Problème à cause de web-média player - Page 2
Résolu
Précédent
- 1
- 2
- 3
Suivant
"je pense qu'il fallait décocher une case après avoir faire démarrer et excécuter..."
---> Il faut éviter cette méthode quand le PC est infecté.
---> Il faut éviter cette méthode quand le PC est infecté.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
voivi le rapport :
[b]SDFix: Version 1.240 [/b]
Run by Anne-Claire PICHARD on 13/04/2009 at 23:32
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Folder C:\microsoft - Removed
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 00:09:49
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"="C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe:*:Disabled:backWeb-8876480"
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe:*:Disabled:Network Diagnostic for Windows XP"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Free Download Manager\\fdm.exe"="C:\\Program Files\\Free Download Manager\\fdm.exe:*:Enabled:fdm"
"C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
"C:\\Program Files\\V-Gear BEE\\VBService.exe"="C:\\Program Files\\V-Gear BEE\\VBService.exe:*:Enabled:V-Gear Bee Service"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"="C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe"="C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe:*:Enabled:TmSunriseExtremeDemo"
"C:\\Program Files\\TmNationsForever\\TmForever.exe"="C:\\Program Files\\TmNationsForever\\TmForever.exe:*:Disabled:TmForever"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[b]Remaining Files [/b]:
[b]Files with Hidden Attributes [/b]:
Tue 30 Sep 2008 6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-K3VRF.tmp"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-R26I8.tmp"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Wed 29 Nov 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 13 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP262\A0081387.sys"
Wed 14 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP263\A0081400.sys"
Thu 15 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081424.sys"
Fri 16 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081433.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081441.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081458.sys"
Thu 22 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081467.sys"
Sat 24 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081498.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081525.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081556.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081565.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081595.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081615.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081639.sys"
Wed 28 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081660.sys"
Thu 29 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081691.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081698.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081724.sys"
Sat 31 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081732.sys"
Sun 1 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081756.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081764.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP268\A0081786.sys"
Tue 3 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081826.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081834.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081865.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081873.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP270\A0081939.sys"
Sat 7 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082022.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082082.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082091.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082110.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082114.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082166.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082170.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082174.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082218.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082227.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082235.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082255.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082263.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082321.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082326.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082353.sys"
Fri 13 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082363.sys"
Sun 15 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082399.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082408.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082431.sys"
Tue 17 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082469.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082513.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082548.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082555.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0083556.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083564.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083600.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083609.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083618.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083645.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083653.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083666.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083701.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084702.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084706.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084747.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084753.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084776.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084782.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084789.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084814.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084878.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084907.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084915.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084921.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085921.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085926.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085958.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085975.sys"
Sun 1 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086010.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086037.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086042.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086046.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086087.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086092.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086098.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086111.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086127.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086134.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086144.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086149.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086174.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086182.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086206.sys"
Fri 6 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0086220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087228.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087247.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087266.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087275.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087300.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP293\A0088300.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088337.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088373.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088395.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088404.sys"
Fri 13 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088411.sys"
Mon 16 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089412.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089433.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089477.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089492.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089526.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089576.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089606.sys"
Fri 20 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0090606.sys"
Sat 21 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0091607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092671.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092699.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092724.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092780.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092798.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092821.sys"
Thu 26 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093842.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093851.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093891.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093946.sys"
Sun 29 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP305\A0094018.sys"
Mon 30 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094096.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094115.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094123.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094135.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094161.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094180.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094190.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094210.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094217.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094238.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094246.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094254.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094269.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094295.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094321.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094348.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094356.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094365.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094378.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094407.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094415.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094445.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094453.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094480.sys"
Fri 10 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094500.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094515.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094541.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094591.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094882.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094898.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094926.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094966.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094974.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094992.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095008.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095033.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095041.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095051.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095055.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095064.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095068.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095072.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095079.sys"
Sun 6 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 14 Apr 2009 72 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Application Data\U3\temp\Launchpad Removal.exe"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL0919.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1260.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1702.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL3403.tmp"
Mon 28 Jan 2008 22,528 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\IMPORTANT DOSSIER CLE USB CRUZER 1 GO\acp perso\ENTRETIEN RMTT 31 janv\~WRL0001.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Sun 8 Apr 2007 21,504 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL0003.tmp"
Thu 3 May 2007 38,912 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL1864.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
[b]Finished![/b]
nous verrons la suite mardi soir
merci
[b]SDFix: Version 1.240 [/b]
Run by Anne-Claire PICHARD on 13/04/2009 at 23:32
Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Folder C:\microsoft - Removed
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 00:09:49
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"="C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe:*:Disabled:backWeb-8876480"
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe:*:Disabled:Network Diagnostic for Windows XP"
"C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Program Files\\Free Download Manager\\fdm.exe"="C:\\Program Files\\Free Download Manager\\fdm.exe:*:Enabled:fdm"
"C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
"C:\\Program Files\\V-Gear BEE\\VBService.exe"="C:\\Program Files\\V-Gear BEE\\VBService.exe:*:Enabled:V-Gear Bee Service"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"="C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe"="C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe:*:Enabled:TmSunriseExtremeDemo"
"C:\\Program Files\\TmNationsForever\\TmForever.exe"="C:\\Program Files\\TmNationsForever\\TmForever.exe:*:Disabled:TmForever"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[b]Remaining Files [/b]:
[b]Files with Hidden Attributes [/b]:
Tue 30 Sep 2008 6,108,728 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-K3VRF.tmp"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\is-R26I8.tmp"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Wed 29 Nov 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 13 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP262\A0081387.sys"
Wed 14 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP263\A0081400.sys"
Thu 15 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081424.sys"
Fri 16 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081433.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081441.sys"
Sat 17 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081458.sys"
Thu 22 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081467.sys"
Sat 24 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP264\A0081498.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081525.sys"
Sun 25 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081556.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081565.sys"
Mon 26 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081595.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081615.sys"
Tue 27 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP265\A0081639.sys"
Wed 28 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081660.sys"
Thu 29 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081691.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081698.sys"
Fri 30 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP266\A0081724.sys"
Sat 31 Jan 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081732.sys"
Sun 1 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081756.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP267\A0081764.sys"
Mon 2 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP268\A0081786.sys"
Tue 3 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081826.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081834.sys"
Wed 4 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081865.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP269\A0081873.sys"
Thu 5 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP270\A0081939.sys"
Sat 7 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082022.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082082.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082091.sys"
Sun 8 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP272\A0082110.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082114.sys"
Mon 9 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP273\A0082166.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082170.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082174.sys"
Tue 10 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP274\A0082218.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082227.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082235.sys"
Wed 11 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082255.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP275\A0082263.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082321.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082326.sys"
Thu 12 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP277\A0082353.sys"
Fri 13 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082363.sys"
Sun 15 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP279\A0082399.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082408.sys"
Mon 16 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082431.sys"
Tue 17 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP280\A0082469.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082513.sys"
Wed 18 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082548.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0082555.sys"
Thu 19 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP281\A0083556.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083564.sys"
Fri 20 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP282\A0083600.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083609.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083618.sys"
Sat 21 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083645.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP283\A0083653.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083666.sys"
Sun 22 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0083701.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084702.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP284\A0084706.sys"
Mon 23 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084747.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084753.sys"
Tue 24 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP285\A0084776.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084782.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084789.sys"
Wed 25 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP286\A0084814.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084878.sys"
Thu 26 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP287\A0084907.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084915.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0084921.sys"
Fri 27 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085921.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085926.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085958.sys"
Sat 28 Feb 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP288\A0085975.sys"
Sun 1 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086010.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086037.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086042.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP289\A0086046.sys"
Mon 2 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086087.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086092.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086098.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086111.sys"
Tue 3 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086127.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP290\A0086134.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086144.sys"
Wed 4 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086149.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086174.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086182.sys"
Thu 5 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP291\A0086206.sys"
Fri 6 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0086220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087220.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087228.sys"
Sat 7 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087247.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087266.sys"
Sun 8 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087275.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP292\A0087300.sys"
Mon 9 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP293\A0088300.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088337.sys"
Wed 11 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088373.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP294\A0088395.sys"
Thu 12 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088404.sys"
Fri 13 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP295\A0088411.sys"
Mon 16 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089412.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089433.sys"
Tue 17 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP296\A0089477.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089492.sys"
Wed 18 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP297\A0089526.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089576.sys"
Thu 19 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP298\A0089606.sys"
Fri 20 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0090606.sys"
Sat 21 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP299\A0091607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092607.sys"
Sun 22 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP300\A0092671.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092699.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092724.sys"
Tue 24 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092780.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP301\A0092798.sys"
Wed 25 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092821.sys"
Thu 26 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP302\A0092834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093834.sys"
Fri 27 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093842.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP303\A0093851.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093891.sys"
Sat 28 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP304\A0093946.sys"
Sun 29 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP305\A0094018.sys"
Mon 30 Mar 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094096.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094115.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094123.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094135.sys"
Wed 1 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP306\A0094161.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094180.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094190.sys"
Thu 2 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094210.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094217.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094238.sys"
Fri 3 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094246.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094254.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP307\A0094269.sys"
Sat 4 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094295.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP308\A0094321.sys"
Sun 5 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094348.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094356.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094365.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP309\A0094378.sys"
Mon 6 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094407.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094415.sys"
Tue 7 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP310\A0094445.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094453.sys"
Wed 8 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094480.sys"
Fri 10 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094500.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP311\A0094515.sys"
Sat 11 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094541.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094591.sys"
Sun 12 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094882.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP312\A0094898.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094926.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094966.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094974.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0094992.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095008.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095033.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095041.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095051.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095055.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095064.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095068.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095072.sys"
Mon 13 Apr 2009 72 A..H. --- "C:\System Volume Information\_restore{626D9BD5-11D8-49A1-B657-D272D1F6275E}\RP313\A0095079.sys"
Sun 6 Jan 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 14 Apr 2009 72 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Application Data\U3\temp\Launchpad Removal.exe"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL0919.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1260.tmp"
Sat 8 Dec 2007 25,600 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\docs word et pdf\~WRL1702.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1\TD Marketing les ‚motions\~WRL3403.tmp"
Mon 28 Jan 2008 22,528 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\IMPORTANT DOSSIER CLE USB CRUZER 1 GO\acp perso\ENTRETIEN RMTT 31 janv\~WRL0001.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Sun 8 Apr 2007 21,504 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL0003.tmp"
Thu 3 May 2007 38,912 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\IMPORTANT ABI et APA ancienne cl‚ USB\APA\~WRL1864.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Mes documents\dossier tel LG VIEWTY\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
Fri 27 Apr 2007 31,744 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0001.tmp"
Thu 3 May 2007 32,256 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\Cl‚s USB\dossier cl‚ storex\A.P.A et A.B.I\APA\dossier officiel\LA NOTE DE SYNTHESE\~WRL0003.tmp"
Mon 24 Nov 2008 78,848 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL1326.tmp"
Tue 25 Nov 2008 39,936 A..H. --- "C:\Documents and Settings\Anne-Claire PICHARD\Bureau\AUTRES\TEL LG VIEWTY\docs tel\Documents\MASTER 1 Science du management\TD MASTER 1 science du management\TD MARKETING\TD Marketing les ‚motions\~WRL3403.tmp"
[b]Finished![/b]
nous verrons la suite mardi soir
merci
"c'est un cable qu'on relie de l'ordi portable au modem ?"
---> Oui.
"cable usb des 2 côtés donc..."
---> Je ne vois pas le rapport avec le câble ethernet.
---> Oui.
"cable usb des 2 côtés donc..."
---> Je ne vois pas le rapport avec le câble ethernet.
/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
j'ai pas installer la console de récupération je crois car, c'était écrit qu'il fallait avoir internet.
voici le rapport :
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04:14.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\nfr.assembly
C:\WINDOWS\system32\nfr.gpref
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07:41 . 2009-04-12 07:07:41 1 ---h--w C:\WINDOWS\f23567.dat
2009-03-21 17:17:40 . 2009-03-21 17:18:56 0 d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16:05 . 2007-07-19 14:43:05 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26:26 . 2009-02-01 17:04:17 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24:37 . 2007-05-12 19:15:53 0 d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2009-04-13 17:39:45 . 2008-12-23 13:44:17 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-04-13 15:28:22 . 2009-04-13 15:27:54 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02:47 . 2008-12-24 15:57:46 0 d-----w C:\Program Files\trend micro
2009-04-13 10:58:53 . 2009-04-12 17:16:10 0 d-----w C:\Program Files\Navilog1
2009-04-13 10:48:09 . 2009-04-13 10:43:35 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33:10 . 2009-04-12 17:18:50 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34:37 . 2006-12-23 14:00:53 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34:37 . 2006-12-23 14:00:53 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32:54 . 2008-12-23 13:44:19 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32:46 . 2008-12-23 13:44:22 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-03-30 16:47:13 . 2006-09-15 12:24:46 78346 ----a-w C:\WINDOWS\system32\perfc00C.dat
2009-03-30 16:47:13 . 2006-09-15 12:24:46 476522 ----a-w C:\WINDOWS\system32\perfh00C.dat
2009-03-21 17:19:22 . 2008-11-23 21:30:56 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34:24 . 2006-09-27 05:20:57 0 d-----w C:\Program Files\Microsoft Works
2009-03-11 09:27:30 . 2006-12-11 21:20:26 0 d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36:00 . 2008-04-07 18:52:26 0 d-----w C:\Program Files\Microsoft Silverlight
2009-02-25 17:10:32 . 2008-10-25 14:18:54 0 d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2009-02-09 14:05:54 . 2006-09-15 12:24:19 1846912 ----a-w C:\WINDOWS\system32\win32k.sys
2009-02-01 15:18:44 . 2007-02-11 00:39:36 83528 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49:25 . 2006-12-02 16:37:21 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49:25 . 2006-12-02 16:37:21 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19:46 . 2006-11-27 21:31:36 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19:45 . 2006-11-27 21:31:36 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34:34 . 2007-11-05 06:54:05 83528 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40:39 . 2006-09-18 12:02:30 83528 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40:57 . 2008-10-22 15:40:57 82752 ----a-w C:\Documents and Settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43:19 . 2007-11-05 06:54:05 129 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21:24 . 2008-01-05 17:21:36 774144 ----a-w C:\Program Files\RngInterstitial.dll
2007-10-22 21:13:51 . 2006-11-25 18:42:31 3840 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21:42 . 2007-05-24 20:20:06 175768 ---ha-w C:\Program Files\Maestria.GID
2007-02-18 15:24:01 . 2007-02-18 15:23:59 288129 ------w C:\Program Files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46:08 . 2006-11-25 16:20:44 142 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07:51 . 2006-11-25 16:20:44 19744 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49:31 . 2006-09-15 12:49:31 137 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27:20 . 2007-02-05 21:39:41 212992 ----a-w C:\Program Files\Columep100040c.dll
2003-12-05 11:22:28 . 2007-02-05 21:39:41 10338304 ----a-w C:\Program Files\GecoMaes.exe
2003-12-05 09:19:32 . 2007-02-05 21:38:21 176128 ----a-w C:\Program Files\MA30mep100040C.dll
2003-12-05 09:19:30 . 2007-02-05 21:38:22 8589312 ----a-w C:\Program Files\Maestria.exe
2002-09-19 12:52:28 . 2007-02-05 21:38:24 55102 ----a-w C:\Program Files\Maestria.cnt
2002-09-17 16:29:44 . 2007-02-05 21:39:45 6724632 ----a-w C:\Program Files\GecoMaes.hlp
2002-09-17 16:29:10 . 2007-02-05 21:39:45 93983 ----a-w C:\Program Files\GecoMaes.cnt
2002-09-11 15:49:56 . 2007-02-05 21:38:24 5093084 ----a-w C:\Program Files\Maestria.hlp
2001-04-19 15:45:44 . 2007-02-05 21:39:43 688128 ----a-w C:\Program Files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01:52 34816 ----a-w C:\Program Files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02:00 73728 ----a-w C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33:59 15360]
"Free Uploader Oe Integration"="C:\Program Files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 18:02:38 40960]
"PanelApp"="C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 22:04:58 31232]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-12-31 14:29:04 962560]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 10:55:02 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 02:34:13 1695232]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-11-18 15:31:04 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25:42 6731312]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 20:04:00 7557120]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-28 12:35:40 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 23:40:34 185872]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 23:10:54 29744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 12:28:40 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-27 00:01:53 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:33:59 15360]
C:\Documents and Settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - C:\Program Files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 11:11:14 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 02:33:48 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=C:\WINDOWS\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=C:\WINDOWS\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49:20 49152 ----a-w C:\Program Files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49:22 282624 ----a-w C:\Program Files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33:59 15360 ----a-w C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20:00 122940 ----a-w C:\WINDOWS\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10:54 29744 ----a-w C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32:44 696320 ----a-w C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38:30 802816 ----a-w C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37:43 190024 ----a-w C:\Program Files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15:58 749568 ----a-w C:\Program Files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01:58 28739 ----a-w C:\Program Files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34:13 1695232 ----a-w C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35:40 98304 ----a-w C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24:50 118784 ----a-w C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47:12 356352 ----a-w C:\Program Files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40:34 185872 ----a-w C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08:00 65536 ----a-w C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11:38 73728 ----a-w C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59:18 24576 ----a-w C:\Program Files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09:12 266240 ----a-w C:\WINDOWS\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\V-Gear BEE\\VBService.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 23:10:54 29744]
R3 PanelSvc;PanelSvc;C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 13:42:18 77312]
S3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 08:45:16 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:49:26 . 2009-03-24 08:49:28]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~C:\Program Files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: C:\Program Files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: C:\Program Files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: C:\Program Files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Picasa2\npPicasa2.dll
FF - plugin: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
voici le rapport :
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04:14.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
C:\WINDOWS\system32\404Fix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\nfr.assembly
C:\WINDOWS\system32\nfr.gpref
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07:41 . 2009-04-12 07:07:41 1 ---h--w C:\WINDOWS\f23567.dat
2009-03-21 17:17:40 . 2009-03-21 17:18:56 0 d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16:05 . 2007-07-19 14:43:05 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26:26 . 2009-02-01 17:04:17 0 d-----w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24:37 . 2007-05-12 19:15:53 0 d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2009-04-13 17:39:45 . 2008-12-23 13:44:17 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-04-13 15:28:22 . 2009-04-13 15:27:54 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02:47 . 2008-12-24 15:57:46 0 d-----w C:\Program Files\trend micro
2009-04-13 10:58:53 . 2009-04-12 17:16:10 0 d-----w C:\Program Files\Navilog1
2009-04-13 10:48:09 . 2009-04-13 10:43:35 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33:10 . 2009-04-12 17:18:50 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34:37 . 2006-12-23 14:00:53 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34:37 . 2006-12-23 14:00:53 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32:54 . 2008-12-23 13:44:19 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32:46 . 2008-12-23 13:44:22 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-03-30 16:47:13 . 2006-09-15 12:24:46 78346 ----a-w C:\WINDOWS\system32\perfc00C.dat
2009-03-30 16:47:13 . 2006-09-15 12:24:46 476522 ----a-w C:\WINDOWS\system32\perfh00C.dat
2009-03-21 17:19:22 . 2008-11-23 21:30:56 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34:24 . 2006-09-27 05:20:57 0 d-----w C:\Program Files\Microsoft Works
2009-03-11 09:27:30 . 2006-12-11 21:20:26 0 d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36:00 . 2008-04-07 18:52:26 0 d-----w C:\Program Files\Microsoft Silverlight
2009-02-25 17:10:32 . 2008-10-25 14:18:54 0 d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2009-02-09 14:05:54 . 2006-09-15 12:24:19 1846912 ----a-w C:\WINDOWS\system32\win32k.sys
2009-02-01 15:18:44 . 2007-02-11 00:39:36 83528 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49:25 . 2006-12-02 16:37:21 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49:25 . 2006-12-02 16:37:21 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19:46 . 2006-11-27 21:31:36 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19:45 . 2006-11-27 21:31:36 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34:34 . 2007-11-05 06:54:05 83528 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40:39 . 2006-09-18 12:02:30 83528 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40:57 . 2008-10-22 15:40:57 82752 ----a-w C:\Documents and Settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43:19 . 2007-11-05 06:54:05 129 ----a-w C:\Documents and Settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21:24 . 2008-01-05 17:21:36 774144 ----a-w C:\Program Files\RngInterstitial.dll
2007-10-22 21:13:51 . 2006-11-25 18:42:31 3840 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21:42 . 2007-05-24 20:20:06 175768 ---ha-w C:\Program Files\Maestria.GID
2007-02-18 15:24:01 . 2007-02-18 15:23:59 288129 ------w C:\Program Files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46:08 . 2006-11-25 16:20:44 142 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07:51 . 2006-11-25 16:20:44 19744 ----a-w C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49:31 . 2006-09-15 12:49:31 137 ----a-w C:\Documents and Settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27:20 . 2007-02-05 21:39:41 212992 ----a-w C:\Program Files\Columep100040c.dll
2003-12-05 11:22:28 . 2007-02-05 21:39:41 10338304 ----a-w C:\Program Files\GecoMaes.exe
2003-12-05 09:19:32 . 2007-02-05 21:38:21 176128 ----a-w C:\Program Files\MA30mep100040C.dll
2003-12-05 09:19:30 . 2007-02-05 21:38:22 8589312 ----a-w C:\Program Files\Maestria.exe
2002-09-19 12:52:28 . 2007-02-05 21:38:24 55102 ----a-w C:\Program Files\Maestria.cnt
2002-09-17 16:29:44 . 2007-02-05 21:39:45 6724632 ----a-w C:\Program Files\GecoMaes.hlp
2002-09-17 16:29:10 . 2007-02-05 21:39:45 93983 ----a-w C:\Program Files\GecoMaes.cnt
2002-09-11 15:49:56 . 2007-02-05 21:38:24 5093084 ----a-w C:\Program Files\Maestria.hlp
2001-04-19 15:45:44 . 2007-02-05 21:39:43 688128 ----a-w C:\Program Files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01:52 34816 ----a-w C:\Program Files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02:00 73728 ----a-w C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 02:33:59 15360]
"Free Uploader Oe Integration"="C:\Program Files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 18:02:38 40960]
"PanelApp"="C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 22:04:58 31232]
"ares"="C:\Program Files\Ares\Ares.exe" [2007-12-31 14:29:04 962560]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 10:55:02 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 02:34:13 1695232]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-11-18 15:31:04 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25:42 6731312]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 20:04:00 7557120]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-28 12:35:40 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 23:40:34 185872]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 23:10:54 29744]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 12:28:40 266497]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-27 00:01:53 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:33:59 15360]
C:\Documents and Settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - C:\Program Files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 11:11:14 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 02:33:48 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0stera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=C:\WINDOWS\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=C:\WINDOWS\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49:20 49152 ----a-w C:\Program Files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49:22 282624 ----a-w C:\Program Files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33:59 15360 ----a-w C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20:00 122940 ----a-w C:\WINDOWS\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10:54 29744 ----a-w C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32:44 696320 ----a-w C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38:30 802816 ----a-w C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37:43 190024 ----a-w C:\Program Files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15:58 749568 ----a-w C:\Program Files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01:58 28739 ----a-w C:\Program Files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34:13 1695232 ----a-w C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35:40 98304 ----a-w C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24:50 118784 ----a-w C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47:12 356352 ----a-w C:\Program Files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40:34 185872 ----a-w C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08:00 65536 ----a-w C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11:38 73728 ----a-w C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59:18 24576 ----a-w C:\Program Files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09:12 266240 ----a-w C:\WINDOWS\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\V-Gear BEE\\VBService.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 23:10:54 29744]
R3 PanelSvc;PanelSvc;C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 13:42:18 77312]
S3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 08:45:16 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 C:\WINDOWS\Tasks\Google Software Updater.job
- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 21:49:26 . 2009-03-24 08:49:28]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~C:\Program Files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - C:\Documents and Settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: C:\Program Files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: C:\Program Files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: C:\Program Files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: C:\Program Files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: C:\Program Files\Picasa2\npPicasa2.dll
FF - plugin: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
voici le rapport log :
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
c:\windows\system32\o4Patch.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07 . 2009-04-12 07:07 1 ---h--w c:\windows\f23567.dat
2009-03-21 17:17 . 2009-03-21 17:18 -------- d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16 . 2007-07-19 14:43 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26 . 2009-02-01 17:04 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24 . 2007-05-12 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-13 17:39 . 2008-12-23 13:44 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-13 15:28 . 2009-04-13 15:27 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02 . 2008-12-24 15:57 -------- d-----w c:\program files\trend micro
2009-04-13 10:58 . 2009-04-12 17:16 -------- d-----w c:\program files\Navilog1
2009-04-13 10:48 . 2009-04-13 10:43 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33 . 2009-04-12 17:18 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34 . 2006-12-23 14:00 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34 . 2006-12-23 14:00 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32 . 2008-12-23 13:44 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-12-23 13:44 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-30 16:47 . 2006-09-15 12:24 78346 ----a-w c:\windows\system32\perfc00C.dat
2009-03-30 16:47 . 2006-09-15 12:24 476522 ----a-w c:\windows\system32\perfh00C.dat
2009-03-21 17:19 . 2008-11-23 21:30 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34 . 2006-09-27 05:20 -------- d-----w c:\program files\Microsoft Works
2009-03-11 09:27 . 2006-12-11 21:20 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36 . 2008-04-07 18:52 -------- d-----w c:\program files\Microsoft Silverlight
2009-02-25 17:10 . 2008-10-25 14:18 -------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
2009-02-09 14:05 . 2006-09-15 12:24 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-01 15:18 . 2007-02-11 00:39 83528 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49 . 2006-12-02 16:37 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49 . 2006-12-02 16:37 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19 . 2006-11-27 21:31 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19 . 2006-11-27 21:31 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34 . 2007-11-05 06:54 83528 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40 . 2006-09-18 12:02 83528 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40 . 2008-10-22 15:40 82752 ----a-w c:\documents and settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43 . 2007-11-05 06:54 129 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21 . 2008-01-05 17:21 774144 ----a-w c:\program files\RngInterstitial.dll
2007-10-22 21:13 . 2006-11-25 18:42 3840 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21 . 2007-05-24 20:20 175768 ---ha-w c:\program files\Maestria.GID
2007-02-18 15:24 . 2007-02-18 15:23 288129 ------w c:\program files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46 . 2006-11-25 16:20 142 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07 . 2006-11-25 16:20 19744 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49 . 2006-09-15 12:49 137 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27 . 2007-02-05 21:39 212992 ----a-w c:\program files\Columep100040c.dll
2003-12-05 11:22 . 2007-02-05 21:39 10338304 ----a-w c:\program files\GecoMaes.exe
2003-12-05 09:19 . 2007-02-05 21:38 176128 ----a-w c:\program files\MA30mep100040C.dll
2003-12-05 09:19 . 2007-02-05 21:38 8589312 ----a-w c:\program files\Maestria.exe
2002-09-19 12:52 . 2007-02-05 21:38 55102 ----a-w c:\program files\Maestria.cnt
2002-09-17 16:29 . 2007-02-05 21:39 6724632 ----a-w c:\program files\GecoMaes.hlp
2002-09-17 16:29 . 2007-02-05 21:39 93983 ----a-w c:\program files\GecoMaes.cnt
2002-09-11 15:49 . 2007-02-05 21:38 5093084 ----a-w c:\program files\Maestria.hlp
2001-04-19 15:45 . 2007-02-05 21:39 688128 ----a-w c:\program files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01 34816 ----a-w c:\program files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02 73728 ----a-w c:\program files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Free Uploader Oe Integration"="c:\program files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 40960]
"PanelApp"="c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 31232]
"ares"="c:\program files\Ares\Ares.exe" [2007-12-31 962560]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-01 7557120]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-05-28 98304]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 185872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 29744]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - c:\program files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - c:\program files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - c:\windows\system32\upnpui.dll [2008-04-14 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/ustera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49 49152 ----a-w c:\program files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49 282624 ----a-w c:\program files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33 15360 ----a-w c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20 122940 ----a-w c:\windows\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10 29744 ----a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32 696320 ----a-w c:\program files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38 802816 ----a-w c:\program files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37 190024 ----a-w c:\program files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15 749568 ----a-w c:\program files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01 28739 ----a-w c:\program files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35 98304 ----a-w c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24 118784 ----a-w c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47 356352 ----a-w c:\program files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40 185872 ----a-w c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08 65536 ----a-w c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11 73728 ----a-w c:\program files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59 24576 ----a-w c:\program files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09 266240 ----a-w c:\windows\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\V-Gear BEE\\VBService.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 29744]
R3 PanelSvc;PanelSvc;c:\program files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 77312]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2005-11-28 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 08:49]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - c:\documents and settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 23:16
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1344)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3632)
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\pahelper_1100.2009.0210.1225.dll
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_1100.2009.0210.1225.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
c:\program files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
c:\progra~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
c:\progra~1\SPYBOT~1\SDHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Toshiba\ConfigFree\CFSvcs.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
c:\program files\Common Files\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Heure de fin: ~,10time:~,-3machine was rebootedCombobatch-by
ComboFix-quarantined-files.txt 2009-04-14 21:21
Avant-CF: 13 640 372 224 octets libres
Après-CF: 14 815 244 288 octets libres
308 --- E O F --- 2009-03-13 00:04
ComboFix 09-04-14.09 - Anne-Claire PICHARD 14/04/2009 23:04.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.522 [GMT 2:00]
Lancé depuis: G:\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Un nouveau point de restauration a été créé
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\check_LSA7.txt
c:\windows\system32\404Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
c:\windows\system32\o4Patch.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-03-14 au 2009-04-14 ))))))))))))))))))))))))))))))))))))
.
2009-04-12 07:07 . 2009-04-12 07:07 1 ---h--w c:\windows\f23567.dat
2009-03-21 17:17 . 2009-03-21 17:18 -------- d--h--w C:\LG3G
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 21:16 . 2007-07-19 14:43 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\Skype
2009-04-14 20:26 . 2009-02-01 17:04 -------- d-----w c:\documents and settings\Anne-Claire PICHARD\Application Data\skypePM
2009-04-14 20:24 . 2007-05-12 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-13 17:39 . 2008-12-23 13:44 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-13 15:28 . 2009-04-13 15:27 3915 ----a-w C:\FindyKill.txt
2009-04-13 13:02 . 2008-12-24 15:57 -------- d-----w c:\program files\trend micro
2009-04-13 10:58 . 2009-04-12 17:16 -------- d-----w c:\program files\Navilog1
2009-04-13 10:48 . 2009-04-13 10:43 4233 ----a-w C:\cleannavi.txt
2009-04-12 18:33 . 2009-04-12 17:18 3991 ----a-w C:\fixnavi.txt
2009-04-07 05:34 . 2006-12-23 14:00 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-07 05:34 . 2006-12-23 14:00 232 ---ha-w C:\sqmdata02.sqm
2009-04-06 13:32 . 2008-12-23 13:44 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-12-23 13:44 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-30 16:47 . 2006-09-15 12:24 78346 ----a-w c:\windows\system32\perfc00C.dat
2009-03-30 16:47 . 2006-09-15 12:24 476522 ----a-w c:\windows\system32\perfh00C.dat
2009-03-21 17:19 . 2008-11-23 21:30 0 ----a-w C:\Tech_Vista.log
2009-03-16 21:34 . 2006-09-27 05:20 -------- d-----w c:\program files\Microsoft Works
2009-03-11 09:27 . 2006-12-11 21:20 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-26 11:36 . 2008-04-07 18:52 -------- d-----w c:\program files\Microsoft Silverlight
2009-02-25 17:10 . 2008-10-25 14:18 -------- d-----w c:\documents and settings\All Users\Application Data\TrackMania
2009-02-09 14:05 . 2006-09-15 12:24 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-01 15:18 . 2007-02-11 00:39 83528 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\GDIPFONTCACHEV1.DAT
2009-01-17 07:49 . 2006-12-02 16:37 244 ---ha-w C:\sqmnoopt01.sqm
2009-01-17 07:49 . 2006-12-02 16:37 232 ---ha-w C:\sqmdata01.sqm
2009-01-16 22:19 . 2006-11-27 21:31 232 ---ha-w C:\sqmdata00.sqm
2009-01-16 22:19 . 2006-11-27 21:31 244 ---ha-w C:\sqmnoopt00.sqm
2009-01-16 18:34 . 2007-11-05 06:54 83528 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-01 16:40 . 2006-09-18 12:02 83528 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-10-22 15:40 . 2008-10-22 15:40 82752 ----a-w c:\documents and settings\Invité\Application Data\GDIPFONTCACHEV1.DAT
2008-10-20 17:43 . 2007-11-05 06:54 129 ----a-w c:\documents and settings\Invité\Local Settings\Application Data\fusioncache.dat
2008-01-05 17:21 . 2008-01-05 17:21 774144 ----a-w c:\program files\RngInterstitial.dll
2007-10-22 21:13 . 2006-11-25 18:42 3840 ----a-w c:\documents and settings\Anne-Claire PICHARD\Application Data\wklnhst.dat
2007-05-24 20:21 . 2007-05-24 20:20 175768 ---ha-w c:\program files\Maestria.GID
2007-02-18 15:24 . 2007-02-18 15:23 288129 ------w c:\program files\Nouveau fichier de paramètres.OPS
2006-11-25 17:46 . 2006-11-25 16:20 142 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\fusioncache.dat
2006-09-22 13:07 . 2006-11-25 16:20 19744 ----a-w c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-09-15 12:49 . 2006-09-15 12:49 137 ----a-w c:\documents and settings\Administrateur\Local Settings\Application Data\fusioncache.dat
2003-12-05 11:27 . 2007-02-05 21:39 212992 ----a-w c:\program files\Columep100040c.dll
2003-12-05 11:22 . 2007-02-05 21:39 10338304 ----a-w c:\program files\GecoMaes.exe
2003-12-05 09:19 . 2007-02-05 21:38 176128 ----a-w c:\program files\MA30mep100040C.dll
2003-12-05 09:19 . 2007-02-05 21:38 8589312 ----a-w c:\program files\Maestria.exe
2002-09-19 12:52 . 2007-02-05 21:38 55102 ----a-w c:\program files\Maestria.cnt
2002-09-17 16:29 . 2007-02-05 21:39 6724632 ----a-w c:\program files\GecoMaes.hlp
2002-09-17 16:29 . 2007-02-05 21:39 93983 ----a-w c:\program files\GecoMaes.cnt
2002-09-11 15:49 . 2007-02-05 21:38 5093084 ----a-w c:\program files\Maestria.hlp
2001-04-19 15:45 . 2007-02-05 21:39 688128 ----a-w c:\program files\GecoMaes.fts
2008-11-27 23:2008-11-27 23:10 10:54 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-12-27 00:01 34816 ----a-w c:\program files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-12-27 00:02 73728 ----a-w c:\program files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Free Uploader Oe Integration"="c:\program files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 40960]
"PanelApp"="c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe" [2007-01-03 31232]
"ares"="c:\program files\Ares\Ares.exe" [2007-12-31 962560]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-01 7557120]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-05-28 98304]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-29 185872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-11-27 29744]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-27 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Anne-Claire PICHARD\Menu D‚marrer\Programmes\D‚marrage\
BEE Service.lnk - c:\program files\V-Gear BEE\VBService.exe [2008-1-1 1393664]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Wireless-G Notebook Adapter.lnk - c:\program files\Linksys\Wireless-G Notebook Adapter\Gcc.exe [2006-11-26 36864]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"UPnPMonitor"= {e57ce738-33e8-4c51-8354-bb4de9d215d1} - c:\windows\system32\upnpui.dll [2008-04-14 240128]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/ustera
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Outil de mise à jour Google.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Outil de mise à jour Google.lnk
backup=c:\windows\pss\Outil de mise à jour Google.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^Lancement rapide de Microsoft Office OneNote 2003.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\Lancement rapide de Microsoft Office OneNote 2003.lnk
backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Anne-Claire PICHARD^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2006-12-16 18:49 49152 ----a-w c:\program files\Softwin\BitDefender10\bdagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2006-12-16 18:49 282624 ----a-w c:\program files\Softwin\BitDefender10\bdmcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 02:33 15360 ----a-w c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-10-06 03:20 122940 ----a-w c:\windows\System32\DLA\DLACTRLW.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2008-11-27 23:10 29744 ----a-w c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2006-08-01 23:32 696320 ----a-w c:\program files\Intel\Wireless\Bin\iFrmewrk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-01 23:38 802816 ----a-w c:\program files\Intel\Wireless\bin\ZCfgSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-06-17 21:37 190024 ----a-w c:\program files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2005-08-19 04:15 749568 ----a-w c:\program files\Microsoft Works\WksSb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
2000-08-04 02:01 28739 ----a-w c:\program files\Microsoft Works\WkDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:34 1695232 ----a-w c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-05-28 12:35 98304 ----a-w c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2005-05-17 07:24 118784 ----a-w c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2006-08-25 11:47 356352 ----a-w c:\program files\Toshiba\Toshiba Applet\THotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-10-29 23:40 185872 ----a-w c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2005-04-11 14:08 65536 ----a-w c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2006-02-02 11:11 73728 ----a-w c:\program files\TOSHIBA\Tvs\TvsTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2000-07-12 11:59 24576 ----a-w c:\program files\Microsoft Works\wkfud.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2005-08-03 14:09 266240 ----a-w c:\windows\system32\TPSMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Anne-Claire PICHARD\\Mes documents\\eMule\\emule.exe"=
"c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\V-Gear BEE\\VBService.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17756:TCP"= 17756:TCP:BitComet 17756 TCP
"17756:UDP"= 17756:UDP:BitComet 17756 UDP
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-11-27 29744]
R3 PanelSvc;PanelSvc;c:\program files\Votre Opinion\PanelApp\PanelSvc.exe [2007-05-17 77312]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2005-11-28 7040]
.
Contenu du dossier 'Tâches planifiées'
2009-04-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-13 08:49]
.
- - - - ORPHELINS SUPPRIMES - - - -
URLSearchHooks-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
WebBrowser-{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
ShellIconOverlayIdentifiers-{B8A03725-03B9-485F-BB22-E848799D4C2A} - c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_0600.2007.0517.1434.dll
HKCU-Run-CanalPlayer - c:\program files\Lecteur CANALPLAY\CanalPlayer.exe
HKCU-Run-AdobeUpdater - c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll
SSODL-WebCheck-{E6FB5E20-DE35-11CF-9C87-00AA005127ED} - %SystemRoot%\system32\webcheck.dll
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-msnmsgr - ~c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe
MSConfigStartUp-CFSServ - CFSServ.exe
MSConfigStartUp-NDSTray - NDSTray.exe
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.81\MediaManager\grab.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Handler: http\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: ipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\[u]0/ux00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\progra~1\FICHIE~1\System\OLEDB~1\MSDAIPP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\FICHIE~1\Skype\SKYPE4~1.DLL
DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} - hxxp://zylom.midasplayer.com/ctl/kingcomie.cab
DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} - hxxp://a14.g.akamai.net/f/14/7141/1d/fr.nielsennetpanel.com/download/OpiStat_preinstaller_activex_fr_4.60.63.0_MEGAPANEL_EUROPE_SILENT.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
FF - ProfilePath - c:\documents and settings\Anne-Claire PICHARD\Application Data\Mozilla\Firefox\Profiles\2mrzbkrf.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\ff\components\FFoxAddinStub.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\APIX\NPAPIX.dll
FF - plugin: c:\program files\Fichiers communs\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 23:16
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(1344)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3632)
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\pahelper_1100.2009.0210.1225.dll
c:\documents and settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp_1100.2009.0210.1225.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll
c:\program files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
c:\progra~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
c:\progra~1\SPYBOT~1\SDHelper.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Toshiba\ConfigFree\CFSvcs.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
c:\program files\Common Files\X10\Common\X10nets.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Heure de fin: ~,10time:~,-3machine was rebootedCombobatch-by
ComboFix-quarantined-files.txt 2009-04-14 21:21
Avant-CF: 13 640 372 224 octets libres
Après-CF: 14 815 244 288 octets libres
308 --- E O F --- 2009-03-13 00:04
Oui, tu peux faire une restauration système.
Menu Démarrer > Tous les programmes > Accessoires > Outils système > Restauration système
Menu Démarrer > Tous les programmes > Accessoires > Outils système > Restauration système
On va vérifier.
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
voici le rapport log :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Anne-Claire PICHARD at 2009-04-16 23:11:13
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 13 GB (18%) free of 76 GB
Total RAM: 1022 MB (25% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:34, on 16/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\V-Gear BEE\VBService.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Anne-Claire PICHARD\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Anne-Claire PICHARD.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MEDIADICO Familial - {CEDDA62B-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\MEDIADICO\MDToolbar\MdToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKCU\..\Run: [PanelApp] C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BEE Service.lnk = C:\Program Files\V-Gear BEE\VBService.exe
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://dida.univ-tln.fr/qp2.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://zylom.midasplayer.com/ctl/kingcomie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} (NMInstall Control) - http://a14.g.akamai.net/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://msnfr.oberon-media.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PanelSvc - Unknown owner - C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by Anne-Claire PICHARD at 2009-04-16 23:11:13
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 13 GB (18%) free of 76 GB
Total RAM: 1022 MB (25% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:34, on 16/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\V-Gear BEE\VBService.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\Anne-Claire PICHARD\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Anne-Claire PICHARD.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MEDIADICO Familial - {CEDDA62B-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\MEDIADICO\MDToolbar\MdToolbar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKCU\..\Run: [PanelApp] C:\Documents and Settings\Anne-Claire PICHARD\Local Settings\Application Data\Votre Opinion\PanelApp\PanelApp.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BEE Service.lnk = C:\Program Files\V-Gear BEE\VBService.exe
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.81\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.81\MediaManager\grab.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Anne-Claire PICHARD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://dida.univ-tln.fr/qp2.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} (king.com) - http://zylom.midasplayer.com/ctl/kingcomie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5554A026-7282-4C11-A8F1-652D0599CD02} (NMInstall Control) - http://a14.g.akamai.net/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=26688
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://msnfr.oberon-media.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp06.photoprintit.de/microsite/12188/defaults/activex/IPSUploader.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://bellerock.microgaming.com/freeplayfrench/FlashAX2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PanelSvc - Unknown owner - C:\Program Files\Votre Opinion\PanelApp\PanelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
en ce qui concerne le rapport info, je ne le trouve pas! il n'est pas dans le dossier RSIT dans le disque dur
---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
voici le rapport MBAM :
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1991
Windows 5.1.2600 Service Pack 3
17/04/2009 00:08:37
mbam-log-2009-04-17 (00-08-37).txt
Type de recherche: Examen rapide
Eléments examinés: 93357
Temps écoulé: 13 minute(s), 11 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\9g2234wesdf3dfgjf23 (Trojan.KoobFace) -> Quarantined and deleted successfully.
bonne nuit.
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1991
Windows 5.1.2600 Service Pack 3
17/04/2009 00:08:37
mbam-log-2009-04-17 (00-08-37).txt
Type de recherche: Examen rapide
Eléments examinés: 93357
Temps écoulé: 13 minute(s), 11 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\9g2234wesdf3dfgjf23 (Trojan.KoobFace) -> Quarantined and deleted successfully.
bonne nuit.
Précédent
- 1
- 2
- 3
Suivant
comme F5 et F8 ne marche pas, je fait comment?
HDD
FDD
CD/DVD
LAN
MEMOIRE USB