Google s'obstine à ouvrir des contenus douteux...

~zopo~ · le 01 Nov 2011 15:45

Bonjour,
J'ai un problème plutôt ennuyeux , depuis quelques jours, quand je clique sur un lien dans le moteur de recherche Google, mon navigateur ouvre des contenus douteux : téléchargement de jeux, hacking et même parfois contenus pornographique.

Je pense que c'est une redirection, car quand j'arrête le chargement de la page et je la réactualise, j'arrive bel et bien sur le site recherché.

J'ai presque tous essayer : changer de navigateur, réparé les erreurs de registre, supprimé les logiciels inconnus et les toolsbarr.

Comment pourrais-je résoudre se problème ennuyeux ?

Merci pour vos réponses à venir...

PS : J'ajoute que je suis sous Windows XP SP3.

Del-crosseur · le 01 Nov 2011 16:25

Bonjour ,

Installation/Suppression

Télécharges AdwCleaner de Xplode
Lance AdwCleaner.exe
accepter l'avertissement qui suit
Sur la page, cliques sur le bouton Suppression
Laisses travailler l'outil
Postes le rapport qui apparait à la fin .
Il est sauvegardé aussi sous C:\AdwCleaner[Delete].txt
Clic sur Quitter

Puis :::

Pour Internet Explorer:
Démarrer IE-->Outils-->Options Internet-->Onglet avancé-->réinitialiser

Pour FireFox:
Démarre FireFox --> Outil Options --> Onglet général --> Restaurer la configuration par défaut

Pour Google Chrome:
Outils "clé en haut à droite" --> Options -- > Options avancés --> Rétablir les valeurs par défaut

Enfin :::

Télécharge ZHPDiag par Nicolas Coolman et sauvegarde-le sur le Bureau.

Laisse toi guider lors de l'installation, le programme se lancera automatiquement à la fin.
/!\Utilisateur de Vista et Seven : Clique droit sur le logo de ZHPdiag:
« exécuter en tant qu'Administrateur »/!\
Cliquer sur l'icône représentant une loupe (« Lancer le diagnostic »)
/!\Ne touche pas au pc lors du Scan ,celui-ci provoquerait un Gel du programme/!\
Enregistrer le rapport sur le Bureau à l'aide de l'icône représentant une disquette
Va sur le site http://www.cijoint.fr/
Clique sur le bouton Parcourir et sélectionne le dernier rapport ZHPDiag.txt qui est sur ton bureau.
Clique ensuite sur cliquez-ici pour déposer le fichier (vers le bas de la page)
Patiente puis copie/colle dans ta réponse le lien qui apparait

Note: pour les utilisateurs d'Avast : Cet antivirus génère des alertes, il s'agit de faux positif (fausses alertes) délivrés par l'antivirus lorsqu'il rencontre une base de donnée PARADOX Delphi Borland.

Bonne journée !

~zopo~ · le 01 Nov 2011 17:21

ZHPDiag ce ferme lorsque qu'il as finit l’analyse et ne veut pas se ré-ouvrir.
Mais j'ai le rapport de AdwCleaner, je l'ai hébergé car il est sûrement trop grand pour être posté sur le forum :
http://www.megaupload.com/?d=82AJRUC5

Del-crosseur · le 01 Nov 2011 17:40

re ,

Se pc est bien infecté dit donc !
Pas possible d'avoir le rapport de ZHPDiag une fois le scan arriver à 100% ?

PS: Utiliser le site Cijoint.fr pour héberger votre les rapports demandé !

Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\Déconnecte-toi et ferme toutes applications en cours (important) /!\

Double-clique sur le programme d'installation ; laisse-le s' installer par défaut (C:\Program files).
Double-clique sur l'icône AD-Remover située sur ton Bureau.
Au menu principal, choisis l'option "Nettoyer".
Poste le rapport qui apparaît à la fin.

(Le rapport est aussi conservé sous C:\Ad-report(date).log)

(Ctrl+A pour tout sélectionner, Ctrl+C pour copier et Ctrl+V pour coller)

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus comme une infection ;
ne pas en tenir compte (il s'agit d'un faux positif) et continue la procédure.

Puis :::

Télécharge puis installe :

par Marcin Kleczynski

*** Met-le à jour(très important ) , puis coche, "Exécuter un examen complet"

*** Si une infection est trouvée, coche la case à coté et valide avec l’Onglet Supprimer la sélection

*** Après la suppression , l'outil va surement te demander de redémarrer l'ordinateur -->accepte<--

*** il est conseillé de désactivé Tea-Timer si tu as Spybot-S&D juste le temps du scan.

Voici comment faire: Lancez Spybot-S&D, passez en Mode avancé via le Menu Mode (en haut) ? cliquez sur Oui--> choisissez Outils dans la barre de navigation sur la gauche -->Résident et là vous pouvez décocher les cases situées devant les deux outils.

Poste le rapport final.

Ps:Au cas ou tu n'a pas le rapport suite à une erreur de manipulation ; relance Malwarebytes puis rends toi dans l'onglet "rapports/Logs" selectionne le dernier puis Copier/Coller dans ta réponse

~zopo~ · le 01 Nov 2011 17:45

Ok, je fait ça.
Je ne pouvais pas posté directement le contenue car mon message ne s'affichait pas, je pense que le forum ne supporte pas plus d'un certain nombre de caractères.

Et je ne comprend pas le passage de ton message qui dit :

il est conseillé de désactivé Tea-Timer si tu as Spybot-S&D juste le temps du scan.

Qu'est-ce que Tea-Timer et Spybot-S&D ?

EDIT : Et oui je ne peut pas accéder au rapport quand ZHPDiag à finit le scan.

Del-crosseur · le 01 Nov 2011 18:15

re ,

Comme ceci => http://www.commentcamarche.net/faq/2128 ... -de-spybot

D'accort , faite donc le Scan avec Malwarebytes puis retenté ZHPDiag.
Si celui-ci ne se lance toujours pas , essayer en Mode sans Échec !

~zopo~ · le 02 Nov 2011 11:37

Comme ZHPDiag, Malwarebyte ce ferme au bout de quelques secondes après l’analyse. Je vais essayer en mode sans échec.
Par contre voici le rapport de AdRemover :

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 18:25:35 le 01/11/2011, Mode normal

Microsoft Windows XP Professionnel Service Pack 3 (X86)
bastien@BM ( )

============== RECHERCHE ==============

Dossier trouvé: C:\Program Files\freeTVRadio

Clé trouvée: HKLM\Software\Classes\CLSID\{9811454A-49EA-4334-ADCE-71E351C39EC1}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9811454A-49EA-4334-ADCE-71E351C39EC1}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9811454A-49EA-4334-ADCE-71E351C39EC1}
Clé trouvée: HKLM\Software\Classes\CLSID\{9C760F4E-8073-43A3-AAFF-1CD887AE392B}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9C760F4E-8073-43A3-AAFF-1CD887AE392B}
Clé trouvée: HKLM\Software\Classes\Toolbar.CT2633954
Clé trouvée: HKU\.DEFAULT\Software\Conduit
Clé trouvée: HKU\.DEFAULT\Software\conduitEngine
Clé trouvée: HKU\.DEFAULT\Software\ShopperReports3
Clé trouvée: HKU\S-1-5-18\Software\Conduit
Clé trouvée: HKU\S-1-5-18\Software\conduitEngine
Clé trouvée: HKU\S-1-5-18\Software\ShopperReports3
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1EA427D9-B978-4994-9A35-CD7F59387258}

============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [7.0.1 (fr)] ****

Plugins\npdeployJava1.dll (Oracle Corporation)
HKLM_MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.4 (x)
HKLM_MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5 (x)
HKLM_MozillaPlugins\Adobe Reader (x)
Searchplugins\bing.xml ( hxxp://www.bing.com/search)
Components\browsercomps.dll (Mozilla Foundation)
Extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} (Java Console)
HKLM_Extensions|{1E73965B-8B48-48be-9C8D-68B920ABC1C4} - C:\Program Files\AVG\AVG10\Firefox4\

-- C:\Documents and Settings\bastien\Application Data\Mozilla\FireFox\Profiles\rs0rssie.default --
Extensions\LogMeInClient@logmein.com (LogMeIn, Inc. Remote Access Plugin)
Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} (DVDVideoSoft Menu)
Prefs.js - browser.download.lastDir, C:\\Documents and Settings\\bastien\\Bureau
Prefs.js - browser.search.defaulturl,
Prefs.js - browser.startup.homepage_override.buildID, 20110928134238
Prefs.js - browser.startup.homepage_override.mstone, rv:7.0.1
Prefs.js - keyword.URL, chrome://browser-region/locale/region.properties

-- C:\Documents and Settings\Admin\Application Data\Mozilla\FireFox\Profiles\zia90y1v.default --
Prefs.js - browser.startup.homepage_override.buildID, 20110318052756
Prefs.js - browser.startup.homepage_override.mstone, rv:2.0

========================================

**** Internet Explorer Version [8.0.6001.18702] ****

HKCU_Main|Start Page - hxxp://www.google.fr
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKLM_Main|Default_Search_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Search bar - hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Start Page - hxxp://www.google.fr
HKCU_URLSearchHooks|{A306B7BF-10D7-44EA-B2AF-010E0CCEADF2} (x)
HKCU_Toolbar\WebBrowser|{EEE6C35B-6118-11DC-9C72-001320C79847} (x)
HKCU_Toolbar\WebBrowser|{09B445AE-2345-4FCA-85AE-FB3626ECEBDD} (x)
HKLM_Toolbar|{09B445AE-2345-4FCA-85AE-FB3626ECEBDD} (x)
HKLM_ElevationPolicy\cf425b3d-4192-4cf1-8a30-1b318cda760e - C:\Program Files\DVDVideoSoftTB\DVDVideoSoftTBToolbarHelper.exe (x)
HKLM_ElevationPolicy\{1EA427D9-B978-4994-9A35-CD7F59387258} - C:\Program Files\ConduitEngine\ConduitEngineHelper.exe (x)
HKLM_ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} - C:\Program Files\Java\jre7\bin\ssvagent.exe (Oracle Corporation)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 0 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 01/11/2011 18:25:41 (470 Octet(s))

Fin à: 18:26:09, 01/11/2011

============== E.O.F ==============

EDIT : Même en mode sans échec ça ne marche pas, le message dit à peu près ça : "Ce programme ne peut pas être ouvert en mode sans échec..."
Et en mode normal le message dit : "Windows ne parvient pas à accéder au périphérique, au chemin d’accès ou au fichier désirer. Vous n'avez peut être pas les droits pour ouvrir ce fichier." Mais mon compte est administrateur

Del-crosseur · le 02 Nov 2011 18:44

Bonsoir ,

Hum...

Télécharge >> OTL <<sur ton bureau.

* Fait un double-clic sur l'icône d'OTL pour le lancer
/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "rapport minimal " soit cochée.

* Coches les case situées devant "Tous les utilisateurs", " Recherche LOP" et "Recherche Purity".

* Copier et colle le contenue de cette citation dans la partie inférieure d'OTL "personnalisation"

%temp%\smtmp\1\*.* /s
%temp%\smtmp\2\*.* /s
%temp%\smtmp\4\*.* /s
NetSvcs
%systemroot%\system32\drivers\*.sys /lockedfiles
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
netsvcs
/md5start
dwm.exe
taskhost.exe
taskeng.exe
wscntfy.exe
ctfmon.exe
rdpclip.exe
volsnap.sys
sptd.sys
explorer.exe
userinit.exe
winlogon.exe
wininit.exe
tcpip.sys
Sfloppy.sys
Changer.sys
cdrom.sys
disk.sys
ndis.sys
usbscan.sys
usbprint.sys
tdtcp.sys
tdpipe.sys
swmidi.sys
splitter.sys
rdpwd.sys
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
RASACD.SYS
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

* Cliques sur l'icône "Analyse" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( réduit dans la barre des taches).
* Copie et colle les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL

PS: Hébérge tes rapport ici -> http://www.cijoint.fr/index.php puis donne moi le lien obtenu !

Bonne soirée !

~zopo~ · le 02 Nov 2011 21:04

C'est bon voici les rapports :

OLT.txt

OTL logfile created on: 02/11/2011 20:52:50 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\bastien\Bureau
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1,99 Gb Total Physical Memory | 1,17 Gb Available Physical Memory | 58,71% Memory free
3,84 Gb Paging File | 3,18 Gb Available in Paging File | 82,88% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 26,37 Gb Total Space | 9,77 Gb Free Space | 37,05% Space Free | Partition Type: NTFS
Drive D: | 29,52 Gb Total Space | 11,21 Gb Free Space | 37,98% Space Free | Partition Type: NTFS

Computer Name: BM | User Name: bastien | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\3528475283:1824370477.exe File not found
PRC - C:\Documents and Settings\bastien\Bureau\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Bamboo Dock\BambooCore.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Bamboo Dock\BambooCore.exe ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files\Tablet\Pen\libxml2.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\pdfcmnnt.dll ()

========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- File not found
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ()
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (TabletServicePen) -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (TouchServicePen) -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
SRV - (NMSAccess) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe ()

========== Driver Services (SafeList) ==========

DRV - (LMIRfsClientNP) -- C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (Lbd) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (wacmoumonitor) -- C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (LMIRfsDriver) -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (iaStor) -- C:\WINDOWS\System32\drivers\iaStor.cat ()
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (w29n51) Pilote de carte de connexion réseau Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (FUJ02E3) -- C:\WINDOWS\system32\drivers\fuj02e3.sys (FUJITSU LIMITED)
DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (FUJ02B1) -- C:\WINDOWS\system32\drivers\fuj02b1.sys (FUJITSU LIMITED)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.fr/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
IE - HKCU\..\URLSearchHook: {A306B7BF-10D7-44EA-B2AF-010E0CCEADF2} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.4: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/10/13 18:41:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/23 14:35:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/31 09:13:15 | 000,000,000 | ---D | M]

[2011/03/08 09:25:00 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\bastien\Application Data\Mozilla\Extensions
[2011/11/01 16:47:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\bastien\Application Data\Mozilla\Firefox\Profiles\rs0rssie.default\extensions
[2011/03/27 15:51:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\bastien\Application Data\Mozilla\Firefox\Profiles\rs0rssie.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/03/27 11:19:31 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Documents and Settings\bastien\Application Data\Mozilla\Firefox\Profiles\rs0rssie.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/08/08 13:16:07 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Documents and Settings\bastien\Application Data\Mozilla\Firefox\Profiles\rs0rssie.default\extensions\LogMeInClient@logmein.com
[2011/10/31 09:13:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/10/31 09:13:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}
[2011/10/23 14:35:52 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/10/31 09:12:52 | 000,611,224 | ---- | M] (Oracle Corporation) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/23 14:35:49 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2011/10/23 14:35:49 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/10/23 14:35:49 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
[2011/10/23 14:35:49 | 000,001,154 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2011/10/23 14:35:49 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2011/10/23 14:35:49 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =

O1 HOSTS File: ([2006/03/02 13:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {09B445AE-2345-4FCA-85AE-FB3626ECEBDD} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {09B445AE-2345-4FCA-85AE-FB3626ECEBDD} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe ()
O4 - HKLM..\Run: [BambooCore] C:\Program Files\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [Raccourci vers la page des propriétés de High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [Bamboo Dock] C:\Program Files\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe ()
O4 - HKCU..\Run: [PCSpeedUp] C:\Program Files\Accelerer PC\PCSpeedUp.lnk ()
O4 - Startup: C:\Documents and Settings\bastien\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\bastien\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - mswsock.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta ... s-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2BDA7233-C049-4C7F-98CF-49BC56EFE110}: DhcpNameServer = 212.27.40.240 212.27.40.241
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\bastien\Local Settings\Application Data\934250d2\X) -C:\Documents and Settings\bastien\Local Settings\Application Data\934250d2\X ()
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\bastien\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\bastien\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/03/07 20:04:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: BambooScribe.exe - hkey= - key= - File not found
MsConfig - StartUpReg: BambooScribeAutoStart.vbe - hkey= - key= - File not found
MsConfig - StartUpReg: uTorrent - hkey= - key= - File not found
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ()
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ()
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Rendu VML (Vector Graphics Rendering)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Liaison de données Dynamic HTML pour Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Création avancée
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Mise à jour de sécurité pour Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {72AD53CC-CCC0-3757-8480-9EE176866A7C} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9A394342-4A68-4EBA-85A6-55B559F4E700} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Planificateur de tâches
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Nla - C:\WINDOWS\system32\mswsock.dll ()
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

File not found -- C:\WINDOWS\System32\
[2011/11/02 20:51:45 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\bastien\Bureau\OTL.exe
[2011/11/02 14:54:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2011/11/02 13:56:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Mes documents\College
[2011/11/02 11:30:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malwarebytes' Anti-Malware
[2011/11/02 11:30:25 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/11/02 11:30:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/11/01 19:13:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Lavasoft
[2011/11/01 18:19:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Application Data\Malwarebytes
[2011/11/01 18:19:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/11/01 18:18:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Menu Démarrer\Programmes\Ad-Remover
[2011/11/01 18:18:29 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Remover
[2011/11/01 17:57:38 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\bastien\Bureau\mbam-setup-1.51.2.1300.exe
[2011/11/01 17:02:19 | 000,000,000 | ---D | C] -- C:\ZHP
[2011/11/01 17:02:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ZHP
[2011/11/01 17:02:03 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPDiag
[2011/11/01 16:52:16 | 002,810,335 | ---- | C] (Nicolas Coolman ) -- C:\Documents and Settings\bastien\Bureau\ZHPDiag2.exe
[2011/11/01 12:37:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Application Data\AVG
[2011/11/01 12:04:10 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\bastien\Recent
[2011/11/01 11:53:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\CCleaner
[2011/11/01 11:53:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/10/31 12:20:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Crocodile Clips
[2011/10/31 12:19:36 | 000,000,000 | ---D | C] -- C:\Program Files\Crocodile Clips
[2011/10/31 12:16:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Local Settings\Application Data\Sun
[2011/10/31 10:06:01 | 000,000,000 | ---D | C] -- C:\JDK
[2011/10/31 09:13:48 | 000,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\Java
[2011/10/31 09:13:14 | 000,214,408 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2011/10/31 09:13:14 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2011/10/31 09:13:14 | 000,173,960 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2011/10/30 16:32:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Application Data\PureBasic
[2011/10/30 16:32:11 | 000,000,000 | ---D | C] -- C:\Program Files\PureBasic
[2011/10/28 14:28:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Application Data\Dofus
[2011/10/28 08:12:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Menu Démarrer\Programmes\Dofus 2
[2011/10/28 08:12:56 | 000,000,000 | ---D | C] -- C:\Program Files\Dofus 2
[2011/10/25 15:05:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Mes documents\Mes fichiers reçus
[2011/10/24 10:53:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2011/10/23 13:46:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Mes documents\PCSpeedUp
[2011/10/23 13:45:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\amsn
[2011/10/23 13:45:48 | 000,000,000 | ---D | C] -- C:\Program Files\Accelerer PC
[2011/10/23 13:45:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Microsoft Silverlight
[2011/10/23 09:56:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/10/20 18:50:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/10/20 18:28:27 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\bastien\Local Settings\Application Data\934250d2
[2011/10/12 17:58:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Bureau\userbarr
[2011/10/10 19:26:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2011/10/06 20:54:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\bastien\Application Data\Skype
[2011/10/06 20:54:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Skype
[2011/10/06 20:54:27 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011/10/06 20:54:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Skype
[2011/10/05 15:01:18 | 000,000,000 | ---D | C] -- C:\Program Files\Hasard
[2011/10/05 15:01:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Hasard
[24 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

File not found -- C:\WINDOWS\System32\
[2011/11/02 20:51:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\bastien\Bureau\OTL.exe
[2011/11/02 20:49:44 | 136,766,677 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/11/02 20:47:32 | 000,000,436 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{AB3636B2-0CA7-4344-90F5-D5A3F0C7875E}.job
[2011/11/02 14:54:35 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2011/11/02 14:54:21 | 000,000,000 | ---- | M] () -- C:\WINDOWS\3528475283
[2011/11/02 14:54:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/11/02 13:54:54 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/11/02 11:30:33 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2011/11/01 19:13:47 | 000,000,506 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/11/01 19:13:35 | 000,000,797 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Ad-Aware.lnk
[2011/11/01 18:35:39 | 000,139,648 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/11/01 18:18:34 | 000,001,554 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\Ad-Remover.lnk
[2011/11/01 17:59:37 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\bastien\Bureau\mbam-setup-1.51.2.1300.exe
[2011/11/01 17:56:36 | 001,563,105 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\AD-R.exe
[2011/11/01 17:41:19 | 000,000,478 | -H-- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for bastien.job
[2011/11/01 17:09:36 | 000,000,673 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk
[2011/11/01 17:09:34 | 000,000,661 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011/11/01 17:09:31 | 000,000,666 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011/11/01 17:01:26 | 002,810,335 | ---- | M] (Nicolas Coolman ) -- C:\Documents and Settings\bastien\Bureau\ZHPDiag2.exe
[2011/11/01 16:01:19 | 000,036,910 | ---- | M] () -- C:\Documents and Settings\bastien\.recently-used.xbel
[2011/11/01 12:30:03 | 000,043,882 | ---- | M] () -- C:\Documents and Settings\bastien\Mes documents\cc_20111101_122956.reg
[2011/11/01 11:53:48 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\CCleaner.lnk
[2011/10/31 15:48:50 | 000,000,480 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\Raccourci vers eclipse.lnk
[2011/10/31 12:20:06 | 000,001,976 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Crocodile Junior (FR).lnk
[2011/10/31 10:53:21 | 000,576,804 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2011/10/31 10:53:21 | 000,503,116 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/10/31 10:53:21 | 000,105,190 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2011/10/31 10:53:21 | 000,088,640 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/10/31 09:12:52 | 000,214,408 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2011/10/31 09:12:52 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2011/10/31 09:12:52 | 000,128,000 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2011/10/31 09:12:51 | 000,544,656 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2011/10/31 09:12:51 | 000,173,960 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2011/10/31 09:09:20 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/10/30 15:40:31 | 000,000,008 | ---- | M] () -- C:\Documents and Settings\bastien\Application Data\DofusAppId0_1
[2011/10/30 14:58:05 | 000,000,197 | ---- | M] () -- C:\Documents and Settings\bastien\Application Data\D2Info0
[2011/10/30 11:34:41 | 000,000,008 | ---- | M] () -- C:\Documents and Settings\bastien\Application Data\DofusAppId0_2
[2011/10/29 14:46:35 | 000,000,008 | ---- | M] () -- C:\Documents and Settings\bastien\Application Data\DofusAppId0_3
[2011/10/28 13:13:51 | 000,021,504 | ---- | M] () -- C:\Documents and Settings\bastien\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/28 10:00:36 | 000,000,548 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\Pokémon Pluie et Foudre DS.lnk
[2011/10/28 08:12:57 | 000,000,761 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\Dofus.lnk
[2011/10/27 10:47:28 | 000,284,523 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\Arène.png
[2011/10/22 14:19:41 | 000,606,877 | ---- | M] () -- C:\Documents and Settings\bastien\Mes documents\présentation.odt
[2011/10/20 18:31:45 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/10/19 13:11:20 | 000,000,390 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\index.html
[2011/10/16 19:30:01 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/10/16 19:30:01 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2011/10/16 16:41:36 | 000,063,504 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/10/15 14:52:41 | 000,450,949 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\BW_WM.jpg
[2011/10/13 18:41:25 | 000,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\AVG 2011.lnk
[2011/10/13 18:36:17 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/10/10 20:37:34 | 000,001,780 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\banière1.png
[2011/10/09 10:18:53 | 000,000,378 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\JeuMa web.lnk
[2011/10/06 20:54:28 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2011/10/05 19:24:19 | 000,083,360 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIRfsClientNP.dll
[2011/10/05 19:24:18 | 000,087,424 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIinit.dll
[2011/10/05 19:24:18 | 000,030,592 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIport.dll
[2011/10/05 15:01:19 | 000,000,606 | ---- | M] () -- C:\Documents and Settings\bastien\Bureau\Hasard.lnk
[2011/10/04 16:33:03 | 000,000,212 | -HS- | M] () -- C:\boot.ini
[24 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/02 11:30:33 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk
[2011/11/01 19:13:35 | 000,000,797 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Ad-Aware.lnk
[2011/11/01 18:18:34 | 000,001,554 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\Ad-Remover.lnk
[2011/11/01 17:56:26 | 001,563,105 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\AD-R.exe
[2011/11/01 17:02:11 | 000,000,673 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk
[2011/11/01 17:02:09 | 000,000,661 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
[2011/11/01 17:02:07 | 000,000,666 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
[2011/11/01 16:01:19 | 000,036,910 | ---- | C] () -- C:\Documents and Settings\bastien\.recently-used.xbel
[2011/11/01 12:33:59 | 000,139,648 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/11/01 12:29:59 | 000,043,882 | ---- | C] () -- C:\Documents and Settings\bastien\Mes documents\cc_20111101_122956.reg
[2011/11/01 11:53:47 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\CCleaner.lnk
[2011/10/31 15:48:52 | 000,000,480 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\Raccourci vers eclipse.lnk
[2011/10/31 12:20:06 | 000,001,976 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Crocodile Junior (FR).lnk
[2011/10/28 10:00:36 | 000,000,548 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\Pokémon Pluie et Foudre DS.lnk
[2011/10/28 08:12:57 | 000,000,761 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\Dofus.lnk
[2011/10/27 10:47:28 | 000,284,523 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\Arène.png
[2011/10/26 10:45:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/10/20 18:31:45 | 000,000,000 | -HS- | C] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
[2011/10/20 18:28:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\3528475283
[2011/10/19 15:27:29 | 000,606,877 | ---- | C] () -- C:\Documents and Settings\bastien\Mes documents\présentation.odt
[2011/10/15 14:52:39 | 000,450,949 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\BW_WM.jpg
[2011/10/14 17:00:42 | 000,000,390 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\index.html
[2011/10/10 20:37:30 | 000,001,780 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\banière1.png
[2011/10/09 10:18:54 | 000,000,378 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\JeuMa web.lnk
[2011/10/06 20:54:28 | 000,001,878 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Skype.lnk
[2011/10/05 20:17:07 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\CodeBlocks.lnk
[2011/10/05 15:01:19 | 000,000,606 | ---- | C] () -- C:\Documents and Settings\bastien\Bureau\Hasard.lnk
[2011/10/05 15:01:18 | 000,064,000 | ---- | C] () -- C:\WINDOWS\System32\richtx32.oca
[2011/10/05 15:01:18 | 000,003,008 | ---- | C] () -- C:\WINDOWS\System32\richtx32.dep
[2011/08/12 11:59:15 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\InstallAlibre.config
[2011/08/02 12:18:33 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011/08/02 09:56:35 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2011/04/30 09:23:48 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/04/30 09:23:48 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2011/04/06 13:33:10 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\bastien\Local Settings\Application Data\fusioncache.dat
[2011/04/02 16:11:32 | 001,589,248 | ---- | C] () -- C:\WINDOWS\System32\libmysql_d.dll
[2011/03/22 18:48:48 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\bastien\Application Data\DofusAppId0_3
[2011/03/20 13:23:16 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\bastien\Application Data\DofusAppId0_1
[2011/03/20 09:17:19 | 000,000,197 | ---- | C] () -- C:\Documents and Settings\bastien\Application Data\D2Info0
[2011/03/20 09:17:19 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\bastien\Application Data\DofusAppId0_2
[2011/03/17 21:01:21 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011/03/12 15:38:00 | 000,021,504 | ---- | C] () -- C:\Documents and Settings\bastien\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/08 09:24:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/03/07 20:53:01 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/03/07 20:24:24 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\drivers\RtkHDAud.dat
[2011/03/07 20:24:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011/03/07 20:11:51 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/03/07 20:08:18 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2011/03/07 20:00:33 | 000,021,892 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/03/02 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/03/02 13:00:00 | 000,576,804 | ---- | C] () -- C:\WINDOWS\System32\perfh00C.dat
[2006/03/02 13:00:00 | 000,503,116 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/02 13:00:00 | 000,322,810 | ---- | C] () -- C:\WINDOWS\System32\perfi00C.dat
[2006/03/02 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/03/02 13:00:00 | 000,247,808 | ---- | C] () -- C:\WINDOWS\System32\mswsock.dll
[2006/03/02 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/03/02 13:00:00 | 000,105,190 | ---- | C] () -- C:\WINDOWS\System32\perfc00C.dat
[2006/03/02 13:00:00 | 000,088,640 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/02 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/03/02 13:00:00 | 000,034,108 | ---- | C] () -- C:\WINDOWS\System32\perfd00C.dat
[2006/03/02 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/03/02 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/03/02 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/03/02 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/07/30 10:48:28 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/07/30 09:49:22 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/03/30 21:58:36 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\Property.dll

========== Custom Scans ==========

< %temp%\smtmp\1\*.* /s >

< %temp%\smtmp\2\*.* /s >

< %temp%\smtmp\4\*.* /s >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %ALLUSERSPROFILE%\Application Data\*. >
[2011/08/02 17:26:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2011/03/07 20:29:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ahead
[2011/08/30 10:21:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alibre Design
[2011/11/01 18:48:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2011/08/02 09:57:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2011/03/07 21:07:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/08/12 10:50:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google
[2011/08/28 15:30:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallMate
[2011/11/01 19:13:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2011/11/01 12:32:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2011/11/01 18:19:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/06/08 18:04:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/10/23 13:45:43 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2011/11/01 12:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Norton
[2011/03/26 15:59:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2011/03/31 06:24:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2011/08/26 20:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Premium
[2011/10/06 20:54:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2011/03/07 21:17:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun
[2011/03/26 15:59:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2011/11/01 12:37:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/03/08 09:38:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Wacom
[2011/08/01 11:22:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2011/03/08 19:30:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip

< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2011/06/06 21:52:43 | 001,560,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1036-7B44-AA1000000001}\setup.exe
[2011/08/08 08:29:45 | 000,015,496 | R-S- | M] (Tarma Software Research Pty Ltd) -- C:\Documents and Settings\All Users\Application Data\InstallMate\{0D7B96A8-C2B4-5D2B-A957-AF83727E6F7F}\Setup.exe
[2011/08/08 08:29:45 | 000,015,496 | R-S- | M] (Tarma Software Research Pty Ltd) -- C:\Documents and Settings\All Users\Application Data\InstallMate\{DD26F4AE-C6F2-02B1-969F-C6DB6226A3CF}\Setup.exe
[2011/08/08 08:29:45 | 000,015,496 | R-S- | M] (Tarma Software Research Pty Ltd) -- C:\Documents and Settings\All Users\Application Data\InstallMate\{E2F0AF55-5FBE-905E-53A2-68E9AE4E0E2C}\Setup.exe

< %APPDATA%\*. >
[2011/03/26 12:59:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Adobe
[2011/08/12 12:01:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Alibre Design
[2011/03/20 09:17:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\app
[2011/11/01 12:37:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\AVG
[2011/03/07 21:22:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\AVG10
[2011/08/02 09:57:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Canneverbe Limited
[2011/10/30 08:34:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\codeblocks
[2011/09/25 18:00:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Crae Interactives
[2011/04/02 13:16:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\DeSmuME
[2011/10/28 14:29:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Dofus
[2011/10/30 15:33:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Dofus 2
[2011/03/20 09:17:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/03/22 18:48:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Dofus-3.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/03/20 13:23:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/03/27 11:27:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\DVDVideoSoftIEHelpers
[2011/11/01 16:45:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\FileZilla
[2011/04/23 09:11:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\GlarySoft
[2011/08/12 10:51:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Google
[2011/11/01 16:01:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\gtk-2.0
[2011/08/01 14:29:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Hitivi
[2011/04/02 13:16:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\iDeaS
[2011/03/07 20:37:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Identities
[2011/09/10 21:07:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\kompozer.net
[2011/03/08 09:06:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Macromedia
[2011/11/01 18:19:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Malwarebytes
[2011/10/05 20:08:57 | 000,000,000 | --SD | M] -- C:\Documents and Settings\bastien\Application Data\Microsoft
[2011/03/08 09:25:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Mozilla
[2011/03/08 09:19:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\MSNInstaller
[2011/10/13 21:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Notepad++
[2011/03/08 16:59:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\OpenOffice.org
[2011/03/09 23:21:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\PhotoFiltre
[2011/10/30 16:37:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\PureBasic
[2011/03/20 09:17:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/11/02 20:45:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Skype
[2011/03/08 09:16:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Sun
[2011/08/03 11:06:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Uniblue
[2011/04/02 13:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\VBA-M
[2011/08/28 19:30:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\vlc
[2011/03/08 09:07:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\Wacom
[2011/03/08 09:07:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2011/03/08 10:11:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\WinRAR
[2011/03/08 09:05:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bastien\Application Data\WTablet

< %APPDATA%\*.exe /s >
[2011/10/06 18:11:23 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Documents and Settings\bastien\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011/03/28 18:14:11 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\bastien\Application Data\Microsoft\Installer\{F7D64E3E-7DF0-46E0-92C5-11F575087ADB}\ARPPRODUCTICON.exe
[2011/04/24 06:23:34 | 000,053,248 | R--- | M] (InstallShield Software Corp.) -- C:\Documents and Settings\bastien\Application Data\Microsoft\Installer\{F7D64E3E-7DF0-46E0-92C5-11F575087ADB}\NewShortcut11_F7D64E3E7DF046E092C511F575087ADB.exe
[2011/04/24 06:23:34 | 000,053,248 | R--- | M] (InstallShield Software Corp.) -- C:\Documents and Settings\bastien\Application Data\Microsoft\Installer\{F7D64E3E-7DF0-46E0-92C5-11F575087ADB}\NewShortcut1_F7D64E3E7DF046E092C511F575087ADB.exe
[2011/05/19 10:06:56 | 000,374,160 | ---- | M] (LogMeIn, Inc.) -- C:\Documents and Settings\bastien\Application Data\Mozilla\Firefox\Profiles\rs0rssie.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardian.exe
[2011/05/16 12:31:42 | 000,070,984 | ---- | M] () -- C:\Documents and Settings\bastien\Application Data\Mozilla\Firefox\Profiles\rs0rssie.default\extensions\LogMeInClient@logmein.com\plugins\LMIProxyHelper.exe

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 10:36:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 10:36:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 10:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 10:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2006/03/02 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\atapi.sys

< MD5 for: CDROM.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008/04/13 10:40:48 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008/04/13 10:40:48 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2006/03/02 13:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys

< MD5 for: CHANGER.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2011/04/24 09:49:16 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys

< MD5 for: CTFMON.EXE >
[2008/04/13 18:34:00 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=59DC5BB82E4C8E0B3EADCFDBC44BA6E4 -- C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
[2008/04/13 18:34:00 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=59DC5BB82E4C8E0B3EADCFDBC44BA6E4 -- C:\WINDOWS\system32\ctfmon.exe
[2006/03/02 13:00:00 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=64E41E8FEE655B03E3F19DED21BA5118 -- C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe

< MD5 for: DISK.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2006/03/02 13:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 10:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 10:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2006/03/02 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=49B1376885340BF9EA0D99F71557B59A -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2008/04/13 18:33:26 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:33:26 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: EXPLORER.EXE >
[2006/03/02 13:00:00 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=2A7BD330924252A2FD80344FC949BB72 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008/04/13 18:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\explorer.exe
[2008/04/13 18:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: IASTOR.SYS >
[2007/03/21 11:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NDIS.SYS >
[2008/04/13 11:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008/04/13 11:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2006/03/02 13:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 18:33:36 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:33:36 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll
[2009/02/06 19:46:49 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ECD7791E0E9246CA5F218A19F3911EB9 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 19:46:49 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ECD7791E0E9246CA5F218A19F3911EB9 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2009/02/06 19:46:49 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ECD7791E0E9246CA5F218A19F3911EB9 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATABUS.SYS >
[2006/08/21 17:24:00 | 000,105,344 | ---- | M] (NVIDIA Corporation) MD5=4D6C6B46B3EDF6F2E219A86B61D104AE -- C:\WINDOWS\system32\drivers\nvatabus.sys

< MD5 for: RASACD.SYS >
[2006/03/02 13:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\dllcache\rasacd.sys
[2006/03/02 13:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\drivers\rasacd.sys

< MD5 for: RDPCLIP.EXE >
[2006/03/02 13:00:00 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=5CEDA4A82F07576B57BD554E20238F1B -- C:\WINDOWS\$NtServicePackUninstall$\rdpclip.exe
[2008/04/13 18:34:20 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=B46EF6930DDE7393FB4BD0150BCC786C -- C:\WINDOWS\ServicePackFiles\i386\rdpclip.exe
[2008/04/13 18:34:20 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=B46EF6930DDE7393FB4BD0150BCC786C -- C:\WINDOWS\system32\rdpclip.exe

< MD5 for: RDPWD.SYS >
[2005/06/10 05:06:01 | 000,139,528 | ---- | M] (Microsoft Corporation) MD5=047BEA21274C8A4A233674A76C958C2C -- C:\WINDOWS\$hf_mig$\KB899591\SP2QFE\rdpwd.sys
[2011/06/24 15:09:15 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=3348E61A78BA4F79C795AAD6565D3B6F -- C:\WINDOWS\$hf_mig$\KB2570222\SP3QFE\rdpwd.sys
[2008/04/13 18:34:56 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=6728E45B66F93C08F11DE2E316FC70DD -- C:\WINDOWS\ServicePackFiles\i386\rdpwd.sys
[2005/06/10 05:11:22 | 000,139,528 | ---- | M] (Microsoft Corporation) MD5=B54CD38A9EBFBF2B3561426E3FE26F62 -- C:\WINDOWS\$NtServicePackUninstall$\rdpwd.sys
[2011/06/24 15:10:47 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=FC105DD312ED64EB66BFF111E8EC6EAC -- C:\WINDOWS\system32\dllcache\rdpwd.sys
[2011/06/24 15:10:47 | 000,139,656 | R--- | M] (Microsoft Corporation) MD5=FC105DD312ED64EB66BFF111E8EC6EAC -- C:\WINDOWS\system32\drivers\rdpwd.sys

< MD5 for: SCECLI.DLL >
[2006/03/02 13:00:00 | 000,186,368 | ---- | M] (Microsoft Corporation) MD5=58D439F6EF73A2D9288B204E819F4BBD -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:33:42 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:33:42 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SFLOPPY.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Sfloppy.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Sfloppy.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Sfloppy.sys
[2006/03/02 13:00:00 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=0D13B6DF6E9E101013A7AFB0CE629FE0 -- C:\WINDOWS\$NtServicePackUninstall$\sfloppy.sys
[2008/04/13 10:40:50 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\ServicePackFiles\i386\sfloppy.sys
[2008/04/13 10:40:50 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\system32\drivers\sfloppy.sys

< MD5 for: SPLITTER.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:splitter.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:splitter.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:splitter.sys
[2004/08/03 23:07:48 | 000,006,400 | ---- | M] (Microsoft Corporation) MD5=8E186B8F23295D1E42C573B82B80D548 -- C:\WINDOWS\$NtServicePackUninstall$\splitter.sys
[2008/04/13 10:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\ServicePackFiles\i386\splitter.sys
[2008/04/13 10:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\system32\drivers\splitter.sys

< MD5 for: SWMIDI.SYS >
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:swmidi.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:swmidi.sys
[2008/04/13 10:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\ServicePackFiles\i386\swmidi.sys
[2008/04/13 10:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\system32\drivers\swmidi.sys
[2001/08/17 22:00:52 | 000,054,272 | ---- | M] (Microsoft Corporation) MD5=94ABC808FC4B6D7D2BBF42B85E25BB4D -- C:\WINDOWS\$NtServicePackUninstall$\swmidi.sys

< MD5 for: TCPIP.SYS >
[2008/06/20 11:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008/06/20 11:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2008/04/13 11:20:18 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008/06/20 12:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008/06/20 12:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008/06/20 12:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2008/06/20 12:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[2008/06/20 12:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2006/04/20 13:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys

< MD5 for: TDPIPE.SYS >
[2006/03/02 13:00:00 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=38D437CF2D98965F239B0ABCD66DCB0F -- C:\WINDOWS\$NtServicePackUninstall$\tdpipe.sys
[2008/04/13 18:34:54 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\ServicePackFiles\i386\tdpipe.sys
[2008/04/13 18:34:54 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\system32\drivers\tdpipe.sys

< MD5 for: TDTCP.SYS >
[2008/04/13 18:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\ServicePackFiles\i386\tdtcp.sys
[2008/04/13 18:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\system32\drivers\tdtcp.sys
[2006/03/02 13:00:00 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=ED0580AF02502D00AD8C4C066B156BE9 -- C:\WINDOWS\$NtServicePackUninstall$\tdtcp.sys

< MD5 for: USBPRINT.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbprint.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbprint.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbprint.sys
[2008/04/13 10:47:38 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A717C8721046828520C9EDF31288FC00 -- C:\WINDOWS\ServicePackFiles\i386\usbprint.sys

< MD5 for: USBSCAN.SYS >
[2006/03/02 13:00:00 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbscan.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbscan.sys
[2008/04/13 18:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbscan.sys
[2008/04/13 10:45:36 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\ServicePackFiles\i386\usbscan.sys

< MD5 for: USERINIT.EXE >
[2006/03/02 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=84717891F0734C611721F56C60B5FBC3 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 18:34:28 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 18:34:28 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\system32\userinit.exe

< MD5 for: VIAMRAID.SYS >
[2005/04/08 10:43:26 | 000,060,928 | ---- | M] (VIA Technologies inc,.ltd) MD5=0363E216E4EB5052969C96608934DBDE -- C:\WINDOWS\system32\drivers\viamraid.sys

< MD5 for: VOLSNAP.SYS >
[2006/03/02 13:00:00 | 000,053,376 | ---- | M] (Microsoft Corporation) MD5=313B1A0D5DB26DFE1C34A6C13B2CE0A7 -- C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys
[2008/04/13 17:56:06 | 000,053,376 | ---- | M] (Microsoft Corporation) MD5=46DE1126684369BACE4849E4FC8C43CA -- C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
[2008/04/13 17:56:06 | 000,053,376 | ---- | M] (Microsoft Corporation) MD5=46DE1126684369BACE4849E4FC8C43CA -- C:\WINDOWS\system32\drivers\volsnap.sys

< MD5 for: WINLOGON.EXE >
[2006/03/02 13:00:00 | 000,506,368 | ---- | M] (Microsoft Corporation) MD5=123EEA158F74D0F67A51DCDF065D1091 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2011/04/24 09:50:53 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 18:34:30 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\system32\winlogon.exe

< MD5 for: WSCNTFY.EXE >
[2008/04/13 18:34:30 | 000,013,824 | ---- | M] (Microsoft Corporation) MD5=02DA31AB433A6C1110A736C85701DECA -- C:\WINDOWS\ServicePackFiles\i386\wscntfy.exe
[2008/04/13 18:34:30 | 000,013,824 | ---- | M] (Microsoft Corporation) MD5=02DA31AB433A6C1110A736C85701DECA -- C:\WINDOWS\system32\wscntfy.exe
[2006/03/02 13:00:00 | 000,013,824 | ---- | M] (Microsoft Corporation) MD5=8558905BA81F6EFAAF9667139BB117DD -- C:\WINDOWS\$NtServicePackUninstall$\wscntfy.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB15471$] -> Error: Cannot create file handle -> Unknown point type

========== Alternate Data Streams ==========

@Alternate Data Stream - 816 bytes -> C:\WINDOWS\3528475283:1824370477.exe
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >

Extras.txt

OTL Extras logfile created on: 02/11/2011 20:52:50 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\bastien\Bureau
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1,99 Gb Total Physical Memory | 1,17 Gb Available Physical Memory | 58,71% Memory free
3,84 Gb Paging File | 3,18 Gb Available in Paging File | 82,88% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 26,37 Gb Total Space | 9,77 Gb Free Space | 37,05% Space Free | Partition Type: NTFS
Drive D: | 29,52 Gb Total Space | 11,21 Gb Free Space | 37,98% Space Free | Partition Type: NTFS

Computer Name: BM | User Name: bastien | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Disabled:Assistant Transfert de fichiers et de paramètres -- (Microsoft Corporation)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Documents and Settings\bastien\Local Settings\Application Data\WinDS PRO\DeSmuME\desmume_nosse.exe" = C:\Documents and Settings\bastien\Local Settings\Application Data\WinDS PRO\DeSmuME\desmume_nosse.exe:*:Enabled:desmume_nosse -- ()
"C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Oracle Corporation)
"C:\Documents and Settings\bastien\Local Settings\Application Data\WinDS PRO\DeSmuME\desmume.exe" = C:\Documents and Settings\bastien\Local Settings\Application Data\WinDS PRO\DeSmuME\desmume.exe:*:Enabled:desmume -- ()
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Programme d'installation AVG -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:Diagnostics AVG 2011 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Bouclier Web -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Scanner e-mail personnel -- (AVG Technologies CZ, s.r.o.)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorateur Windows -- (Microsoft Corporation)
"C:\Program Files\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe" = C:\Program Files\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe:*:Enabled:Bamboo Dock -- ()
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\WINDOWS\system32\msfeedssync.exe" = C:\WINDOWS\system32\msfeedssync.exe:*:Enabled:Microsoft Feeds Synchronization -- (Microsoft Corporation)
"C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" = C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe:*:Enabled:Adobe Reader and Acrobat Manager -- (Adobe Systems Incorporated)
"C:\Program Files\OpenOffice.org 3\program\soffice.bin" = C:\Program Files\OpenOffice.org 3\program\soffice.bin:*:Enabled:OpenOffice.org 3.3 -- (OpenOffice.org)
"C:\Program Files\KompoZer-0.8b1\kompozer.exe" = C:\Program Files\KompoZer-0.8b1\kompozer.exe:*:Enabled:Composer -- (Mozilla Foundation)
"C:\Program Files\FileZilla FTP Client\filezilla.exe" = C:\Program Files\FileZilla FTP Client\filezilla.exe:*:Enabled:FileZilla FTP Client -- (FileZilla Project)
"D:\SoftonicDownloader_pour_windows-live-messenger-msn-messenger.exe" = D:\SoftonicDownloader_pour_windows-live-messenger-msn-messenger.exe:*:Enabled:SoftonicDownloader_pour_windows-live-messenger-msn-messenger -- ()
"C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe" = C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe:*:Enabled:Adobe AIR Installer -- (Adobe Systems Inc.)
"C:\Program Files\Fichiers communs\Java\Java Update\jaucheck.exe" = C:\Program Files\Fichiers communs\Java\Java Update\jaucheck.exe:*:Enabled:Java(TM) Update Client Checker -- (Sun Microsystems, Inc.)
"C:\Program Files\Notepad++\notepad++.exe" = C:\Program Files\Notepad++\notepad++.exe:*:Enabled:Notepad++ : a free (GNU) source code editor -- (Don HO don.h@free.fr)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\SweetIM\Messenger\SweetIM.exe" = C:\Program Files\SweetIM\Messenger\SweetIM.exe:*:Enabled:SweetIM Instant Messenger Enhancer -- (SweetIM Technologies Ltd.)
"C:\Program Files\Dofus 2\app\UpLauncher.exe" = C:\Program Files\Dofus 2\app\UpLauncher.exe:*:Enabled:UpLauncher -- ()
"C:\Program Files\Dofus 2\app\Dofus.exe" = C:\Program Files\Dofus 2\app\Dofus.exe:*:Enabled:Dofus -- ()
"C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe" = C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe:*:Enabled:Java(TM) Update Scheduler -- (Sun Microsystems, Inc.)
"C:\Program Files\Fichiers communs\Java\Java Update\jucheck.exe" = C:\Program Files\Fichiers communs\Java\Java Update\jucheck.exe:*:Enabled:Java(TM) Update Checker -- (Sun Microsystems, Inc.)
"C:\Program Files\Dofus 2\app\DofusMod.exe" = C:\Program Files\Dofus 2\app\DofusMod.exe:*:Enabled:DofusMod -- ()
"C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe" = C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe:*:Enabled:Adobe Reader -- (Adobe Systems Incorporated)
"D:\jre-7u1-windows-i586-s.exe" = D:\jre-7u1-windows-i586-s.exe:*:Enabled:Java(TM) Platform SE binary -- (Oracle Corporation)
"C:\JDK\jre\bin\javaw.exe" = C:\JDK\jre\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Oracle Corporation)
"D:\eclipse\eclipse.exe" = D:\eclipse\eclipse.exe:*:Enabled:eclipse -- ()
"C:\Program Files\Java\jre7\bin\javaw.exe" = C:\Program Files\Java\jre7\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Oracle Corporation)
"C:\Program Files\Argente - Registry Cleaner\Registry Cleaner.exe" = C:\Program Files\Argente - Registry Cleaner\Registry Cleaner.exe:*:Enabled:Argente - Registry Cleaner -- (Argente Software)
"D:\ccsetup312.exe" = D:\ccsetup312.exe:*:Enabled:CCleaner Installer -- (Piriform Ltd)
"C:\Program Files\ZHPDiag\ZHPDiag.exe" = C:\Program Files\ZHPDiag\ZHPDiag.exe:*:Enabled:Diagnostic Tool -- ()
"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" = C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware -- ()
"C:\Program Files\AVG\AVG10\avgui.exe" = C:\Program Files\AVG\AVG10\avgui.exe:*:Enabled:AVG User Interface -- (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0266CCBE-BBD8-416C-A48F-7FC47C6DB566}" = Microsoft SQL Server System CLR Types
"{043F86B7-EE12-3399-B2CA-D0B603D87963}" = Microsoft .NET Framework 4 Extended FRA Language Pack
"{05653DE1-6567-40C6-B930-39D399B64369}" = OpenOffice.org 3.3
"{05E740C4-0F88-4673-9DAF-549E41A6CB21}" = AVG 2011
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0BD83598-C2EF-3343-847B-7D2E84599128}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA
"{0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}" = Microsoft .NET Framework 4 Client Profile FRA Language Pack
"{133742BA-6F46-4D3E-85AF-78631D9AD8B8}" = Installation Windows Live
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1EE04769-91C4-4A06-92B7-FCAFE6BABDD9}" = Galerie de photos Windows Live
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Outil de téléchargement Windows Live
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{25C11A11-C6AE-C717-41CA-3DA699F2A7B8}" = Bamboo Dock
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83217001FF}" = Java(TM) 7 Update 1
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32A3A4F4-B792-11D6-A78A-00B0D0170010}" = Java(TM) SE Development Kit 7 Update 1
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3BA7E387-9401-3371-9464-5E224D243FC5}" = Outils Microsoft Visual Studio 2010 ADO.NET Entity Framework
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra
"{3F6FD3E9-4767-4000-BCA9-F958BC414A56}" = TIxx21
"{445B183D-F4F1-45C8-B9DB-F11355CA657B}" = Windows Live Messenger
"{4634B21A-CC07-4396-890C-2B8168661FEA}" = Windows Live Writer
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5DD76286-9BE7-4894-A990-E905E91AC818}" = Windows Live Mail
"{5EEBFF93-5647-4EB1-8CB2-33515EB24CED}" = Crocodile Junior (FR)
"{6730E60A-788C-4F38-B271-1ECD17C26458}_is1" = RPG Maker VX 1.02
"{72AD53CC-CCC0-3757-8480-9EE176866A7C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA
"{76810709-A7D3-468D-9167-A1780C1E766C}" = Windows Live FolderShare
"{7D543DFE-6459-462A-9A62-B5B012B1DCF1}" = AVG 2011
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97B4DF0B-7499-455F-AFBA-F70F64D6D86A}" = SweetIM for Messenger 3.5
"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8
"{A1194237-547A-461d-BD44-B97B1574A7DA}" = SweetIM Toolbar for Internet Explorer 4.1
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1036-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Français
"{ACD8FFB2-D376-45A2-AADE-8815B304140A}" = Make Autorun
"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR
"{AF6919D0-5691-4F35-9D65-54F981013514}" = Microsoft SQL Server Compact 3.5 SP2 FRA
"{B01A7AFC-0356-43AF-A333-C65912AEA8DC}" = Objets de gestion Microsoft SQL Server 2008 R2
"{B3B487E7-6171-4376-9074-B28082CEB504}" = Windows Live Call
"{BC398BE9-C1DC-374B-90B1-460CB70C7CDD}" = Microsoft Help Viewer 1.0 Language Pack - FRA
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4E1603B-E550-4A14-8F53-4E989849D1B4}" = Google SketchUp 8
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D56B3391-1DAB-4AB3-AFF5-D55457911BBB}" = Ad-Aware
"{D60023FA-3DF1-4537-93DD-13024CC4E366}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 FRA
"{D95AA4F4-9FCF-4BD8-AC07-AB1912A202E2}_is1" = Home Plan Pro version 5.2.24.3
"{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}" = Assistant de connexion Windows Live
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F7D64E3E-7DF0-46E0-92C5-11F575087ADB}" = RealFlight G3 Demo
"{F8CC6F57-1649-4FBE-A392-2421C1AE90B5}_is1" = RPG Maker VX RTP
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Argente - Registry Cleaner_is1" = Argente - Registry Cleaner 2.0.0.5
"AVG" = AVG 2011
"AviSynth" = AviSynth 2.5
"Bamboo Dock" = Bamboo Dock 3.3
"Bamboo Explore" = Bamboo Explore
"CCleaner" = CCleaner
"ffdshow_is1" = ffdshow [rev 2583] [2009-01-05]
"FileZilla Client" = FileZilla Client 3.5.1
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"HaaliMkx" = Haali Media Splitter
"Hasard_is1" = Hasard version 1.30 (beta)
"ie8" = Windows Internet Explorer 8
"InstallShield_{3F6FD3E9-4767-4000-BCA9-F958BC414A56}" = Texas Instruments PCIxx21/x515 drivers.
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - fra" = Module linguistique Microsoft .NET Framework 3.5 SP1- fra
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile FRA Language Pack" = Module linguistique Microsoft .NET Framework 4 Client Profile FRA
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended FRA Language Pack" = Module linguistique Microsoft .NET Framework 4 Extended FRA
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - FRA" = Module linguistique de la visionneuse d'aide Microsoft 1.0 - FRA
"Mozilla Firefox 7.0.1 (x86 fr)" = Mozilla Firefox 7.0.1 (x86 fr)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Notepad++" = Notepad++
"Pen Tablet Driver" = Bamboo
"Pokemon Script Project Maker(PSP 0.7)" = Pokemon Script Project Maker(PSP 0.7)
"RGSS de RPG MAKER XP_is1" = RGSS de RMXP version 1.0.1
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TBSB06155.TBSB06155Toolbar" = A supprimé
"TuxGuitar_0" = TuxGuitar 1.2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.11
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Lecteur Windows Media 11
"Windows XP Service" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Installation Windows Live
"WinRAR archiver" = Logiciel d'archivage WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZHPDiag_is1" = ZHPDiag 1.28

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Ad-Remover" = Ad-Remover
"CodeBlocks" = CodeBlocks
"FoxTab Video Converter" = FoxTab Video Converter
"PhotoFiltre" = PhotoFiltre

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 28/08/2011 14:21:01 | Computer Name = MAISON-2 | Source = Application Hang | ID = 1002
Description = Application bloquée iexplore.exe, version 8.0.6001.18702, module bloqué
hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Error - 28/08/2011 14:36:42 | Computer Name = MAISON-2 | Source = Application Error | ID = 1000
Description = Application défaillante iexplore.exe, version 8.0.6001.18702, module
défaillant mshtml.dll, version 8.0.6001.19120, adresse de défaillance 0x00067b98.

Error - 28/08/2011 14:40:52 | Computer Name = MAISON-2 | Source = Application Hang | ID = 1002
Description = Application bloquée iexplore.exe, version 8.0.6001.18702, module bloqué
hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Error - 31/08/2011 08:59:39 | Computer Name = MAISON-2 | Source = Application Hang | ID = 1002
Description = Application bloquée PSP_Mod.exe, version 1.0.0.1, module bloqué hungapp,
version 0.0.0.0, adresse de blocage 0x00000000.

Error - 04/09/2011 10:45:40 | Computer Name = MAISON-2 | Source = TabletServicePen | ID = 1
Description =

Error - 06/09/2011 12:51:15 | Computer Name = MAISON-2 | Source = Application Error | ID = 1000
Description = Application défaillante iexplore.exe, version 8.0.6001.18702, module
défaillant offerbox_air_iexplorer.dll, version 5.3.2613.30, adresse de défaillance
0x00003179.

Error - 11/09/2011 13:37:42 | Computer Name = MAISON-2 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 25/09/2011 13:45:51 | Computer Name = MAISON-2 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 29/09/2011 13:30:59 | Computer Name = MAISON-2 | Source = Application Hang | ID = 1002
Description = Application bloquée PSP DS v0.exe, version 0.0.0.0, module bloqué
hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Error - 29/09/2011 13:38:50 | Computer Name = MAISON-2 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

[ System Events ]
Error - 01/11/2011 07:31:52 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service LMIGuardianSvc n'a pas pu démarrer en raison de l'erreur :
%%5

Error - 01/11/2011 07:34:33 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service AVG WatchDog n'a pas pu démarrer en raison de l'erreur :
%%5

Error - 01/11/2011 13:31:44 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service AVG WatchDog n'a pas pu démarrer en raison de l'erreur :
%%5

Error - 01/11/2011 13:31:52 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service AVGIDSAgent n'a pas pu démarrer en raison de l'erreur :
%%5

Error - 01/11/2011 13:32:02 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service AVGIDSAgent n'a pas pu démarrer en raison de l'erreur :
%%5

Error - 01/11/2011 13:36:14 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service LogMeIn Kernel Information Provider n'a pas pu démarrer
en raison de l'erreur : %%2

Error - 02/11/2011 06:24:33 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service Lavasoft Ad-Aware Service n'a pas pu démarrer en raison
de l'erreur : %%5

Error - 02/11/2011 06:24:33 | Computer Name = BM | Source = Service Control Manager | ID = 7000
Description = Le service LogMeIn Kernel Information Provider n'a pas pu démarrer
en raison de l'erreur : %%2

Error - 02/11/2011 15:45:08 | Computer Name = BM | Source = Service Control Manager | ID = 7023
Description = Le service NLA (Network Location Awareness) s'est arrêté avec l'erreur :
%%127

Error - 02/11/2011 15:45:08 | Computer Name = BM | Source = Service Control Manager | ID = 7023
Description = Le service NLA (Network Location Awareness) s'est arrêté avec l'erreur :
%%127

< End of report >

J'ai trouvé pourquoi j'ai contracté se virus : AVG, veut absolument me faire acheter sa version Pro et à donc arrêter le bouclier résident. Quels c*n franchement : et même pas de message...

Del-crosseur · le 02 Nov 2011 21:39

Bonsoir ,

Sa ne m'étonne pas , ton pc est infecté par un Zaccess !! :evil:

Fais se qui suit stp... :

Fait un double-clic sur l'icône d'OTL pour le lancer
/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

* Assure-toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case " Rapport minimal" soit cochée.

* Copies et colles le contenue de cette citation dans la partie inférieure d'OTL "Personnalisation"

:OTL
O3 - HKLM\..\Toolbar: (no name) - {09B445AE-2345-4FCA-85AE-FB3626ECEBDD} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {09B445AE-2345-4FCA-85AE-FB3626ECEBDD} - No CLSID value found.
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\bastien\Local Settings\Application Data\934250d2\X) -C:\Documents and Settings\bastien\Local Settings\Application Data\934250d2\X ()
[2011/10/20 18:28:27 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\bastien\Local Settings\Application Data\934250d2
File not found -- C:\WINDOWS\System32\
File not found -- C:\WINDOWS\System32\
[2011/06/06 21:52:43 | 001,560,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1036-7B44-AA1000000001}\setup.exe
[2011/08/08 08:29:45 | 000,015,496 | R-S- | M] (Tarma Software Research Pty Ltd) -- C:\Documents and Settings\All Users\Application Data\InstallMate\{0D7B96A8-C2B4-5D2B-A957-AF83727E6F7F}\Setup.exe
[2011/08/08 08:29:45 | 000,015,496 | R-S- | M] (Tarma Software Research Pty Ltd) -- C:\Documents and Settings\All Users\Application Data\InstallMate\{DD26F4AE-C6F2-02B1-969F-C6DB6226A3CF}\Setup.exe
[2011/08/08 08:29:45 | 000,015,496 | R-S- | M] (Tarma Software Research Pty Ltd) -- C:\Documents and Settings\All Users\Application Data\InstallMate\{E2F0AF55-5FBE-905E-53A2-68E9AE4E0E2C}\Setup.exe
[24 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
[2011/11/02 14:54:21 | 000,000,000 | ---- | M] () -- C:\WINDOWS\3528475283
[2011/10/20 18:31:45 | 000,000,000 | -HS- | M] () -- C:\WINDOWS\{2521BB91-29B1-4d7e-9137-AC9875D77735}
@Alternate Data Stream - 816 bytes -> C:\WINDOWS\3528475283:1824370477.exe
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

:Commands
[emptytemp]
[emptyflash]

* Cliques sur l'icône Correction (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un rapport s'ouvrir "OTL.log"
* Copie et colle le ou les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

Puis :::

Télécharge AntiZaccess => http://anywhere.webrootcloudav.com/antizeroaccess.exe
Place à la racine de c:\ se qui donnerais => "C:\antizeroaccess.exe"
Ensuite à chaque fois que le tool te demande de choisir [Y/N] répond Y et valide avec la touche entrée.
Si il y avait infection (ligne rouge), à la fin du fix doit apparait "Cleaned" en vert.
Appuyez sur une touche et redémarrer l’ordinateur en Mode Normale !

Ensuite :::

Télécharge TDSSKiller sur ton Bureau.

Cet outil est conçu pour automatiser différentes tâches proposées par TDSSKiller, un fix de Kaspersky.
Lance load_tdsskiller en double-cliquant dessus.
Clic droit et"exécuter en tant qu'administrateur" avec Vista/Seven

A cette fenêtre lance le scan.

-Récupérer le rapport en validant Report
Poste-le moi

Si des fichiers infects sont trouvés, une nouvelle fenêtre s'ouvre:

Si TDSS.tdl2 est détecté l'option "delete" sera cochée par défaut.
Si TDSS.tdl3 est détecté assure toi que "Cure" est bien cochée.
Si TDSS.tdl4 (\HardDisk0\MBR) est détecté assure toi que "Cure" est bien cochée.
Si Suspicious file est indiqué, laisse l'option cochée sur "Skip"
Si Rootkit.Win32.ZAccess est détecté règle sur "cure" en haut , et "delete" en bas.
Clique sur "Continue" puis sur "Reboot now" pour redémarrer le PC.

exemple:

redémarres le pc pour confirmer la suppression de celle-ci.

info supplémentaire -> http://support.kaspersky.com/viruses/so ... =208280684

Bonne soirée ! :wink:

~zopo~ · le 02 Nov 2011 21:47

Ok, je fait ça tout de suite, je viens de télécharger Avast (le vrai) et il vient de trouvé un cheval de troie

Je suppose qu'il faut fermé Avast pour lancé l’analyse...

Del-crosseur · le 02 Nov 2011 21:50

Oui laisse le de coté , il est inefficace fasse à cette infection...
Suit mes instruction

~zopo~ · le 05 Nov 2011 14:22

Hello !
Malwarebyte s'est enfin décider à marcher, il a trouvé 24 erreurs que j'ai supprimé, par contre comme je n'ai plus de connexion internet je ne l'ai pas mis à jour.
J'ai également supprimer les erreurs que Ad-Remover à trouvé...

J’exécuterais tes instructions lorsque que ma connexion seras rétablit

Bonne journée !

Del-crosseur · le 05 Nov 2011 15:29

Bonjour ,

Comment sa vous n'avez plus de connexion internet , depuis quand ?
Suivez mes instructions et on verras pour remettre celle-ci en en marche

~zopo~ · le 05 Nov 2011 16:10

Voici le forum de mon problème de connexion :
http://www.pc-infopratique.com/forum-informatique/ip-en000-vt-60261.html

Google s'obstine à ouvrir des contenus douteux...

Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Re: Google s'obstine à ouvrir des contenus douteux...

Sujets similaires

Qui est en ligne