Rapport HijackThis +BROOWser MERCI de m'aider
Résolu
Ficelle2x
Messages postés
8
Statut
Membre
-
Ficelle2x -
Ficelle2x -
Bonjour,
Voici le rapport demandé
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1770
Windows 5.1.2600 Service Pack 3
17/02/2009 19:04:55
mbam-log-2009-02-17 (19-04-36).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 199420
Temps écoulé: 59 minute(s), 26 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\utilisateur\Local Settings\Application Data\okymgoe_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Application Data\okymgoe_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Program Files\EoRezo (Rogue.Eorezo) -> No action taken.
Voici le rapport demandé
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1770
Windows 5.1.2600 Service Pack 3
17/02/2009 19:04:55
mbam-log-2009-02-17 (19-04-36).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 199420
Temps écoulé: 59 minute(s), 26 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\utilisateur\Local Settings\Application Data\okymgoe_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\utilisateur\Local Settings\Application Data\okymgoe_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Program Files\EoRezo (Rogue.Eorezo) -> No action taken.
A voir également:
- Rapport HijackThis +BROOWser MERCI de m'aider
- Hijackthis - Télécharger - Antivirus & Antimalwares
- Plan rapport de stage - Guide
- Rapport de crash windows - Guide
- Thème rapport de stage comptabilité - Forum Word
- Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport existant ✓ - Forum Excel
36 réponses
On recommence.
1/
---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
2/
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
1/
---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
2/
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
Logfile of random's system information tool 1.05 (written by random/random)
Run by utilisateur at 2009-03-06 19:21:47
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 21 GB (47%) free of 45 GB
Total RAM: 511 MB (22% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:19, on 06/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\Program Files\Spamihilator\spamihilator.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe
C:\Documents and Settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\PROGRA~1\WANADOO\GestionnaireInternet.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe
C:\PROGRA~1\WANADOO\ComComp.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\WANADOO\PollingModule.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\OFFICE ONE6.5\program\soffice.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\WANADOO\Watch.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\utilisateur\Bureau\RSIT.exe
C:\Program Files\trend micro\utilisateur.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [MediaDICO4Ut] C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe Lancement
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\WANADOO\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Documents and Settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [OrangePlayer] c:\program files\orange\player orange\Orange Player.exe /systray (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OFFICE One 6.5.lnk = C:\Program Files\OFFICE ONE6.5\program\quickstart.exe
O4 - Startup: Pense-bête.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Startup: Canon IJ Status Monitor Canon MP500 Series Printer.lnk = ?
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.asus.com/fr/
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - https://login.orange.fr/captcha?return_url=https%3A%2F%2Fmescontacts.orange.fr
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: System Guard(SpySoap) (SpySoapSysGuardService) - Unknown owner - C:\Program Files\SpySoap\SysGuard.exe (file missing)
Run by utilisateur at 2009-03-06 19:21:47
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 21 GB (47%) free of 45 GB
Total RAM: 511 MB (22% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:19, on 06/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\Program Files\Spamihilator\spamihilator.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe
C:\Documents and Settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\PROGRA~1\WANADOO\GestionnaireInternet.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe
C:\PROGRA~1\WANADOO\ComComp.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\WANADOO\PollingModule.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\OFFICE ONE6.5\program\soffice.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\WANADOO\Watch.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\utilisateur\Bureau\RSIT.exe
C:\Program Files\trend micro\utilisateur.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Pinnacle WebUpdater] "C:\Program Files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe" -s -f=UpdateVersion.xml -url=http://cdn.pinnaclesys.com/SupportFiles
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [MediaDICO4Ut] C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe Lancement
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\WANADOO\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [PMCS] "C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Documents and Settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [OrangePlayer] c:\program files\orange\player orange\Orange Player.exe /systray (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OFFICE One 6.5.lnk = C:\Program Files\OFFICE ONE6.5\program\quickstart.exe
O4 - Startup: Pense-bête.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Startup: Canon IJ Status Monitor Canon MP500 Series Printer.lnk = ?
O4 - Global Startup: OFFICE One Clock v6.5.lnk = C:\Program Files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.asus.com/fr/
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - https://login.orange.fr/captcha?return_url=https%3A%2F%2Fmescontacts.orange.fr
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: System Guard(SpySoap) (SpySoapSysGuardService) - Unknown owner - C:\Program Files\SpySoap\SysGuard.exe (file missing)
info.txt logfile of random's system information tool 1.05 2009-03-06 19:22:25
======Uninstall list======
-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D00360DC-9634-44CC-AF88-924A12406E81}\SETUP.EXE" -l0x40c anything
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.61 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
ABBYY FineReader 6.0-->MsiExec.exe /I{AF600F7B-67A7-48D9-BA3B-0FF97F35F970}
ABBYY FineReader OCR Engine -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}\setup.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
AF Cam-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6213FD4F-C3A3-4A2F-9CC1-8DAEAF469633}\Setup.exe"
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x40c
ArcSoft Software Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F7BB0F7-E782-4086-BD9E-762204239605}\Setup.exe" -l0x40c
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Asus ChkMail-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Asus\Asus ChkMail\Uninst.isu"
ASUS Enhanced Display Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\SETUP.EXE" -l0x9
ASUS Live Update-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\ASUS Live Update\Uninst.isu" -c"C:\Program Files\ASUS\ASUS Live Update\Uninst.dll"
ASUS Probe V2.11-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\ASUS Probe\Uninst.isu"
Asus_A6_ScreenSaver-->C:\WINDOWS\Asus_A6_ScreenSaver.scr /u
ASUSDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
BisonCam, NB Pro-->C:\WINDOWS\BisonRem.exe
Canon MP Navigator 2.0-->"C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP500-->"C:\WINDOWS\system32\CanonMP Uninstaller Information\{BA4DF4C3-196E-4128-969A-00996B5A46F8}\DelDrv.exe" /U:{BA4DF4C3-196E-4128-969A-00996B5A46F8} /L0x000c
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CD-LabelPrint-->"C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
Centre d'imagerie Lexmark-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\8\INTEL3~1\IDriver.exe /M{523BD5B6-E904-493C-B902-1BC9B7D44DF4} /l1036
Ciel Devis Factures-->MsiExec.exe /I{D9308B24-B490-4952-A583-553881711DA1}
Console Oracle Web Conferencing-->"C:\Program Files\Fichiers communs\Oracle\RTC Client\3.0.3.667\fr\cnsrun.exe" --dll:cnssetup.dll --entry:5 --cmd:/u
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Cosmo Player 2.1 (38329)-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\CosmoSoftware\CosmoPlayer\CosmoPlayer21.isu"
Digital Video-->C:\Program Files\InstallShield Installation Information\{C833C7B6-1140-471D-932B-391B5CA66D7D}\setup.exe -runfromtemp -l0x040c -removeonly
DivX-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
Easy-WebPrint-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
Encyclopédie Universelle Larousse-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5D02AE2F-0C28-4AB1-91FA-049E6192AB93}\setup.exe" -l0x40c
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
FlashDiskManager 3.00-->"C:\Program Files\FlashDiskManager\uninstall.exe"
Free Download Manager 2.5 build 758-->C:\Program Files\Free Download Manager\uninst.exe
Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
Gestionnaire Internet-->C:\PROGRA~1\WANADOO\uninstall.exe
getPlus(R) for Adobe-->"C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_0531C63A913CC9D1.exe" /uninstall
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
INFORAD MANAGER 3.5-->"C:\Program Files\INFORAD\unins000.exe"
Intel(R) PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe
ISSENDIS WebUpdate v6-->"C:\Program Files\ISSENDIS\ISSENDIS WebUpdate v6\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Lexmark Skin: Elastic-->C:\PROGRA~1\LEXMAR~1\SKIN9\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN9\INSTALL.LOG
Lexmark Skin: Helix-->C:\PROGRA~1\LEXMAR~1\SKIN1\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN1\INSTALL.LOG
Lexmark Skin: Machine1-->C:\PROGRA~1\LEXMAR~1\SKIN5\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN5\INSTALL.LOG
Lexmark Skin: Nature TV1-->C:\PROGRA~1\LEXMAR~1\SKIN1\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN1\INSTALL.LOG
Lexmark Skin: Nature TV2-->C:\PROGRA~1\LEXMAR~1\SKIN2\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN2\INSTALL.LOG
Lexmark Skin: Nature TV3-->C:\PROGRA~1\LEXMAR~1\SKIN3\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN3\INSTALL.LOG
Lexmark Z700-P700 Series-->C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLUN5C.EXE -dLexmark Z700-P700 Series
Logiciel de Synchronisation Orange-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C2EBC2F1-B766-4AE3-A10C-6EBBC1EE3B02}\setup.exe" -l0x40c -removeonly
Macromedia Shockwave Player-->C:\WINDOWS\system32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~1\INSTALL.LOG
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
mCore-->MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}
mDriver-->MsiExec.exe /I{28DA872A-0848-48CF-B749-19A198157A2A}
mDrWiFi-->MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
Medi@Show-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\CyberLink\MediaShow\Uninst.isu"
MediaConverter-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{83DA46EC-2CB1-4649-9100-C4F98D8DA8CD}\Setup.exe" -l0x40c
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
mEoU.msi-->MsiExec.exe /I{B502B428-3386-40A9-98DB-079AAB72E64F}
mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Micro Application - MediaDICO Les 4 Dictionnaires Utiles-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Uninst.isu"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 CD-ROM 2-->MsiExec.exe /I{0004040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office 2000 Premium-->MsiExec.exe /I{0000040C-78E1-11D2-B60F-006097C998E7}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Web Publishing Wizard 1.52-->RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie4x86.inf,WebPostUninstall
Microsoft Works-->MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mIWCA-->MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}
mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.19)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz-->MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser-->MsiExec.exe /I{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}
mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML-->MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig-->MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023}
Navigateur Orange-->C:\PROGRA~1\WANADOO\Shell.exe inst\uninst_FTBrowser.shl
Nero 7 Essentials-->MsiExec.exe /X{B28B351F-1232-46EA-85EF-B8EA91641036}
NetShow Tools 3.0-->C:\Program Files\NetShow Services\Tools\_insttoo.exe /U
Nokia Connectivity Cable Driver-->MsiExec.exe /X{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}
Nokia Flashing Cable Driver-->MsiExec.exe /X{D99C322D-C21B-40C7-AE71-EE51AA096B6E}
Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{D5577624-0626-4C4B-87AA-D966DA1739D6}\Nokia_PC_Suite_rel_7_0_9_2_wu_fre.exe
Nokia PC Suite-->MsiExec.exe /I{D5577624-0626-4C4B-87AA-D966DA1739D6}
Nokia Software Updater-->MsiExec.exe /X{59367F7E-D7C1-4629-8AEC-71AA24A68F31}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
OFFICE One 150 Modèles de documents-->"C:\Program Files\OFFICE ONE6.5\Modeles\unins000.exe"
OFFICE One 6.5 Bureautique désinstallation complète 6.5-->"C:\Program Files\OFFICE One6.5\Uninstall All\SETUP\setup.exe" /u
OFFICE One 6.5-->c:\Program Files\OFFICE ONE6.5\program\setup.exe -deinstall
OFFICE One Clock 6.5-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Clock\SETUP\setup.exe" /u
OFFICE One Coffre Fort v6-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Coffre Fort v6\unins000.exe"
OFFICE One Color Picker 6.5-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Color Picker\SETUP\setup.exe" /u
OFFICE One Comptes Bancaires v6-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Comptes Bancaires v6\unins000.exe"
OFFICE One Guide 6.5-->"C:\Program Files\OFFICE ONE6.5\Guide\SETUP\setup.exe" /u
OFFICE One Notes 6.5-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Notes\SETUP\setup.exe" /u
OFFICE One PDF Manager 6.5-->"C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\SETUP\setup.exe" /u
OFFICE One Zip v6-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Zip v6\unins000.exe"
OmniPage SE 2.0-->MsiExec.exe /I{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Package de pilotes Windows - Nokia Modem (05/22/2008 3.8)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_6F90B0F4A73A2F780A1010B5D6CB5DDFB098181E\nokia_bluetooth.inf
Package de pilotes Windows - Nokia Modem (05/22/2008 7.00.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_E68D50F7E25BFE399D47C864C3B52557346242A9\nokbtmdm.inf
Package de pilotes Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf
PC Camera (602a VGA)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23484C5A-E7AE-4F59-B7DF-88D63BEF18F4}\Setup.exe" -l0x9
PC Connectivity Solution-->MsiExec.exe /I{1A524CFE-DF85-4555-8BC2-0C89DBD8BC2C}
PC SECURITY TEST 2008-->"C:\Program Files\AxBx\PC Security Test 2008\unins000.exe"
PhotoImpression-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4FE82F4B-B7D8-4E65-84AD-E0436CDE57DD}\Setup.exe" -l0x40c
PhotoShow Deluxe 3-->"C:\Program Files\Simple Star\PhotoShow Deluxe 3\data\Xtras\Uninstall.exe"
Pinnacle MediaCenter-->"C:\Program Files\InstallShield Installation Information\{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}\Setup.exe"UNINSTALL /l0x040c
PowerDirector-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" -uninstall
PrintMaster 7.00-->c:\PROGRA~1\MINDSC~1\PRINTM~1\uninst32.exe /IFirst
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x40c -removeonly
ScanWizard 5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B08D262E-D902-11D5-9C28-0080C85A0C2D}\setup.exe"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Shockwave-->C:\WINDOWS\system32\MACROMED\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~2\Install.log
ShowBiz DVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E883DCB3-766D-4166-8B28-33C8FE451F2B}\Setup.exe" -l0x40c
Spamihilator-->"C:\Program Files\Spamihilator\uninstall.exe"
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Ulead COOL 360 1.0-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ulead Systems\Ulead COOL 360\Uninst.isu" -c"C:\Program Files\Ulead Systems\Ulead COOL 360\IS32Inst.dll"
Ulead Photo Explorer 7.0 SE Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E38E1721-7FE7-11D4-A898-0000E83DCDA6}\Setup.exe" -l0x40c
Ulead Photo Explorer 8.0 SE Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D271DAE0-8D68-4C97-8356-A126D48A1D8C}\Setup.exe" -l0x40c
Ulead Photo Express 4.0 SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BBC0D330-C37B-4472-BFB9-AA217CF0C95F}\setup.exe" -l0x40c
Ulead PhotoImpact XL SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CADA6C4C-3EF2-43FC-8E5B-E89E3880A399}\setup.exe" -l0x40c
Ulead VideoStudio version 4.0 SE Basic-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Ulead Systems\Ulead VideoStudio 4.0 SE Basic\Uninst.isu" -c"C:\Program Files\Ulead Systems\Ulead VideoStudio 4.0 SE Basic\IS32Inst.dll"
USB MEMORY BAR Tool-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B1F69DF2-8C69-437E-A288-663326C4404A}\Setup.exe" -l0x9
VC_MergeModuleToMSI-->MsiExec.exe /I{900A92BA-19EF-4A34-86CF-7B6C85BDD971}
VideoLive Mail 4.0-->C:\WINDOWS\IsUn040c.exe -f"c:\program files\cyberlink\Uninst.isu"
VirginMega.Fr Premium-->MsiExec.exe /I{EE467474-04A8-48D5-8DDF-0F8D3A3CCBE5}
Visual C++ CRT 9.0 SP1-->MsiExec.exe /I{EC25B803-4BDB-47F7-B877-FCE7D7966C0F}
VLC media player 0.9.7-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Watchtower Library 2006 - Édition française-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B2C37022-C6A2-4523-BC45-6BFD68BB429B}\Setup.exe"
Watchtower Library 2007 - Français-->C:\Program Files\Watchtower\Watchtower Library 2007\F\uninst.exe
Watchtower Library 2008 - Français-->C:\Program Files\Watchtower\Watchtower Library 2008\F\uninst.exe
Windows Defender-->MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Search 4.0-->"C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Wireless Console-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{83F73CB1-7705-49D1-9852-84D839CA2A45}\SETUP.exe" -l0x9 -removeonly
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
XVID Codec Installation-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{534C6D59-D6E3-48A6-AD0B-747799019960}\Setup.exe" -l0x40c
Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\YAHOO!\Common\YINSTH~1.DLL
======Security center information======
AV: Avira AntiVir PersonalEdition Classic
System event log
Computer Name: NOM-0DD0D418616
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Configuration automatique sans fil.
Record Number: 47539
Source Name: Service Control Manager
Time Written: 20090220021353.000000+060
Event Type: Informations
User: NOM-0DD0D418616\utilisateur
Computer Name: NOM-0DD0D418616
Event Code: 115
Message: Le suivi de la Restauration système a été activé sur tous les lecteurs.
Record Number: 47538
Source Name: SRService
Time Written: 20090220013817.000000+060
Event Type: Informations
User:
Computer Name: NOM-0DD0D418616
Event Code: 7036
Message: Le service Service de restauration système est entré dans l'état : en cours d'exécution.
Record Number: 47537
Source Name: Service Control Manager
Time Written: 20090220013810.000000+060
Event Type: Informations
User:
Computer Name: NOM-0DD0D418616
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de restauration système.
Record Number: 47536
Source Name: Service Control Manager
Time Written: 20090220013810.000000+060
Event Type: Informations
User: NOM-0DD0D418616\utilisateur
Computer Name: NOM-0DD0D418616
Event Code: 7036
Message: Le service Service de restauration système est entré dans l'état : arrêté.
Record Number: 47535
Source Name: Service Control Manager
Time Written: 20090220013739.000000+060
Event Type: Informations
User:
Application event log
Computer Name: NOM-0DD0D418616
Event Code: 1001
Message: Détecteur d'erreurs 225408530.
Record Number: 4980
Source Name: Application Error
Time Written: 20090116220541.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1000
Message: Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d.
Record Number: 4979
Source Name: Application Error
Time Written: 20090116220538.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1001
Message: Détecteur d'erreurs 1048325031.
Record Number: 4978
Source Name: Application Error
Time Written: 20090116220532.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1000
Message: Application défaillante iexplore.exe, version 7.0.6000.16762, module défaillant comctl32.dll, version 6.0.2900.5512, adresse de défaillance 0x00087132.
Record Number: 4977
Source Name: Application Error
Time Written: 20090116220528.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1001
Message: Détecteur d'erreurs 736169863.
Record Number: 4976
Source Name: Application Hang
Time Written: 20090116214522.000000+060
Event Type: erreur
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Fichiers communs\Ulead Systems\DVD
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
======Uninstall list======
-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D00360DC-9634-44CC-AF88-924A12406E81}\SETUP.EXE" -l0x40c anything
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.61 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
ABBYY FineReader 6.0-->MsiExec.exe /I{AF600F7B-67A7-48D9-BA3B-0FF97F35F970}
ABBYY FineReader OCR Engine -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{345C90FB-FA10-11D5-9C2A-0080C85A0C2D}\setup.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A90000000001}
AF Cam-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6213FD4F-C3A3-4A2F-9CC1-8DAEAF469633}\Setup.exe"
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x40c
ArcSoft Software Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F7BB0F7-E782-4086-BD9E-762204239605}\Setup.exe" -l0x40c
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Asus ChkMail-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Asus\Asus ChkMail\Uninst.isu"
ASUS Enhanced Display Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\SETUP.EXE" -l0x9
ASUS Live Update-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\ASUS Live Update\Uninst.isu" -c"C:\Program Files\ASUS\ASUS Live Update\Uninst.dll"
ASUS Probe V2.11-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\ASUS Probe\Uninst.isu"
Asus_A6_ScreenSaver-->C:\WINDOWS\Asus_A6_ScreenSaver.scr /u
ASUSDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
BisonCam, NB Pro-->C:\WINDOWS\BisonRem.exe
Canon MP Navigator 2.0-->"C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP500-->"C:\WINDOWS\system32\CanonMP Uninstaller Information\{BA4DF4C3-196E-4128-969A-00996B5A46F8}\DelDrv.exe" /U:{BA4DF4C3-196E-4128-969A-00996B5A46F8} /L0x000c
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CD-LabelPrint-->"C:\Program Files\Canon\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
Centre d'imagerie Lexmark-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\8\INTEL3~1\IDriver.exe /M{523BD5B6-E904-493C-B902-1BC9B7D44DF4} /l1036
Ciel Devis Factures-->MsiExec.exe /I{D9308B24-B490-4952-A583-553881711DA1}
Console Oracle Web Conferencing-->"C:\Program Files\Fichiers communs\Oracle\RTC Client\3.0.3.667\fr\cnsrun.exe" --dll:cnssetup.dll --entry:5 --cmd:/u
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Cosmo Player 2.1 (38329)-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\CosmoSoftware\CosmoPlayer\CosmoPlayer21.isu"
Digital Video-->C:\Program Files\InstallShield Installation Information\{C833C7B6-1140-471D-932B-391B5CA66D7D}\setup.exe -runfromtemp -l0x040c -removeonly
DivX-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
Easy-WebPrint-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
Encyclopédie Universelle Larousse-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5D02AE2F-0C28-4AB1-91FA-049E6192AB93}\setup.exe" -l0x40c
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
FlashDiskManager 3.00-->"C:\Program Files\FlashDiskManager\uninstall.exe"
Free Download Manager 2.5 build 758-->C:\Program Files\Free Download Manager\uninst.exe
Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
Gestionnaire Internet-->C:\PROGRA~1\WANADOO\uninstall.exe
getPlus(R) for Adobe-->"C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_0531C63A913CC9D1.exe" /uninstall
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)-->"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
INFORAD MANAGER 3.5-->"C:\Program Files\INFORAD\unins000.exe"
Intel(R) PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe
ISSENDIS WebUpdate v6-->"C:\Program Files\ISSENDIS\ISSENDIS WebUpdate v6\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Lexmark Skin: Elastic-->C:\PROGRA~1\LEXMAR~1\SKIN9\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN9\INSTALL.LOG
Lexmark Skin: Helix-->C:\PROGRA~1\LEXMAR~1\SKIN1\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN1\INSTALL.LOG
Lexmark Skin: Machine1-->C:\PROGRA~1\LEXMAR~1\SKIN5\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN5\INSTALL.LOG
Lexmark Skin: Nature TV1-->C:\PROGRA~1\LEXMAR~1\SKIN1\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN1\INSTALL.LOG
Lexmark Skin: Nature TV2-->C:\PROGRA~1\LEXMAR~1\SKIN2\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN2\INSTALL.LOG
Lexmark Skin: Nature TV3-->C:\PROGRA~1\LEXMAR~1\SKIN3\UNWISE.EXE C:\PROGRA~1\LEXMAR~1\SKIN3\INSTALL.LOG
Lexmark Z700-P700 Series-->C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLUN5C.EXE -dLexmark Z700-P700 Series
Logiciel de Synchronisation Orange-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C2EBC2F1-B766-4AE3-A10C-6EBBC1EE3B02}\setup.exe" -l0x40c -removeonly
Macromedia Shockwave Player-->C:\WINDOWS\system32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~1\INSTALL.LOG
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
mCore-->MsiExec.exe /I{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}
mDriver-->MsiExec.exe /I{28DA872A-0848-48CF-B749-19A198157A2A}
mDrWiFi-->MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
Medi@Show-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\CyberLink\MediaShow\Uninst.isu"
MediaConverter-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{83DA46EC-2CB1-4649-9100-C4F98D8DA8CD}\Setup.exe" -l0x40c
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
mEoU.msi-->MsiExec.exe /I{B502B428-3386-40A9-98DB-079AAB72E64F}
mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Micro Application - MediaDICO Les 4 Dictionnaires Utiles-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Uninst.isu"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 CD-ROM 2-->MsiExec.exe /I{0004040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office 2000 Premium-->MsiExec.exe /I{0000040C-78E1-11D2-B60F-006097C998E7}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Web Publishing Wizard 1.52-->RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie4x86.inf,WebPostUninstall
Microsoft Works-->MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mIWCA-->MsiExec.exe /I{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}
mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.19)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mPfWiz-->MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9}
mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser-->MsiExec.exe /I{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}
mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}
mXML-->MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401}
mZConfig-->MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023}
Navigateur Orange-->C:\PROGRA~1\WANADOO\Shell.exe inst\uninst_FTBrowser.shl
Nero 7 Essentials-->MsiExec.exe /X{B28B351F-1232-46EA-85EF-B8EA91641036}
NetShow Tools 3.0-->C:\Program Files\NetShow Services\Tools\_insttoo.exe /U
Nokia Connectivity Cable Driver-->MsiExec.exe /X{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}
Nokia Flashing Cable Driver-->MsiExec.exe /X{D99C322D-C21B-40C7-AE71-EE51AA096B6E}
Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{D5577624-0626-4C4B-87AA-D966DA1739D6}\Nokia_PC_Suite_rel_7_0_9_2_wu_fre.exe
Nokia PC Suite-->MsiExec.exe /I{D5577624-0626-4C4B-87AA-D966DA1739D6}
Nokia Software Updater-->MsiExec.exe /X{59367F7E-D7C1-4629-8AEC-71AA24A68F31}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
OFFICE One 150 Modèles de documents-->"C:\Program Files\OFFICE ONE6.5\Modeles\unins000.exe"
OFFICE One 6.5 Bureautique désinstallation complète 6.5-->"C:\Program Files\OFFICE One6.5\Uninstall All\SETUP\setup.exe" /u
OFFICE One 6.5-->c:\Program Files\OFFICE ONE6.5\program\setup.exe -deinstall
OFFICE One Clock 6.5-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Clock\SETUP\setup.exe" /u
OFFICE One Coffre Fort v6-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Coffre Fort v6\unins000.exe"
OFFICE One Color Picker 6.5-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Color Picker\SETUP\setup.exe" /u
OFFICE One Comptes Bancaires v6-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Comptes Bancaires v6\unins000.exe"
OFFICE One Guide 6.5-->"C:\Program Files\OFFICE ONE6.5\Guide\SETUP\setup.exe" /u
OFFICE One Notes 6.5-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Notes\SETUP\setup.exe" /u
OFFICE One PDF Manager 6.5-->"C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\SETUP\setup.exe" /u
OFFICE One Zip v6-->"C:\Program Files\OFFICE ONE6.5\OFFICE One Zip v6\unins000.exe"
OmniPage SE 2.0-->MsiExec.exe /I{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Package de pilotes Windows - Nokia Modem (05/22/2008 3.8)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_6F90B0F4A73A2F780A1010B5D6CB5DDFB098181E\nokia_bluetooth.inf
Package de pilotes Windows - Nokia Modem (05/22/2008 7.00.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_E68D50F7E25BFE399D47C864C3B52557346242A9\nokbtmdm.inf
Package de pilotes Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf
PC Camera (602a VGA)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23484C5A-E7AE-4F59-B7DF-88D63BEF18F4}\Setup.exe" -l0x9
PC Connectivity Solution-->MsiExec.exe /I{1A524CFE-DF85-4555-8BC2-0C89DBD8BC2C}
PC SECURITY TEST 2008-->"C:\Program Files\AxBx\PC Security Test 2008\unins000.exe"
PhotoImpression-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4FE82F4B-B7D8-4E65-84AD-E0436CDE57DD}\Setup.exe" -l0x40c
PhotoShow Deluxe 3-->"C:\Program Files\Simple Star\PhotoShow Deluxe 3\data\Xtras\Uninstall.exe"
Pinnacle MediaCenter-->"C:\Program Files\InstallShield Installation Information\{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}\Setup.exe"UNINSTALL /l0x040c
PowerDirector-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" -uninstall
PrintMaster 7.00-->c:\PROGRA~1\MINDSC~1\PRINTM~1\uninst32.exe /IFirst
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x40c -removeonly
ScanWizard 5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B08D262E-D902-11D5-9C28-0080C85A0C2D}\setup.exe"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Shockwave-->C:\WINDOWS\system32\MACROMED\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~2\Install.log
ShowBiz DVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E883DCB3-766D-4166-8B28-33C8FE451F2B}\Setup.exe" -l0x40c
Spamihilator-->"C:\Program Files\Spamihilator\uninstall.exe"
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Ulead COOL 360 1.0-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ulead Systems\Ulead COOL 360\Uninst.isu" -c"C:\Program Files\Ulead Systems\Ulead COOL 360\IS32Inst.dll"
Ulead Photo Explorer 7.0 SE Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E38E1721-7FE7-11D4-A898-0000E83DCDA6}\Setup.exe" -l0x40c
Ulead Photo Explorer 8.0 SE Basic-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D271DAE0-8D68-4C97-8356-A126D48A1D8C}\Setup.exe" -l0x40c
Ulead Photo Express 4.0 SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BBC0D330-C37B-4472-BFB9-AA217CF0C95F}\setup.exe" -l0x40c
Ulead PhotoImpact XL SE-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CADA6C4C-3EF2-43FC-8E5B-E89E3880A399}\setup.exe" -l0x40c
Ulead VideoStudio version 4.0 SE Basic-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Ulead Systems\Ulead VideoStudio 4.0 SE Basic\Uninst.isu" -c"C:\Program Files\Ulead Systems\Ulead VideoStudio 4.0 SE Basic\IS32Inst.dll"
USB MEMORY BAR Tool-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B1F69DF2-8C69-437E-A288-663326C4404A}\Setup.exe" -l0x9
VC_MergeModuleToMSI-->MsiExec.exe /I{900A92BA-19EF-4A34-86CF-7B6C85BDD971}
VideoLive Mail 4.0-->C:\WINDOWS\IsUn040c.exe -f"c:\program files\cyberlink\Uninst.isu"
VirginMega.Fr Premium-->MsiExec.exe /I{EE467474-04A8-48D5-8DDF-0F8D3A3CCBE5}
Visual C++ CRT 9.0 SP1-->MsiExec.exe /I{EC25B803-4BDB-47F7-B877-FCE7D7966C0F}
VLC media player 0.9.7-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Watchtower Library 2006 - Édition française-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B2C37022-C6A2-4523-BC45-6BFD68BB429B}\Setup.exe"
Watchtower Library 2007 - Français-->C:\Program Files\Watchtower\Watchtower Library 2007\F\uninst.exe
Watchtower Library 2008 - Français-->C:\Program Files\Watchtower\Watchtower Library 2008\F\uninst.exe
Windows Defender-->MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Search 4.0-->"C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Wireless Console-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{83F73CB1-7705-49D1-9852-84D839CA2A45}\SETUP.exe" -l0x9 -removeonly
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
XVID Codec Installation-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{534C6D59-D6E3-48A6-AD0B-747799019960}\Setup.exe" -l0x40c
Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\YAHOO!\Common\YINSTH~1.DLL
======Security center information======
AV: Avira AntiVir PersonalEdition Classic
System event log
Computer Name: NOM-0DD0D418616
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Configuration automatique sans fil.
Record Number: 47539
Source Name: Service Control Manager
Time Written: 20090220021353.000000+060
Event Type: Informations
User: NOM-0DD0D418616\utilisateur
Computer Name: NOM-0DD0D418616
Event Code: 115
Message: Le suivi de la Restauration système a été activé sur tous les lecteurs.
Record Number: 47538
Source Name: SRService
Time Written: 20090220013817.000000+060
Event Type: Informations
User:
Computer Name: NOM-0DD0D418616
Event Code: 7036
Message: Le service Service de restauration système est entré dans l'état : en cours d'exécution.
Record Number: 47537
Source Name: Service Control Manager
Time Written: 20090220013810.000000+060
Event Type: Informations
User:
Computer Name: NOM-0DD0D418616
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service de restauration système.
Record Number: 47536
Source Name: Service Control Manager
Time Written: 20090220013810.000000+060
Event Type: Informations
User: NOM-0DD0D418616\utilisateur
Computer Name: NOM-0DD0D418616
Event Code: 7036
Message: Le service Service de restauration système est entré dans l'état : arrêté.
Record Number: 47535
Source Name: Service Control Manager
Time Written: 20090220013739.000000+060
Event Type: Informations
User:
Application event log
Computer Name: NOM-0DD0D418616
Event Code: 1001
Message: Détecteur d'erreurs 225408530.
Record Number: 4980
Source Name: Application Error
Time Written: 20090116220541.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1000
Message: Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d.
Record Number: 4979
Source Name: Application Error
Time Written: 20090116220538.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1001
Message: Détecteur d'erreurs 1048325031.
Record Number: 4978
Source Name: Application Error
Time Written: 20090116220532.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1000
Message: Application défaillante iexplore.exe, version 7.0.6000.16762, module défaillant comctl32.dll, version 6.0.2900.5512, adresse de défaillance 0x00087132.
Record Number: 4977
Source Name: Application Error
Time Written: 20090116220528.000000+060
Event Type: erreur
User:
Computer Name: NOM-0DD0D418616
Event Code: 1001
Message: Détecteur d'erreurs 736169863.
Record Number: 4976
Source Name: Application Hang
Time Written: 20090116214522.000000+060
Event Type: erreur
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Fichiers communs\Ulead Systems\DVD
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
Les fichiers textes ont été envoyés
Je suppose qu'il faut désinstaller Toolscleaner et RSIT dans le panneau de configuration?
Je suppose qu'il faut désinstaller Toolscleaner et RSIT dans le panneau de configuration?
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.
---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant ci-dessous :
:processes
explorer.exe
:services
SpySoapSysGuardDriver
SpySoapSysGuardService
:files
C:\Program Files\SpySoap
:commands
[purity]
[emptytemp]
[reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant ci-dessous :
:processes
explorer.exe
:services
SpySoapSysGuardDriver
SpySoapSysGuardService
:files
C:\Program Files\SpySoap
:commands
[purity]
[emptytemp]
[reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
voici le résultat avec le message suivant:
"Cannot create File C:\OtmoveIt\MovedFiles\03062009_234238.log
J'ai fait 2 tentatives mais veines...
File/Folder :processes not found.
File/Folder explorer.exe not found.
File/Folder not found.
File/Folder :services not found.
File/Folder SpySoapSysGuardDriver not found.
File/Folder SpySoapSysGuardService not found.
File/Folder not found.
File/Folder :files not found.
File/Folder C:\Program Files\SpySoap not found.
File/Folder not found.
File/Folder :commands not found.
File/Folder [purity] not found.
File/Folder [emptytemp] not found.
File/Folder [reboot] not found.
File/Folder not found.
Created on 03/06/2009 23:14:50
PAr ailleurs, j'ai aperçu 4 fois "svchost.exe" SYSTEM Réseau ou Service local dans les Processus or j'ai lu que ce processus était risqué?
"Cannot create File C:\OtmoveIt\MovedFiles\03062009_234238.log
J'ai fait 2 tentatives mais veines...
File/Folder :processes not found.
File/Folder explorer.exe not found.
File/Folder not found.
File/Folder :services not found.
File/Folder SpySoapSysGuardDriver not found.
File/Folder SpySoapSysGuardService not found.
File/Folder not found.
File/Folder :files not found.
File/Folder C:\Program Files\SpySoap not found.
File/Folder not found.
File/Folder :commands not found.
File/Folder [purity] not found.
File/Folder [emptytemp] not found.
File/Folder [reboot] not found.
File/Folder not found.
Created on 03/06/2009 23:14:50
PAr ailleurs, j'ai aperçu 4 fois "svchost.exe" SYSTEM Réseau ou Service local dans les Processus or j'ai lu que ce processus était risqué?
/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
ComboFix 09-03-04.01 - utilisateur 2009-03-07 0:45:44.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.127 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\emMON.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-06 au 2009-03-06 ))))))))))))))))))))))))))))))))))))
.
2009-03-06 19:21 . 2009-03-06 19:21 <REP> d-------- C:\rsit
2009-03-06 19:11 . 2009-03-06 19:12 89,807,908 --a------ C:\Sauv.reg
2009-03-05 19:11 . 2009-03-05 19:11 <REP> d-------- c:\program files\Ad-remover
2009-02-27 20:55 . 2009-02-27 20:55 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Search
2009-02-26 11:16 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Thunderbird
2009-02-23 16:26 . 2009-02-23 16:26 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-02-22 23:59 . 2009-02-22 23:59 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\documents and settings\utilisateur\Application Data\SUPERAntiSpyware.com
2009-02-21 23:10 . 2009-02-21 23:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Desktop Search
2009-02-21 22:55 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 22:51 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-21 22:51 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-21 22:51 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-21 00:30 . 2009-02-21 19:54 754 --a------ c:\windows\wordpad.INI
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\program files\Free Download Manager
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Free Download Manager
2009-02-18 16:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 16:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-16 20:41 . 2009-02-16 20:41 <REP> d-------- c:\program files\AxBx
2009-02-16 15:58 . 2009-02-16 15:58 <REP> d-------- c:\program files\Trend Micro
2009-02-15 00:42 . 2002-12-25 19:55 32,768 --------- c:\windows\system32\UleadPhotoExplorer8_Res.dll
2009-02-15 00:42 . 2002-11-01 14:28 24,576 --------- c:\windows\system32\Ulead Photo Explorer 8.scr
2009-02-13 19:20 . 2009-02-13 19:20 <REP> d-------- c:\documents and settings\utilisateur\Application Data\dvdcss
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\program files\MSBuild
2009-02-13 00:05 . 2009-02-13 00:05 <REP> d-------- c:\program files\Reference Assemblies
2009-02-12 16:43 . 2009-02-12 16:44 <REP> d-------- c:\windows\ulead.dat
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\program files\Spamihilator
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Spamihilator
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 11:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-10 19:08 . 2008-07-06 13:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\program files\Avira
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-09 15:57 . 2005-05-25 06:00 90,112 --------- c:\windows\SDUnInst.exe
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\dllcache\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\dllcache\kbdkor.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\dllcache\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101b.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\dllcache\kbd103.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 14:05 23,196 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2009-02-05 22:00 --------- d-----w c:\program files\NOS
2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-05 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-14 21:30 --------- d-----w c:\program files\NetShow Services
2009-01-14 21:14 --------- d-----w c:\program files\AF Cam
2009-01-12 14:16 --------- d-----w c:\program files\Windows Desktop Search
2009-01-12 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe(3)
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2005-08-25 20:00 48,128 ----a-w c:\documents and settings\utilisateur\cnmss Canon MP500 Series Printer (Local).dll
2008-05-30 09:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008053020080531\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"MediaDICO4Ut"="c:\program files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe" [2004-03-03 252416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]
"WOOKIT"="c:\progra~1\WANADOO\Shell.exe" [2004-08-23 122880]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-12-01 1406192]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]
"PC Suite Tray"="c:\documents and settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2008-11-12 2474031]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-07 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WOOTASKBARICON"="c:\progra~1\WANADOO\GestMaj.exe" [2004-10-14 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
"WOOWATCH"="c:\progra~1\WANADOO\Watch.exe" [2004-08-23 20480]
"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe [2007-12-16 257536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Logiciel de Synchronisation Orange.lnk - c:\program files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-12-02 684032]
Contr“leur de calendrier Ulead.lnk - c:\program files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2009-01-14 69632]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 11:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.asv2"= asusasv2.dll
"msacm.dvacm"= dvacm.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SBService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\System32\\FXSCLNT.exe"=
"c:\\Program Files\\Spamihilator\\cdcc.exe"=
"c:\\Program Files\\Spamihilator\\dccproc.exe"=
"c:\\Program Files\\Spamihilator\\spamihilator.exe"=
R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2008-12-03 2304]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
S2 Ca533av;AF Cam, WDM Video Capture;c:\windows\system32\drivers\Ca533av.sys [2009-01-14 515803]
S2 SpySoapSysGuardService;System Guard(SpySoap);c:\program files\SpySoap\SysGuard.exe --> c:\program files\SpySoap\SysGuard.exe [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-05 33752]
S3 SpySoapSysGuardDriver;SpySoapSysGuardDriver;\??\c:\program files\SpySoap\sysGuard.sys --> c:\program files\SpySoap\sysGuard.sys [?]
UnknownUnknown dsload;dsload; [x]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - dsgrab_01c86384e88f3e56
.
Contenu du dossier 'Tâches planifiées'
2009-03-06 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2009-03-04 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
2009-03-06 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Pinnacle WebUpdater - c:\program files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe -s -f=UpdateVersion.xml
HKU-Default-Run-OrangePlayer - c:\program files\orange\player orange\Orange Player.exe
.
------- Examen supplémentaire -------
.
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: live.com\safety
Trusted Zone: orange.fr\www
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\9ir1kb69.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 00:48:33
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2227729942-2260562539-462105317-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,12,21,e5,bf,0e,
32,1e,5f,e2,63,26,f1,3f,c8,ff,68,4e,0c,63,6c,dd,12,22,db,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,70,7c,8e,2d,63,
f7,09,93,6a,9c,d6,61,af,45,84,18,06,55,c5,20,0c,04,2f,65,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,54,6e,ec,6e,d7,
cd,91,f6,ff,7c,85,e0,43,d4,0e,fe,ec,60,8b,d5,53,d8,cf,a7,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,58,f8,b7,13,99,
66,17,6d,86,8c,21,01,be,91,eb,e7,a6,7b,5a,c5,9f,38,35,79,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b8,30,a9,6d,8e,
bd,e1,e4,f5,1d,4d,73,a8,13,5c,05,b8,2c,b8,c2,c5,cf,b2,c3,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3e,6d,39,c6,66,
f8,00,ec,df,20,58,62,78,6b,cf,c8,c1,4a,4f,8c,60,ae,03,e3,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,ce,45,30,f2,05,
79,e3,12,fb,a7,78,e6,12,2f,9a,ea,ca,d3,da,42,f9,ca,9b,03,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ba,62,15,d3,9f,
5e,75,de,01,3a,48,fc,e8,04,4a,f1,cb,d9,de,85,18,f3,36,dc,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ab,04,2d,61,61,
86,c7,0e,f6,0f,4e,58,98,5b,89,c9,c4,c3,2e,55,75,92,3b,54,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,64,bd,7d,66,34,
d7,b5,85,3d,ce,ea,26,2d,45,aa,78,de,26,dc,ba,fc,f5,e8,45,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,9f,37,44,e6,2e,
d7,98,4c,2a,b7,cc,b5,b9,7f,41,e7,98,1a,a8,54,8d,2e,9a,09,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,d0,94,c2,b6,1e,
b1,ba,4c,6c,43,2d,1e,aa,22,2f,9c,e8,13,be,e2,f0,36,0f,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1056)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Heure de fin: 2009-03-07 0:50:38
ComboFix-quarantined-files.txt 2009-03-06 23:50:36
Avant-CF: 21 759 393 792 octets libres
Après-CF: 21,770,731,520 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
331 --- E O F --- 2009-03-06 15:36:17
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.127 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\emMON.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-06 au 2009-03-06 ))))))))))))))))))))))))))))))))))))
.
2009-03-06 19:21 . 2009-03-06 19:21 <REP> d-------- C:\rsit
2009-03-06 19:11 . 2009-03-06 19:12 89,807,908 --a------ C:\Sauv.reg
2009-03-05 19:11 . 2009-03-05 19:11 <REP> d-------- c:\program files\Ad-remover
2009-02-27 20:55 . 2009-02-27 20:55 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Search
2009-02-26 11:16 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Thunderbird
2009-02-23 16:26 . 2009-02-23 16:26 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-02-22 23:59 . 2009-02-22 23:59 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\documents and settings\utilisateur\Application Data\SUPERAntiSpyware.com
2009-02-21 23:10 . 2009-02-21 23:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Desktop Search
2009-02-21 22:55 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 22:51 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-21 22:51 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-21 22:51 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-21 00:30 . 2009-02-21 19:54 754 --a------ c:\windows\wordpad.INI
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\program files\Free Download Manager
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Free Download Manager
2009-02-18 16:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 16:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-16 20:41 . 2009-02-16 20:41 <REP> d-------- c:\program files\AxBx
2009-02-16 15:58 . 2009-02-16 15:58 <REP> d-------- c:\program files\Trend Micro
2009-02-15 00:42 . 2002-12-25 19:55 32,768 --------- c:\windows\system32\UleadPhotoExplorer8_Res.dll
2009-02-15 00:42 . 2002-11-01 14:28 24,576 --------- c:\windows\system32\Ulead Photo Explorer 8.scr
2009-02-13 19:20 . 2009-02-13 19:20 <REP> d-------- c:\documents and settings\utilisateur\Application Data\dvdcss
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\program files\MSBuild
2009-02-13 00:05 . 2009-02-13 00:05 <REP> d-------- c:\program files\Reference Assemblies
2009-02-12 16:43 . 2009-02-12 16:44 <REP> d-------- c:\windows\ulead.dat
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\program files\Spamihilator
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Spamihilator
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 11:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-10 19:08 . 2008-07-06 13:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\program files\Avira
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-09 15:57 . 2005-05-25 06:00 90,112 --------- c:\windows\SDUnInst.exe
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\dllcache\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\dllcache\kbdkor.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\dllcache\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101b.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\dllcache\kbd103.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 14:05 23,196 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2009-02-05 22:00 --------- d-----w c:\program files\NOS
2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-05 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-14 21:30 --------- d-----w c:\program files\NetShow Services
2009-01-14 21:14 --------- d-----w c:\program files\AF Cam
2009-01-12 14:16 --------- d-----w c:\program files\Windows Desktop Search
2009-01-12 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe(3)
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2005-08-25 20:00 48,128 ----a-w c:\documents and settings\utilisateur\cnmss Canon MP500 Series Printer (Local).dll
2008-05-30 09:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008053020080531\index.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"MediaDICO4Ut"="c:\program files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe" [2004-03-03 252416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]
"WOOKIT"="c:\progra~1\WANADOO\Shell.exe" [2004-08-23 122880]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-12-01 1406192]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]
"PC Suite Tray"="c:\documents and settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2008-11-12 2474031]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-07 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WOOTASKBARICON"="c:\progra~1\WANADOO\GestMaj.exe" [2004-10-14 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
"WOOWATCH"="c:\progra~1\WANADOO\Watch.exe" [2004-08-23 20480]
"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe [2007-12-16 257536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Logiciel de Synchronisation Orange.lnk - c:\program files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-12-02 684032]
Contr“leur de calendrier Ulead.lnk - c:\program files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2009-01-14 69632]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 11:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.asv2"= asusasv2.dll
"msacm.dvacm"= dvacm.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SBService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\System32\\FXSCLNT.exe"=
"c:\\Program Files\\Spamihilator\\cdcc.exe"=
"c:\\Program Files\\Spamihilator\\dccproc.exe"=
"c:\\Program Files\\Spamihilator\\spamihilator.exe"=
R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2008-12-03 2304]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
S2 Ca533av;AF Cam, WDM Video Capture;c:\windows\system32\drivers\Ca533av.sys [2009-01-14 515803]
S2 SpySoapSysGuardService;System Guard(SpySoap);c:\program files\SpySoap\SysGuard.exe --> c:\program files\SpySoap\SysGuard.exe [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-05 33752]
S3 SpySoapSysGuardDriver;SpySoapSysGuardDriver;\??\c:\program files\SpySoap\sysGuard.sys --> c:\program files\SpySoap\sysGuard.sys [?]
UnknownUnknown dsload;dsload; [x]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - dsgrab_01c86384e88f3e56
.
Contenu du dossier 'Tâches planifiées'
2009-03-06 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2009-03-04 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
2009-03-06 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Pinnacle WebUpdater - c:\program files\Pinnacle\Shared Files\Programs\WebUpdater\WebUpdater.exe -s -f=UpdateVersion.xml
HKU-Default-Run-OrangePlayer - c:\program files\orange\player orange\Orange Player.exe
.
------- Examen supplémentaire -------
.
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: live.com\safety
Trusted Zone: orange.fr\www
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\9ir1kb69.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 00:48:33
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2227729942-2260562539-462105317-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,12,21,e5,bf,0e,
32,1e,5f,e2,63,26,f1,3f,c8,ff,68,4e,0c,63,6c,dd,12,22,db,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,70,7c,8e,2d,63,
f7,09,93,6a,9c,d6,61,af,45,84,18,06,55,c5,20,0c,04,2f,65,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,54,6e,ec,6e,d7,
cd,91,f6,ff,7c,85,e0,43,d4,0e,fe,ec,60,8b,d5,53,d8,cf,a7,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,58,f8,b7,13,99,
66,17,6d,86,8c,21,01,be,91,eb,e7,a6,7b,5a,c5,9f,38,35,79,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b8,30,a9,6d,8e,
bd,e1,e4,f5,1d,4d,73,a8,13,5c,05,b8,2c,b8,c2,c5,cf,b2,c3,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3e,6d,39,c6,66,
f8,00,ec,df,20,58,62,78,6b,cf,c8,c1,4a,4f,8c,60,ae,03,e3,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,ce,45,30,f2,05,
79,e3,12,fb,a7,78,e6,12,2f,9a,ea,ca,d3,da,42,f9,ca,9b,03,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ba,62,15,d3,9f,
5e,75,de,01,3a,48,fc,e8,04,4a,f1,cb,d9,de,85,18,f3,36,dc,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ab,04,2d,61,61,
86,c7,0e,f6,0f,4e,58,98,5b,89,c9,c4,c3,2e,55,75,92,3b,54,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,64,bd,7d,66,34,
d7,b5,85,3d,ce,ea,26,2d,45,aa,78,de,26,dc,ba,fc,f5,e8,45,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,9f,37,44,e6,2e,
d7,98,4c,2a,b7,cc,b5,b9,7f,41,e7,98,1a,a8,54,8d,2e,9a,09,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,d0,94,c2,b6,1e,
b1,ba,4c,6c,43,2d,1e,aa,22,2f,9c,e8,13,be,e2,f0,36,0f,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1056)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Heure de fin: 2009-03-07 0:50:38
ComboFix-quarantined-files.txt 2009-03-06 23:50:36
Avant-CF: 21 759 393 792 octets libres
Après-CF: 21,770,731,520 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
331 --- E O F --- 2009-03-06 15:36:17
/!\ Seul Ficelle2x peut suivre cette procédure. /!\
1/
---> Ouvre le Bloc-notes.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
Driver::
SpySoapSysGuardDriver
SpySoapSysGuardService
Folder::
C:\Program Files\SpySoap
--> Colle la sélection dans le Bloc-notes.
--> Enregistre ce fichier sur le Bureau (Impératif).
--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.
2/
--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
--> Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
--> Une fois le scan achevé, un rapport va s'afficher : poste-le.
--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt
1/
---> Ouvre le Bloc-notes.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
Driver::
SpySoapSysGuardDriver
SpySoapSysGuardService
Folder::
C:\Program Files\SpySoap
--> Colle la sélection dans le Bloc-notes.
--> Enregistre ce fichier sur le Bureau (Impératif).
--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.
2/
--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
--> Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
--> Une fois le scan achevé, un rapport va s'afficher : poste-le.
--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt
J'ai beaucoup de difficultés à me connecter et Je dois sans cesse réparer la connexion Internet
Je n'ai pas très bien compris la procédure N°2 surtout le glisser déposer de CFScript sur la capture HTTP://www.searchengines.pl... (laquelle sélectionner?)
J'ai glisser le fichier Microsoft sur l'icône ComboFix mais je ne sui aps certain que la console soit installée
car je n'ai pas eu de message me l'affirmant ni me demandant s'il fallait faire l'analyse
La fenêtre bleue n'est aps apaprue
ComboFix 09-03-04.01 - utilisateur 2009-03-07 2:42:50.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.205 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\utilisateur\Bureau\CFScript.lnk
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-07 au 2009-03-07 ))))))))))))))))))))))))))))))))))))
.
2009-03-06 19:21 . 2009-03-06 19:21 <REP> d-------- C:\rsit
2009-03-06 19:11 . 2009-03-06 19:12 89,807,908 --a------ C:\Sauv.reg
2009-03-05 19:11 . 2009-03-05 19:11 <REP> d-------- c:\program files\Ad-remover
2009-02-27 20:55 . 2009-02-27 20:55 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Search
2009-02-26 11:16 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Thunderbird
2009-02-23 16:26 . 2009-02-23 16:26 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-02-22 23:59 . 2009-02-22 23:59 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\documents and settings\utilisateur\Application Data\SUPERAntiSpyware.com
2009-02-21 23:10 . 2009-02-21 23:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Desktop Search
2009-02-21 22:55 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 22:51 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-21 22:51 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-21 22:51 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-21 00:30 . 2009-02-21 19:54 754 --a------ c:\windows\wordpad.INI
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\program files\Free Download Manager
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Free Download Manager
2009-02-18 16:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 16:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-16 20:41 . 2009-02-16 20:41 <REP> d-------- c:\program files\AxBx
2009-02-16 15:58 . 2009-02-16 15:58 <REP> d-------- c:\program files\Trend Micro
2009-02-15 00:42 . 2002-12-25 19:55 32,768 --------- c:\windows\system32\UleadPhotoExplorer8_Res.dll
2009-02-15 00:42 . 2002-11-01 14:28 24,576 --------- c:\windows\system32\Ulead Photo Explorer 8.scr
2009-02-13 19:20 . 2009-02-13 19:20 <REP> d-------- c:\documents and settings\utilisateur\Application Data\dvdcss
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\program files\MSBuild
2009-02-13 00:05 . 2009-02-13 00:05 <REP> d-------- c:\program files\Reference Assemblies
2009-02-12 16:43 . 2009-02-12 16:44 <REP> d-------- c:\windows\ulead.dat
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\program files\Spamihilator
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Spamihilator
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 11:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-10 19:08 . 2008-07-06 13:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\program files\Avira
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-09 15:57 . 2005-05-25 06:00 90,112 --------- c:\windows\SDUnInst.exe
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\dllcache\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\dllcache\kbdkor.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\dllcache\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101b.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\dllcache\kbd103.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 14:05 23,196 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2009-02-05 22:00 --------- d-----w c:\program files\NOS
2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-05 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-14 21:30 --------- d-----w c:\program files\NetShow Services
2009-01-14 21:14 --------- d-----w c:\program files\AF Cam
2009-01-12 14:16 --------- d-----w c:\program files\Windows Desktop Search
2009-01-12 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe(3)
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2005-08-25 20:00 48,128 ----a-w c:\documents and settings\utilisateur\cnmss Canon MP500 Series Printer (Local).dll
2008-05-30 09:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008053020080531\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-03-07_ 0.49.14,48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-07 00:00:22 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_770.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"MediaDICO4Ut"="c:\program files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe" [2004-03-03 252416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]
"WOOKIT"="c:\progra~1\WANADOO\Shell.exe" [2004-08-23 122880]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-12-01 1406192]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]
"PC Suite Tray"="c:\documents and settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2008-11-12 2474031]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-07 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WOOTASKBARICON"="c:\progra~1\WANADOO\GestMaj.exe" [2004-10-14 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
"WOOWATCH"="c:\progra~1\WANADOO\Watch.exe" [2004-08-23 20480]
"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe [2007-12-16 257536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Logiciel de Synchronisation Orange.lnk - c:\program files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-12-02 684032]
Contr“leur de calendrier Ulead.lnk - c:\program files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2009-01-14 69632]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 11:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.asv2"= asusasv2.dll
"msacm.dvacm"= dvacm.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SBService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\System32\\FXSCLNT.exe"=
"c:\\Program Files\\Spamihilator\\cdcc.exe"=
"c:\\Program Files\\Spamihilator\\dccproc.exe"=
"c:\\Program Files\\Spamihilator\\spamihilator.exe"=
R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2008-12-03 2304]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S2 Ca533av;AF Cam, WDM Video Capture;c:\windows\system32\drivers\Ca533av.sys [2009-01-14 515803]
S2 SpySoapSysGuardService;System Guard(SpySoap);c:\program files\SpySoap\SysGuard.exe --> c:\program files\SpySoap\SysGuard.exe [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-05 33752]
S3 SpySoapSysGuardDriver;SpySoapSysGuardDriver;\??\c:\program files\SpySoap\sysGuard.sys --> c:\program files\SpySoap\sysGuard.sys [?]
UnknownUnknown dsload;dsload; [x]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - SASDIFSV
*Deregistered* - dsgrab_01c86384e88f3e56
.
Contenu du dossier 'Tâches planifiées'
2009-03-07 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2009-03-04 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
2009-03-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
.
------- Examen supplémentaire -------
.
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: live.com\safety
Trusted Zone: orange.fr\www
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\9ir1kb69.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 02:44:15
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2227729942-2260562539-462105317-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,12,21,e5,bf,0e,
32,1e,5f,e2,63,26,f1,3f,c8,ff,68,4e,0c,63,6c,dd,12,22,db,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,70,7c,8e,2d,63,
f7,09,93,6a,9c,d6,61,af,45,84,18,06,55,c5,20,0c,04,2f,65,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,54,6e,ec,6e,d7,
cd,91,f6,ff,7c,85,e0,43,d4,0e,fe,ec,60,8b,d5,53,d8,cf,a7,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,58,f8,b7,13,99,
66,17,6d,86,8c,21,01,be,91,eb,e7,a6,7b,5a,c5,9f,38,35,79,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b8,30,a9,6d,8e,
bd,e1,e4,f5,1d,4d,73,a8,13,5c,05,b8,2c,b8,c2,c5,cf,b2,c3,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3e,6d,39,c6,66,
f8,00,ec,df,20,58,62,78,6b,cf,c8,c1,4a,4f,8c,60,ae,03,e3,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,ce,45,30,f2,05,
79,e3,12,fb,a7,78,e6,12,2f,9a,ea,ca,d3,da,42,f9,ca,9b,03,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ba,62,15,d3,9f,
5e,75,de,01,3a,48,fc,e8,04,4a,f1,cb,d9,de,85,18,f3,36,dc,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ab,04,2d,61,61,
86,c7,0e,f6,0f,4e,58,98,5b,89,c9,c4,c3,2e,55,75,92,3b,54,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,64,bd,7d,66,34,
d7,b5,85,3d,ce,ea,26,2d,45,aa,78,de,26,dc,ba,fc,f5,e8,45,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,9f,37,44,e6,2e,
d7,98,4c,2a,b7,cc,b5,b9,7f,41,e7,98,1a,a8,54,8d,2e,9a,09,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,d0,94,c2,b6,1e,
b1,ba,4c,6c,43,2d,1e,aa,22,2f,9c,e8,13,be,e2,f0,36,0f,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1052)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Heure de fin: 2009-03-07 2:45:21
ComboFix-quarantined-files.txt 2009-03-07 01:45:20
ComboFix4.txt 2009-03-06 23:50:42
ComboFix3.txt 2009-03-07 00:50:56
ComboFix2.txt 2009-03-07 01:40:54
Avant-CF: 21 586 018 304 octets libres
Après-CF: 21,571,698,688 octets libres
320 --- E O F --- 2009-03-06 15:36:17
J'ai mal à la tête, je vais me coucher...Bonne nuit
Je n'ai pas très bien compris la procédure N°2 surtout le glisser déposer de CFScript sur la capture HTTP://www.searchengines.pl... (laquelle sélectionner?)
J'ai glisser le fichier Microsoft sur l'icône ComboFix mais je ne sui aps certain que la console soit installée
car je n'ai pas eu de message me l'affirmant ni me demandant s'il fallait faire l'analyse
La fenêtre bleue n'est aps apaprue
ComboFix 09-03-04.01 - utilisateur 2009-03-07 2:42:50.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.205 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\utilisateur\Bureau\CFScript.lnk
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-07 au 2009-03-07 ))))))))))))))))))))))))))))))))))))
.
2009-03-06 19:21 . 2009-03-06 19:21 <REP> d-------- C:\rsit
2009-03-06 19:11 . 2009-03-06 19:12 89,807,908 --a------ C:\Sauv.reg
2009-03-05 19:11 . 2009-03-05 19:11 <REP> d-------- c:\program files\Ad-remover
2009-02-27 20:55 . 2009-02-27 20:55 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Search
2009-02-26 11:16 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Thunderbird
2009-02-23 16:26 . 2009-02-23 16:26 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-02-22 23:59 . 2009-02-22 23:59 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\documents and settings\utilisateur\Application Data\SUPERAntiSpyware.com
2009-02-21 23:10 . 2009-02-21 23:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Desktop Search
2009-02-21 22:55 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 22:51 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-21 22:51 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-21 22:51 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-21 00:30 . 2009-02-21 19:54 754 --a------ c:\windows\wordpad.INI
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\program files\Free Download Manager
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Free Download Manager
2009-02-18 16:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 16:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-16 20:41 . 2009-02-16 20:41 <REP> d-------- c:\program files\AxBx
2009-02-16 15:58 . 2009-02-16 15:58 <REP> d-------- c:\program files\Trend Micro
2009-02-15 00:42 . 2002-12-25 19:55 32,768 --------- c:\windows\system32\UleadPhotoExplorer8_Res.dll
2009-02-15 00:42 . 2002-11-01 14:28 24,576 --------- c:\windows\system32\Ulead Photo Explorer 8.scr
2009-02-13 19:20 . 2009-02-13 19:20 <REP> d-------- c:\documents and settings\utilisateur\Application Data\dvdcss
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\program files\MSBuild
2009-02-13 00:05 . 2009-02-13 00:05 <REP> d-------- c:\program files\Reference Assemblies
2009-02-12 16:43 . 2009-02-12 16:44 <REP> d-------- c:\windows\ulead.dat
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\program files\Spamihilator
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Spamihilator
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 11:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-10 19:08 . 2008-07-06 13:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\program files\Avira
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-09 15:57 . 2005-05-25 06:00 90,112 --------- c:\windows\SDUnInst.exe
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\dllcache\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\dllcache\kbdkor.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\dllcache\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101b.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\dllcache\kbd103.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 14:05 23,196 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2009-02-05 22:00 --------- d-----w c:\program files\NOS
2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-05 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-14 21:30 --------- d-----w c:\program files\NetShow Services
2009-01-14 21:14 --------- d-----w c:\program files\AF Cam
2009-01-12 14:16 --------- d-----w c:\program files\Windows Desktop Search
2009-01-12 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe(3)
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2005-08-25 20:00 48,128 ----a-w c:\documents and settings\utilisateur\cnmss Canon MP500 Series Printer (Local).dll
2008-05-30 09:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008053020080531\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-03-07_ 0.49.14,48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-07 00:00:22 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_770.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"MediaDICO4Ut"="c:\program files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe" [2004-03-03 252416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]
"WOOKIT"="c:\progra~1\WANADOO\Shell.exe" [2004-08-23 122880]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-12-01 1406192]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]
"PC Suite Tray"="c:\documents and settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2008-11-12 2474031]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-07 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WOOTASKBARICON"="c:\progra~1\WANADOO\GestMaj.exe" [2004-10-14 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
"WOOWATCH"="c:\progra~1\WANADOO\Watch.exe" [2004-08-23 20480]
"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe [2007-12-16 257536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Logiciel de Synchronisation Orange.lnk - c:\program files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-12-02 684032]
Contr“leur de calendrier Ulead.lnk - c:\program files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2009-01-14 69632]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 11:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.asv2"= asusasv2.dll
"msacm.dvacm"= dvacm.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SBService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\System32\\FXSCLNT.exe"=
"c:\\Program Files\\Spamihilator\\cdcc.exe"=
"c:\\Program Files\\Spamihilator\\dccproc.exe"=
"c:\\Program Files\\Spamihilator\\spamihilator.exe"=
R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2008-12-03 2304]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S2 Ca533av;AF Cam, WDM Video Capture;c:\windows\system32\drivers\Ca533av.sys [2009-01-14 515803]
S2 SpySoapSysGuardService;System Guard(SpySoap);c:\program files\SpySoap\SysGuard.exe --> c:\program files\SpySoap\SysGuard.exe [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-05 33752]
S3 SpySoapSysGuardDriver;SpySoapSysGuardDriver;\??\c:\program files\SpySoap\sysGuard.sys --> c:\program files\SpySoap\sysGuard.sys [?]
UnknownUnknown dsload;dsload; [x]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - SASDIFSV
*Deregistered* - dsgrab_01c86384e88f3e56
.
Contenu du dossier 'Tâches planifiées'
2009-03-07 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2009-03-04 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
2009-03-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
.
------- Examen supplémentaire -------
.
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: live.com\safety
Trusted Zone: orange.fr\www
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\9ir1kb69.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 02:44:15
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2227729942-2260562539-462105317-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,12,21,e5,bf,0e,
32,1e,5f,e2,63,26,f1,3f,c8,ff,68,4e,0c,63,6c,dd,12,22,db,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,70,7c,8e,2d,63,
f7,09,93,6a,9c,d6,61,af,45,84,18,06,55,c5,20,0c,04,2f,65,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,54,6e,ec,6e,d7,
cd,91,f6,ff,7c,85,e0,43,d4,0e,fe,ec,60,8b,d5,53,d8,cf,a7,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,58,f8,b7,13,99,
66,17,6d,86,8c,21,01,be,91,eb,e7,a6,7b,5a,c5,9f,38,35,79,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b8,30,a9,6d,8e,
bd,e1,e4,f5,1d,4d,73,a8,13,5c,05,b8,2c,b8,c2,c5,cf,b2,c3,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3e,6d,39,c6,66,
f8,00,ec,df,20,58,62,78,6b,cf,c8,c1,4a,4f,8c,60,ae,03,e3,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,ce,45,30,f2,05,
79,e3,12,fb,a7,78,e6,12,2f,9a,ea,ca,d3,da,42,f9,ca,9b,03,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ba,62,15,d3,9f,
5e,75,de,01,3a,48,fc,e8,04,4a,f1,cb,d9,de,85,18,f3,36,dc,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ab,04,2d,61,61,
86,c7,0e,f6,0f,4e,58,98,5b,89,c9,c4,c3,2e,55,75,92,3b,54,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,64,bd,7d,66,34,
d7,b5,85,3d,ce,ea,26,2d,45,aa,78,de,26,dc,ba,fc,f5,e8,45,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,9f,37,44,e6,2e,
d7,98,4c,2a,b7,cc,b5,b9,7f,41,e7,98,1a,a8,54,8d,2e,9a,09,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,d0,94,c2,b6,1e,
b1,ba,4c,6c,43,2d,1e,aa,22,2f,9c,e8,13,be,e2,f0,36,0f,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1052)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Heure de fin: 2009-03-07 2:45:21
ComboFix-quarantined-files.txt 2009-03-07 01:45:20
ComboFix4.txt 2009-03-06 23:50:42
ComboFix3.txt 2009-03-07 00:50:56
ComboFix2.txt 2009-03-07 01:40:54
Avant-CF: 21 586 018 304 octets libres
Après-CF: 21,571,698,688 octets libres
320 --- E O F --- 2009-03-06 15:36:17
J'ai mal à la tête, je vais me coucher...Bonne nuit
"c:\documents and settings\utilisateur\Bureau\CFScript.lnk"
CFScript.lnk ---> C'est un raccourci mais pourquoi ?
CFScript.lnk ---> C'est un raccourci mais pourquoi ?
ComboFix 09-03-04.01 - utilisateur 2009-03-07 11:00:04.7 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.100 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\utilisateur\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SPYSOAPSYSGUARDDRIVER
-------\Legacy_SPYSOAPSYSGUARDSERVICE
-------\Service_SpySoapSysGuardDriver
-------\Service_SpySoapSysGuardService
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-07 au 2009-03-07 ))))))))))))))))))))))))))))))))))))
.
2009-03-06 19:21 . 2009-03-06 19:21 <REP> d-------- C:\rsit
2009-03-06 19:11 . 2009-03-06 19:12 89,807,908 --a------ C:\Sauv.reg
2009-03-05 19:11 . 2009-03-05 19:11 <REP> d-------- c:\program files\Ad-remover
2009-02-27 20:55 . 2009-02-27 20:55 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Search
2009-02-26 11:16 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Thunderbird
2009-02-23 16:26 . 2009-02-23 16:26 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-02-22 23:59 . 2009-02-22 23:59 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\documents and settings\utilisateur\Application Data\SUPERAntiSpyware.com
2009-02-21 23:10 . 2009-02-21 23:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Desktop Search
2009-02-21 22:55 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 22:51 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-21 22:51 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-21 22:51 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-21 00:30 . 2009-02-21 19:54 754 --a------ c:\windows\wordpad.INI
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\program files\Free Download Manager
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Free Download Manager
2009-02-18 16:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 16:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-16 20:41 . 2009-02-16 20:41 <REP> d-------- c:\program files\AxBx
2009-02-16 15:58 . 2009-02-16 15:58 <REP> d-------- c:\program files\Trend Micro
2009-02-15 00:42 . 2002-12-25 19:55 32,768 --------- c:\windows\system32\UleadPhotoExplorer8_Res.dll
2009-02-15 00:42 . 2002-11-01 14:28 24,576 --------- c:\windows\system32\Ulead Photo Explorer 8.scr
2009-02-13 19:20 . 2009-02-13 19:20 <REP> d-------- c:\documents and settings\utilisateur\Application Data\dvdcss
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\program files\MSBuild
2009-02-13 00:05 . 2009-02-13 00:05 <REP> d-------- c:\program files\Reference Assemblies
2009-02-12 16:43 . 2009-02-12 16:44 <REP> d-------- c:\windows\ulead.dat
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\program files\Spamihilator
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Spamihilator
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 11:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-10 19:08 . 2008-07-06 13:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\program files\Avira
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-09 15:57 . 2005-05-25 06:00 90,112 --------- c:\windows\SDUnInst.exe
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\dllcache\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\dllcache\kbdkor.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\dllcache\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101b.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\dllcache\kbd103.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 14:05 23,196 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2009-02-05 22:00 --------- d-----w c:\program files\NOS
2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-05 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-14 21:30 --------- d-----w c:\program files\NetShow Services
2009-01-14 21:14 --------- d-----w c:\program files\AF Cam
2009-01-12 14:16 --------- d-----w c:\program files\Windows Desktop Search
2009-01-12 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe(3)
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2005-08-25 20:00 48,128 ----a-w c:\documents and settings\utilisateur\cnmss Canon MP500 Series Printer (Local).dll
2008-05-30 09:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008053020080531\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-03-07_ 0.49.14,48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-03-07 10:04:50 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_764.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"MediaDICO4Ut"="c:\program files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe" [2004-03-03 252416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]
"WOOKIT"="c:\progra~1\WANADOO\Shell.exe" [2004-08-23 122880]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-12-01 1406192]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]
"PC Suite Tray"="c:\documents and settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2008-11-12 2474031]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-07 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WOOTASKBARICON"="c:\progra~1\WANADOO\GestMaj.exe" [2004-10-14 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"WOOWATCH"="c:\progra~1\WANADOO\Watch.exe" [2004-08-23 20480]
"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe [2007-12-16 257536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Logiciel de Synchronisation Orange.lnk - c:\program files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-12-02 684032]
Contr“leur de calendrier Ulead.lnk - c:\program files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2009-01-14 69632]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 11:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.asv2"= asusasv2.dll
"msacm.dvacm"= dvacm.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SBService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\System32\\FXSCLNT.exe"=
"c:\\Program Files\\Spamihilator\\cdcc.exe"=
"c:\\Program Files\\Spamihilator\\dccproc.exe"=
"c:\\Program Files\\Spamihilator\\spamihilator.exe"=
R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2008-12-03 2304]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S2 Ca533av;AF Cam, WDM Video Capture;c:\windows\system32\drivers\Ca533av.sys [2009-01-14 515803]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-05 33752]
UnknownUnknown dsload;dsload; [x]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - dsgrab_01c86384e88f3e56
.
Contenu du dossier 'Tâches planifiées'
2009-03-07 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2009-03-04 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
2009-03-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
.
------- Examen supplémentaire -------
.
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: live.com\safety
Trusted Zone: orange.fr\www
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\9ir1kb69.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 11:05:47
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2227729942-2260562539-462105317-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,12,21,e5,bf,0e,
32,1e,5f,e2,63,26,f1,3f,c8,ff,68,4e,0c,63,6c,dd,12,22,db,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,70,7c,8e,2d,63,
f7,09,93,6a,9c,d6,61,af,45,84,18,06,55,c5,20,0c,04,2f,65,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,54,6e,ec,6e,d7,
cd,91,f6,ff,7c,85,e0,43,d4,0e,fe,ec,60,8b,d5,53,d8,cf,a7,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,58,f8,b7,13,99,
66,17,6d,86,8c,21,01,be,91,eb,e7,a6,7b,5a,c5,9f,38,35,79,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b8,30,a9,6d,8e,
bd,e1,e4,f5,1d,4d,73,a8,13,5c,05,b8,2c,b8,c2,c5,cf,b2,c3,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3e,6d,39,c6,66,
f8,00,ec,df,20,58,62,78,6b,cf,c8,c1,4a,4f,8c,60,ae,03,e3,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,ce,45,30,f2,05,
79,e3,12,fb,a7,78,e6,12,2f,9a,ea,ca,d3,da,42,f9,ca,9b,03,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ba,62,15,d3,9f,
5e,75,de,01,3a,48,fc,e8,04,4a,f1,cb,d9,de,85,18,f3,36,dc,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ab,04,2d,61,61,
86,c7,0e,f6,0f,4e,58,98,5b,89,c9,c4,c3,2e,55,75,92,3b,54,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,64,bd,7d,66,34,
d7,b5,85,3d,ce,ea,26,2d,45,aa,78,de,26,dc,ba,fc,f5,e8,45,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,9f,37,44,e6,2e,
d7,98,4c,2a,b7,cc,b5,b9,7f,41,e7,98,1a,a8,54,8d,2e,9a,09,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,d0,94,c2,b6,1e,
b1,ba,4c,6c,43,2d,1e,aa,22,2f,9c,e8,13,be,e2,f0,36,0f,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1052)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\windows\ATKKBService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\System32\FTRTSVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\OProtSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\System32\snmp.exe
c:\windows\system32\SearchIndexer.exe
c:\progra~1\WANADOO\TaskBarIcon.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\progra~1\WANADOO\PollingModule.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\OFFICE ONE6.5\program\soffice.exe
c:\program files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
c:\windows\system32\ntvdm.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
J'étais trop fatigué et je me suis trompé donc j'ai refait l'opération avec le bloc notes et voici le rapport
Il me reste à gaire le glisser/déposer de CFScript sur https://searchengines.pl/ si j'y arrive car j'ai des difficultés à conserver la connexion (IE ne fonctionne pas mais Firefox de temps en temps)
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
.
**************************************************************************
.
Heure de fin: 2009-03-07 11:10:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-07 10:10:44
ComboFix4.txt 2009-03-07 00:50:56
ComboFix3.txt 2009-03-07 01:40:54
ComboFix5.txt 2009-03-07 09:59:10
ComboFix2.txt 2009-03-07 01:45:24
Avant-CF: 21 519 532 032 octets libres
Après-CF: 21,427,191,808 octets libres
364 --- E O F --- 2009-03-06 15:36:17
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.100 [GMT 1:00]
Lancé depuis: c:\documents and settings\utilisateur\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\utilisateur\Bureau\CFScript.txt
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SPYSOAPSYSGUARDDRIVER
-------\Legacy_SPYSOAPSYSGUARDSERVICE
-------\Service_SpySoapSysGuardDriver
-------\Service_SpySoapSysGuardService
((((((((((((((((((((((((((((( Fichiers créés du 2009-02-07 au 2009-03-07 ))))))))))))))))))))))))))))))))))))
.
2009-03-06 19:21 . 2009-03-06 19:21 <REP> d-------- C:\rsit
2009-03-06 19:11 . 2009-03-06 19:12 89,807,908 --a------ C:\Sauv.reg
2009-03-05 19:11 . 2009-03-05 19:11 <REP> d-------- c:\program files\Ad-remover
2009-02-27 20:55 . 2009-02-27 20:55 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Search
2009-02-26 11:16 . 2009-01-09 20:19 1,089,883 --------- c:\windows\system32\dllcache\ntprint.cat
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\program files\Mozilla Thunderbird
2009-02-24 17:10 . 2009-02-24 17:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Thunderbird
2009-02-23 16:26 . 2009-02-23 16:26 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-02-22 23:59 . 2009-02-22 23:59 <REP> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\program files\SUPERAntiSpyware
2009-02-22 23:58 . 2009-02-22 23:58 <REP> d-------- c:\documents and settings\utilisateur\Application Data\SUPERAntiSpyware.com
2009-02-21 23:10 . 2009-02-21 23:10 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Windows Desktop Search
2009-02-21 22:55 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-02-21 22:51 . 2008-03-07 18:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-21 22:51 . 2008-03-07 18:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-21 22:51 . 2008-03-07 18:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-21 00:30 . 2009-02-21 19:54 754 --a------ c:\windows\wordpad.INI
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\program files\Free Download Manager
2009-02-19 00:17 . 2009-02-19 00:17 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Free Download Manager
2009-02-18 16:25 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-18 16:25 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-16 20:41 . 2009-02-16 20:41 <REP> d-------- c:\program files\AxBx
2009-02-16 15:58 . 2009-02-16 15:58 <REP> d-------- c:\program files\Trend Micro
2009-02-15 00:42 . 2002-12-25 19:55 32,768 --------- c:\windows\system32\UleadPhotoExplorer8_Res.dll
2009-02-15 00:42 . 2002-11-01 14:28 24,576 --------- c:\windows\system32\Ulead Photo Explorer 8.scr
2009-02-13 19:20 . 2009-02-13 19:20 <REP> d-------- c:\documents and settings\utilisateur\Application Data\dvdcss
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\windows\system32\XPSViewer
2009-02-13 00:06 . 2009-02-13 00:06 <REP> d-------- c:\program files\MSBuild
2009-02-13 00:05 . 2009-02-13 00:05 <REP> d-------- c:\program files\Reference Assemblies
2009-02-12 16:43 . 2009-02-12 16:44 <REP> d-------- c:\windows\ulead.dat
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\program files\Spamihilator
2009-02-12 11:51 . 2009-02-12 11:51 <REP> d-------- c:\documents and settings\utilisateur\Application Data\Spamihilator
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 19:08 . 2008-07-06 11:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 19:08 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-10 19:08 . 2008-07-06 13:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\program files\Avira
2009-02-09 16:22 . 2009-02-09 16:22 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-09 15:57 . 2005-05-25 06:00 90,112 --------- c:\windows\SDUnInst.exe
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\dllcache\kbdjpn.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-02-09 14:17 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\dllcache\kbdkor.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-02-09 14:17 . 2008-04-14 04:31 6,144 --a------ c:\windows\system32\dllcache\kbd106.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101c.dll
2009-02-09 14:17 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\dllcache\kbd101b.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-02-09 14:17 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\dllcache\kbd103.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 14:05 23,196 ----a-w c:\documents and settings\utilisateur\Application Data\wklnhst.dat
2009-02-05 22:00 --------- d-----w c:\program files\NOS
2009-02-05 22:00 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-05 19:48 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 20:15 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-14 21:30 --------- d-----w c:\program files\NetShow Services
2009-01-14 21:14 --------- d-----w c:\program files\AF Cam
2009-01-12 14:16 --------- d-----w c:\program files\Windows Desktop Search
2009-01-12 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe(3)
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 22:47 826,368 ------w c:\windows\system32\dllcache\wininet.dll
2008-12-20 22:47 671,232 ------w c:\windows\system32\dllcache\mstime.dll
2008-12-20 22:47 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll
2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
2008-12-20 22:47 193,024 ------w c:\windows\system32\dllcache\msrating.dll
2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
2008-12-20 22:47 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll
2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2005-08-25 20:00 48,128 ----a-w c:\documents and settings\utilisateur\cnmss Canon MP500 Series Printer (Local).dll
2008-05-30 09:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008053020080531\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-03-07_ 0.49.14,48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-03-07 10:04:50 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_764.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"MediaDICO4Ut"="c:\program files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe" [2004-03-03 252416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-14 68856]
"WOOKIT"="c:\progra~1\WANADOO\Shell.exe" [2004-08-23 122880]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-12-01 1406192]
"PMCS"="c:\program files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" [2006-06-08 65536]
"PC Suite Tray"="c:\documents and settings\utilisateur\Mes documents\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2008-11-12 2474031]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-07 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 5562368]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"WOOTASKBARICON"="c:\progra~1\WANADOO\GestMaj.exe" [2004-10-14 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"WOOWATCH"="c:\progra~1\WANADOO\Watch.exe" [2004-08-23 20480]
"Ulead AutoDetector"="c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe" [2003-03-24 45056]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\utilisateur\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One 6.5.lnk - c:\program files\OFFICE ONE6.5\program\quickstart.exe [2004-03-08 36864]
Pense-bˆte.lnk - c:\program files\Mindscape\PrintMaster\PMREMIND.EXE [2008-01-31 2344920]
Canon IJ Status Monitor Canon MP500 Series Printer.lnk - c:\windows\system32\rundll32.exe [2004-09-20 33792]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
OFFICE One Clock v6.5.lnk - c:\program files\OFFICE ONE6.5\OFFICE One Clock\ooneclockv65.exe [2007-12-16 257536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Logiciel de Synchronisation Orange.lnk - c:\program files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe [2008-12-02 684032]
Contr“leur de calendrier Ulead.lnk - c:\program files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2009-01-14 69632]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 11:27 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.asv2"= asusasv2.dll
"msacm.dvacm"= dvacm.acm
"VIDC.VDOM"= vdowave.drv
"VIDC.TR20"= tr2032.dll
"vidc.vivo"= ivvideo.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SBService"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\System32\\LEXPPS.EXE"=
"c:\\Program Files\\Fichiers communs\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\WINDOWS\\System32\\FXSCLNT.exe"=
"c:\\Program Files\\Spamihilator\\cdcc.exe"=
"c:\\Program Files\\Spamihilator\\dccproc.exe"=
"c:\\Program Files\\Spamihilator\\spamihilator.exe"=
R0 R592;R592;c:\windows\system32\drivers\R592.sys [2004-10-15 57088]
R0 risdpntk;risdpntk;c:\windows\system32\drivers\risdpntk.sys [2004-10-15 27264]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Machnm32;Machnm32 Driver;c:\windows\system32\Machnm32.sys [2008-12-03 2304]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S2 Ca533av;AF Cam, WDM Video Capture;c:\windows\system32\drivers\Ca533av.sys [2009-01-14 515803]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-02-05 33752]
UnknownUnknown dsload;dsload; [x]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - dsgrab_01c86384e88f3e56
.
Contenu du dossier 'Tâches planifiées'
2009-03-07 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
2009-03-04 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
2009-03-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
.
------- Examen supplémentaire -------
.
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: { - c:\program files\Messenger\msmsgs.exe
Trusted Zone: live.com\safety
Trusted Zone: orange.fr\www
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} - hxxp://contacts.orange.fr/wfr_webab/VoxsyncX.cab
DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
FF - ProfilePath - c:\documents and settings\utilisateur\Application Data\Mozilla\Firefox\Profiles\9ir1kb69.default\
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.current_page", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("pref.browser.homepage.disable_button.restore_default", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importBookmarksHTML", true);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.places.importDefaults", false);
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.search.selectedEngine", "xeoo.com");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("keyword.URL", "http://xeoo.com/?p=url&a=firefox&k=");
c:\program files\Mozilla Firefox\defaults\profile\prefs.js - user_pref("browser.startup.homepage", "http://www.xeoo.com/?p=h&a=firefox");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 11:05:47
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-2227729942-2260562539-462105317-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,12,21,e5,bf,0e,
32,1e,5f,e2,63,26,f1,3f,c8,ff,68,4e,0c,63,6c,dd,12,22,db,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,70,7c,8e,2d,63,
f7,09,93,6a,9c,d6,61,af,45,84,18,06,55,c5,20,0c,04,2f,65,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,54,6e,ec,6e,d7,
cd,91,f6,ff,7c,85,e0,43,d4,0e,fe,ec,60,8b,d5,53,d8,cf,a7,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,58,f8,b7,13,99,
66,17,6d,86,8c,21,01,be,91,eb,e7,a6,7b,5a,c5,9f,38,35,79,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,b8,30,a9,6d,8e,
bd,e1,e4,f5,1d,4d,73,a8,13,5c,05,b8,2c,b8,c2,c5,cf,b2,c3,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,3e,6d,39,c6,66,
f8,00,ec,df,20,58,62,78,6b,cf,c8,c1,4a,4f,8c,60,ae,03,e3,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,ce,45,30,f2,05,
79,e3,12,fb,a7,78,e6,12,2f,9a,ea,ca,d3,da,42,f9,ca,9b,03,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ba,62,15,d3,9f,
5e,75,de,01,3a,48,fc,e8,04,4a,f1,cb,d9,de,85,18,f3,36,dc,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ab,04,2d,61,61,
86,c7,0e,f6,0f,4e,58,98,5b,89,c9,c4,c3,2e,55,75,92,3b,54,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,64,bd,7d,66,34,
d7,b5,85,3d,ce,ea,26,2d,45,aa,78,de,26,dc,ba,fc,f5,e8,45,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,9f,37,44,e6,2e,
d7,98,4c,2a,b7,cc,b5,b9,7f,41,e7,98,1a,a8,54,8d,2e,9a,09,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,d0,94,c2,b6,1e,
b1,ba,4c,6c,43,2d,1e,aa,22,2f,9c,e8,13,be,e2,f0,36,0f,9b,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1052)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\windows\ATKKBService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\System32\FTRTSVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\OProtSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\System32\snmp.exe
c:\windows\system32\SearchIndexer.exe
c:\progra~1\WANADOO\TaskBarIcon.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\progra~1\WANADOO\PollingModule.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\OFFICE ONE6.5\program\soffice.exe
c:\program files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
c:\windows\system32\ntvdm.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
J'étais trop fatigué et je me suis trompé donc j'ai refait l'opération avec le bloc notes et voici le rapport
Il me reste à gaire le glisser/déposer de CFScript sur https://searchengines.pl/ si j'y arrive car j'ai des difficultés à conserver la connexion (IE ne fonctionne pas mais Firefox de temps en temps)
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
.
**************************************************************************
.
Heure de fin: 2009-03-07 11:10:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-03-07 10:10:44
ComboFix4.txt 2009-03-07 00:50:56
ComboFix3.txt 2009-03-07 01:40:54
ComboFix5.txt 2009-03-07 09:59:10
ComboFix2.txt 2009-03-07 01:45:24
Avant-CF: 21 519 532 032 octets libres
Après-CF: 21,427,191,808 octets libres
364 --- E O F --- 2009-03-06 15:36:17
Ça a fonctionné.
---> Menu Démarrer > Exécuter > Tape combofix /u et valide.
- Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer).
- En bas à droite, clique sur Démarrer Online-scanner.
- Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte.
- Accepte les Contrôles ActiveX.
- Choisis Poste de travail pour le scan.
- Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport.
- Pour t'aider à utiliser le scan en ligne : Lien
Note : Si tu reçois le message La licence de Kaspersky On-line Scanner est périmée, va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.
---> Menu Démarrer > Exécuter > Tape combofix /u et valide.
- Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer).
- En bas à droite, clique sur Démarrer Online-scanner.
- Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte.
- Accepte les Contrôles ActiveX.
- Choisis Poste de travail pour le scan.
- Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport.
- Pour t'aider à utiliser le scan en ligne : Lien
Note : Si tu reçois le message La licence de Kaspersky On-line Scanner est périmée, va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.
Je ne sais pas si c'est important mais j'avais téléchargé IE8 il y a environ 2/3 semaines environ;
D'autre part, ACTIVA AntiVir a détecté un programme désagréable C:\System Volume Information\...A0088916.exe que j'ai mis en quarantaine par précaution...
D'autre part, ACTIVA AntiVir a détecté un programme désagréable C:\System Volume Information\...A0088916.exe que j'ai mis en quarantaine par précaution...
Pour ce soir, on en reste là, j'ai un truc à faire de mon côté.
Bonjour,
Pendant les 10 jours sans réponse, j'ai consulté les conseils pour le même Pb sur le forum mais j'avoue que c'est en vain et que j'ai vraiment besoin de l'aide d'un PRO...
J'utilise FIREFOX mais certainsoutils ou applications ne fonctionnent qu'avec IE
MERCI demeire ce que je dois faire STP ? Clôturer ce dossier sans que mon PB soit réglé et reposer la question sur le forum?
Je reste avec mon PB de non fonctionnement de IE:
WINDOWS XP Pack 3 – Navigateur FIREFOX -
J’ai commis l’erreur de désinstaller IE suite à certains PB mais impossible de le réinstaller, ni IE6 – Que faire ?
Adresse actuelle : https://www.msn.com/fr-fr/?ocid=iehp
Mes paramètres = http://runonce.msn.com/runonce3.aspx
Page par défaut = https://www.msn.com/fr-fr
https://outlook.live.com/owa/
Page vierge = about:blank
Aucun proxy
Je n'ai pas su faire ce que tu m'avais suggéré le 7 mars:
- car impossible de scanner avec Kapersky (aucune réaction du bouton "J'accepte" .
- Je n'ai pas réussi non plus à ajouter IE Tab de FIREFOX comme suggéré.
- Impossible de trouver "sfc scannuw"
- ni la clé "HKEY-CLASSES-ROOT-INTERFACE {34A715A0-6587-11D0-924A-0020AFC7AC4D}", ni winnt-32 /inattend
A + si vraiment tu as encore envie de m'aider et de relever le défi ou alors dis moi qui peut m'aider STP
Encore merci du temps passé à décontaminer mon ordi
L'homme se mesure face à l'obstacle"
Pendant les 10 jours sans réponse, j'ai consulté les conseils pour le même Pb sur le forum mais j'avoue que c'est en vain et que j'ai vraiment besoin de l'aide d'un PRO...
J'utilise FIREFOX mais certainsoutils ou applications ne fonctionnent qu'avec IE
MERCI demeire ce que je dois faire STP ? Clôturer ce dossier sans que mon PB soit réglé et reposer la question sur le forum?
Je reste avec mon PB de non fonctionnement de IE:
WINDOWS XP Pack 3 – Navigateur FIREFOX -
J’ai commis l’erreur de désinstaller IE suite à certains PB mais impossible de le réinstaller, ni IE6 – Que faire ?
Adresse actuelle : https://www.msn.com/fr-fr/?ocid=iehp
Mes paramètres = http://runonce.msn.com/runonce3.aspx
Page par défaut = https://www.msn.com/fr-fr
https://outlook.live.com/owa/
Page vierge = about:blank
Aucun proxy
Je n'ai pas su faire ce que tu m'avais suggéré le 7 mars:
- car impossible de scanner avec Kapersky (aucune réaction du bouton "J'accepte" .
- Je n'ai pas réussi non plus à ajouter IE Tab de FIREFOX comme suggéré.
- Impossible de trouver "sfc scannuw"
- ni la clé "HKEY-CLASSES-ROOT-INTERFACE {34A715A0-6587-11D0-924A-0020AFC7AC4D}", ni winnt-32 /inattend
A + si vraiment tu as encore envie de m'aider et de relever le défi ou alors dis moi qui peut m'aider STP
Encore merci du temps passé à décontaminer mon ordi
L'homme se mesure face à l'obstacle"
-->- Recherche:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
Point de restauration crée !
Fichiers temporaires nettoyés !
Corbeille vidée!
Sauvegarde du registre crée !