Infecté par win32/heur
Bonjour,
depuis hier, avg m indique que je suis infecté par win32/heur. Je n arrive pas à virer ce virus et je ne sais pas si il y a un lien de cause a effet, nero ne reconnait plus mon graveur, et chose etrange quand je met un dvd vierge dans celui ci, je ne peux plus ouvrir le tiroir car il m est indiqué que mon lecteur est en cours d utilisation...
Comment me debarrasser de win32/heur ?
Merci:
Ps: c est mon premier cas d infection donc n hesitez pas a m indiquer les logiciels a utiliser et quel rapport vous envoyer!
depuis hier, avg m indique que je suis infecté par win32/heur. Je n arrive pas à virer ce virus et je ne sais pas si il y a un lien de cause a effet, nero ne reconnait plus mon graveur, et chose etrange quand je met un dvd vierge dans celui ci, je ne peux plus ouvrir le tiroir car il m est indiqué que mon lecteur est en cours d utilisation...
Comment me debarrasser de win32/heur ?
Merci:
Ps: c est mon premier cas d infection donc n hesitez pas a m indiquer les logiciels a utiliser et quel rapport vous envoyer!
Configuration: Windows Vista Firefox 3.0.10
26 réponses
Résumé de la discussion
La discussion porte sur une détection AVG de win32/heur et des symptômes sur Windows Vista, notamment un graveur Nero qui ne répond plus et un tiroir bloqué. La meilleure réponse s'appuie sur un rapport détaillé généré par HijackThis et des analyses RSIT pour repérer les éléments suspects dans les processus et le démarrage et estimer l'étendue de l'infection. Le contenu du rapport énumère des éléments suspects, tels que des BHO et barres d’outils (Yahoo!, AVG Safe Search) ainsi que des programmes au démarrage et des entrées de registre. D'autres éléments ajoutent une dimension pratique, comme la présence de rapports d'analyse et d'outils de correction (RSIT, Malwarebytes, ComboFix) et des indices de modifications système.
-
ModérateurBonjour,
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit. -
Contributeur sécuritébonjour, je retire mon intervention et te laisses avec destrio5, @+
-
Voici le rapport log
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-05-31 17:58:50
Microsoft® Windows Vista™ Édition Intégrale Service Pack 2
System drive C: has 7 GB (24%) free of 30 GB
Total RAM: 2046 MB (59% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:59:03, on 31/05/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
D:\programme\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
D:\programme\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrateur\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unattendshare.free.fr/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programme\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: RocketDock -.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Unknown owner - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
-
ModérateurPeux-tu poster le dernier rapport de MBAM ?
-
je viens de lancer l analyse.
J ai lance l analyse profonde... la rapide aurait elle été suffisante ? -
ModérateurTu n'avais pas déjà fait un scan ?
-
Non, je n avais fait que le scan RSIT
le scan de malware est en cours -
ModérateurOk, tu me posteras le rapport.
-
Aie
soucis: le scan bugge au bout d une vingtaine de minute (j avais essayé en scan rapide, mais bug aussi) -
Modérateur/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix -
voici le rapport de combofix
ComboFix 09-05-30.06 - Administrateur 31/05/2009 18:46.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.33.1036.18.2046.1031 [GMT 2:00]
Lancé depuis: d:\téléchargement\ComboFix.exe
FW: Look 'n' Stop 2.06p3 (Soft4Ever) *enabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\drivers\kungsfdnbwecsp.sys
c:\windows\system32\drivers\kungsfdnbwecsp.sys.rmv
c:\windows\system32\kungsfawlxdyoc.dat
c:\windows\system32\kungsfawlxdyoc.dat.rmv
c:\windows\system32\kungsfepvtemes.dat
c:\windows\system32\kungsfkimgdxpx.dll
c:\windows\system32\kungsfkimgdxpx.dll.rmv
c:\windows\system32\kungsftvybitop.dll
c:\windows\system32\kungsftvybitop.dll.rmv
----- BITS: Il y a peut-être des sites infectés -----
hxxp://binuser.fileave.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_kungsfiuhcrrrj
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-31 ))))))))))))))))))))))))))))))))))))
.
2009-05-31 16:50 . 2009-05-31 16:50 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- c:\program files\trend micro
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- C:\rsit
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\programdata\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-30 12:05 . 2009-05-31 16:36 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-30 01:46 . 2009-05-30 01:46 48640 ----a-w- C:\Iexplor179.exe
2009-05-28 20:47 . 2009-05-28 20:47 25600 ----a-w- C:\Iexplor171.exe
2009-05-28 18:17 . 2009-05-28 18:17 -------- d-----w- c:\program files\Microsoft Works
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\windows\PCHEALTH
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\program files\Microsoft.NET
2009-05-28 18:14 . 2009-05-28 18:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-28 18:13 . 2009-05-28 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Microsoft Help
2009-05-28 18:13 . 2009-05-28 18:18 -------- d-----w- c:\programdata\Microsoft Help
2009-05-28 18:10 . 2009-05-28 18:10 -------- d--h--r- C:\MSOCache
2009-05-28 17:46 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Local\QuickPar
2009-05-27 04:57 . 2009-05-31 16:35 -------- d-----r- c:\users\Public\Recorded TV
2009-05-21 16:45 . 2009-05-21 16:45 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Nero
2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\programdata\SlySoft
2009-05-21 16:29 . 2009-05-21 16:38 -------- d-----w- c:\programdata\DVD Shrink
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Yahoo!
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\programdata\Yahoo! Companion
2009-05-18 19:39 . 2009-05-21 13:59 -------- d-----w- c:\users\Administrateur\AppData\Roaming\uTorrent
2009-05-18 17:28 . 2009-05-18 17:28 10134 ----a-r- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-05-18 17:28 . 2009-05-18 17:28 -------- d-----w- c:\program files\Microsoft WSE
2009-05-18 17:23 . 2009-05-18 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-05-18 17:14 . 2009-05-18 17:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\DAEMON Tools Lite
2009-05-18 15:13 . 2009-05-16 20:34 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-18 15:13 . 2009-05-16 20:34 12552 ----a-w- c:\programdata\avg8\update\backup\avgrkx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 107912 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-18 15:13 . 2009-05-16 20:34 325640 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 485144 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-18 15:13 . 2009-05-16 20:34 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-18 15:10 . 2009-05-16 20:34 1057024 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe
2009-05-18 15:10 . 2009-05-16 20:34 745240 ----a-w- c:\programdata\avg8\update\backup\avginet.dll
2009-05-18 15:10 . 2009-05-16 20:34 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-18 15:10 . 2009-05-16 20:34 1424152 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-05-17 15:12 . 2009-05-17 15:12 -------- d-----w- c:\programdata\WindowsSearch
2009-05-17 15:08 . 2009-05-17 15:08 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Media Player Classic
2009-05-17 13:28 . 2009-05-17 14:33 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:34 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:28 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-17 13:28 . 2009-03-19 14:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-17 13:28 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-17 13:27 . 2009-05-17 13:27 -------- d-----w- c:\program files\iPod
2009-05-17 13:27 . 2009-05-17 13:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-17 13:26 . 2009-05-17 13:27 -------- d-----w- c:\program files\Common Files\Apple
2009-05-17 13:23 . 2009-05-17 13:23 -------- d-----w- c:\program files\Bonjour
2009-05-17 13:22 . 2009-05-17 13:27 -------- d-----w- c:\programdata\Apple Computer
2009-05-17 13:22 . 2009-05-17 13:23 -------- d-----w- c:\program files\QuickTime
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\program files\Apple Software Update
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\programdata\Apple
2009-05-17 13:04 . 2009-05-17 13:04 -------- d-----w- c:\programdata\FLEXnet
2009-05-17 12:38 . 2009-05-17 12:41 -------- d-----w- c:\users\Administrateur\AppData\Local\looknstop
2009-05-17 11:56 . 2009-05-17 11:56 -------- d-----w- c:\programdata\ALM
2009-05-17 11:41 . 2009-05-17 11:41 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-17 11:16 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2009-05-17 11:07 . 2009-05-17 11:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-17 11:04 . 2009-05-17 11:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-17 10:54 . 2009-05-17 10:54 79232 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-05-17 10:54 . 2009-05-17 10:54 58232 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-05-17 10:54 . 2009-05-17 10:54 36864 ----a-w- c:\windows\system32\fwapi.dll
2009-05-17 10:53 . 2009-05-17 10:55 -------- d-----w- c:\program files\Soft4Ever
2009-05-17 10:37 . 2009-05-17 10:38 -------- d-----w- c:\program files\NewsBin
2009-05-17 10:28 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Roaming\NewsBin
2009-05-17 10:28 . 2009-05-17 10:28 -------- d-----w- c:\programdata\NewsBin
2009-05-17 10:19 . 2009-05-17 10:26 -------- d-----w- c:\users\Administrateur\AppData\Roaming\GrabIt
2009-05-17 10:12 . 2009-05-17 10:12 -------- d-----w- c:\program files\GrabIt
2009-05-16 21:31 . 2009-05-16 21:31 -------- d-----w- c:\program files\Sunbelt Software
2009-05-16 21:19 . 2009-05-16 21:19 0 ----a-w- c:\windows\nsreg.dat
2009-05-16 21:19 . 2009-05-16 21:35 -------- d-----w- c:\users\Administrateur\AppData\Local\Thunderbird
2009-05-16 21:19 . 2009-05-16 21:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Thunderbird
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\programdata\ATI
2009-05-16 20:41 . 2009-05-16 20:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-05-16 20:34 . 2009-05-18 15:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-16 20:34 . 2009-05-18 15:12 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-16 20:34 . 2009-05-18 15:12 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-16 20:34 . 2009-05-18 15:12 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-16 20:34 . 2009-05-31 09:47 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-16 20:34 . 2009-05-18 15:12 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-16 20:34 . 2009-05-31 13:11 -------- d-----w- c:\programdata\avg8
2009-05-16 20:34 . 2009-05-16 20:34 -------- d-----w- c:\program files\AVG
2009-05-16 20:27 . 2009-05-16 20:27 9158 ----a-w- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-05-16 20:27 . 2009-05-16 20:27 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-05-16 20:19 . 2009-05-16 20:19 -------- d-----w- C:\WPI
2009-05-16 20:19 . 2007-03-01 13:38 4390912 ----a-w- c:\windows\RtHDVCpl.exe
2009-05-16 20:19 . 2007-01-16 08:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-05-16 20:19 . 2009-05-16 20:25 -------- d-----w- C:\drivers
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Cooliris
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Xtremsplit
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Microsoft
2009-05-16 20:09 . 2009-05-31 14:42 -------- d-----w- c:\users\Administrateur\AppData\Local\Downloaded Installations
2009-05-16 20:09 . 2009-05-16 20:09 -------- d---a-w- C:\WPI_Audio
2009-05-16 20:06 . 2009-05-28 19:25 78736 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-16 20:06 . 2009-05-16 20:06 -------- d-----w- c:\program files\System
2009-05-16 20:06 . 2009-03-31 14:21 345670 ----a-w- c:\windows\Windows 7_Calculator.exe
2009-05-16 20:06 . 2009-03-31 02:39 412813 ----a-w- c:\windows\Wordpad_2009.exe
2009-05-16 20:05 . 2008-03-21 23:16 1347584 ----a-w- c:\programdata\Nero\DrWeb\DRWEB32.DLL
2009-05-16 20:05 . 2009-05-31 14:36 -------- d-----w- c:\program files\Common Files\Nero
2009-05-16 20:05 . 2009-05-31 14:30 -------- d-----w- c:\programdata\Nero
2009-05-16 20:05 . 2009-05-31 14:26 -------- d-----w- c:\program files\Nero
2009-05-16 20:05 . 2009-05-16 20:05 -------- d-----w- c:\program files\7-Zip
2009-05-16 20:05 . 2009-05-26 04:46 -------- d-----w- c:\windows\system32\Macromed
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-16 19:42 . 2009-05-31 15:01 -------- d-sh--w- c:\windows\Installer
2009-05-16 19:42 . 2009-05-18 17:14 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Notepad2
2009-05-16 19:33 . 2009-05-16 21:10 -------- d-----w- c:\windows\system32\RTCOM
2009-05-16 19:33 . 2009-05-16 19:33 -------- d-----w- c:\program files\Realtek
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 16:44 . 2009-04-12 15:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-31 16:44 . 2008-01-21 08:04 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 16:44 . 2008-01-21 08:04 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-28 18:16 . 2006-11-02 12:35 -------- d-----w- c:\program files\MSBuild
2009-05-17 13:31 . 2009-05-17 13:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 12:46 . 2009-05-16 20:12 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-16 21:42 . 2009-05-16 20:12 -------- d-----w- c:\program files\FileZilla
2009-05-16 20:36 . 2009-05-16 19:43 680 ----a-w- c:\users\Administrateur\AppData\Local\d3d9caps.dat
2009-05-16 20:27 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI Technologies
2009-05-16 20:26 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Java
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\HashTab Shell Extension
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\PowerISO
2009-05-16 20:11 . 2009-05-16 20:10 -------- d-----w- c:\program files\Windows Live
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Resource Hacker
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\QuickPar
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Yahoo!
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\programdata\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\ACD Systems
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Modèles
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Menu Démarrer
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Favoris
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Documents
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Bureau
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\program files\Fichiers communs
2009-05-16 19:27 . 2009-05-16 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-04-19 12:12 . 2009-04-19 12:12 -------- d-----w- c:\program files\CCleaner
2009-04-19 12:11 . 2009-04-19 12:11 -------- d-----w- c:\program files\uTorrent
2009-04-19 08:41 . 2006-11-02 07:26 30051328 ----a-w- c:\windows\system32\imageres.dll
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\IconWorkshopPortable
2009-04-17 11:49 . 2009-04-17 13:10 -------- d-----w- c:\program files\RocketDock
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\Diskeeper
2009-04-17 11:48 . 2009-04-17 13:09 -------- d-----w- c:\program files\PhotoshopPortable
2009-04-17 11:47 . 2009-04-17 13:09 -------- d-----w- c:\program files\NeroPortable
2009-04-14 18:21 . 2009-04-14 18:21 705024 ----a-w- c:\windows\system32\sbe.dll
2009-04-14 18:19 . 2009-04-14 18:19 604672 ----a-w- c:\windows\system32\CPFilters.dll
2009-04-14 18:19 . 2009-04-14 18:19 450048 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-14 18:19 . 2009-04-14 18:19 153088 ----a-w- c:\windows\system32\sbeio.dll
2009-04-14 18:05 . 2009-04-14 18:05 -------- d-----w- c:\program files\Hyper-V
2009-04-14 18:05 . 2009-04-14 18:05 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-04-14 18:05 . 2009-04-14 18:05 43544 ----a-w- c:\windows\system32\wups2.dll
2009-04-14 18:05 . 2009-04-14 18:05 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-04-14 18:05 . 2009-04-14 18:05 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-04-14 18:05 . 2009-04-14 18:05 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-04-14 18:05 . 2009-04-14 18:05 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-04-14 18:05 . 2009-04-14 18:05 34328 ----a-w- c:\windows\system32\wups.dll
2009-04-14 18:05 . 2009-04-14 18:05 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-04-14 18:05 . 2009-04-14 18:05 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-04-14 18:04 . 2009-04-14 18:04 762880 ----a-w- c:\windows\system32\MSDTVVDEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 2198528 ----a-w- c:\windows\system32\MSVidCtl.dll
2009-04-14 18:00 . 2009-04-14 18:00 53248 ----a-w- c:\windows\system32\Mcx2Svc.dll
2009-04-14 18:00 . 2009-04-14 18:00 140288 ----a-w- c:\windows\system32\iTVData.dll
2009-04-14 18:00 . 2009-04-14 18:00 65024 ----a-w- c:\windows\system32\cca.dll
2009-04-14 18:00 . 2009-04-14 18:00 65536 ----a-w- c:\windows\system32\sberes.dll
2009-04-14 18:00 . 2009-04-14 18:00 357376 ----a-w- c:\windows\system32\msdri.dll
2009-04-14 18:00 . 2009-04-14 18:00 27136 ----a-w- c:\windows\system32\tvratings.dll
2009-04-14 18:00 . 2009-04-14 18:00 657408 ----a-w- c:\windows\system32\MSDTVADEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 413208 ----a-w- c:\windows\system32\MCEWMDRMNDBootstrap.dll
2009-04-14 18:00 . 2009-04-14 18:00 86016 ----a-w- c:\windows\system32\mcsrchPH.dll
2009-04-14 17:55 . 2009-04-14 17:55 44032 ----a-w- c:\windows\system32\vmclusex.dll
2009-04-14 17:55 . 2009-04-14 17:55 140288 ----a-w- c:\windows\system32\RemoteFileBrowse.dll
2009-04-14 17:54 . 2009-04-14 17:54 12288 ----a-w- c:\windows\system32\rsatclient.dll
2009-04-14 17:52 . 2009-04-14 17:52 9728 ----a-w- c:\windows\system32\ftlx041e.dll
2009-04-14 17:52 . 2009-04-14 17:52 9216 ----a-w- c:\windows\system32\ftlx0411.dll
2009-04-14 17:52 . 2009-04-14 17:52 296960 ----a-w- c:\windows\winhlp32.exe
2009-04-14 17:52 . 2009-04-14 17:52 194560 ----a-w- c:\windows\system32\ftsrch.dll
2009-04-12 19:22 . 2009-04-12 19:22 233888 ----a-w- c:\windows\system32\DreamScene.dll
2009-04-12 19:22 . 2009-04-12 19:22 -------- d-----w- c:\program files\BitLocker
2009-04-12 19:22 . 2009-04-12 19:22 1171848 ----a-w- c:\windows\system32\SecureKeyBackupCPL.dll
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-04-12 16:18 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-04-03 20:25 . 2009-04-12 16:07 56320 ----a-w- c:\windows\system32\xmlfilter.dll
2009-04-03 20:24 . 2009-04-12 16:07 73216 ----a-w- c:\windows\system32\msiexec.exe
2009-04-03 20:18 . 2009-04-12 16:07 37376 ----a-w- c:\windows\system32\cdd.dll
2009-04-03 19:40 . 2009-04-12 16:08 93696 ----a-w- c:\windows\system32\drivers\bridge.sys
2009-04-03 18:54 . 2009-04-12 16:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-04-03 18:52 . 2009-04-12 16:07 2048 ----a-w- c:\windows\system32\mferror.dll
2009-04-03 18:49 . 2009-04-12 16:08 248320 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-04-03 18:48 . 2009-04-12 16:08 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2009-04-03 18:44 . 2009-04-12 16:07 273920 ----a-w- c:\windows\system32\drivers\afd.sys
2009-04-03 18:44 . 2009-04-12 16:08 69120 ----a-w- c:\windows\system32\drivers\rassstp.sys
2009-04-03 18:44 . 2009-04-12 16:07 121344 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2009-04-03 18:44 . 2009-04-12 16:08 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2009-04-03 18:43 . 2009-04-12 16:07 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2009-04-03 18:43 . 2009-04-12 16:08 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2009-04-03 18:43 . 2009-04-12 16:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-04-03 18:43 . 2009-04-12 16:07 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2009-04-03 18:43 . 2009-04-12 16:08 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-04-03 18:43 . 2009-04-12 16:07 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2009-04-03 18:42 . 2009-04-12 16:08 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnhancedStorageShell]
@="{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}"
[HKEY_CLASSES_ROOT\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}]
2009-04-03 20:25 114176 ----a-w- c:\windows\System32\EhStorShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-03 1233920]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-04-14 135680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-30 7289376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-18 1947928]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2009-05-17 557056]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\programme\iTunesHelper.exe" [2009-04-02 342312]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock -.lnk - c:\program files\RocketDock\RocketDock.exe [2009-4-17 495616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,84,fc,44,8b,bb,c9,01
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{511A0F25-EB6A-436E-9571-F2D36BD2DDD9}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{A8D388CD-32BD-4AB3-8E7B-BA3702BCF05C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{D3408CDD-83C3-442D-924F-BAC10760A7B8}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{5EEAFA7F-B134-4700-AFD4-B65D369969AD}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{32142CEF-8088-4B87-97FB-4C17ECDAE608}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{3847FD50-F7EF-4537-BDA7-FAB9394ED644}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{D07568B7-4D5B-4BC5-AA1E-758E98210613}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{25DDA7D6-BD8B-4D89-A454-91AF12466375}"= UDP:5353:Adobe CSI CS4
"{63841FEB-4F1E-49BD-9AA5-E81862617A8E}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{13CE020D-7895-4B8C-AA22-17A8DA9C0E72}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C1961A97-BC7A-4851-9F2C-03AD257BF8B5}"= UDP:3703:Adobe Version Cue CS4 Server
"{B847146F-6A13-4E99-8A86-3097550E39E7}"= UDP:3704:Adobe Version Cue CS4 Server
"{1D168581-D9AF-4A4E-A0CC-55DC1081CB22}"= UDP:51000:Adobe Version Cue CS4 Server
"{4C1019E6-D6A6-4763-B7B2-C7A2D4F2FC5D}"= UDP:51001:Adobe Version Cue CS4 Server
"{156B9E22-8E6E-4311-90CF-3D5534BA2795}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{6B7BCBB3-454D-479A-A2EA-1429EFC55B85}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{9FB10FB9-F95B-4992-8626-1FAC9EEE7FAA}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{292EE44C-97B9-48D2-9BE8-608E635357AC}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4DCC8BCA-D4C0-495D-8C6D-6097C322014E}"= UDP:d:\programme\iTunes.exe:iTunes
"{12548456-98C6-4E65-AEC5-7D8AEBC6CE42}"= TCP:d:\programme\iTunes.exe:iTunes
"{94EC5EF2-12F9-4CEE-897E-4F78058E9A47}"= UDP:d:\programme\uTorrent.exe:µTorrent (TCP-In)
"{235F28AE-2E98-4478-B693-27345D9C57D4}"= TCP:d:\programme\uTorrent.exe:µTorrent (UDP-In)
"{D69D428D-B9A1-4610-8D58-3B8865BA75F2}"= UDP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (TCP-In)
"{1C5C82FC-D8A6-4D2A-B25D-B836332E123D}"= TCP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (UDP-In)
"{297B1F05-80DB-4FB1-A030-DD7C76C47908}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [16/05/2009 22:34 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16/05/2009 22:34 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16/05/2009 22:34 108552]
R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [17/05/2009 12:54 79232]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16/05/2009 22:34 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 22:34 298776]
R2 lnssvcVista;Look 'n' Stop Service;c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r --> c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [31/05/2009 17:13 40160]
S4 USB_FPRd;FingerPrinterReader;c:\windows\System32\drivers\UT_FPRd.sys [14/04/2009 20:55 16128]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
SafeBoot-procexp90.Sys
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://unattendshare.free.fr/index2.html
uInternet Settings,ProxyOverride = *.local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programme\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 18:50
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.avi"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ThunderbirdEML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MP3"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AcroExch.Document"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10o"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10p"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10pf"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.xmp"
.
Heure de fin: 2009-05-31 18:52
ComboFix-quarantined-files.txt 2009-05-31 16:52
Avant-CF: 7 200 116 736 octets libres
Après-CF: 8 989 401 088 octets libres
538 -
ModérateurTu vas pouvoir faire ton scan avec MBAM désormais.
-
voici le rapport rapide de malware
Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2201
Windows 6.0.6002 Service Pack 2
31/05/2009 19:07:21
mbam-log-2009-05-31 (19-07-18).txt
Type de recherche: Examen rapide
Eléments examinés: 70637
Temps écoulé: 2 minute(s), 33 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\Iexplor171.exe (Trojan.Dropper) -> No action taken. -
le rapport du scan rapide est il suffisant ?
-
ModérateurTu as bien supprimé les infections trouvées par MBAM ?
--> Refais un scan RSIT et poste le rapport log. -
voici le rapport du log
Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-05-31 20:46:26
Microsoft® Windows Vista™ Édition Intégrale Service Pack 2
System drive C: has 8 GB (28%) free of 30 GB
Total RAM: 2046 MB (50% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:32, on 31/05/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrateur\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unattendshare.free.fr/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programme\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: RocketDock -.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Unknown owner - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
-
Modérateur/!\ Seul volavoil peut suivre cette procédure. /!\
1/
---> Ouvre le Bloc-notes.
---> Copie le texte ci-dessous par sélection puis Ctrl+C :
KillAll::
File::
C:\Iexplor179.exe
C:\Iexplor171.exe
Folder::
C:\Program Files\DAEMON Tools Toolbar
Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]
--> Colle la sélection dans le Bloc-notes.
--> Enregistre ce fichier sur le Bureau (Impératif).
--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.
2/
--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif
--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.
--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.
--> Une fois le scan achevé, un rapport va s'afficher : poste-le.
--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt -
voila
ComboFix 09-05-31.02 - Administrateur 31/05/2009 21:13.2 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.33.1036.18.2046.1322 [GMT 2:00]
Lancé depuis: c:\users\Administrateur\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Administrateur\Desktop\CFScript.txt
FW: Look 'n' Stop 2.06p3 (Soft4Ever) *disabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
"C:\Iexplor171.exe"
"C:\Iexplor179.exe"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Iexplor171.exe
C:\Iexplor179.exe
c:\program files\DAEMON Tools Toolbar
.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-31 ))))))))))))))))))))))))))))))))))))
.
2009-05-31 19:15 . 2009-05-31 19:18 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2009-05-31 15:58 . 2009-05-31 18:46 -------- d-----w- c:\program files\trend micro
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- C:\rsit
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\programdata\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-30 12:05 . 2009-05-31 16:36 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-28 18:17 . 2009-05-28 18:17 -------- d-----w- c:\program files\Microsoft Works
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\windows\PCHEALTH
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\program files\Microsoft.NET
2009-05-28 18:14 . 2009-05-28 18:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-28 18:13 . 2009-05-28 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Microsoft Help
2009-05-28 18:13 . 2009-05-28 18:18 -------- d-----w- c:\programdata\Microsoft Help
2009-05-28 18:10 . 2009-05-28 18:10 -------- d--h--r- C:\MSOCache
2009-05-28 17:46 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Local\QuickPar
2009-05-27 04:57 . 2009-05-31 19:18 -------- d-----r- c:\users\Public\Recorded TV
2009-05-21 16:45 . 2009-05-21 16:45 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Nero
2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\programdata\SlySoft
2009-05-21 16:29 . 2009-05-21 16:38 -------- d-----w- c:\programdata\DVD Shrink
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Yahoo!
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\programdata\Yahoo! Companion
2009-05-18 19:39 . 2009-05-21 13:59 -------- d-----w- c:\users\Administrateur\AppData\Roaming\uTorrent
2009-05-18 17:28 . 2009-05-18 17:28 10134 ----a-r- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-05-18 17:28 . 2009-05-18 17:28 -------- d-----w- c:\program files\Microsoft WSE
2009-05-18 17:23 . 2009-05-18 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-05-18 17:14 . 2009-05-18 17:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\DAEMON Tools Lite
2009-05-18 15:13 . 2009-05-16 20:34 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-18 15:13 . 2009-05-16 20:34 12552 ----a-w- c:\programdata\avg8\update\backup\avgrkx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 107912 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-18 15:13 . 2009-05-16 20:34 325640 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 485144 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-18 15:13 . 2009-05-16 20:34 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-18 15:10 . 2009-05-16 20:34 1057024 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe
2009-05-18 15:10 . 2009-05-16 20:34 745240 ----a-w- c:\programdata\avg8\update\backup\avginet.dll
2009-05-18 15:10 . 2009-05-16 20:34 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-18 15:10 . 2009-05-16 20:34 1424152 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-05-17 15:12 . 2009-05-17 15:12 -------- d-----w- c:\programdata\WindowsSearch
2009-05-17 15:08 . 2009-05-17 15:08 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Media Player Classic
2009-05-17 13:28 . 2009-05-17 14:33 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:34 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:28 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-17 13:28 . 2009-03-19 14:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-17 13:28 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-17 13:27 . 2009-05-17 13:27 -------- d-----w- c:\program files\iPod
2009-05-17 13:27 . 2009-05-17 13:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-17 13:26 . 2009-05-17 13:27 -------- d-----w- c:\program files\Common Files\Apple
2009-05-17 13:23 . 2009-05-17 13:23 -------- d-----w- c:\program files\Bonjour
2009-05-17 13:22 . 2009-05-17 13:27 -------- d-----w- c:\programdata\Apple Computer
2009-05-17 13:22 . 2009-05-17 13:23 -------- d-----w- c:\program files\QuickTime
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\program files\Apple Software Update
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\programdata\Apple
2009-05-17 13:04 . 2009-05-31 18:48 -------- d-----w- c:\programdata\FLEXnet
2009-05-17 12:38 . 2009-05-17 12:41 -------- d-----w- c:\users\Administrateur\AppData\Local\looknstop
2009-05-17 11:56 . 2009-05-17 11:56 -------- d-----w- c:\programdata\ALM
2009-05-17 11:41 . 2009-05-17 11:41 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-17 11:16 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2009-05-17 11:07 . 2009-05-17 11:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-17 11:04 . 2009-05-17 11:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-17 10:54 . 2009-05-17 10:54 79232 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-05-17 10:54 . 2009-05-17 10:54 58232 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-05-17 10:54 . 2009-05-17 10:54 36864 ----a-w- c:\windows\system32\fwapi.dll
2009-05-17 10:53 . 2009-05-17 10:55 -------- d-----w- c:\program files\Soft4Ever
2009-05-17 10:37 . 2009-05-17 10:38 -------- d-----w- c:\program files\NewsBin
2009-05-17 10:28 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Roaming\NewsBin
2009-05-17 10:28 . 2009-05-17 10:28 -------- d-----w- c:\programdata\NewsBin
2009-05-17 10:19 . 2009-05-17 10:26 -------- d-----w- c:\users\Administrateur\AppData\Roaming\GrabIt
2009-05-17 10:12 . 2009-05-17 10:12 -------- d-----w- c:\program files\GrabIt
2009-05-16 21:31 . 2009-05-16 21:31 -------- d-----w- c:\program files\Sunbelt Software
2009-05-16 21:19 . 2009-05-16 21:19 0 ----a-w- c:\windows\nsreg.dat
2009-05-16 21:19 . 2009-05-16 21:35 -------- d-----w- c:\users\Administrateur\AppData\Local\Thunderbird
2009-05-16 21:19 . 2009-05-16 21:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Thunderbird
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\programdata\ATI
2009-05-16 20:41 . 2009-05-16 20:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-05-16 20:34 . 2009-05-18 15:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-16 20:34 . 2009-05-18 15:12 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-16 20:34 . 2009-05-18 15:12 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-16 20:34 . 2009-05-18 15:12 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-16 20:34 . 2009-05-31 09:47 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-16 20:34 . 2009-05-18 15:12 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-16 20:34 . 2009-05-31 13:11 -------- d-----w- c:\programdata\avg8
2009-05-16 20:34 . 2009-05-16 20:34 -------- d-----w- c:\program files\AVG
2009-05-16 20:27 . 2009-05-16 20:27 9158 ----a-w- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-05-16 20:27 . 2009-05-16 20:27 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-05-16 20:19 . 2009-05-16 20:19 -------- d-----w- C:\WPI
2009-05-16 20:19 . 2007-03-01 13:38 4390912 ----a-w- c:\windows\RtHDVCpl.exe
2009-05-16 20:19 . 2007-01-16 08:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-05-16 20:19 . 2009-05-16 20:25 -------- d-----w- C:\drivers
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Cooliris
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Xtremsplit
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Microsoft
2009-05-16 20:09 . 2009-05-31 14:42 -------- d-----w- c:\users\Administrateur\AppData\Local\Downloaded Installations
2009-05-16 20:09 . 2009-05-16 20:09 -------- d---a-w- C:\WPI_Audio
2009-05-16 20:06 . 2009-05-28 19:25 78736 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-16 20:06 . 2009-05-16 20:06 -------- d-----w- c:\program files\System
2009-05-16 20:06 . 2009-03-31 14:21 345670 ----a-w- c:\windows\Windows 7_Calculator.exe
2009-05-16 20:06 . 2009-03-31 02:39 412813 ----a-w- c:\windows\Wordpad_2009.exe
2009-05-16 20:05 . 2008-03-21 23:16 1347584 ----a-w- c:\programdata\Nero\DrWeb\DRWEB32.DLL
2009-05-16 20:05 . 2009-05-31 14:36 -------- d-----w- c:\program files\Common Files\Nero
2009-05-16 20:05 . 2009-05-31 14:30 -------- d-----w- c:\programdata\Nero
2009-05-16 20:05 . 2009-05-31 14:26 -------- d-----w- c:\program files\Nero
2009-05-16 20:05 . 2009-05-16 20:05 -------- d-----w- c:\program files\7-Zip
2009-05-16 20:05 . 2009-05-26 04:46 -------- d-----w- c:\windows\system32\Macromed
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-16 19:42 . 2009-05-31 15:01 -------- d-sh--w- c:\windows\Installer
2009-05-16 19:42 . 2009-05-18 17:14 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Notepad2
2009-05-16 19:33 . 2009-05-16 21:10 -------- d-----w- c:\windows\system32\RTCOM
2009-05-16 19:33 . 2009-05-16 19:33 -------- d-----w- c:\program files\Realtek
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 19:16 . 2009-04-12 15:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-31 17:22 . 2008-01-21 08:04 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 17:22 . 2008-01-21 08:04 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-28 18:16 . 2006-11-02 12:35 -------- d-----w- c:\program files\MSBuild
2009-05-17 13:31 . 2009-05-17 13:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 12:46 . 2009-05-16 20:12 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-16 21:42 . 2009-05-16 20:12 -------- d-----w- c:\program files\FileZilla
2009-05-16 20:36 . 2009-05-16 19:43 680 ----a-w- c:\users\Administrateur\AppData\Local\d3d9caps.dat
2009-05-16 20:27 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI Technologies
2009-05-16 20:26 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Java
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\HashTab Shell Extension
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\PowerISO
2009-05-16 20:11 . 2009-05-16 20:10 -------- d-----w- c:\program files\Windows Live
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Resource Hacker
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\QuickPar
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Yahoo!
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\programdata\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\ACD Systems
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Modèles
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Menu Démarrer
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Favoris
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Documents
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Bureau
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\program files\Fichiers communs
2009-05-16 19:27 . 2009-05-16 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-04-19 12:12 . 2009-04-19 12:12 -------- d-----w- c:\program files\CCleaner
2009-04-19 12:11 . 2009-04-19 12:11 -------- d-----w- c:\program files\uTorrent
2009-04-19 08:41 . 2006-11-02 07:26 30051328 ----a-w- c:\windows\system32\imageres.dll
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\IconWorkshopPortable
2009-04-17 11:49 . 2009-04-17 13:10 -------- d-----w- c:\program files\RocketDock
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\Diskeeper
2009-04-17 11:48 . 2009-04-17 13:09 -------- d-----w- c:\program files\PhotoshopPortable
2009-04-17 11:47 . 2009-04-17 13:09 -------- d-----w- c:\program files\NeroPortable
2009-04-14 18:21 . 2009-04-14 18:21 705024 ----a-w- c:\windows\system32\sbe.dll
2009-04-14 18:19 . 2009-04-14 18:19 604672 ----a-w- c:\windows\system32\CPFilters.dll
2009-04-14 18:19 . 2009-04-14 18:19 450048 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-14 18:19 . 2009-04-14 18:19 153088 ----a-w- c:\windows\system32\sbeio.dll
2009-04-14 18:05 . 2009-04-14 18:05 -------- d-----w- c:\program files\Hyper-V
2009-04-14 18:05 . 2009-04-14 18:05 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-04-14 18:05 . 2009-04-14 18:05 43544 ----a-w- c:\windows\system32\wups2.dll
2009-04-14 18:05 . 2009-04-14 18:05 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-04-14 18:05 . 2009-04-14 18:05 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-04-14 18:05 . 2009-04-14 18:05 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-04-14 18:05 . 2009-04-14 18:05 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-04-14 18:05 . 2009-04-14 18:05 34328 ----a-w- c:\windows\system32\wups.dll
2009-04-14 18:05 . 2009-04-14 18:05 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-04-14 18:05 . 2009-04-14 18:05 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-04-14 18:04 . 2009-04-14 18:04 762880 ----a-w- c:\windows\system32\MSDTVVDEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 2198528 ----a-w- c:\windows\system32\MSVidCtl.dll
2009-04-14 18:00 . 2009-04-14 18:00 53248 ----a-w- c:\windows\system32\Mcx2Svc.dll
2009-04-14 18:00 . 2009-04-14 18:00 140288 ----a-w- c:\windows\system32\iTVData.dll
2009-04-14 18:00 . 2009-04-14 18:00 65024 ----a-w- c:\windows\system32\cca.dll
2009-04-14 18:00 . 2009-04-14 18:00 65536 ----a-w- c:\windows\system32\sberes.dll
2009-04-14 18:00 . 2009-04-14 18:00 357376 ----a-w- c:\windows\system32\msdri.dll
2009-04-14 18:00 . 2009-04-14 18:00 27136 ----a-w- c:\windows\system32\tvratings.dll
2009-04-14 18:00 . 2009-04-14 18:00 657408 ----a-w- c:\windows\system32\MSDTVADEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 413208 ----a-w- c:\windows\system32\MCEWMDRMNDBootstrap.dll
2009-04-14 18:00 . 2009-04-14 18:00 86016 ----a-w- c:\windows\system32\mcsrchPH.dll
2009-04-14 17:55 . 2009-04-14 17:55 44032 ----a-w- c:\windows\system32\vmclusex.dll
2009-04-14 17:55 . 2009-04-14 17:55 140288 ----a-w- c:\windows\system32\RemoteFileBrowse.dll
2009-04-14 17:54 . 2009-04-14 17:54 12288 ----a-w- c:\windows\system32\rsatclient.dll
2009-04-14 17:52 . 2009-04-14 17:52 9728 ----a-w- c:\windows\system32\ftlx041e.dll
2009-04-14 17:52 . 2009-04-14 17:52 9216 ----a-w- c:\windows\system32\ftlx0411.dll
2009-04-14 17:52 . 2009-04-14 17:52 296960 ----a-w- c:\windows\winhlp32.exe
2009-04-14 17:52 . 2009-04-14 17:52 194560 ----a-w- c:\windows\system32\ftsrch.dll
2009-04-12 19:22 . 2009-04-12 19:22 233888 ----a-w- c:\windows\system32\DreamScene.dll
2009-04-12 19:22 . 2009-04-12 19:22 -------- d-----w- c:\program files\BitLocker
2009-04-12 19:22 . 2009-04-12 19:22 1171848 ----a-w- c:\windows\system32\SecureKeyBackupCPL.dll
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-04-12 16:18 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-04-03 20:25 . 2009-04-12 16:07 56320 ----a-w- c:\windows\system32\xmlfilter.dll
2009-04-03 20:24 . 2009-04-12 16:07 73216 ----a-w- c:\windows\system32\msiexec.exe
2009-04-03 20:18 . 2009-04-12 16:07 37376 ----a-w- c:\windows\system32\cdd.dll
2009-04-03 19:40 . 2009-04-12 16:08 93696 ----a-w- c:\windows\system32\drivers\bridge.sys
2009-04-03 18:54 . 2009-04-12 16:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-04-03 18:52 . 2009-04-12 16:07 2048 ----a-w- c:\windows\system32\mferror.dll
2009-04-03 18:49 . 2009-04-12 16:08 248320 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-04-03 18:48 . 2009-04-12 16:08 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2009-04-03 18:44 . 2009-04-12 16:07 273920 ----a-w- c:\windows\system32\drivers\afd.sys
2009-04-03 18:44 . 2009-04-12 16:08 69120 ----a-w- c:\windows\system32\drivers\rassstp.sys
2009-04-03 18:44 . 2009-04-12 16:07 121344 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2009-04-03 18:44 . 2009-04-12 16:08 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2009-04-03 18:43 . 2009-04-12 16:07 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2009-04-03 18:43 . 2009-04-12 16:08 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2009-04-03 18:43 . 2009-04-12 16:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-04-03 18:43 . 2009-04-12 16:07 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2009-04-03 18:43 . 2009-04-12 16:08 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-04-03 18:43 . 2009-04-12 16:07 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2009-04-03 18:42 . 2009-04-12 16:08 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-05-31_16.50.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-31 17:15 . 2009-05-31 17:15 44032 c:\windows\assembly\NativeImages_v2.0.50727_32\stdole\52a46f3dd36f111d1836b3097fee5a70\stdole.ni.dll
- 2009-05-17 11:40 . 2009-05-17 11:40 88064 c:\windows\assembly\NativeImages_v2.0.50727_32\InspectVhdDialog\6213ae2ede752dde2a3be772ab2ac04c\InspectVhdDialog.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 88064 c:\windows\assembly\NativeImages_v2.0.50727_32\InspectVhdDialog\6213ae2ede752dde2a3be772ab2ac04c\InspectVhdDialog.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 47616 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiActivScp\78a2e752b27b91e1b4a78bec105d96e4\ehiActivScp.ni.dll
- 2009-05-31 16:45 . 2009-05-31 16:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-05-31 19:16 . 2009-05-31 19:16 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2009-05-31 16:44 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-31 17:22 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-31 17:22 101052 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-05-31 16:44 101052 c:\windows\System32\perfc009.dat
+ 2009-05-31 17:16 . 2009-05-31 17:16 479232 c:\windows\assembly\NativeImages_v2.0.50727_32\vmconnect\ee38c3e6b9f03692bf4ea1462c0bec6b\vmconnect.ni.exe
- 2009-05-17 11:41 . 2009-05-17 11:41 479232 c:\windows\assembly\NativeImages_v2.0.50727_32\vmconnect\ee38c3e6b9f03692bf4ea1462c0bec6b\vmconnect.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 835072 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\[u]0/u28a510b64c8632110c43f056e08f45d\ehiVidCtl.ni.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnhancedStorageShell]
@="{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}"
[HKEY_CLASSES_ROOT\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}]
2009-04-03 20:25 114176 ----a-w- c:\windows\System32\EhStorShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-03 1233920]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-04-14 135680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-30 7289376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-18 1947928]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2009-05-17 557056]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\programme\iTunesHelper.exe" [2009-04-02 342312]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock -.lnk - c:\program files\RocketDock\RocketDock.exe [2009-4-17 495616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,84,fc,44,8b,bb,c9,01
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{511A0F25-EB6A-436E-9571-F2D36BD2DDD9}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{A8D388CD-32BD-4AB3-8E7B-BA3702BCF05C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{D3408CDD-83C3-442D-924F-BAC10760A7B8}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{5EEAFA7F-B134-4700-AFD4-B65D369969AD}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{32142CEF-8088-4B87-97FB-4C17ECDAE608}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{3847FD50-F7EF-4537-BDA7-FAB9394ED644}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{D07568B7-4D5B-4BC5-AA1E-758E98210613}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{25DDA7D6-BD8B-4D89-A454-91AF12466375}"= UDP:5353:Adobe CSI CS4
"{63841FEB-4F1E-49BD-9AA5-E81862617A8E}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{13CE020D-7895-4B8C-AA22-17A8DA9C0E72}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C1961A97-BC7A-4851-9F2C-03AD257BF8B5}"= UDP:3703:Adobe Version Cue CS4 Server
"{B847146F-6A13-4E99-8A86-3097550E39E7}"= UDP:3704:Adobe Version Cue CS4 Server
"{1D168581-D9AF-4A4E-A0CC-55DC1081CB22}"= UDP:51000:Adobe Version Cue CS4 Server
"{4C1019E6-D6A6-4763-B7B2-C7A2D4F2FC5D}"= UDP:51001:Adobe Version Cue CS4 Server
"{156B9E22-8E6E-4311-90CF-3D5534BA2795}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{6B7BCBB3-454D-479A-A2EA-1429EFC55B85}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{9FB10FB9-F95B-4992-8626-1FAC9EEE7FAA}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{292EE44C-97B9-48D2-9BE8-608E635357AC}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4DCC8BCA-D4C0-495D-8C6D-6097C322014E}"= UDP:d:\programme\iTunes.exe:iTunes
"{12548456-98C6-4E65-AEC5-7D8AEBC6CE42}"= TCP:d:\programme\iTunes.exe:iTunes
"{94EC5EF2-12F9-4CEE-897E-4F78058E9A47}"= UDP:d:\programme\uTorrent.exe:µTorrent (TCP-In)
"{235F28AE-2E98-4478-B693-27345D9C57D4}"= TCP:d:\programme\uTorrent.exe:µTorrent (UDP-In)
"{D69D428D-B9A1-4610-8D58-3B8865BA75F2}"= UDP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (TCP-In)
"{1C5C82FC-D8A6-4D2A-B25D-B836332E123D}"= TCP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (UDP-In)
"{297B1F05-80DB-4FB1-A030-DD7C76C47908}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [16/05/2009 22:34 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16/05/2009 22:34 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16/05/2009 22:34 108552]
R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [17/05/2009 12:54 79232]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16/05/2009 22:34 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 22:34 298776]
R2 lnssvcVista;Look 'n' Stop Service;c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r --> c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S4 USB_FPRd;FingerPrinterReader;c:\windows\System32\drivers\UT_FPRd.sys [14/04/2009 20:55 16128]
--- Autres Services/Pilotes en mémoire ---
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://unattendshare.free.fr/index2.html
uInternet Settings,ProxyOverride = *.local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programme\Mozilla Plugins\npitunes.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 21:17
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.avi"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ThunderbirdEML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="jpegfile"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MP3"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AcroExch.Document"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10o"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10p"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10pf"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMA"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMV"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.xmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.exe'(5732)
c:\program files\RocketDock\RocketDock.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Soft4Ever\looknstop\LnSSvcVista.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\System32\WUDFHost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\System32\wbem\WmiApSrv.exe
.
**************************************************************************
.
Heure de fin: 2009-05-31 21:21 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-31 19:20
ComboFix2.txt 2009-05-31 16:52
Avant-CF: 8 702 521 344 octets libres
Après-CF: 8 457 478 144 octets libres
571 -
ModérateurFais un scan complet avec AVG.
-
Voici le rapport d avg
par contre juste pour infos, aucun de mes navigateurs n arrivent à aller sur le net ce matin et pourtant thunderbird peut bien aller chercher mes messages... d ou le fait que je reponde depuis l ordi de ma copine
L'Analyse "Analyse complète" est terminée.
Rootkits;"1";"0";"1"
Dossiers sélectionnés pour l'analyse :;"Analyse complète"
Analyse démarrée :;"lundi 1 juin 2009, 09:28:34"
Analyse terminée :;"lundi 1 juin 2009, 11:07:26 (1 heure(s) 38 minute(s) 52 seconde(s))"
Total des objets analysés :;"909722"
Utilisateur ayant exécuté l'analyse :;"Administrateur"
Avertissements
Fichier;"Infection";"Résultat"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite;"Détection de : Tracking cookie.Clickbank ";"Réparé"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite:\clickbank.net.82079eb1;"Détection de : Tracking cookie.Clickbank ";"Placé en quarantaine"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite:\estat.com.efda7a5a;"Détection de : Tracking cookie.Estat ";"Placé en quarantaine"
Rootkits
Fichier;"Infection";"Résultat"
C:\Windows\System32\Drivers\apwnqqjt.SYS;"Pilote masqué";"L'objet est masqué"
- 1
- 2
Suivant
