Problème à cause de web-média player
Résolu
fleuranne
Messages postés
190
Statut
Membre
-
Destrio5 Messages postés 99820 Statut Modérateur -
Destrio5 Messages postés 99820 Statut Modérateur -
Bonjour,
j'ai malencontreusement téléchargé web-media player et j'ai des problèmes à la suite de ceci.
quand je clique sur un lien , dans google, en bas, cela met getsearch330!!!
et au final, je ne tombe pas sur la page voulue mais sur une page avec cela écrit dessus
par exemple, si je veux aller sur facebook : voici ce qui s'écrit :
facebook
File Info: 94 Kb
File type: installer
DOWNLOAD
je ne peux ainsi plus aller sur les sites internet où j'ai l'habitude d'aller!
Pourriez vous m'aider à résoudre ce problèlme svp?
Bien cordialement
j'ai malencontreusement téléchargé web-media player et j'ai des problèmes à la suite de ceci.
quand je clique sur un lien , dans google, en bas, cela met getsearch330!!!
et au final, je ne tombe pas sur la page voulue mais sur une page avec cela écrit dessus
par exemple, si je veux aller sur facebook : voici ce qui s'écrit :
File Info: 94 Kb
File type: installer
DOWNLOAD
je ne peux ainsi plus aller sur les sites internet où j'ai l'habitude d'aller!
Pourriez vous m'aider à résoudre ce problèlme svp?
Bien cordialement
A voir également:
- Problème à cause de web-média player
- Windows media player - Télécharger - Lecture
- Web office - Guide
- Vlc media player - Télécharger - Lecture
- Media player classic - Télécharger - Lecture
- Adobe flash player - Télécharger - Divers Web & Internet
60 réponses
"je pense qu'il fallait décocher une case après avoir faire démarrer et excécuter..."
---> Il faut éviter cette méthode quand le PC est infecté.
---> Il faut éviter cette méthode quand le PC est infecté.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
voivi le rapport :
[b]SDFix: Version 1.240 [/b]
Run by Anne-Claire PICHARD on 13/04/2009 at 23:32
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Folder C:\microsoft - Removed
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 00:09:49
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"="C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe:*:Disabled:backWeb-8876480"
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe:*:Disabled:Network Diagnostic for Windows XP"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Free Download Manager\\fdm.exe"="C:\\Program Files\\Free Download Manager\\fdm.exe:*:Enabled:fdm"
"C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
"C:\\Program Files\\V-Gear BEE\\VBService.exe"="C:\\Program Files\\V-Gear BEE\\VBService.exe:*:Enabled:V-Gear Bee Service"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"="C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe"="C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe:*:Enabled:TmSunriseExtremeDemo"
"C:\\Program Files\\TmNationsForever\\TmForever.exe"="C:\\Program Files\\TmNationsForever\\TmForever.exe:*:Disabled:TmForever"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[b]Remaining Files [/b]:
[b]Files with Hidden Attributes [/b]:
Tue 30 Sep 2008 6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-K3VRF.tmp"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-R26I8.tmp"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Wed 29 Nov 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 13 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP262\A0081387.sys"
Wed 14 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP263\A0081400.sys"
Thu 15 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081424.sys"
Fri 16 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081433.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081441.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081458.sys"
Thu 22 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081467.sys"
Sat 24 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081498.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081525.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081556.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081565.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081595.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081615.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081639.sys"
Wed 28 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081660.sys"
Thu 29 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081691.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081698.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081724.sys"
Sat 31 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081732.sys"
Sun 1 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081756.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081764.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP268\A0081786.sys"
Tue 3 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081826.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081834.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081865.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081873.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP270\A0081939.sys"
Sat 7 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082022.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082082.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082091.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082110.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082114.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082166.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082170.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082174.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082218.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082227.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082235.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082255.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082263.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082321.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082326.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082353.sys"
Fri 13 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082363.sys"
Sun 15 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082399.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082408.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082431.sys"
Tue 17 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082469.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082513.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082548.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082555.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0083556.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083564.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083600.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083609.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083618.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083645.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083653.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083666.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083701.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084702.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084706.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084747.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084753.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084776.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084782.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084789.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084814.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084878.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084907.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084915.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084921.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085921.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085926.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085958.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085975.sys"
Sun 1 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086010.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086037.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086042.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086046.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086087.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086092.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086098.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086111.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086127.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086134.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086144.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086149.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086174.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086182.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086206.sys"
Fri 6 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0086220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087228.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087247.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087266.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087275.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087300.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP293\A0088300.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088337.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088373.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088395.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088404.sys"
Fri 13 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088411.sys"
Mon 16 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089412.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089433.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089477.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089492.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089526.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089576.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089606.sys"
Fri 20 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0090606.sys"
Sat 21 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0091607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092671.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092699.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092724.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092780.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092798.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092821.sys"
Thu 26 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093842.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093851.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093891.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093946.sys"
Sun 29 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP305\A0094018.sys"
Mon 30 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094096.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094115.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094123.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094135.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094161.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094180.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094190.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094210.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094217.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094238.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094246.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094254.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094269.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094295.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094321.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094348.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094356.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094365.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094378.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094407.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094415.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094445.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094453.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094480.sys"
Fri 10 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094500.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094515.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094541.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094591.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094882.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094898.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094926.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094966.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094974.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094992.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095008.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095033.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095041.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095051.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095055.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095064.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095068.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095072.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095079.sys"
Sun 6 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 14 Apr 2009 72 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Application Data\U3\temp\Launchpad Removal.exe"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL0919.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1260.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1702.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL3403.tmp"
Mon 28 Jan 2008 22,528 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\IMPORTANT DOSSIER CLE USB CRUZER 1 GO\acp perso\ENTRETIEN RMTT 31 janv\~WRL0001.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Sun 8 Apr 2007 21,504 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL0003.tmp"
Thu 3 May 2007 38,912 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL1864.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
[b]Finished![/b]
nous verrons la suite mardi soir
merci
[b]SDFix: Version 1.240 [/b]
Run by Anne-Claire PICHARD on 13/04/2009 at 23:32
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Folder C:\microsoft - Removed
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 00:09:49
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"="C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe:*:Disabled:backWeb-8876480"
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe:*:Disabled:Network Diagnostic for Windows XP"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Free Download Manager\\fdm.exe"="C:\\Program Files\\Free Download Manager\\fdm.exe:*:Enabled:fdm"
"C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
"C:\\Program Files\\V-Gear BEE\\VBService.exe"="C:\\Program Files\\V-Gear BEE\\VBService.exe:*:Enabled:V-Gear Bee Service"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"="C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe"="C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe:*:Enabled:TmSunriseExtremeDemo"
"C:\\Program Files\\TmNationsForever\\TmForever.exe"="C:\\Program Files\\TmNationsForever\\TmForever.exe:*:Disabled:TmForever"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[b]Remaining Files [/b]:
[b]Files with Hidden Attributes [/b]:
Tue 30 Sep 2008 6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-K3VRF.tmp"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-R26I8.tmp"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Wed 29 Nov 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 13 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP262\A0081387.sys"
Wed 14 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP263\A0081400.sys"
Thu 15 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081424.sys"
Fri 16 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081433.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081441.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081458.sys"
Thu 22 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081467.sys"
Sat 24 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081498.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081525.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081556.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081565.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081595.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081615.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081639.sys"
Wed 28 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081660.sys"
Thu 29 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081691.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081698.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081724.sys"
Sat 31 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081732.sys"
Sun 1 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081756.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081764.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP268\A0081786.sys"
Tue 3 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081826.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081834.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081865.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081873.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP270\A0081939.sys"
Sat 7 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082022.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082082.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082091.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082110.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082114.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082166.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082170.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082174.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082218.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082227.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082235.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082255.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082263.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082321.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082326.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082353.sys"
Fri 13 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082363.sys"
Sun 15 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082399.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082408.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082431.sys"
Tue 17 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082469.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082513.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082548.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082555.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0083556.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083564.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083600.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083609.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083618.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083645.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083653.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083666.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083701.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084702.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084706.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084747.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084753.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084776.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084782.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084789.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084814.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084878.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084907.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084915.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084921.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085921.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085926.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085958.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085975.sys"
Sun 1 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086010.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086037.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086042.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086046.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086087.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086092.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086098.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086111.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086127.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086134.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086144.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086149.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086174.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086182.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086206.sys"
Fri 6 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0086220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087228.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087247.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087266.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087275.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087300.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP293\A0088300.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088337.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088373.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088395.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088404.sys"
Fri 13 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088411.sys"
Mon 16 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089412.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089433.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089477.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089492.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089526.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089576.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089606.sys"
Fri 20 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0090606.sys"
Sat 21 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0091607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092671.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092699.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092724.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092780.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092798.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092821.sys"
Thu 26 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093842.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093851.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093891.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093946.sys"
Sun 29 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP305\A0094018.sys"
Mon 30 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094096.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094115.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094123.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094135.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094161.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094180.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094190.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094210.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094217.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094238.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094246.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094254.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094269.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094295.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094321.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094348.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094356.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094365.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094378.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094407.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094415.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094445.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094453.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094480.sys"
Fri 10 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094500.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094515.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094541.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094591.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094882.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094898.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094926.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094966.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094974.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094992.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095008.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095033.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095041.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095051.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095055.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095064.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095068.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095072.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095079.sys"
Sun 6 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 14 Apr 2009 72 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Application Data\U3\temp\Launchpad Removal.exe"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL0919.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1260.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1702.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL3403.tmp"
Mon 28 Jan 2008 22,528 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\IMPORTANT DOSSIER CLE USB CRUZER 1 GO\acp perso\ENTRETIEN RMTT 31 janv\~WRL0001.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Sun 8 Apr 2007 21,504 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL0003.tmp"
Thu 3 May 2007 38,912 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL1864.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
[b]Finished![/b]
nous verrons la suite mardi soir
merci
"c'est un cable qu'on relie de l'ordi portable au modem ?"
---> Oui.
"cable usb des 2 côtés donc..."
---> Je ne vois pas le rapport avec le câble ethernet.
---> Oui.
"cable usb des 2 côtés donc..."
---> Je ne vois pas le rapport avec le câble ethernet.
/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
j'ai pas installer la console de récupération je crois car, c'était écrit qu'il fallait avoir internet.
voici le rapport :
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04:14.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\nfr.assembly
C:\WINDOWS\system32\nfr.gpref
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07:41 . 2009-04-12 07:07:41 1 ---h--w C:\WINDOWS\f23567.dat
2009-03-21 17:17:40 . 2009-03-21 17:18:56 0 d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16:05 . 2007-07-19 14:43:05 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26:26 . 2009-02-01 17:04:17 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24:37 . 2007-05-12 19:15:53 0 d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2009-04-13 17:39:45 . 2008-12-23 13:44:17 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-04-13 15:28:22 . 2009-04-13 15:27:54 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02:47 . 2008-12-24 15:57:46 0 d-----w C:\Program Files\trend micro
2009-04-13 10:58:53 . 2009-04-12 17:16:10 0 d-----w C:\Program Files\Navilog1
2009-04-13 10:48:09 . 2009-04-13 10:43:35 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33:10 . 2009-04-12 17:18:50 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34:37 . 2006-12-23 14:00:53 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34:37 . 2006-12-23 14:00:53 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32:54 . 2008-12-23 13:44:19 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32:46 . 2008-12-23 13:44:22 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-03-30 16:47:13 . 2006-09-15 12:24:46 78346 ----a-w C:\WINDOWS\system32\perfc00C.dat
2009-03-30 16:47:13 . 2006-09-15 12:24:46 476522 ----a-w C:\WINDOWS\system32\perfh00C.dat
2009-03-21 17:19:22 . 2008-11-23 21:30:56 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34:24 . 2006-09-27 05:20:57 0 d-----w C:\Program Files\Microsoft Works
2009-03-11 09:27:30 . 2006-12-11 21:20:26 0 d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36:00 . 2008-04-07 18:52:26 0 d-----w C:\Program Files\Microsoft Silverlight
2009-02-25 17:10:32 . 2008-10-25 14:18:54 0 d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2009-02-09 14:05:54 . 2006-09-15 12:24:19 1846912 ----a-w C:\WINDOWS\system32\win32k.sys
2009-02-01 15:18:44 . 2007-02-11 00:39:36 83528 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49:25 . 2006-12-02 16:37:21 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49:25 . 2006-12-02 16:37:21 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19:46 . 2006-11-27 21:31:36 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19:45 . 2006-11-27 21:31:36 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34:34 . 2007-11-05 06:54:05 83528 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40:39 . 2006-09-18 12:02:30 83528 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40:57 . 2008-10-22 15:40:57 82752 ----a-w C:\Documents and Settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43:19 . 2007-11-05 06:54:05 129 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21:24 . 2008-01-05 17:21:36 774144 ----a-w C:\Program Files\RngInterstitial.dll
2007-10-22 21:13:51 . 2006-11-25 18:42:31 3840 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21:42 . 2007-05-24 20:20:06 175768 ---ha-w C:\Program Files\Maestria.GID
2007-02-18 15:24:01 . 2007-02-18 15:23:59 288129 ------w C:\Program Files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46:08 . 2006-11-25 16:20:44 142 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07:51 . 2006-11-25 16:20:44 19744 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49:31 . 2006-09-15 12:49:31 137 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27:20 . 2007-02-05 21:39:41 212992 ----a-w C:\Program Files\Columep100040c.dll
2003-12-05 11:22:28 . 2007-02-05 21:39:41 10338304 ----a-w C:\Program Files\GecoMaes.exe
2003-12-05 09:19:32 . 2007-02-05 21:38:21 176128 ----a-w C:\Program Files\MA30mep100040C.dll
2003-12-05 09:19:30 . 2007-02-05 21:38:22 8589312 ----a-w C:\Program Files\Maestria.exe
2002-09-19 12:52:28 . 2007-02-05 21:38:24 55102 ----a-w C:\Program Files\Maestria.cnt
2002-09-17 16:29:44 . 2007-02-05 21:39:45 6724632 ----a-w C:\Program Files\GecoMaes.hlp
2002-09-17 16:29:10 . 2007-02-05 21:39:45 93983 ----a-w C:\Program Files\GecoMaes.cnt
2002-09-11 15:49:56 . 2007-02-05 21:38:24 5093084 ----a-w C:\Program Files\Maestria.hlp
2001-04-19 15:45:44 . 2007-02-05 21:39:43 688128 ----a-w C:\Program Files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01:52 34816 ----a-w C:\Program Files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02:00 73728 ----a-w C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33:59 15360]
"Free Uploader Oe Integration"="C:\Program Files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 18:02:38 40960]
"PanelApp"="C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 22:04:58 31232]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-12-31 14:29:04 962560]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 10:55:02 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 02:34:13 1695232]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-11-18 15:31:04 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25:42 6731312]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 20:04:00 7557120]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-28 12:35:40 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 23:40:34 185872]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 23:10:54 29744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 12:28:40 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-27 00:01:53 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:33:59 15360]
C:\Documents and Settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - C:\Program Files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 11:11:14 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 02:33:48 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=C:\WINDOWS\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=C:\WINDOWS\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49:20 49152 ----a-w C:\Program Files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49:22 282624 ----a-w C:\Program Files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33:59 15360 ----a-w C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20:00 122940 ----a-w C:\WINDOWS\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10:54 29744 ----a-w C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32:44 696320 ----a-w C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38:30 802816 ----a-w C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37:43 190024 ----a-w C:\Program Files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15:58 749568 ----a-w C:\Program Files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01:58 28739 ----a-w C:\Program Files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34:13 1695232 ----a-w C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35:40 98304 ----a-w C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24:50 118784 ----a-w C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47:12 356352 ----a-w C:\Program Files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40:34 185872 ----a-w C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08:00 65536 ----a-w C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11:38 73728 ----a-w C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59:18 24576 ----a-w C:\Program Files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09:12 266240 ----a-w C:\WINDOWS\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\V-Gear BEE\\VBService.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 23:10:54 29744]
R3 PanelSvc;PanelSvc;C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 13:42:18 77312]
S3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 08:45:16 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:49:26 . 2009-03-24 08:49:28]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~C:\Program Files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: C:\Program Files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: C:\Program Files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: C:\Program Files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Picasa2\npPicasa2.dll
FF - plugin: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
voici le rapport :
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04:14.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\nfr.assembly
C:\WINDOWS\system32\nfr.gpref
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07:41 . 2009-04-12 07:07:41 1 ---h--w C:\WINDOWS\f23567.dat
2009-03-21 17:17:40 . 2009-03-21 17:18:56 0 d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16:05 . 2007-07-19 14:43:05 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26:26 . 2009-02-01 17:04:17 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24:37 . 2007-05-12 19:15:53 0 d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2009-04-13 17:39:45 . 2008-12-23 13:44:17 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-04-13 15:28:22 . 2009-04-13 15:27:54 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02:47 . 2008-12-24 15:57:46 0 d-----w C:\Program Files\trend micro
2009-04-13 10:58:53 . 2009-04-12 17:16:10 0 d-----w C:\Program Files\Navilog1
2009-04-13 10:48:09 . 2009-04-13 10:43:35 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33:10 . 2009-04-12 17:18:50 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34:37 . 2006-12-23 14:00:53 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34:37 . 2006-12-23 14:00:53 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32:54 . 2008-12-23 13:44:19 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32:46 . 2008-12-23 13:44:22 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-03-30 16:47:13 . 2006-09-15 12:24:46 78346 ----a-w C:\WINDOWS\system32\perfc00C.dat
2009-03-30 16:47:13 . 2006-09-15 12:24:46 476522 ----a-w C:\WINDOWS\system32\perfh00C.dat
2009-03-21 17:19:22 . 2008-11-23 21:30:56 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34:24 . 2006-09-27 05:20:57 0 d-----w C:\Program Files\Microsoft Works
2009-03-11 09:27:30 . 2006-12-11 21:20:26 0 d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36:00 . 2008-04-07 18:52:26 0 d-----w C:\Program Files\Microsoft Silverlight
2009-02-25 17:10:32 . 2008-10-25 14:18:54 0 d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2009-02-09 14:05:54 . 2006-09-15 12:24:19 1846912 ----a-w C:\WINDOWS\system32\win32k.sys
2009-02-01 15:18:44 . 2007-02-11 00:39:36 83528 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49:25 . 2006-12-02 16:37:21 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49:25 . 2006-12-02 16:37:21 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19:46 . 2006-11-27 21:31:36 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19:45 . 2006-11-27 21:31:36 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34:34 . 2007-11-05 06:54:05 83528 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40:39 . 2006-09-18 12:02:30 83528 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40:57 . 2008-10-22 15:40:57 82752 ----a-w C:\Documents and Settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43:19 . 2007-11-05 06:54:05 129 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21:24 . 2008-01-05 17:21:36 774144 ----a-w C:\Program Files\RngInterstitial.dll
2007-10-22 21:13:51 . 2006-11-25 18:42:31 3840 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21:42 . 2007-05-24 20:20:06 175768 ---ha-w C:\Program Files\Maestria.GID
2007-02-18 15:24:01 . 2007-02-18 15:23:59 288129 ------w C:\Program Files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46:08 . 2006-11-25 16:20:44 142 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07:51 . 2006-11-25 16:20:44 19744 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49:31 . 2006-09-15 12:49:31 137 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27:20 . 2007-02-05 21:39:41 212992 ----a-w C:\Program Files\Columep100040c.dll
2003-12-05 11:22:28 . 2007-02-05 21:39:41 10338304 ----a-w C:\Program Files\GecoMaes.exe
2003-12-05 09:19:32 . 2007-02-05 21:38:21 176128 ----a-w C:\Program Files\MA30mep100040C.dll
2003-12-05 09:19:30 . 2007-02-05 21:38:22 8589312 ----a-w C:\Program Files\Maestria.exe
2002-09-19 12:52:28 . 2007-02-05 21:38:24 55102 ----a-w C:\Program Files\Maestria.cnt
2002-09-17 16:29:44 . 2007-02-05 21:39:45 6724632 ----a-w C:\Program Files\GecoMaes.hlp
2002-09-17 16:29:10 . 2007-02-05 21:39:45 93983 ----a-w C:\Program Files\GecoMaes.cnt
2002-09-11 15:49:56 . 2007-02-05 21:38:24 5093084 ----a-w C:\Program Files\Maestria.hlp
2001-04-19 15:45:44 . 2007-02-05 21:39:43 688128 ----a-w C:\Program Files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01:52 34816 ----a-w C:\Program Files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02:00 73728 ----a-w C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33:59 15360]
"Free Uploader Oe Integration"="C:\Program Files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 18:02:38 40960]
"PanelApp"="C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 22:04:58 31232]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-12-31 14:29:04 962560]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 10:55:02 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 02:34:13 1695232]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-11-18 15:31:04 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25:42 6731312]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 20:04:00 7557120]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-28 12:35:40 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 23:40:34 185872]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 23:10:54 29744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 12:28:40 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-27 00:01:53 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:33:59 15360]
C:\Documents and Settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - C:\Program Files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 11:11:14 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 02:33:48 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=C:\WINDOWS\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=C:\WINDOWS\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49:20 49152 ----a-w C:\Program Files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49:22 282624 ----a-w C:\Program Files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33:59 15360 ----a-w C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20:00 122940 ----a-w C:\WINDOWS\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10:54 29744 ----a-w C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32:44 696320 ----a-w C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38:30 802816 ----a-w C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37:43 190024 ----a-w C:\Program Files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15:58 749568 ----a-w C:\Program Files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01:58 28739 ----a-w C:\Program Files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34:13 1695232 ----a-w C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35:40 98304 ----a-w C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24:50 118784 ----a-w C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47:12 356352 ----a-w C:\Program Files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40:34 185872 ----a-w C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08:00 65536 ----a-w C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11:38 73728 ----a-w C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59:18 24576 ----a-w C:\Program Files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09:12 266240 ----a-w C:\WINDOWS\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\V-Gear BEE\\VBService.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 23:10:54 29744]
R3 PanelSvc;PanelSvc;C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 13:42:18 77312]
S3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 08:45:16 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:49:26 . 2009-03-24 08:49:28]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~C:\Program Files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: C:\Program Files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: C:\Program Files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: C:\Program Files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Picasa2\npPicasa2.dll
FF - plugin: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
voici le rapport log :
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
c:\windows\system32\o4Patch.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07 . 2009-04-12 07:07 1 ---h--w c:\windows\f23567.dat
2009-03-21 17:17 . 2009-03-21 17:18 -------- d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16 . 2007-07-19 14:43 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26 . 2009-02-01 17:04 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24 . 2007-05-12 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-13 17:39 . 2008-12-23 13:44 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-13 15:28 . 2009-04-13 15:27 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02 . 2008-12-24 15:57 -------- d-----w c:\program files\trend micro
2009-04-13 10:58 . 2009-04-12 17:16 -------- d-----w c:\program files\Navilog1
2009-04-13 10:48 . 2009-04-13 10:43 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33 . 2009-04-12 17:18 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34 . 2006-12-23 14:00 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34 . 2006-12-23 14:00 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32 . 2008-12-23 13:44 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-12-23 13:44 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-30 16:47 . 2006-09-15 12:24 78346 ----a-w c:\windows\system32\perfc00C.dat
2009-03-30 16:47 . 2006-09-15 12:24 476522 ----a-w c:\windows\system32\perfh00C.dat
2009-03-21 17:19 . 2008-11-23 21:30 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34 . 2006-09-27 05:20 -------- d-----w c:\program files\Microsoft Works
2009-03-11 09:27 . 2006-12-11 21:20 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36 . 2008-04-07 18:52 -------- d-----w c:\program files\Microsoft Silverlight
2009-02-25 17:10 . 2008-10-25 14:18 -------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
2009-02-09 14:05 . 2006-09-15 12:24 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-01 15:18 . 2007-02-11 00:39 83528 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49 . 2006-12-02 16:37 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49 . 2006-12-02 16:37 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19 . 2006-11-27 21:31 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19 . 2006-11-27 21:31 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34 . 2007-11-05 06:54 83528 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40 . 2006-09-18 12:02 83528 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40 . 2008-10-22 15:40 82752 ----a-w c:\documents and settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43 . 2007-11-05 06:54 129 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21 . 2008-01-05 17:21 774144 ----a-w c:\program files\RngInterstitial.dll
2007-10-22 21:13 . 2006-11-25 18:42 3840 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21 . 2007-05-24 20:20 175768 ---ha-w c:\program files\Maestria.GID
2007-02-18 15:24 . 2007-02-18 15:23 288129 ------w c:\program files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46 . 2006-11-25 16:20 142 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07 . 2006-11-25 16:20 19744 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49 . 2006-09-15 12:49 137 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27 . 2007-02-05 21:39 212992 ----a-w c:\program files\Columep100040c.dll
2003-12-05 11:22 . 2007-02-05 21:39 10338304 ----a-w c:\program files\GecoMaes.exe
2003-12-05 09:19 . 2007-02-05 21:38 176128 ----a-w c:\program files\MA30mep100040C.dll
2003-12-05 09:19 . 2007-02-05 21:38 8589312 ----a-w c:\program files\Maestria.exe
2002-09-19 12:52 . 2007-02-05 21:38 55102 ----a-w c:\program files\Maestria.cnt
2002-09-17 16:29 . 2007-02-05 21:39 6724632 ----a-w c:\program files\GecoMaes.hlp
2002-09-17 16:29 . 2007-02-05 21:39 93983 ----a-w c:\program files\GecoMaes.cnt
2002-09-11 15:49 . 2007-02-05 21:38 5093084 ----a-w c:\program files\Maestria.hlp
2001-04-19 15:45 . 2007-02-05 21:39 688128 ----a-w c:\program files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01 34816 ----a-w c:\program files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02 73728 ----a-w c:\program files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Free Uploader Oe Integration"="c:\program files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 40960]
"PanelApp"="c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 31232]
"ares"="c:\program files\Ares\Ares.exe" [2007-12-31 962560]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-01 7557120]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-05-28 98304]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 185872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 29744]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - c:\program files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - c:\program files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - c:\windows\system32\upnpui.dll [2008-04-14 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/ustera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49 49152 ----a-w c:\program files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49 282624 ----a-w c:\program files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33 15360 ----a-w c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20 122940 ----a-w c:\windows\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10 29744 ----a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32 696320 ----a-w c:\program files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38 802816 ----a-w c:\program files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37 190024 ----a-w c:\program files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15 749568 ----a-w c:\program files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01 28739 ----a-w c:\program files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35 98304 ----a-w c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24 118784 ----a-w c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47 356352 ----a-w c:\program files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40 185872 ----a-w c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08 65536 ----a-w c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11 73728 ----a-w c:\program files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59 24576 ----a-w c:\program files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09 266240 ----a-w c:\windows\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\V-Gear BEE\\VBService.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 29744]
R3 PanelSvc;PanelSvc;c:\program files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 77312]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2005-11-28 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 08:49]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - c:\documents and settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 23:16
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1344)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3632)
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\pahelper_1100.2009.0210.1225.dll
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_1100.2009.0210.1225.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
c:\program files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
c:\progra~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
c:\progra~1\SPYBOT~1\SDHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Toshiba\ConfigFree\CFSvcs.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
c:\program files\Common Files\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Heure de fin: ~,10time:~,-3machine was rebootedCombobatch-by
ComboFix-quarantined-files.txt 2009-04-14 21:21
Avant-CF: 13 640 372 224 octets libres
Après-CF: 14 815 244 288 octets libres
308 --- E O F --- 2009-03-13 00:04
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
c:\windows\system32\o4Patch.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07 . 2009-04-12 07:07 1 ---h--w c:\windows\f23567.dat
2009-03-21 17:17 . 2009-03-21 17:18 -------- d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16 . 2007-07-19 14:43 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26 . 2009-02-01 17:04 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24 . 2007-05-12 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-13 17:39 . 2008-12-23 13:44 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-13 15:28 . 2009-04-13 15:27 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02 . 2008-12-24 15:57 -------- d-----w c:\program files\trend micro
2009-04-13 10:58 . 2009-04-12 17:16 -------- d-----w c:\program files\Navilog1
2009-04-13 10:48 . 2009-04-13 10:43 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33 . 2009-04-12 17:18 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34 . 2006-12-23 14:00 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34 . 2006-12-23 14:00 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32 . 2008-12-23 13:44 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-12-23 13:44 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-30 16:47 . 2006-09-15 12:24 78346 ----a-w c:\windows\system32\perfc00C.dat
2009-03-30 16:47 . 2006-09-15 12:24 476522 ----a-w c:\windows\system32\perfh00C.dat
2009-03-21 17:19 . 2008-11-23 21:30 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34 . 2006-09-27 05:20 -------- d-----w c:\program files\Microsoft Works
2009-03-11 09:27 . 2006-12-11 21:20 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36 . 2008-04-07 18:52 -------- d-----w c:\program files\Microsoft Silverlight
2009-02-25 17:10 . 2008-10-25 14:18 -------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
2009-02-09 14:05 . 2006-09-15 12:24 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-01 15:18 . 2007-02-11 00:39 83528 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49 . 2006-12-02 16:37 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49 . 2006-12-02 16:37 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19 . 2006-11-27 21:31 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19 . 2006-11-27 21:31 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34 . 2007-11-05 06:54 83528 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40 . 2006-09-18 12:02 83528 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40 . 2008-10-22 15:40 82752 ----a-w c:\documents and settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43 . 2007-11-05 06:54 129 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21 . 2008-01-05 17:21 774144 ----a-w c:\program files\RngInterstitial.dll
2007-10-22 21:13 . 2006-11-25 18:42 3840 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21 . 2007-05-24 20:20 175768 ---ha-w c:\program files\Maestria.GID
2007-02-18 15:24 . 2007-02-18 15:23 288129 ------w c:\program files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46 . 2006-11-25 16:20 142 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07 . 2006-11-25 16:20 19744 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49 . 2006-09-15 12:49 137 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27 . 2007-02-05 21:39 212992 ----a-w c:\program files\Columep100040c.dll
2003-12-05 11:22 . 2007-02-05 21:39 10338304 ----a-w c:\program files\GecoMaes.exe
2003-12-05 09:19 . 2007-02-05 21:38 176128 ----a-w c:\program files\MA30mep100040C.dll
2003-12-05 09:19 . 2007-02-05 21:38 8589312 ----a-w c:\program files\Maestria.exe
2002-09-19 12:52 . 2007-02-05 21:38 55102 ----a-w c:\program files\Maestria.cnt
2002-09-17 16:29 . 2007-02-05 21:39 6724632 ----a-w c:\program files\GecoMaes.hlp
2002-09-17 16:29 . 2007-02-05 21:39 93983 ----a-w c:\program files\GecoMaes.cnt
2002-09-11 15:49 . 2007-02-05 21:38 5093084 ----a-w c:\program files\Maestria.hlp
2001-04-19 15:45 . 2007-02-05 21:39 688128 ----a-w c:\program files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01 34816 ----a-w c:\program files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02 73728 ----a-w c:\program files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Free Uploader Oe Integration"="c:\program files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 40960]
"PanelApp"="c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 31232]
"ares"="c:\program files\Ares\Ares.exe" [2007-12-31 962560]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-01 7557120]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-05-28 98304]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 185872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 29744]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - c:\program files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - c:\program files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - c:\windows\system32\upnpui.dll [2008-04-14 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/ustera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49 49152 ----a-w c:\program files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49 282624 ----a-w c:\program files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33 15360 ----a-w c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20 122940 ----a-w c:\windows\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10 29744 ----a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32 696320 ----a-w c:\program files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38 802816 ----a-w c:\program files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37 190024 ----a-w c:\program files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15 749568 ----a-w c:\program files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01 28739 ----a-w c:\program files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35 98304 ----a-w c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24 118784 ----a-w c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47 356352 ----a-w c:\program files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40 185872 ----a-w c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08 65536 ----a-w c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11 73728 ----a-w c:\program files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59 24576 ----a-w c:\program files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09 266240 ----a-w c:\windows\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\V-Gear BEE\\VBService.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 29744]
R3 PanelSvc;PanelSvc;c:\program files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 77312]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2005-11-28 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 08:49]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - c:\documents and settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 23:16
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1344)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3632)
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\pahelper_1100.2009.0210.1225.dll
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_1100.2009.0210.1225.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
c:\program files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
c:\progra~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
c:\progra~1\SPYBOT~1\SDHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Toshiba\ConfigFree\CFSvcs.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
c:\program files\Common Files\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Heure de fin: ~,10time:~,-3machine was rebootedCombobatch-by
ComboFix-quarantined-files.txt 2009-04-14 21:21
Avant-CF: 13 640 372 224 octets libres
Après-CF: 14 815 244 288 octets libres
308 --- E O F --- 2009-03-13 00:04
Oui, tu peux faire une restauration système.
Menu Démarrer > Tous les programmes > Accessoires > Outils système > Restauration système
Menu Démarrer > Tous les programmes > Accessoires > Outils système > Restauration système
On va vérifier.
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
voici le rapport log :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Anne-Claire PICHARD at 2009-04-16 23:11:13
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 13 GB (18%) free of 76 GB
Total RAM: 1022 MB (25% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:34, on 16/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\V-Gear BEE\VBService.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Anne-Claire PICHARD\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Anne-Claire PICHARD.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MEDIADICO Familial - {CEDDA62B-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\MEDIADICO\MDToolbar\MdToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKCU\..\Run: [PanelApp] C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BEE Service.lnk = C:\Program Files\V-Gear BEE\VBService.exe
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://dida.univ-tln.fr/qp2.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://zylom.midasplayer.com/ctl/kingcomie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} (NMInstall Control) - http://a14.g.akamai.net/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://msnfr.oberon-media.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PanelSvc - Unknown owner - C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by Anne-Claire PICHARD at 2009-04-16 23:11:13
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 13 GB (18%) free of 76 GB
Total RAM: 1022 MB (25% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:34, on 16/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\V-Gear BEE\VBService.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Anne-Claire PICHARD\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Anne-Claire PICHARD.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MEDIADICO Familial - {CEDDA62B-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\MEDIADICO\MDToolbar\MdToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKCU\..\Run: [PanelApp] C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BEE Service.lnk = C:\Program Files\V-Gear BEE\VBService.exe
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://dida.univ-tln.fr/qp2.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://zylom.midasplayer.com/ctl/kingcomie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} (NMInstall Control) - http://a14.g.akamai.net/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://msnfr.oberon-media.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PanelSvc - Unknown owner - C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
en ce qui concerne le rapport info, je ne le trouve pas! il n'est pas dans le dossier RSIT dans le disque dur
---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
voici le rapport MBAM :
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1991
Windows 5.1.2600 Service Pack 3
17/04/2009 00:08:37
mbam-log-2009-04-17 (00-08-37).txt
Type de recherche: Examen rapide
Eléments examinés: 93357
Temps écoulé: 13 minute(s), 11 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\9g2234wesdf3dfgjf23 (Trojan.KoobFace) -> Quarantined and deleted successfully.
bonne nuit.
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1991
Windows 5.1.2600 Service Pack 3
17/04/2009 00:08:37
mbam-log-2009-04-17 (00-08-37).txt
Type de recherche: Examen rapide
Eléments examinés: 93357
Temps écoulé: 13 minute(s), 11 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\9g2234wesdf3dfgjf23 (Trojan.KoobFace) -> Quarantined and deleted successfully.
bonne nuit.
comme F5 et F8 ne marche pas, je fait comment?
HDD
FDD
CD/DVD
LAN
MEMOIRE USB