc
[2010/02/11 19:06:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/09 18:17:02 | 000,088,064 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\expos_ manuels-textew2003[1]-2.ppt
[2010/02/08 16:32:01 | 000,014,848 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\lettre motivation bourse de voyage.doc
[2010/02/04 22:37:29 | 000,002,407 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Play Camera.lnk
[2010/02/02 15:08:25 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\fiche pédagogique didiactique écrit apprenant.doc
[2010/02/02 14:10:36 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Fiche+péd..[2).doc
[2010/02/01 18:14:13 | 000,068,838 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Séquence+..[2]-1.odt
[2009/11/11 21:52:49 | 000,016,504 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/10/24 21:42:41 | 000,000,085 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\FASTWiz.log
[2009/10/24 21:19:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/12 13:43:57 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\desktop.ini
[2009/02/12 13:43:57 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2009/02/12 12:54:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/02/12 12:54:39 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/02/12 12:54:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/02/28 23:06:06 | 000,001,054 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/28 22:50:21 | 000,003,121 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/02/28 21:40:27 | 000,256,608 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Comment_supprimer_le_virus_Bagle_sous_XP.pdf
[2010/02/28 21:04:35 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\HijackThis.lnk
[2010/02/28 20:45:10 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\housecall.guid.cache
[2010/02/28 20:42:03 | 000,019,070 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\antivirus-en-ligne-1.gif
[2010/02/28 20:35:17 | 000,000,004 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
[2010/02/28 20:26:34 | 000,001,050 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/28 20:26:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/02/28 20:26:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/02/28 20:26:03 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010/02/28 13:04:13 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\NTUSER.DAT
[2010/02/28 13:04:13 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\Patricia MOUHOT\ntuser.ini
[2010/02/26 22:04:40 | 006,937,110 | -H-- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\IconCache.db
[2010/02/26 19:08:08 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/02/26 19:05:52 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2010/02/26 11:32:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/02/23 22:06:37 | 002,037,699 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images pour flash cards.odt
[2010/02/23 22:03:46 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\didactique oral[1]-1.doc
[2010/02/22 21:04:55 | 000,061,952 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\images ustensiles.doc
[2010/02/22 20:42:09 | 000,352,388 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\beh_24_2007.pdf
[2010/02/21 23:41:30 | 000,775,034 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/21 23:41:30 | 000,367,658 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2010/02/21 23:41:30 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/21 23:41:30 | 000,048,616 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2010/02/21 23:41:30 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/21 23:29:23 | 000,013,824 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\dossier madame Othman transcriptions dialogue.doc
[2010/02/21 23:09:01 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\dossier madame Othman transcriptions dialogue.doc
[2010/02/20 17:18:25 | 000,030,720 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison entre declic et belleville 2.doc
[2010/02/19 18:22:00 | 000,017,955 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc 3.odt
[2010/02/19 15:55:06 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/17 13:39:23 | 003,632,503 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Pate_a_crepe.flv
[2010/02/15 18:05:24 | 000,010,352 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\titres livres grammaire à emprunter.odt
[2010/02/12 08:34:44 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\comparaison déclic et belleville.doc
[2010/02/11 19:06:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/02/09 18:17:02 | 000,088,064 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\expos_ manuels-textew2003[1]-2.ppt
[2010/02/08 16:32:01 | 000,014,848 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Mes documents\lettre motivation bourse de voyage.doc
[2010/02/04 22:37:29 | 000,002,407 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Play Camera.lnk
[2010/02/02 15:08:25 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\fiche pédagogique didiactique écrit apprenant.doc
[2010/02/02 14:10:36 | 000,075,264 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Fiche+péd..[2).doc
[2010/02/01 18:14:13 | 000,068,838 | ---- | M] () -- C:\Documents and Settings\Patricia MOUHOT\Bureau\Séquence+..[2]-1.odt
[14 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== LOP Check ==========

[2009/02/12 12:58:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLAN
[2009/10/24 22:22:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\OpenOffice.org
[2009/10/24 21:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Patricia MOUHOT\Application Data\Thunderbird

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 13:00:00 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 13:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 13:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 13:00:00 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 13:00:00 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< End of report >

laurentmouhot · le 01 Mar 2010 07:32

et voic i le log EXtra

OTL Extras logfile created on: 28/02/2010 22:58:20 - Run 1
OTL by OldTimer - Version 3.1.30.3 Folder = C:\Documents and Settings\Patricia MOUHOT\Mes documents\Téléchargements
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1 014,00 Mb Total Physical Memory | 580,00 Mb Available Physical Memory | 57,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 49,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92,04 Gb Total Space | 80,91 Gb Free Space | 87,90% Space Free | Partition Type: NTFS
Drive D: | 51,00 Gb Total Space | 50,91 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PATRICIA
Current User Name: Patricia MOUHOT
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" = C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}" = OpenOffice.org 3.1
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1036-7B44-A81200000003}" = Adobe Reader 8.1.2 - Français
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast!" = avast! Antivirus
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Marvell Miniport Driver" = Marvell Miniport Driver
"Mozilla Firefox (3.5.

" = Mozilla Firefox (3.5.

"Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.3.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.0.3

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 28/12/2009 08:00:55 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestOpenList Error 1753.

Error - 28/12/2009 08:00:55 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::LoadFiles()
chestOpenList() failed: 2147422219.

Error - 28/12/2009 08:01:06 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::OnCreate()
!m_strErrorWnd.IsEmpty().

[ Application Events ]
Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:04 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:31 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Le serveur a renvoyé une réponse non valide ou non reconnue

Error - 26/02/2010 07:01:05 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 10:01:17 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 12:01:15 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 28/02/2010 15:57:54 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Secdrv n'a pas pu démarrer en raison de l'erreur : %%2

Error - 28/02/2010 15:59:31 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Détrameur décalage BDA n'a pas pu démarrer en raison de
l'erreur : %%2

Error - 28/02/2010 15:59:42 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Splitter audio du noyau Microsoft n'a pas pu démarrer en
raison de l'erreur : %%2

Error - 28/02/2010 16:00:51 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service BDA IPSink n'a pas pu démarrer en raison de l'erreur :
%%2

Error - 28/02/2010 16:01:04 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service SUE NDIS Protocol Driver n'a pas pu démarrer en raison
de l'erreur : %%2

Error - 28/02/2010 16:01:13 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Synthétiseur de table de sons GC noyau Microsoft n'a pas
pu démarrer en raison de l'erreur : %%2

Error - 28/02/2010 16:01:44 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Pilote parent générique USB Microsoft n'a pas pu démarrer
en raison de l'erreur : %%2

Error - 28/02/2010 16:11:53 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Pilote de stockage de masse USB n'a pas pu démarrer en
raison de l'erreur : %%2

Error - 28/02/2010 16:12:02 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Périphérique vidéo USB (WDM) n'a pas pu démarrer en raison
de l'erreur : %%2

Error - 28/02/2010 16:12:25 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Codec Teletext standard n'a pas pu démarrer en raison de
l'erreur : %%2

< End of report >

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" = C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}" = OpenOffice.org 3.1
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1036-7B44-A81200000003}" = Adobe Reader 8.1.2 - Français
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast!" = avast! Antivirus
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Marvell Miniport Driver" = Marvell Miniport Driver
"Mozilla Firefox (3.5.

" = Mozilla Firefox (3.5.

"Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.3.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.0.3

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 28/12/2009 08:00:55 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestOpenList Error 1753.

Error - 28/12/2009 08:00:55 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::LoadFiles()
chestOpenList() failed: 2147422219.

Error - 28/12/2009 08:01:06 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::OnCreate()
!m_strErrorWnd.IsEmpty().

[ Application Events ]
Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:04 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:31 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Le serveur a renvoyé une réponse non valide ou non reconnue

Error - 26/02/2010 07:01:05 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 10:01:17 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 12:01:15 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 28/02/2010 15:57:54 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Secdrv n'a pas pu démarrer en raison de l'erreur : %%2

Error - 28/02/2010 15:59:31 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Détrameur décalage BDA n'a pas pu démarrer en raison de
l'erreur : %%2

Error - 28/02/2010 15:59:42 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Splitter audio du noyau Microsoft n'a pas pu démarrer en
raison de l'erreur : %%2

Error - 28/02/2010 16:00:51 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service BDA IPSink n'a pas pu démarrer en raison de l'erreur :
%%2

Error - 28/02/2010 16:01:04 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service SUE NDIS Protocol Driver n'a pas pu démarrer en raison
de l'erreur : %%2

Error - 28/02/2010 16:01:13 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Synthétiseur de table de sons GC noyau Microsoft n'a pas
pu démarrer en raison de l'erreur : %%2

Error - 28/02/2010 16:01:44 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Pilote parent générique USB Microsoft n'a pas pu démarrer
en raison de l'erreur : %%2

Error - 28/02/2010 16:11:53 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Pilote de stockage de masse USB n'a pas pu démarrer en
raison de l'erreur : %%2

Error - 28/02/2010 16:12:02 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Périphérique vidéo USB (WDM) n'a pas pu démarrer en raison
de l'erreur : %%2

Error - 28/02/2010 16:12:25 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Codec Teletext standard n'a pas pu démarrer en raison de
l'erreur : %%2

< End of report >

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-4067298374-275367959-1537749475-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" = C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}" = OpenOffice.org 3.1
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1036-7B44-A81200000003}" = Adobe Reader 8.1.2 - Français
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast!" = avast! Antivirus
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Marvell Miniport Driver" = Marvell Miniport Driver
"Mozilla Firefox (3.5.

" = Mozilla Firefox (3.5.

"Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.3.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.0.3

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 28/12/2009 08:00:55 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = Error in aswChestC: chestOpenList Error 1753.

Error - 28/12/2009 08:00:55 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::LoadFiles()
chestOpenList() failed: 2147422219.

Error - 28/12/2009 08:01:06 | Computer Name = PATRICIA | Source = avast! | ID = 33554522
Description = aswChestInterface - Program error description: CChestListView::OnCreate()
!m_strErrorWnd.IsEmpty().

[ Application Events ]
Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:03 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:04 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Cette connexion réseau n'existe pas.

Error - 22/02/2010 09:44:31 | Computer Name = PATRICIA | Source = crypt32 | ID = 131080
Description = Échec de la récupération de la mise à jour automatique du numéro de
séquence de la liste racine tierce partie à partir de : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
avec l'erreur : Le serveur a renvoyé une réponse non valide ou non reconnue

Error - 26/02/2010 07:01:05 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 10:01:17 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 12:01:15 | Computer Name = PATRICIA | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 28/02/2010 15:57:54 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Secdrv n'a pas pu démarrer en raison de l'erreur : %%2

Error - 28/02/2010 15:59:31 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Détrameur décalage BDA n'a pas pu démarrer en raison de
l'erreur : %%2

Error - 28/02/2010 15:59:42 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Splitter audio du noyau Microsoft n'a pas pu démarrer en
raison de l'erreur : %%2

Error - 28/02/2010 16:00:51 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service BDA IPSink n'a pas pu démarrer en raison de l'erreur :
%%2

Error - 28/02/2010 16:01:04 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service SUE NDIS Protocol Driver n'a pas pu démarrer en raison
de l'erreur : %%2

Error - 28/02/2010 16:01:13 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Synthétiseur de table de sons GC noyau Microsoft n'a pas
pu démarrer en raison de l'erreur : %%2

Error - 28/02/2010 16:01:44 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Pilote parent générique USB Microsoft n'a pas pu démarrer
en raison de l'erreur : %%2

Error - 28/02/2010 16:11:53 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Pilote de stockage de masse USB n'a pas pu démarrer en
raison de l'erreur : %%2

Error - 28/02/2010 16:12:02 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Périphérique vidéo USB (WDM) n'a pas pu démarrer en raison
de l'erreur : %%2

Error - 28/02/2010 16:12:25 | Computer Name = PATRICIA | Source = Service Control Manager | ID = 7000
Description = Le service Codec Teletext standard n'a pas pu démarrer en raison de
l'erreur : %%2

< End of report >

laurentmouhot · le 01 Mar 2010 13:09

Bonjour,

Maintenant WIndows ne demarre plus en mode normal; seul le mode sans echec fonctionne...

Je suis de plus en plus inquiet

Merci de ton aide

jeanmimigab · le 01 Mar 2010 18:36

salut,

ouai, au vue des rapports pas mal d'erreur système apparaissent...

commence par cela stp...

Télécharge >> TFC.exe << impérativement sur ton bureau

Ferme tous les programmes en cour de fonctionnement...

Fait un double-clic sur l'icône de TFC pour le lancer

Une demande va apparaitre pour te demander de redémarrer ton pc, cliques sur "YES" et laisse faire TFC.

ensuite...

* Fait un double-clic sur l'icône d'OTL pour le lancer
/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Output" (en haut à droite) la case "minimal Output" soit cochée.

* Copies et colles le contenue de cette citation dans la partie inférieure d'OTL "Custom scan/fixes"

:files
C:\Documents and Settings\Patricia MOUHOT\Menu Démarrer\Programmes\Démarrage\winesm32.exe
C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat
C:\WINDOWS\Temp\_ex-68.exe

:Commands
[emptytemp]

* Cliques sur l'icône "Run Fix" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).
* Copie et colle le ou les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

ensuite dit moi si tu arrives a redémarrer en mode normal, et si le problème persiste, dit moi à quel moment cela bloque

@++

laurentmouhot · le 01 Mar 2010 21:08

Merci pour tes conseils

J'ai fais tourner TFC ( il n'y a pas eu de reboot)
Puis OTL qui a fait rebooter le systeme

Voici le log

All processes killed
========== FILES ==========
C:\Documents and Settings\Patricia MOUHOT\Menu Démarrer\Programmes\Démarrage\winesm32.exe moved successfully.
C:\Documents and Settings\Patricia MOUHOT\Application Data\avdrn.dat moved successfully.
File\Folder C:\WINDOWS\Temp\_ex-68.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1007755 bytes
->FireFox cache emptied: 3642148 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Patricia MOUHOT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 4,00 mb

OTL by OldTimer - Version 3.1.30.3 log created on 03012010_205726

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

jeanmimigab · le 01 Mar 2010 21:10

hello,

est ce que le pc re-fonctionne en mode normal maintenant ?

marjo30 · le 01 Mar 2010 22:00

Salut,
depuis cet après midi Avast a détecté le virus W32:rootkit-gen et pertube fortement mon ordi.
Si quelqu'un peu m'aider car je sais pas quoi faire.
J'ai fais une analyse avec Hijack et voici le rapport. merci de m'indiquer la arche à suivre.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:11:09, on 01/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\csrss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
H:\WINDOWS\system32\WgaTray.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Bonjour\mDNSResponder.exe
H:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
H:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
H:\Program Files\Norton Ghost\Agent\VProSvc.exe
H:\Program Files\Controle Parental\bin\optproxy.exe
H:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\WINDOWS\RTHDCPL.EXE
H:\Program Files\Norton Ghost\Agent\VProTray.exe
H:\Program Files\Canon\MyPrinter\BJMyPrt.exe
H:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
H:\Program Files\iTunes\iTunesHelper.exe
H:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
H:\Program Files\Logitech\QuickCam\Quickcam.exe
H:\PROGRA~1\CONTRO~1\bin\optgui.exe
H:\DOCUME~1\ALLUSE~1\APPLIC~1\92663329\92663329.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
H:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
H:\Program Files\OpenOffice.org 2.0\program\soffice.exe
H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
H:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
H:\Program Files\iPod\bin\iPodService.exe
H:\WINDOWS\System32\alg.exe
H:\Program Files\OrangeHSS\systray\systrayapp.exe
H:\WINDOWS\system32\wuauclt.exe
H:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Windows Live\Toolbar\wltuser.exe
H:\Documents and Settings\Marjorie\Local Settings\Temporary Internet Files\Content.IE5\1ITN2R8B\HiJackThis[1].exe
H:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ke.voila.fr/S/voila?kw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - H:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - H:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - H:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - H:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - H:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - H:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - H:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] H:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [StartCCC] "H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Norton Ghost 12.0] "H:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] H:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] H:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "H:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "H:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [fssui] "H:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "H:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "H:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [OPTENET_GUI] H:\PROGRA~1\CONTRO~1\bin\optgui.exe
O4 - HKLM\..\Run: [ORAHSSSessionManager] "H:\Program Files\OrangeHSS\SessionManager\SessionManager.exe"
O4 - HKLM\..\Run: [92663329] H:\DOCUME~1\ALLUSE~1\APPLIC~1\92663329\92663329.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "H:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 2.0.lnk = H:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: winesm32.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.0.lnk = H:\Program Files\OpenOffice.org 2.0\program\quickstart.exe (User 'Default user')
O4 - .DEFAULT Startup: winesm32.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = H:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: winesm32.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://H:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://H:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://H:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - H:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - H:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mu3: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mxl: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mya: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myt: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .xmz: H:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader5.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-U ... E_UNO1.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maco ... _0_2_0.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - H:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - H:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - H:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - H:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - H:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Norton Ghost - Symantec Corporation - H:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - H:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 14066 bytes

jeanmimigab · le 01 Mar 2010 22:23

salut marjo30

il ne faut pas squater le topic d'un autre,

rend toi en catégorie "forum sécurité et virus" et clique sur l'icône

afin de créer ton propre sujet stp...

laurentmouhot · le 04 Mar 2010 22:27

Bonsoir,
je suis désolé d'avoir mis autant de temps pour répondre.

Le PC ne démarrage toujours pas en mode normal . Il bloque en mode sans echec après le logo windows

jeanmimigab · le 05 Mar 2010 17:02

hello,

Pas de soucie pour le délais de réponse :wink:

l'infection que tu as détruit partiellement ou totalement certain pilotes nécessaire au bon fonctionnement de ton pc;..

est ce que tu as la possibilité de démarrer en "mode sans échec avec prise en charge réseau", si oui, démarres dans ce mode et dit moi si tu peux te connecter au web :wink:

laurentmouhot · le 05 Mar 2010 19:42

BOnjour,

EN mode sans echec avec prise en charge reseau j'ai la connection internet qui fonctionne normalement c'est seulement au demarrage sandard que le PC bloque sur l'écran bienvenue.

A bientot

jeanmimigab · le 05 Mar 2010 20:15

ok c'est cool, on va tenter une restauration du système à une date antérieur à tes problèmes de démarrage.

1. une fois que tu es en mode sans échec
2. Clique sur Démarrer, pointe sur Tous les programmes, Accessoires, Outils système, puis clique sur Restauration du système. La Restauration du système démarre.
3. Sur la page Restauration du système, cliquez sur l'option Restaurer mon ordinateur à une heure antérieure (si elle n'est pas déjà sélectionnée), puis clique sur Suivant.
4. Sur la page Sélectionnez un point de restauration assez ancien (antérieur aux soucis de démarrage), cliquez sur le point de restauration puis clique sur Suivant.

Remarque :Un message de la Restauration du système peut s'afficher pour indiquer les modifications de configuration qui vont être effectuée. Cliquez sur OK.
5. Sur la page Confirmez la sélection du point de restauration, cliquez sur Suivant. L'outil Restauration du système restaure la configuration Windows XP antérieure, puis redémarre l'ordinateur.
suis le reste des instructions et dit moi si le pc redémarre en mode normal :wink:

laurentmouhot · le 06 Mar 2010 05:37

Super ca demarre merci beaucoup
tout semble etre revenu normal

encore une fois merci pour ton aide

il ne me reste qu'a remettre en etat moin autre PC*

A bientot

W32:rootkit-gen

W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Re: W32:rootkit-gen

Sujets similaires

Qui est en ligne