Lenteur PC + internet = virus?

Question

Bonjour,

Depuis quelque temps on a un problème de PC qui rame et d'internet lent sur les 2 pc de la maison qui  sont reliés via un routeur D-link. L'un des PC commence à fermer des appli sans rien demander à personne, ne réponds pas, le débit internet tout pourrit pour de l'adsl... Bref: ça pue le virus!

L'autre jour ma copine était revenue de la fac avec un virus sur sa clé USB. Antivir l'a bloqué, mais on dirait que quelque chose est passé quand même?...

Bref, je viens de faire un scan Hijackthis des 2 pc.

Y-aurait il quelqu'un de sympa et d'assé informé sur le sujet pour me dire si je peux les poster? Ca serait chouette!

Merci d'avance!

Eric
ps: les 2 pc ont la mm "protection" Avira antivir, Zone Alarm

Lyonnais92 · Answer

Bonjour,

je suis Lyonnais92 et je t'accompagnerai jusqu'à ce que ton ordi soit désinfecté.

J'ai besoin de certaines informations afin de te faire faire les meilleures manipulations, au moindre risque.


 -  il s'agit d'un ordi personnel ou  professionnel ?
 
 - ta session a les droits  d'administrateur ?
 
 - ton Windows est légitime ?
 
 - tu as un CD (ou DVD)  d'installation ou seulement de  restauration en l'état neuf ?
 
 - tu as une sauvegarde de tes  données personnelles (sur un  support externe) ?
  
 - tu as (ou peut avoir) l'usage  d'un autre ordi sain ? avec un  graveur de CD ?


===============

on traite un ordi, puis l'autre.

On commence par le moins atteint.

=================
Télécharge OTList2 de OLDTimer ici :

http://oldtimer.geekstogo.com/OTListIt2.exe

et enregistre le sur ton Bureau.

Double clic sur OTListIt2.exe pour le lancer.

Coche les 2 cases Lop et Purity

Coche la case devant "scan all users"

Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport.

Copie le dans une nouvelle réponse

Rico Brisbane · Answer

Bonjour,

Merci pour ton aide. Alors, dans l'ordre:

- Il s'agit d'un PC perso (à la maison quoi) bien que je m'en serve pour mon activité professionelle (Freelance donc taf avec mon propre PC). Au passage, pour info,  je viens de brancher mon PC portable tout neuf à internet, et tout va très vite (enfin normale quoi) internet se charge vite, les videos ne rament pas... Contraire aux deux PC fixes...
- Ma session à les droit d'administrateurs.
- Je ne sais pas ce que tu entends par "légitime"? Mon windows est un XP LSD intallé en 2006 qui n'a jusqu'ici jamais crashé. J'ai eu des problèmes de virus une fois ou deux et ai réussit à tout désinfecter grâce à l'aide précieuse de forums comme celui-ci.
- Je n'ai hélas plus le CD d'instal de mon XP (oublié en france que je suis parti en Juin dernier... Un peu à l'arrache, PC dans la valise... Par contre j'ai le CD de XP du PC de ma copine, ainsi qu'un DVD de Vista? Mais j'espère ne pas devoir en arriver là?...)
- J'ai un HD externe avec une partie de mes sauvegardes. (Pourquoi? Au cas où il y aurais du formatage dans l'air?)
- L'usage d'un autre ordi sain avec un graveur de CD -> OUI mon portable.

Voici le rapport OTListIt:

OTListIt logfile created on: 05/05/2009 00:34:08 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.3     Folder = D:\Downloadz
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
990,42 Mb Total Physical Memory | 470,11 Mb Available Physical Memory | 47,47% Memory free
2,33 Gb Paging File | 1,77 Gb Available in Paging File | 76,03% Paging File free
Paging file location(s): C:\pagefile.sys 1488 2976 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 5,49 Gb Free Space | 28,13% Space Free | Partition Type: NTFS
Drive D: | 133,84 Gb Total Space | 29,93 Gb Free Space | 22,37% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: RICO
Current User Name: Rico
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Output = Standard
File Age = 30 Days
Company Name Whitelist: On
 
[color=orange]========== Processes (SafeList) ==========/color
 
PRC - [2008/07/09 09:05:18 | 00,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2005/06/16 07:01:14 | 01,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008/10/15 14:31:53 | 00,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008/10/15 14:30:02 | 00,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2005/10/01 03:34:58 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
PRC - [2008/12/05 16:11:54 | 00,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
PRC - [2005/10/28 15:21:02 | 00,118,843 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
PRC - [2005/10/28 15:20:46 | 00,061,503 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
PRC - [2005/08/08 22:54:00 | 00,167,936 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe
PRC - [2007/05/29 02:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- D:\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2005/01/28 21:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe
PRC - [2005/10/28 15:23:54 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe
PRC - [2004/08/20 04:10:06 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe
PRC - [2005/10/01 03:34:58 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
PRC - [2005/10/28 15:25:14 | 00,270,336 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
TrayFw.exe
PRC - [2006/10/12 12:10:54 | 00,049,263 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
PRC - [2007/05/15 08:22:22 | 00,035,328 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe
PRC - [2007/06/29 07:01:00 | 02,512,128 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodtray.exe
PRC - [2008/06/12 14:28:45 | 00,266,497 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008/07/09 09:05:20 | 00,919,016 | ---- | M] (Zone Labs, LLC) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2005/10/19 18:19:08 | 00,049,152 | ---- | M] (Alpha Networks Inc.) -- C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
PRC - [2009/01/17 10:32:25 | 00,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2006/10/12 12:10:54 | 00,241,775 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
PRC - [2005/06/16 07:01:14 | 01,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/30 22:31:10 | 00,312,880 | ---- | M] (GRISOFT s.r.o.) -- C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
PRC - [2007/06/11 19:25:42 | 06,731,312 | ---- | M] (GRISOFT s.r.o.) -- C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
PRC - [2008/04/28 21:21:36 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/05/05 00:31:01 | 00,501,248 | ---- | M] (OldTimer Tools) -- D:\Downloadz\OTListIt2.exe
PRC - [2004/08/20 04:10:06 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
 
[color=orange]========== Win32 Services (SafeList) ==========/color
 
SRV - [2006/10/27 00:54:41 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand | Stopped])
SRV - [2005/10/19 18:19:10 | 00,049,152 | ---- | M] (Alpha Networks Inc.) -- C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService [Auto | Stopped])
SRV - [2008/10/15 14:31:53 | 00,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler [Auto | Running])
SRV - [2008/10/15 14:30:02 | 00,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService [Auto | Running])
SRV - [2005/09/23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2005/09/23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2006/10/20 21:21:24 | 00,036,864 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2005/10/28 15:23:54 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM) [Auto | Running])
SRV - [2005/10/01 03:34:58 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface [Auto | Running])
SRV - [2009/03/24 12:05:30 | 00,183,280 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [Disabled | Stopped])
SRV - [2004/08/20 04:09:38 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Disabled | Stopped])
SRV - [2006/10/30 03:33:58 | 00,741,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2004/08/20 01:09:32 | 00,028,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\irmon.dll -- (Irmon [Auto | Running])
SRV - [2008/12/05 16:11:54 | 00,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0 [Auto | Running])
SRV - [2006/10/30 03:34:02 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2005/10/28 15:21:02 | 00,118,843 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe -- (nSvcIp [Auto | Running])
SRV - [2005/10/28 15:20:46 | 00,061,503 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe -- (nSvcLog [Auto | Running])
SRV - [2005/10/10 23:49:00 | 00,131,139 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32
vsvc32.exe -- (NVSvc [Auto | Stopped])
SRV - [2007/06/29 07:02:08 | 01,049,856 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe -- (O&O Defrag [Disabled | Stopped])
SRV - [2005/08/08 22:54:00 | 00,167,936 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo [Auto | Running])
SRV - [2007/05/29 02:57:54 | 00,275,968 | ---- | M] (Rocket Division Software) -- D:\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE [Auto | Running])
SRV - [2005/01/28 21:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running])
SRV - [2007/01/19 21:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped])
SRV - [2008/07/09 09:05:18 | 00,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- (vsmon [Auto | Running])
SRV - [2007/05/30 22:31:10 | 00,312,880 | ---- | M] (GRISOFT s.r.o.) -- C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -- (AVG Anti-Spyware Guard [Auto | Running])
 
[color=orange]========== Driver Services (SafeList) ==========/color
 
DRV - [2007/12/20 00:43:44 | 00,068,672 | R--- | M] (2Wire, Inc.) -- C:\WINDOWS\system32\DRIVERS\2WirePCP.sys -- (2WIREPCP [On_Demand | Stopped])
DRV - [2005/03/09 23:53:00 | 00,043,008 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\system32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running])
DRV - [2005/11/09 15:44:48 | 00,024,288 | ---- | M] (Alpha Networks Inc.) -- C:\WINDOWS\system32\ANIO.SYS -- (ANIO [Auto | Running])
DRV - [2007/02/27 15:25:01 | 00,011,840 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio [System | Running])
DRV - [2008/05/20 16:29:41 | 00,052,032 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt [On_Demand | Running])
DRV - [2008/11/26 07:27:55 | 00,075,072 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\DRIVERS\avipbb.sys -- (avipbb [System | Running])
DRV - [2002/10/21 20:37:16 | 00,515,803 | ---- | M] (Digital Camera) -- C:\WINDOWS\System32\Drivers\Ca533av.sys -- (Ca533av [Auto | Stopped])
DRV - [2005/01/08 01:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2005/12/09 18:48:40 | 04,123,136 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])
DRV - [2007/07/19 15:10:28 | 00,127,768 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\DRIVERS\klif.sys -- (KLIF [System | Running])
DRV - [2004/08/13 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\system32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running])
DRV - [2005/10/10 23:49:00 | 03,530,432 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS
v4_mini.sys -- (nv [On_Demand | Running])
DRV - [2005/09/29 11:08:10 | 00,098,816 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS
vata.sys -- (nvata [Boot | Running])
DRV - [2005/07/29 19:11:02 | 00,034,048 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running])
DRV - [2005/07/29 19:11:04 | 00,012,928 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS
vnetbus.sys -- (nvnetbus [On_Demand | Running])
DRV - [2008/07/06 19:26:36 | 00,033,952 | ---- | M] () -- C:\WINDOWS\system32\drivers\oreans32.sys -- (oreans32 [System | Running])
DRV - [2001/08/29 02:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2007/03/08 09:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2005/11/03 20:39:02 | 00,245,504 | ---- | M] (Ralink Technology, Corp.) -- C:\WINDOWS\system32\DRIVERS\Dr71WU.sys -- (RT73 [On_Demand | Stopped])
DRV - [2004/07/17 23:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2005/08/10 22:44:04 | 00,050,688 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01 [Boot | Running])
DRV - [2005/05/16 23:20:39 | 00,006,656 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02 [Boot | Running])
DRV - [2005/11/04 00:40:07 | 00,063,488 | ---- | M] (Protection Technology) -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02 [Boot | Running])
DRV - [2008/02/22 03:15:04 | 00,715,248 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2004/04/02 01:30:56 | 00,047,087 | ---- | M] () -- C:\WINDOWS\System32\Drivers\Capt9150.sys -- (SQTECH9150 [On_Demand | Stopped])
DRV - [2008/02/27 03:10:44 | 00,051,176 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan [Boot | Running])
DRV - [2007/03/01 10:34:22 | 00,028,352 | ---- | M] (Avira GmbH) -- C:\WINDOWS\system32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running])
DRV - [2001/08/18 06:49:10 | 00,026,624 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\system32\DRIVERS\irstusb.sys -- (STIrUsb [On_Demand | Stopped])
DRV - [2004/08/04 08:07:56 | 00,059,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio [On_Demand | Stopped])
DRV - [2002/07/25 20:19:48 | 00,010,986 | ---- | M] (USB BULK) -- C:\WINDOWS\System32\Drivers\Bulk533.sys -- (USBCamera [On_Demand | Stopped])
DRV - [2008/07/09 09:05:22 | 00,394,952 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsdatant.sys -- (vsdatant [System | Running])
DRV - [2007/05/30 22:10:42 | 00,010,872 | ---- | M] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys -- (AvgAsCln [System | Stopped])
DRV - [2007/05/30 22:10:42 | 00,011,000 | ---- | M] () -- C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys -- (AVG Anti-Spyware Driver [System | Running])
 
[color=orange]========== Standard Registry (SafeList) ==========/color
 
 
[color=orange]========== Internet Explorer ==========/color
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/toolbar/ie8/sidebar.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = http://www.iesearch.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page Restore = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
 
 
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://media.telstra.com.au/home.html
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html
IE - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\S-1-5-21-1417001333-1292428093-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=orange]========== FireFox ==========/color
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.com/?gws_rd=ssl"
FF - prefs.js..extensions.enabledItems: fr-FR@dictionaries.addons.mozilla.org:2.0
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.3
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.1.8.5
FF - prefs.js..extensions.enabledItems: {ecdee021-0d17-467f-a1ff-c7a115230949}:1.5.41.0
FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10
FF - prefs.js..keyword.URL: "https://search.yahoo.com/web?fr=vmn"
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2008/04/28 21:21:41 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2008/04/28 21:21:41 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.14\extensions\Components: C:\PROGRAM FILES\MOZILLA THUNDERBIRD\COMPONENTS [2009/04/01 19:31:48 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.14\extensions\Plugins: C:\PROGRAM FILES\MOZILLA THUNDERBIRD\PLUGINS [2009/04/01 19:31:48 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.3.0\Extensions\Components: C:\PROGRAM FILES\NETSCAPE\NETSCAPE BROWSER\COMPONENTS [2009/04/01 19:31:48 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.1.3.0\Extensions\Plugins: C:\PROGRAM FILES\NETSCAPE\NETSCAPE BROWSER\PLUGINS [2009/04/01 19:31:48 | 00,000,000 | ---D | M]
 
[2009/01/15 23:23:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Extensions
[2009/01/15 23:23:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/05/04 12:35:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Firefox\Profiles\gk0x9401.default\extensions
[2009/04/16 10:33:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Firefox\Profiles\gk0x9401.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2008/12/10 19:11:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Firefox\Profiles\gk0x9401.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/04/16 10:33:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Firefox\Profiles\gk0x9401.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2008/06/22 15:20:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Firefox\Profiles\gk0x9401.default\extensions\{ecdee021-0d17-467f-a1ff-c7a115230949}
[2009/01/25 08:31:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\mozilla\Firefox\Profiles\gk0x9401.default\extensions\fr-FR@dictionaries.addons.mozilla.org
[2009/05/04 12:35:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2006/10/26 18:15:13 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/04/28 21:21:41 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2007/06/13 02:30:15 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
[2008/06/06 07:59:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\search@searchsettings.com
[2008/04/28 21:21:36 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2008/04/28 21:21:36 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2006/09/10 21:35:08 | 00,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2008/09/28 17:10:26 | 00,000,757 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2008/04/16 14:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2006/09/10 21:35:08 | 00,000,748 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\MediaDICO-fr.xml
[2008/03/29 23:59:44 | 00,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2006/09/13 04:49:04 | 00,000,652 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml
 
O1 HOSTS File: (193010 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	1001-search.info
O1 - Hosts: 127.0.0.1	www.1001-search.info
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	123topsearch.com
O1 - Hosts: 127.0.0.1	www.123topsearch.com
O1 - Hosts: 127.0.0.1	132.com
O1 - Hosts: 127.0.0.1	www.132.com
O1 - Hosts: 127.0.0.1	136136.net
O1 - Hosts: 127.0.0.1	www.136136.net
O1 - Hosts: 6834 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (VMN Toolbar) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\Program Files\vmntoolbar\vmntoolbar.dll (Visicom Media Inc.                           )
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - Reg Error: Key error. File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (no name) - {D032570A-5F63-4812-A094-87D007C23012} - Reg Error: Key error. File not found
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (VMN Toolbar) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\Program Files\vmntoolbar\vmntoolbar.dll (Visicom Media Inc.                           )
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\..\Toolbar\ShellBrowser: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\Program Files\vmntoolbar\vmntoolbar.dll (Visicom Media Inc.                           )
O3 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\Program Files\vmntoolbar\vmntoolbar.dll (Visicom Media Inc.                           )
O3 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\..\Toolbar\WebBrowser: (no name) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized (GRISOFT s.r.o.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Alpha Networks Inc.)
O4 - HKLM..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min (Avira GmbH)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
TrayFw.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /install ()
O4 - HKLM..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (Zone Labs, LLC)
O4 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003..\Run: [AlcoholAutomount] "D:\Alcohol Soft\Alcohol 120\axcmd.exe" /automount (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003..\Run: [EPSON Stylus TX400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEGP.EXE /FU "C:\WINDOWS\TEMP\E_S10D.tmp" /EF "HKCU" (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\Rico\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Rico\Menu Démarrer\Programmes\Démarrage\MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceClassicControlPanel = 1
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 64
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O9 - Extra 'Tools' menuitem : Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin
pjpi150_09.dll (Sun Microsystems, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\WINDOWS\system32
vappfilter.dll (NVIDIA)
O15 - HKLM\..Trusted Domains: 30 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 30 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 30 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-19\..Trusted Domains: 30 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-20\..Trusted Domains: 30 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003\..Trusted Domains: 30 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-1417001333-1292428093-839522115-1003 Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O28 - HKLM ShellExecuteHooks: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll (GRISOFT s.r.o.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/10/26 01:59:01 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0129bc9a-7e72-11dc-b0bc-001731143500}\Shell\Auto\command - "" = AdobeR.exe e
O33 - MountPoints2\{69a8834f-3b77-11dd-b204-001731143500}\Shell\AutoRun\command - "" = J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\driver.exe -- File not found
O33 - MountPoints2\{69a8834f-3b77-11dd-b204-001731143500}\Shell\open\command - "" = J:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\driver.exe -- File not found
O33 - MountPoints2\{790b995b-15b2-11dc-936c-001731143500}\Shell - "" = AutoRun
O33 - MountPoints2\{b6693822-463d-11dd-b226-001731143500}\Shell\AutoRun\command - "" = F:\setupSNK.exe -- File not found
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
 
[color=orange]========== Files/Folders - Created Within 30 Days ==========/color
 
[1 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[2009/05/04 22:33:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Rico\Application Data\Grisoft
[2009/05/04 22:33:21 | 00,000,849 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\AVG Anti-Spyware.lnk
[2009/05/04 22:33:14 | 00,010,872 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\AvgAsCln.sys
[2009/05/04 22:33:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2009/05/04 22:33:09 | 00,000,000 | ---D | C] -- C:\Program Files\Grisoft
[2009/05/04 21:46:01 | 00,118,106 | ---- | C] () -- C:\Documents and Settings\Rico\Mes documents\cc_20090504_2145.reg
[2009/05/04 00:07:00 | 00,000,185 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\Virus sur mon puter.rtf
[2009/05/03 14:43:03 | 16,409,960 | ---- | C] (Safer Networking Limited                                    ) -- C:\Documents and Settings\Rico\Bureau\spybotsd162.exe
[2009/05/02 10:52:36 | 00,000,352 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\Samedi 02-05-09.rtf
[2009/05/02 10:23:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Rico\Bureau\Sent 02-05-09
[2009/05/01 19:42:19 | 00,003,297 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\Childern of the revolution.rtf
[2009/05/01 13:07:26 | 00,020,164 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\FileZilla_3.2.4.1_win32-setup.exe
[2009/04/29 23:38:52 | 00,000,239 | ---- | C] () -- C:\Documents and Settings\Rico\Mes documents\Mail Comics Guy.rtf
[2009/04/29 18:31:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Rico\Bureau\A envoyer mec Comics
[2009/04/28 18:00:21 | 00,000,297 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\Site à contacter.rtf
[2009/04/27 23:22:39 | 00,000,836 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\Taxe Info.rtf
[2009/04/27 14:41:33 | 00,005,120 | -HS- | C] () -- C:\Documents and Settings\Rico\Mes documents\Thumbs.db
[2009/04/26 19:10:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Rico\Mes documents\³Ø½¼ ÇÃ·¯±×
[2009/04/26 18:56:55 | 00,001,497 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Combat Arms.lnk
[2009/04/26 18:54:42 | 00,000,000 | ---D | C] -- C:\Nexon
[2009/04/26 18:54:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2009/04/26 18:10:51 | 77,827,1398 | ---- | C] (Nexon) -- C:\Documents and Settings\Rico\Bureau\CombatArmsSetupV21.exe
[2009/04/26 18:10:12 | 00,000,595 | ---- | C] () -- C:\Documents and Settings\Rico\Mes documents\Games.rtf
[2009/04/26 18:06:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2009/04/26 18:05:37 | 00,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2009/04/25 02:01:44 | 00,002,680 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\A flanc de certitude Tab.rtf
[2009/04/25 01:22:53 | 15,395,960 | ---- | C] (W3i, LLC) -- C:\Documents and Settings\Rico\Bureau\flvplayer_setup.exe
[2009/04/25 01:20:50 | 00,000,000 | ---D | C] -- C:\Program Files\YouTUBE (TM) movie downloader
[2009/04/22 23:34:56 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2009/04/22 23:23:12 | 00,000,000 | -H-D | C] -- C:\WINDOWS\msdownld.tmp
[2009/04/22 23:23:00 | 00,000,000 | ---D | C] -- C:\WINDOWS\WBEM
[2009/04/22 23:22:38 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
[2009/04/22 18:40:22 | 00,113,171 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\vistathemes.jpg
[2009/04/22 17:41:05 | 00,000,432 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\Freelance Australia.lnk
[2009/04/20 00:42:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Rico\Mes documents\WORLI - West Of The Ranges Landcare Inc
[2009/04/16 12:50:11 | 00,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn
[2009/04/16 12:50:11 | 00,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for
[2009/04/09 12:14:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Rico\Application Data\FileZilla
[2009/04/09 12:13:13 | 00,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client
[2009/04/06 22:27:31 | 00,000,000 | ---D | C] -- C:\Program Files\Kraken
[2009/04/06 19:16:52 | 00,001,659 | ---- | C] () -- C:\Documents and Settings\Rico\Bureau\DOSBox 0.72.lnk
[2009/04/06 19:16:51 | 00,000,000 | ---D | C] -- C:\Program Files\DOSBox-0.72
[2009/04/06 19:11:45 | 00,000,000 | ---D | C] -- C:\oldies
[2009/04/06 18:31:18 | 02,268,231 | ---- | C] () -- C:\Documents and Settings\Rico\Mes documents\Portfolio 2009.pdf
[2009/03/30 15:20:13 | 00,049,152 | ---- | C] () -- C:\WINDOWS\System32\JJAKEn.dll
[2009/03/26 15:58:20 | 00,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2009/03/19 15:33:43 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/16 16:51:02 | 00,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2009/01/29 21:41:44 | 00,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2009/01/29 21:35:13 | 00,000,025 | ---- | C] () -- C:\WINDOWS\CDETX400ASIA.ini
[2008/11/06 22:12:16 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2008/07/08 13:41:26 | 00,000,008 | ---- | C] () -- C:\WINDOWS\save.ini
[2008/07/06 19:26:36 | 00,033,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\oreans32.sys
[2008/02/22 03:15:04 | 00,715,248 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008/01/28 21:32:34 | 00,047,087 | ---- | C] () -- C:\WINDOWS\System32\drivers\Capt9150.sys
[2008/01/28 21:32:34 | 00,023,979 | ---- | C] () -- C:\WINDOWS\System32\drivers\Camd9150.sys
[2008/01/21 08:27:14 | 00,000,106 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008/01/21 06:45:12 | 00,000,050 | ---- | C] () -- C:\WINDOWS\System32\PCRCVersion.ini
[2007/10/20 02:46:10 | 00,000,000 | ---- | C] () -- C:\WINDOWS\OODCNT.INI
[2007/10/20 00:48:17 | 00,021,904 | ---- | C] () -- C:\WINDOWS\System32\imsinstall_loc040c.dll
[2007/10/20 00:48:17 | 00,017,808 | ---- | C] () -- C:\WINDOWS\System32\imslsp_install_loc040c.dll
[2007/10/19 21:51:17 | 00,135,168 | R--- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2007/09/14 19:53:06 | 00,000,041 | ---- | C] () -- C:\WINDOWS\config.ini
[2007/08/27 06:19:56 | 00,000,761 | ---- | C] () -- C:\WINDOWS\m3jp2k.ini
[2007/08/27 06:19:56 | 00,000,714 | ---- | C] () -- C:\WINDOWS\m3jpeg.ini
[2007/08/27 06:19:56 | 00,000,702 | ---- | C] () -- C:\WINDOWS\mmtvmj.ini
[2007/08/27 06:19:53 | 00,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2007/08/27 06:19:51 | 00,152,064 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2007/08/24 08:13:10 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2007/08/24 08:13:10 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2007/08/24 08:13:10 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2007/08/24 08:01:44 | 00,000,343 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/08/15 10:47:45 | 00,003,875 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/06/19 10:28:37 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007/03/20 08:46:38 | 00,000,163 | ---- | C] () -- C:\WINDOWS\Setup533.ini
[2007/03/20 08:31:46 | 00,002,204 | ---- | C] () -- C:\WINDOWS\System32\drivers\UNINST2K.SYS
[2007/03/20 08:31:46 | 00,001,225 | ---- | C] () -- C:\WINDOWS\SMSHELL.INI
[2007/03/20 08:31:43 | 00,004,231 | ---- | C] () -- C:\WINDOWS\System32\Dfusbpdr.ini
[2006/12/06 07:07:26 | 00,761,856 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2006/12/06 07:07:26 | 00,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2006/12/06 07:07:25 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2006/12/06 07:07:24 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2006/12/06 07:07:24 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006/10/26 02:17:32 | 00,021,149 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2006/10/26 02:17:32 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2006/10/26 02:17:25 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2006/10/26 01:59:09 | 00,069,632 | ---- | C] () -- C:\WINDOWS\LC.dll
[2006/10/26 01:59:08 | 00,081,920 | ---- | C] () -- C:\WINDOWS\Calendar.dll
[2006/10/26 01:59:08 | 00,004,336 | ---- | C] () -- C:\WINDOWS\LClock.ini
[2006/10/26 01:59:08 | 00,003,166 | ---- | C] () -- C:\WINDOWS\Calendar.ini
[2006/10/26 01:59:08 | 00,000,182 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/10/26 01:59:08 | 00,000,002 | ---- | C] () -- C:\WINDOWS\Events.ini
[2005/10/10 23:49:00 | 01,662,976 | ---- | C] () -- C:\WINDOWS\System32
vwdmcpl.dll
[2005/10/10 23:49:00 | 01,466,368 | ---- | C] () -- C:\WINDOWS\System32
view.dll
[2005/10/10 23:49:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32
vwimg.dll
[2005/10/10 23:49:00 | 00,573,440 | ---- | C] () -- C:\WINDOWS\System32
vhwvid.dll
[2005/10/10 23:49:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32
vshell.dll
[2005/10/10 23:49:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32
vnt4cpl.dll
[2005/10/10 23:49:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32
vapi.dll
[2004/07/17 23:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2001/08/29 02:00:00 | 00,009,484 | ---- | C] () -- C:\WINDOWS\system.ini
[2001/08/29 02:00:00 | 00,000,462 | ---- | C] () -- C:\WINDOWS\win.ini
[1997/06/14 10:56:08 | 00,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
 
[color=orange]========== Files - Modified Within 30 Days ==========/color
 
[1 C:\WINDOWS\System32\*.tmp files]
[5 C:\WINDOWS\*.tmp files]
[2009/05/05 00:31:21 | 19,259,424 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2009/05/04 22:33:21 | 00,000,849 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\AVG Anti-Spyware.lnk
[2009/05/04 21:46:08 | 00,118,106 | ---- | M] () -- C:\Documents and Settings\Rico\Mes documents\cc_20090504_2145.reg
[2009/05/04 10:28:24 | 00,358,381 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009/05/04 10:28:22 | 00,039,291 | ---- | M] () -- C:\WINDOWS\System32
vapps.xml
[2009/05/04 10:27:45 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Rico\Local Settings\desktop.ini
[2009/05/04 10:27:41 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/05/04 10:27:35 | 01,174,833 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2009/05/04 00:07:12 | 00,227,504 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2009/05/04 00:07:00 | 00,000,185 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\Virus sur mon puter.rtf
[2009/05/03 14:16:54 | 00,003,297 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\Childern of the revolution.rtf
[2009/05/03 12:22:12 | 16,409,960 | ---- | M] (Safer Networking Limited                                    ) -- C:\Documents and Settings\Rico\Bureau\spybotsd162.exe
[2009/05/03 11:08:14 | 00,000,591 | ---- | M] () -- C:\Documents and Settings\Rico\Mes documents\Mes dossiers de partage.lnk
[2009/05/02 10:52:36 | 00,000,352 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\Samedi 02-05-09.rtf
[2009/05/02 09:44:35 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/05/01 13:24:04 | 00,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[2009/05/01 13:07:31 | 00,020,164 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\FileZilla_3.2.4.1_win32-setup.exe
[2009/04/29 23:38:52 | 00,000,239 | ---- | M] () -- C:\Documents and Settings\Rico\Mes documents\Mail Comics Guy.rtf
[2009/04/29 11:15:45 | 00,000,836 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\Taxe Info.rtf
[2009/04/28 18:00:21 | 00,000,297 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\Site à contacter.rtf
[2009/04/27 20:58:44 | 00,002,680 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\A flanc de certitude Tab.rtf
[2009/04/27 14:41:35 | 00,005,120 | -HS- | M] () -- C:\Documents and Settings\Rico\Mes documents\Thumbs.db
[2009/04/27 14:23:20 | 00,009,484 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/04/27 14:23:20 | 00,000,462 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/04/27 14:23:20 | 00,000,212 | -HS- | M] () -- C:\boot.ini
[2009/04/27 13:40:57 | 00,001,000 | ---- | M] () -- C:\WINDOWS	asks\Google Software Updater.job
[2009/04/26 18:56:55 | 00,001,497 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Combat Arms.lnk
[2009/04/26 18:42:48 | 77,827,1398 | ---- | M] (Nexon) -- C:\Documents and Settings\Rico\Bureau\CombatArmsSetupV21.exe
[2009/04/26 18:10:32 | 00,000,595 | ---- | M] () -- C:\Documents and Settings\Rico\Mes documents\Games.rtf
[2009/04/26 15:11:13 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2009/04/25 01:22:53 | 15,395,960 | ---- | M] (W3i, LLC) -- C:\Documents and Settings\Rico\Bureau\flvplayer_setup.exe
[2009/04/22 23:36:26 | 00,000,076 | -HS- | M] () -- C:\Documents and Settings\Rico\Mes documents\desktop.ini
[2009/04/22 18:40:22 | 00,113,171 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\vistathemes.jpg
[2009/04/22 17:41:13 | 00,000,432 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\Freelance Australia.lnk
[2009/04/16 12:50:11 | 00,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for
[2009/04/06 19:16:52 | 00,001,659 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\DOSBox 0.72.lnk
[2009/04/06 18:31:18 | 02,268,231 | ---- | M] () -- C:\Documents and Settings\Rico\Mes documents\Portfolio 2009.pdf
[2009/04/06 16:31:25 | 00,001,380 | ---- | M] () -- C:\Documents and Settings\Rico\Bureau\calc.exe.lnk
[2009/04/06 14:25:28 | 00,000,250 | ---- | M] () -- C:\Documents and Settings\Rico\Application Data\default.rss
[2009/04/06 14:25:27 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
 
[color=orange]========== LOP Check ==========/color
 
[2009/05/04 22:33:10 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2009/03/23 15:21:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2006/10/27 00:54:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe Systems
[2007/10/12 17:40:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2007/10/12 17:40:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/11/06 21:59:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avira
[2006/11/24 07:17:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CyberLink
[2008/04/29 10:18:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DVD Shrink
[2008/11/11 23:28:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
[2008/07/31 21:39:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Emotum
[2009/01/29 21:40:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2007/07/13 02:51:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google
[2009/04/26 14:13:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google Updater
[2009/05/04 22:33:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/11/06 21:49:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Macromedia
[2007/10/20 00:48:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/05/04 21:20:49 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/03/26 15:48:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nero
[2009/04/26 19:10:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2007/08/26 19:18:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data
View_Profiles
[2009/04/26 18:10:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2007/06/13 02:30:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Skype
[2007/11/11 23:14:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2008/01/21 19:19:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2008/07/31 19:45:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2009/01/29 21:46:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UDL
[2006/10/26 02:33:01 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Application Data
[2006/10/26 01:58:46 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft
[2006/10/26 02:04:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data
[2006/10/26 01:58:46 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2006/10/26 02:04:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data
[2006/10/26 01:58:46 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/05/04 22:33:29 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\Rico\Application Data
[2007/08/16 18:51:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Acoustica
[2009/03/12 19:32:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Adobe
[2006/11/18 19:05:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\AdobeUM
[2009/03/19 15:33:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Ahead
[2007/10/15 05:54:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Apple Computer
[2007/06/19 02:22:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Azureus
[2008/03/27 22:35:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Canon
[2006/11/24 07:17:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\CyberLink
[2008/07/01 22:49:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\dvdcss
[2009/03/05 13:28:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\EPSON
[2009/05/01 14:04:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\FileZilla
[2008/04/01 07:39:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\FUJIFILM
[2009/01/17 10:36:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Google
[2009/05/04 22:33:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Grisoft
[2007/08/13 20:33:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Help
[2006/10/26 02:04:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Identities
[2009/01/29 21:41:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\InstallShield
[2009/05/04 21:20:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Lavasoft
[2008/10/22 19:41:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\LimeWire
[2008/11/06 21:53:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Macromedia
[2006/12/06 07:08:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Media Player Classic
[2009/03/30 15:24:11 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Rico\Application Data\Microsoft
[2009/01/15 23:23:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Mozilla
[2009/03/26 18:04:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Nero
[2009/03/26 20:10:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Netscape
[2007/09/08 09:16:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Opera
[2009/03/16 17:35:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Privacy components
[2008/08/08 19:49:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Real
[2008/06/06 09:05:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Search Settings
[2007/01/21 04:56:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\SecondLife
[2008/11/23 22:29:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Skype
[2007/08/13 20:08:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Sony Setup
[2006/12/28 04:17:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Sun
[2008/06/19 16:23:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\TaoUSign
[2008/07/31 22:01:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Telstra
[2008/06/27 18:18:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\Thunderbird
[2007/07/03 07:47:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\vlc
[2009/05/03 11:19:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\vmntoolbar
[2007/09/14 19:49:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\WinRAR
[2009/03/28 12:28:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Rico\Application Data\YouSendIt
[2001/08/29 02:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/04/27 13:40:57 | 00,001,000 | ---- | M] () -- C:\WINDOWS\Tasks\Google Software Updater.job
[2006/10/26 02:05:09 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT
 
[color=orange]========== Purity Check ==========/color
 
< End of report >

Ainsi le rapport Extras (je sais pas ce que c'est, OTListIt m'a fait 2 fichiers Txt):

OTListIt Extras logfile created on: 05/05/2009 00:34:08 - Run 1

Lyonnais92 · Answer

Re,

mes questions me permettraient de réagir efficacement en cas de coup dur et de prévenir les risques :

sauvegarde tes données. C'est une nécessité en soi. C'est une nécessité absolue dès lors que tu en as un usage professionnel.

2 infections visibles.

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

    * Lance l'installation du programme en exécutant le fichier téléchargé.
    * Double-clique maintenant sur le raccourci de Toolbar-S&D.
    * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
    * Choisis maintenant l'option  "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

==================

Ouvre ce lien  (merci a S!RI pour ce programme). http://siri.urz.free.fr/Fix/SmitfraudFix.php
et télécharge SmitfraudFix.exe.

Regarde le tuto
Exécute le en choisissant l’option 1, il va générer un rapport
Copie/colle le sur le poste stp.

===================

une vérif supplémentaire :

Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

--> Clique droit sur le raccourci UsbFix sur ton Bureau et choisis Exécuter en tant qu'administrateur.

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)

Lyonnais92 · Answer

Bonjour,

téléphone et carte mémoire pas nécessaire.

============

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau

# choisis l'option 2 ( Suppression )

# Ton bureau disparaitra et le pc redémarrera .

# Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

# Ensuite poste le rapport UsbFix.txt qui apparaitra avec le Bureau .

# Note : Le rapport UsbFix.txt est sauvegardé à la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

===================
    Démarre en mode sans échec :
    Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
    Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
    (Si F8 ne marche pas utilise la touche F5).
    ----------------------------------------------------------------------------
    Relance le programme Smitfraud,
    Cette fois choisit l’option 2, répond oui a tous ;
    Sauvegarde le rapport,

 Redémarre en mode normal, 

copie/colle le rapport sauvegardé sur le forum

================================
Refais tourner OTListIt2 (Runscan) et poste le rapport.

Comment va l'ordi ?

Lyonnais92 · Answer

Re,

pour savoir si "c'est propre", j'ai besoin d'un nouveau rapport de OTList2.

Il me semble que tout n'est pas parti.

==

Pour le PC de ta copine, garde les rapports. On verra après.

Dis moi juste si tu as fait tourner Toolbar S&D ('cest le premier outil qui soigne dans ce que je t'ai fait faire)

Lyonnais92 · Answer

Re,

1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :

https://download.cnet.com/Malwarebytes/3000-8022_4-10804572.html

3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

7) Dans l'onglet analyse, vérifie que "Exécuter une analyse rapide"  est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

12) Ferme MBAM en cliquant sur Quitter.

13) Poste le rapport dans ta réponse

Lyonnais92 · Answer

Bonjour,

un rogue et une toolbar infectée ne me semblent pas faire courir de risques de ce côté la.

Comment se comporte ton ordi ?

Si il va bien, on va désinfecter l'autre (et on finira ensemble les dernières opérations).

Envoie moi le rapport d'OTList2

Lyonnais92 · Answer

Bonjour,

désolé, c'est l'autre rapport qu'il me faut en priorité.

Lyonnais92 · Answer

Bonjour,

on peut entamer la désinfection de l'ordi de ta copine.

Mais me faut "l'autre" rapport de OTListIt de son ordi.

Lenteur PC + internet = virus?

9 réponses

Votre réponse

Newsletters