Pas encore inscrit ?

Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs !

Se connecter

ou

S’inscrire

(RÉSOLU) MERCI Problème de spyware, cheval de troie ?

Par speck41
le 19 juin 2010 dans Analyses et éradication malwares

https://forum.zebulon.fr/topic/177550-r%C3%A9solu-merci-probl%C3%A8me-de-spyware-cheval-de-troie/

Abonnés 0

Messages recommandés

speck41

Posté(e) le 19 juin 2010

- Signaler

Posté(e) le 19 juin 2010 (modifié)

Bonjour a vous tous, Vraiment réussie la nouvelle image de votre forum, j'aime beaucoup.

Bon, pour ce qui est de mon problème, j'ai des fenêtres internet explorer qui s'ouvrent toutes seule, ( de ce genre : http://c5.mt-50.com/5611401432.cmp ), pourtant je n'utilise pas internet explorer, il y a mon antivirus qui trouve un cheval de troie : TR/crypt.xpack.gen que je supprime et qui revient aussitot. Il y a aussi dans le gestionnaire des taches des applications du genre ''IBATIA.exe '', ''IJD.exe'' que je ne connais pas. Je vous remercis à l'avance de l'aide que vous pourrez m'apporter.

Speck41

Modifié le 21 juin 2010 par speck41

Citer

no.ppp

Posté(e) le 19 juin 2010

- Signaler

Posté(e) le 19 juin 2010

Salut Speck41,

Je vais te demander un rapport d'analyse histoire de mieux cerner le problème

Télécharge OTL sur ton Bureau

Double-clique sur OTL.exe pour le lancer.
Coche la case Tous les utilisateurs
Fais de même avec Recherche Lop et Recherche Purity.
Clique ensuite sur Analyse puis patiente pendant qu'il scanne le registre et les fichiers.
Quand l'analyse est terminée, deux fenêtres du Bloc-notes vont s'ouvrir. OTL.Txt et Extras.Txt. Ces fichiers sont sauvegardés au même endroit que OTL.
Copie-colle les dans ta prochaine réponse.

Citer

speck41

Posté(e) le 20 juin 2010

Auteur

- Signaler

Posté(e) le 20 juin 2010

Bonsoir, merci no.ppp de prendre mon problème en main.

Voici les 2 rapports demandés.

-----------------------------------------------------------------------------------------

OTL logfile created on: 2010-06-19 19:33:24 - Run 1

OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\FKB\Bureau

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000C0C | Country: Canada | Language: FRC | Date Format: yyyy-MM-dd

510,00 Mb Total Physical Memory | 90,00 Mb Available Physical Memory | 18,00% Memory free

3,00 Gb Paging File | 2,00 Gb Available in Paging File | 75,00% Paging File free

Paging file location(s): c:\pagefile.sys 2500 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 19,13 Gb Total Space | 2,84 Gb Free Space | 14,87% Space Free | Partition Type: NTFS

Drive D: | 149,05 Gb Total Space | 90,99 Gb Free Space | 61,05% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: ORDISALON

Current User Name: FKB

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010-06-19 19:29:40 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\FKB\Bureau\OTL.exe

PRC - [2010-06-19 09:30:09 | 000,150,528 | ---- | M] () -- C:\Documents and Settings\FKB\Local Settings\temp\Ijd.exe

PRC - [2010-06-19 09:29:40 | 000,165,376 | ---- | M] () -- C:\WINDOWS\Ibatia.exe

PRC - [2010-05-07 08:36:10 | 000,092,008 | ---- | M] (TomTom) -- D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

PRC - [2010-05-07 08:36:08 | 000,247,144 | ---- | M] (TomTom) -- D:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

PRC - [2010-04-28 13:45:50 | 000,835,952 | ---- | M] (Opera Software) -- D:\Program Files\Opera\opera.exe

PRC - [2010-04-16 18:36:42 | 000,026,480 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Contacts\wlcomm.exe

PRC - [2009-10-26 21:42:42 | 000,718,232 | ---- | M] (Pelmorex Media Inc.) -- C:\Documents and Settings\FKB\Local Settings\Application Data\MétéoMédia\MétéoÉclair\WeatherEye.exe

PRC - [2009-09-17 21:34:03 | 000,451,896 | ---- | M] (Pure Networks, Inc.) -- D:\Program Files\Pure Networks\Network Magic\nmapp.exe

PRC - [2009-07-21 14:33:58 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2009-05-13 16:47:40 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2009-03-02 13:08:11 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008-11-09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008-05-16 06:11:44 | 000,648,504 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe

PRC - [2008-05-16 06:11:44 | 000,648,504 | ---- | M] (Pure Networks, Inc.) -- C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmctxth.exe

PRC - [2007-06-25 09:47:24 | 001,629,480 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

PRC - [2007-06-25 09:47:12 | 001,552,680 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

PRC - [2007-06-25 09:47:02 | 001,057,064 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCD.exe

PRC - [2007-06-13 09:22:28 | 001,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2010-06-19 19:29:40 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\FKB\Bureau\OTL.exe

MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010-05-07 08:36:10 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)

SRV - [2010-04-08 05:41:27 | 001,265,264 | ---- | M] (Lavasoft) [On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2009-07-21 14:33:58 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009-05-13 16:47:40 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2008-11-09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008-11-04 02:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2008-07-26 08:27:42 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)

SRV - [2008-05-16 06:11:44 | 000,648,504 | ---- | M] (Pure Networks, Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)

SRV - [2008-05-16 05:56:04 | 000,012,800 | ---- | M] (Pure Networks, Inc.) [On_Demand | Stopped] -- D:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe -- (nmraapache)

SRV - [2007-06-27 20:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)

SRV - [2007-06-25 09:47:12 | 001,552,680 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)

SRV - [2006-10-26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003-06-19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

========== Driver Services (SafeList) ==========

DRV - [2010-02-05 05:03:36 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)

DRV - [2010-01-01 13:20:34 | 000,026,024 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)

DRV - [2009-12-10 11:00:26 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009-05-11 10:11:52 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009-03-30 10:32:47 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009-02-13 12:34:33 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008-05-16 06:10:32 | 000,023,992 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp)

DRV - [2008-05-16 06:10:30 | 000,025,272 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis)

DRV - [2007-06-25 09:47:12 | 000,038,440 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)

DRV - [2007-06-25 09:47:12 | 000,036,776 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)

DRV - [2007-06-25 09:47:02 | 000,119,080 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)

DRV - [2007-03-06 17:52:46 | 002,261,792 | ---- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)

DRV - [2007-03-06 17:50:30 | 001,669,664 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)

DRV - [2007-02-15 20:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL)

DRV - [2004-11-19 19:07:00 | 000,101,488 | ---- | M] () [Kernel | Auto | Running] -- D:\Program Files\Lock Folder XP 3.6\LF30XP.sys -- (LF30FS)

DRV - [2004-08-04 00:10:12 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\61883.sys -- (61883)

DRV - [2004-08-04 00:10:12 | 000,038,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avc.sys -- (Avc)

DRV - [2004-08-04 00:10:00 | 000,051,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\msdv.sys -- (MSDV)

DRV - [2004-08-03 18:29:50 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wVchNTxx.sys -- (iAimFP4)

DRV - [2004-08-03 18:29:48 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wSiINTxx.sys -- (iAimFP3)

DRV - [2004-08-03 18:29:46 | 000,025,471 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV10nt.sys -- (iAimTV5)

DRV - [2004-08-03 18:29:46 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wCh7xxNT.sys -- (iAimTV4)

DRV - [2004-08-03 18:29:46 | 000,022,271 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV06nt.sys -- (iAimTV6)

DRV - [2004-08-03 18:29:44 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV04nt.sys -- (iAimTV3)

DRV - [2004-08-03 18:29:44 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV02NT.sys -- (iAimTV1)

DRV - [2004-08-03 18:29:42 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wATV01nt.sys -- (iAimTV0)

DRV - [2004-08-03 18:29:42 | 000,011,871 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV09NT.sys -- (iAimFP7)

DRV - [2004-08-03 18:29:40 | 000,011,807 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV07nt.sys -- (iAimFP5)

DRV - [2004-08-03 18:29:40 | 000,011,295 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV08NT.sys -- (iAimFP6)

DRV - [2004-08-03 18:29:38 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\i81xnt5.sys -- (i81x)

DRV - [2004-08-03 18:29:38 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV01nt.sys -- (iAimFP0)

DRV - [2004-08-03 18:29:38 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV02NT.sys -- (iAimFP1)

DRV - [2004-08-03 18:29:38 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wADV05NT.sys -- (iAimFP2)

DRV - [2003-09-04 11:38:56 | 000,152,576 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV532AV.SYS -- (PID_0920) Logitech QuickCam Express(PID_0920)

DRV - [2001-08-17 16:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Service d'installation du pilote audio Intel® 82801 (WDM)

DRV - [1999-05-21 01:00:00 | 000,015,488 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ScFBPNT2.sys -- (ScFBPNT2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-606747145-162531612-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

IE - HKU\S-1-5-21-606747145-162531612-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-606747145-162531612-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-type: "${8}"

FF - prefs.js..browser.startup.homepage: "http://www.evolutionsynchro.123.fr/|http://www.google.ca/"'>http://www.evolutionsynchro.123.fr/|http://www.google.ca/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655

FF - prefs.js..browser.startup.homepage: "http://fr.msn.com/"'>http://fr.msn.com/"

FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q="'>http://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q="

FF - prefs.js..browser.search.selectedEngine: "Live Search"

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: D:\Program Files\Real\RealPlayer\browserrecord [2009-12-03 17:29:25 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2010-01-23 14:46:32 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2010-04-10 20:04:08 | 000,000,000 | ---D | M]

[2009-12-13 15:40:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Mozilla\Extensions

[2009-12-13 15:40:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Mozilla\Extensions\home2@tomtom.com

[2010-05-21 09:12:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Mozilla\Firefox\Profiles\iwzhylrv.default\extensions

[2009-10-28 20:03:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\FKB\Application Data\Mozilla\Firefox\Profiles\iwzhylrv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010-05-11 19:44:22 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\FKB\Application Data\Mozilla\Firefox\Profiles\iwzhylrv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2010-06-01 20:30:38 | 000,001,775 | ---- | M] () -- C:\Documents and Settings\FKB\Application Data\Mozilla\Firefox\Profiles\iwzhylrv.default\searchplugins\live-search.xml

O1 HOSTS File: ([2010-01-24 18:16:55 | 000,000,745 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com

O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll ()

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

O3 - HKLM\..\Toolbar: (Yahoo! Barre d'outils) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [nmapp] D:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)

O4 - HKLM..\Run: [nmctxth] C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)

O4 - HKLM..\Run: [securDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)

O4 - HKLM..\Run: [WordQ carat flag] D:\Program Files\WordQ2Fr\WordQcrs.exe ()

O4 - HKU\S-1-5-21-606747145-162531612-682003330-1003..\Run: [M5T8QL3YW3] C:\Documents and Settings\FKB\Local Settings\temp\Ijd.exe ()

O4 - HKU\S-1-5-21-606747145-162531612-682003330-1003..\Run: [Messenger (Yahoo!)] D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)

O4 - HKU\S-1-5-21-606747145-162531612-682003330-1003..\Run: [TomTomHOME.exe] D:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)

O4 - HKU\S-1-5-21-606747145-162531612-682003330-1003..\Run: [WeatherEye] C:\Documents and Settings\FKB\Local Settings\Application Data\MétéoMédia\MétéoÉclair\WeatherEye.exe (Pelmorex Media Inc.)

O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WordQCRS.lnk = D:\Program Files\WordQ2Fr\WordQcrs.exe ()

O4 - Startup: C:\Documents and Settings\FKB\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk = C:\Documents and Settings\FKB\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-606747145-162531612-682003330-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-606747145-162531612-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O7 - HKU\S-1-5-21-606747145-162531612-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255

O7 - HKU\S-1-5-21-606747145-162531612-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0

O8 - Extra context menu item: E&xporter vers Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKU\S-1-5-21-606747145-162531612-682003330-1003\..Trusted Domains: tomtom.com ([www] https in Trusted sites)

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab (BDSCANONLINE Control)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264313117109 (WUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)

O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.18.160.73 64.18.160.74

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.53,93.188.161.183

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\intu-ir2009 {E4616804-F2F8-4839-B728-5305004DA6A7} - D:\Program Files\ImpotRapide 2009\ic2009pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Fichiers communs\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found

O24 - Desktop Components:0 (Ma page d'accueil) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\FKB\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\FKB\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - Reg Error: Key error. File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009-09-17 18:10:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2010-05-11 09:45:21 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2010-05-11 09:45:21 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010-06-19 19:29:39 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\FKB\Bureau\OTL.exe

[2010-06-16 20:55:44 | 000,000,000 | ---D | C] -- C:\Program Files\AxBx

[2010-06-12 22:32:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Bureau\OBD Soft

[2010-06-12 21:36:30 | 000,000,000 | ---D | C] -- C:\spoolerlogs

[2010-06-10 10:45:29 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll

[2010-06-07 17:34:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Bureau\Toyota

[2010-06-07 10:42:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Bureau\Demande Ordi

[2010-06-07 09:27:39 | 000,000,000 | ---D | C] -- D:\Mes documents\Permis SAAQ 2010

[2010-06-05 11:43:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\FKB\Recent

[2010-06-04 21:42:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Application Data\Acapela Group

[2010-06-04 21:39:47 | 000,000,000 | ---D | C] -- D:\Mes documents\Utilisateurs de WordQ 2

[2010-06-02 19:52:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Bureau\Routeur

[2010-06-01 20:34:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive

[2010-06-01 12:50:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Bureau\Bulletin

[2010-05-27 20:23:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\FKB\Bureau\Rencontre Instructeurs

[2010-05-27 09:44:45 | 000,000,000 | ---D | C] -- D:\Mes documents\Émoticones

[2010-05-26 18:35:38 | 000,000,000 | ---D | C] -- D:\Mes documents\TomTom

[2004-11-24 14:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll

========== Files - Modified Within 30 Days ==========

[2010-06-19 19:56:48 | 000,000,242 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

[2010-06-19 19:47:05 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

[2010-06-19 19:43:21 | 008,388,608 | ---- | M] () -- C:\Documents and Settings\FKB\ntuser.dat

[2010-06-19 19:29:40 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\FKB\Bureau\OTL.exe

[2010-06-19 19:20:04 | 000,001,138 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-606747145-162531612-682003330-1003UA.job

[2010-06-19 16:58:01 | 000,000,276 | -H-- | M] () -- C:\WINDOWS\tasks\ac9af519.job

[2010-06-19 16:55:02 | 000,044,544 | ---- | M] () -- C:\WINDOWS\System32\ernel32.dll

[2010-06-19 16:54:56 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job

[2010-06-19 16:54:11 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010-06-19 16:53:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010-06-19 16:53:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010-06-19 16:53:38 | 535,285,760 | -HS- | M] () -- C:\hiberfil.sys

[2010-06-19 16:52:26 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\FKB\ntuser.ini

[2010-06-19 10:37:48 | 000,092,160 | ---- | M] () -- C:\Documents and Settings\FKB\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010-06-19 10:30:20 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2010-06-19 09:29:40 | 000,165,376 | ---- | M] () -- C:\WINDOWS\Ibatia.exe

[2010-06-19 09:29:18 | 000,044,544 | ---- | M] () -- C:\Documents and Settings\FKB\Application Data\ac9af519.exe

[2010-06-19 08:20:01 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-606747145-162531612-682003330-1003Core.job

[2010-06-18 10:59:33 | 000,172,134 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\perceuse.docx

[2010-06-14 11:57:45 | 000,000,384 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\Recettes.lnk

[2010-06-10 21:33:07 | 000,349,792 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010-06-10 21:24:07 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010-06-10 21:02:17 | 001,033,070 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010-06-10 21:02:17 | 000,494,760 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat

[2010-06-10 21:02:17 | 000,426,514 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010-06-10 21:02:17 | 000,078,146 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat

[2010-06-10 21:02:17 | 000,065,332 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010-06-10 10:31:57 | 000,000,000 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP

[2010-06-09 10:05:03 | 000,703,511 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\St-Augustin_st_jean_2010.pdf

[2010-06-09 09:44:21 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\FKB\Application Data\Settings.cfg

[2010-06-07 09:21:11 | 000,020,450 | ---- | M] () -- C:\WINDOWS\SICALIB2.DAT

[2010-06-04 21:39:28 | 000,000,561 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WordQCRS.lnk

[2010-06-04 21:39:28 | 000,000,060 | ---- | M] () -- C:\WINDOWS\WiViK3.ini

[2010-06-03 19:22:08 | 000,067,260 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\Milliplein.jpeg

[2010-06-03 09:28:28 | 000,024,124 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\Magic Jack conditions.docx

[2010-06-01 20:30:39 | 000,001,109 | ---- | M] () -- C:\Documents and Settings\FKB\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk

[2010-05-28 17:37:57 | 000,010,534 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\Letter to Parents - June Exams.pdf

[2010-05-28 17:37:56 | 000,107,004 | ---- | M] () -- C:\Documents and Settings\FKB\Bureau\Exam schedule June 2010.pdf

========== Files Created - No Company Name ==========

[2010-06-19 16:55:02 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\ernel32.dll

[2010-06-19 15:50:55 | 000,000,242 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

[2010-06-19 09:30:29 | 000,000,274 | -H-- | C] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

[2010-06-19 09:30:17 | 000,165,376 | ---- | C] () -- C:\WINDOWS\Ibatia.exe

[2010-06-19 09:29:24 | 000,000,276 | -H-- | C] () -- C:\WINDOWS\tasks\ac9af519.job

[2010-06-19 09:29:20 | 000,044,544 | ---- | C] () -- C:\Documents and Settings\FKB\Application Data\ac9af519.exe

[2010-06-18 10:58:02 | 000,172,134 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\perceuse.docx

[2010-06-14 11:57:45 | 000,000,384 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\Recettes.lnk

[2010-06-10 21:05:41 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2010-06-09 10:05:01 | 000,703,511 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\St-Augustin_st_jean_2010.pdf

[2010-06-04 21:39:28 | 000,000,561 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\WordQCRS.lnk

[2010-06-04 21:39:28 | 000,000,060 | ---- | C] () -- C:\WINDOWS\WiViK3.ini

[2010-06-03 19:22:08 | 000,067,260 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\Milliplein.jpeg

[2010-06-03 09:27:05 | 000,024,124 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\Magic Jack conditions.docx

[2010-06-01 20:30:39 | 000,001,109 | ---- | C] () -- C:\Documents and Settings\FKB\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk

[2010-05-28 17:37:56 | 000,107,004 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\Exam schedule June 2010.pdf

[2010-05-28 17:37:56 | 000,010,534 | ---- | C] () -- C:\Documents and Settings\FKB\Bureau\Letter to Parents - June Exams.pdf

[2010-05-26 18:16:31 | 000,186,142 | ---- | C] () -- D:\Mes documents\Contrat Trousse auto occasion.pdf

[2010-05-26 18:16:31 | 000,122,866 | ---- | C] () -- D:\Mes documents\Procuration Transfert SAAQ.pdf

[2010-04-10 10:38:57 | 000,000,379 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2010-04-10 10:21:38 | 000,000,091 | ---- | C] () -- C:\WINDOWS\fpxpress.ini

[2010-03-13 18:56:05 | 000,000,174 | ---- | C] () -- C:\WINDOWS\mp3 recorder.ini

[2010-02-28 21:24:24 | 000,000,014 | ---- | C] () -- C:\WINDOWS\System32\systeminfo3.dll

[2010-02-02 20:03:06 | 000,000,504 | ---- | C] () -- C:\WINDOWS\_delis32.ini

[2009-10-23 17:41:55 | 000,000,026 | ---- | C] () -- C:\WINDOWS\dvdSanta.INI

[2009-10-15 11:37:15 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll

[2009-10-14 15:17:51 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll

[2009-10-13 12:05:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WD.INI

[2009-10-04 21:06:54 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2009-09-28 20:33:52 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009-09-24 09:31:56 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A4W.INI

[2009-09-24 09:29:41 | 000,000,548 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI

[2009-09-24 09:27:30 | 000,015,488 | ---- | C] () -- C:\WINDOWS\System32\drivers\ScFBPNT2.sys

[2007-03-06 17:50:30 | 001,669,664 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys

[2006-05-25 01:22:06 | 000,025,602 | ---- | C] () -- C:\WINDOWS\System32\knstwai.dll

[2005-03-14 14:38:28 | 000,000,469 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini

[2004-10-03 12:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll

[1999-08-10 18:02:20 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL

[1999-08-10 18:02:16 | 000,343,040 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll

[1999-01-27 14:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll

[1997-06-13 08:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

========== LOP Check ==========

[2010-01-16 11:16:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\GlarySoft

[2009-11-29 13:34:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited

[2009-09-17 21:37:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ

[2010-02-28 21:26:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Configs

[2010-01-12 19:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes

[2009-10-16 12:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EmailNotifier

[2009-10-16 13:54:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo

[2010-01-23 22:41:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ma-config.com

[2010-05-11 09:14:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\open-config

[2010-03-01 10:18:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft

[2010-02-27 20:01:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp

[2009-12-13 15:55:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom

[2009-12-20 00:49:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk

[2010-03-27 10:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WindSolutions

[2010-03-26 08:53:05 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{52AC600B-5800-407E-99FF-83CD0669760B}

[2010-01-03 15:22:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2010-06-04 21:42:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Acapela Group

[2009-12-03 18:54:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Apowersoft

[2009-09-19 20:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Auslogics

[2009-11-29 13:34:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Canneverbe_Limited

[2010-06-09 09:44:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Classes de site

[2009-09-22 09:47:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Convivea

[2009-09-23 09:40:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Dynamique

[2009-09-23 09:38:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\EmailNotifier

[2010-01-03 13:02:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\GlarySoft

[2009-12-13 19:54:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\ImgBurn

[2009-10-16 13:59:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\iolo

[2010-01-10 13:50:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\kibisoft

[2010-05-15 09:56:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Leadertech

[2009-12-12 14:44:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\MSNInstaller

[2009-10-24 15:26:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Netscape

[2009-09-24 10:07:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Opera

[2009-10-24 16:36:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Photodex

[2009-09-19 18:00:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\PhotoFiltre Studio X

[2010-06-09 09:44:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Sites

[2010-04-11 20:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Softativity

[2009-09-18 10:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Styler

[2010-01-16 13:22:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\TomTom

[2010-01-16 12:52:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\TomTom(2)

[2010-04-06 20:32:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Tracker Software

[2010-06-19 10:38:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\uTorrent

[2010-04-04 10:36:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Visicom Media

[2010-03-01 10:08:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\Vso

[2010-03-27 13:05:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\FKB\Application Data\WindSolutions

[2009-10-31 11:36:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Invité\Application Data\EmailNotifier

[2009-10-31 11:34:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Invité\Application Data\OnlineArmor

[2009-10-31 11:36:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Invité\Application Data\VMNTOOLBAR

[2009-10-14 15:21:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\iolo

[2010-06-19 16:58:01 | 000,000,276 | -H-- | M] () -- C:\WINDOWS\Tasks\ac9af519.job

[2010-06-19 16:54:56 | 000,000,308 | ---- | M] () -- C:\WINDOWS\Tasks\GlaryInitialize.job

[2010-06-19 19:56:48 | 000,000,242 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

[2010-06-19 19:47:05 | 000,000,274 | -H-- | M] () -- C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job

========== Purity Check ==========

< End of report >