Sujet Précédent Sujet Suivant

Infecté par win32/heur

volavoil -  
jacques.gache Messages postés 34829 Statut Contributeur sécurité -
Bonjour,
depuis hier, avg m indique que je suis infecté par win32/heur. Je n arrive pas à virer ce virus et je ne sais pas si il y a un lien de cause a effet, nero ne reconnait plus mon graveur, et chose etrange quand je met un dvd vierge dans celui ci, je ne peux plus ouvrir le tiroir car il m est indiqué que mon lecteur est en cours d utilisation...
Comment me debarrasser de win32/heur ?
Merci:

Ps: c est mon premier cas d infection donc n hesitez pas a m indiquer les logiciels a utiliser et quel rapport vous envoyer!

26 réponses

  • 1
  • 2
Réponse 1 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Bonjour,

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.
0
Réponse 2 / 26
jacques.gache Messages postés 34829 Statut Contributeur sécurité 1 618
 
bonjour, je retire mon intervention et te laisses avec destrio5, @+
0
Réponse 3 / 26
volavoil
 
Voici le rapport log

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-05-31 17:58:50
Microsoft® Windows Vista™ Édition Intégrale Service Pack 2
System drive C: has 7 GB (24%) free of 30 GB
Total RAM: 2046 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:59:03, on 31/05/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
D:\programme\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
D:\programme\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrateur\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unattendshare.free.fr/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programme\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: RocketDock -.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Unknown owner - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
0
Réponse 4 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Peux-tu poster le dernier rapport de MBAM ?
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 26
volavoil
 
je viens de lancer l analyse.
J ai lance l analyse profonde... la rapide aurait elle été suffisante ?
0
Réponse 6 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Tu n'avais pas déjà fait un scan ?
0
Réponse 7 / 26
volavoil
 
Non, je n avais fait que le scan RSIT
le scan de malware est en cours
0
Réponse 8 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Ok, tu me posteras le rapport.
0
Réponse 9 / 26
volavoil
 
Aie
soucis: le scan bugge au bout d une vingtaine de minute (j avais essayé en scan rapide, mais bug aussi)
0
Réponse 10 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
0
Réponse 11 / 26
volavoil
 
voici le rapport de combofix
ComboFix 09-05-30.06 - Administrateur 31/05/2009 18:46.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.33.1036.18.2046.1031 [GMT 2:00]
Lancé depuis: d:\téléchargement\ComboFix.exe
FW: Look 'n' Stop 2.06p3 (Soft4Ever) *enabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\drivers\kungsfdnbwecsp.sys
c:\windows\system32\drivers\kungsfdnbwecsp.sys.rmv
c:\windows\system32\kungsfawlxdyoc.dat
c:\windows\system32\kungsfawlxdyoc.dat.rmv
c:\windows\system32\kungsfepvtemes.dat
c:\windows\system32\kungsfkimgdxpx.dll
c:\windows\system32\kungsfkimgdxpx.dll.rmv
c:\windows\system32\kungsftvybitop.dll
c:\windows\system32\kungsftvybitop.dll.rmv

----- BITS: Il y a peut-être des sites infectés -----

hxxp://binuser.fileave.com
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kungsfiuhcrrrj

((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-31 ))))))))))))))))))))))))))))))))))))
.

2009-05-31 16:50 . 2009-05-31 16:50 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- c:\program files\trend micro
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- C:\rsit
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\programdata\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-30 12:05 . 2009-05-31 16:36 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-30 01:46 . 2009-05-30 01:46 48640 ----a-w- C:\Iexplor179.exe
2009-05-28 20:47 . 2009-05-28 20:47 25600 ----a-w- C:\Iexplor171.exe
2009-05-28 18:17 . 2009-05-28 18:17 -------- d-----w- c:\program files\Microsoft Works
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\windows\PCHEALTH
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\program files\Microsoft.NET
2009-05-28 18:14 . 2009-05-28 18:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-28 18:13 . 2009-05-28 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Microsoft Help
2009-05-28 18:13 . 2009-05-28 18:18 -------- d-----w- c:\programdata\Microsoft Help
2009-05-28 18:10 . 2009-05-28 18:10 -------- d--h--r- C:\MSOCache
2009-05-28 17:46 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Local\QuickPar
2009-05-27 04:57 . 2009-05-31 16:35 -------- d-----r- c:\users\Public\Recorded TV
2009-05-21 16:45 . 2009-05-21 16:45 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Nero
2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\programdata\SlySoft
2009-05-21 16:29 . 2009-05-21 16:38 -------- d-----w- c:\programdata\DVD Shrink
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Yahoo!
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\programdata\Yahoo! Companion
2009-05-18 19:39 . 2009-05-21 13:59 -------- d-----w- c:\users\Administrateur\AppData\Roaming\uTorrent
2009-05-18 17:28 . 2009-05-18 17:28 10134 ----a-r- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-05-18 17:28 . 2009-05-18 17:28 -------- d-----w- c:\program files\Microsoft WSE
2009-05-18 17:23 . 2009-05-18 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-05-18 17:14 . 2009-05-18 17:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\DAEMON Tools Lite
2009-05-18 15:13 . 2009-05-16 20:34 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-18 15:13 . 2009-05-16 20:34 12552 ----a-w- c:\programdata\avg8\update\backup\avgrkx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 107912 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-18 15:13 . 2009-05-16 20:34 325640 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 485144 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-18 15:13 . 2009-05-16 20:34 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-18 15:10 . 2009-05-16 20:34 1057024 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe
2009-05-18 15:10 . 2009-05-16 20:34 745240 ----a-w- c:\programdata\avg8\update\backup\avginet.dll
2009-05-18 15:10 . 2009-05-16 20:34 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-18 15:10 . 2009-05-16 20:34 1424152 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-05-17 15:12 . 2009-05-17 15:12 -------- d-----w- c:\programdata\WindowsSearch
2009-05-17 15:08 . 2009-05-17 15:08 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Media Player Classic
2009-05-17 13:28 . 2009-05-17 14:33 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:34 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:28 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-17 13:28 . 2009-03-19 14:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-17 13:28 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-17 13:27 . 2009-05-17 13:27 -------- d-----w- c:\program files\iPod
2009-05-17 13:27 . 2009-05-17 13:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-17 13:26 . 2009-05-17 13:27 -------- d-----w- c:\program files\Common Files\Apple
2009-05-17 13:23 . 2009-05-17 13:23 -------- d-----w- c:\program files\Bonjour
2009-05-17 13:22 . 2009-05-17 13:27 -------- d-----w- c:\programdata\Apple Computer
2009-05-17 13:22 . 2009-05-17 13:23 -------- d-----w- c:\program files\QuickTime
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\program files\Apple Software Update
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\programdata\Apple
2009-05-17 13:04 . 2009-05-17 13:04 -------- d-----w- c:\programdata\FLEXnet
2009-05-17 12:38 . 2009-05-17 12:41 -------- d-----w- c:\users\Administrateur\AppData\Local\looknstop
2009-05-17 11:56 . 2009-05-17 11:56 -------- d-----w- c:\programdata\ALM
2009-05-17 11:41 . 2009-05-17 11:41 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-17 11:16 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2009-05-17 11:07 . 2009-05-17 11:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-17 11:04 . 2009-05-17 11:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-17 10:54 . 2009-05-17 10:54 79232 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-05-17 10:54 . 2009-05-17 10:54 58232 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-05-17 10:54 . 2009-05-17 10:54 36864 ----a-w- c:\windows\system32\fwapi.dll
2009-05-17 10:53 . 2009-05-17 10:55 -------- d-----w- c:\program files\Soft4Ever
2009-05-17 10:37 . 2009-05-17 10:38 -------- d-----w- c:\program files\NewsBin
2009-05-17 10:28 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Roaming\NewsBin
2009-05-17 10:28 . 2009-05-17 10:28 -------- d-----w- c:\programdata\NewsBin
2009-05-17 10:19 . 2009-05-17 10:26 -------- d-----w- c:\users\Administrateur\AppData\Roaming\GrabIt
2009-05-17 10:12 . 2009-05-17 10:12 -------- d-----w- c:\program files\GrabIt
2009-05-16 21:31 . 2009-05-16 21:31 -------- d-----w- c:\program files\Sunbelt Software
2009-05-16 21:19 . 2009-05-16 21:19 0 ----a-w- c:\windows\nsreg.dat
2009-05-16 21:19 . 2009-05-16 21:35 -------- d-----w- c:\users\Administrateur\AppData\Local\Thunderbird
2009-05-16 21:19 . 2009-05-16 21:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Thunderbird
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\programdata\ATI
2009-05-16 20:41 . 2009-05-16 20:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-05-16 20:34 . 2009-05-18 15:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-16 20:34 . 2009-05-18 15:12 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-16 20:34 . 2009-05-18 15:12 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-16 20:34 . 2009-05-18 15:12 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-16 20:34 . 2009-05-31 09:47 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-16 20:34 . 2009-05-18 15:12 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-16 20:34 . 2009-05-31 13:11 -------- d-----w- c:\programdata\avg8
2009-05-16 20:34 . 2009-05-16 20:34 -------- d-----w- c:\program files\AVG
2009-05-16 20:27 . 2009-05-16 20:27 9158 ----a-w- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-05-16 20:27 . 2009-05-16 20:27 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-05-16 20:19 . 2009-05-16 20:19 -------- d-----w- C:\WPI
2009-05-16 20:19 . 2007-03-01 13:38 4390912 ----a-w- c:\windows\RtHDVCpl.exe
2009-05-16 20:19 . 2007-01-16 08:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-05-16 20:19 . 2009-05-16 20:25 -------- d-----w- C:\drivers
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Cooliris
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Xtremsplit
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Microsoft
2009-05-16 20:09 . 2009-05-31 14:42 -------- d-----w- c:\users\Administrateur\AppData\Local\Downloaded Installations
2009-05-16 20:09 . 2009-05-16 20:09 -------- d---a-w- C:\WPI_Audio
2009-05-16 20:06 . 2009-05-28 19:25 78736 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-16 20:06 . 2009-05-16 20:06 -------- d-----w- c:\program files\System
2009-05-16 20:06 . 2009-03-31 14:21 345670 ----a-w- c:\windows\Windows 7_Calculator.exe
2009-05-16 20:06 . 2009-03-31 02:39 412813 ----a-w- c:\windows\Wordpad_2009.exe
2009-05-16 20:05 . 2008-03-21 23:16 1347584 ----a-w- c:\programdata\Nero\DrWeb\DRWEB32.DLL
2009-05-16 20:05 . 2009-05-31 14:36 -------- d-----w- c:\program files\Common Files\Nero
2009-05-16 20:05 . 2009-05-31 14:30 -------- d-----w- c:\programdata\Nero
2009-05-16 20:05 . 2009-05-31 14:26 -------- d-----w- c:\program files\Nero
2009-05-16 20:05 . 2009-05-16 20:05 -------- d-----w- c:\program files\7-Zip
2009-05-16 20:05 . 2009-05-26 04:46 -------- d-----w- c:\windows\system32\Macromed
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-16 19:42 . 2009-05-31 15:01 -------- d-sh--w- c:\windows\Installer
2009-05-16 19:42 . 2009-05-18 17:14 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Notepad2
2009-05-16 19:33 . 2009-05-16 21:10 -------- d-----w- c:\windows\system32\RTCOM
2009-05-16 19:33 . 2009-05-16 19:33 -------- d-----w- c:\program files\Realtek
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 16:44 . 2009-04-12 15:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-31 16:44 . 2008-01-21 08:04 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 16:44 . 2008-01-21 08:04 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-28 18:16 . 2006-11-02 12:35 -------- d-----w- c:\program files\MSBuild
2009-05-17 13:31 . 2009-05-17 13:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 12:46 . 2009-05-16 20:12 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-16 21:42 . 2009-05-16 20:12 -------- d-----w- c:\program files\FileZilla
2009-05-16 20:36 . 2009-05-16 19:43 680 ----a-w- c:\users\Administrateur\AppData\Local\d3d9caps.dat
2009-05-16 20:27 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI Technologies
2009-05-16 20:26 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Java
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\HashTab Shell Extension
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\PowerISO
2009-05-16 20:11 . 2009-05-16 20:10 -------- d-----w- c:\program files\Windows Live
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Resource Hacker
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\QuickPar
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Yahoo!
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\programdata\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\ACD Systems
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Modèles
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Menu Démarrer
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Favoris
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Documents
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Bureau
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\program files\Fichiers communs
2009-05-16 19:27 . 2009-05-16 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-04-19 12:12 . 2009-04-19 12:12 -------- d-----w- c:\program files\CCleaner
2009-04-19 12:11 . 2009-04-19 12:11 -------- d-----w- c:\program files\uTorrent
2009-04-19 08:41 . 2006-11-02 07:26 30051328 ----a-w- c:\windows\system32\imageres.dll
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\IconWorkshopPortable
2009-04-17 11:49 . 2009-04-17 13:10 -------- d-----w- c:\program files\RocketDock
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\Diskeeper
2009-04-17 11:48 . 2009-04-17 13:09 -------- d-----w- c:\program files\PhotoshopPortable
2009-04-17 11:47 . 2009-04-17 13:09 -------- d-----w- c:\program files\NeroPortable
2009-04-14 18:21 . 2009-04-14 18:21 705024 ----a-w- c:\windows\system32\sbe.dll
2009-04-14 18:19 . 2009-04-14 18:19 604672 ----a-w- c:\windows\system32\CPFilters.dll
2009-04-14 18:19 . 2009-04-14 18:19 450048 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-14 18:19 . 2009-04-14 18:19 153088 ----a-w- c:\windows\system32\sbeio.dll
2009-04-14 18:05 . 2009-04-14 18:05 -------- d-----w- c:\program files\Hyper-V
2009-04-14 18:05 . 2009-04-14 18:05 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-04-14 18:05 . 2009-04-14 18:05 43544 ----a-w- c:\windows\system32\wups2.dll
2009-04-14 18:05 . 2009-04-14 18:05 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-04-14 18:05 . 2009-04-14 18:05 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-04-14 18:05 . 2009-04-14 18:05 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-04-14 18:05 . 2009-04-14 18:05 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-04-14 18:05 . 2009-04-14 18:05 34328 ----a-w- c:\windows\system32\wups.dll
2009-04-14 18:05 . 2009-04-14 18:05 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-04-14 18:05 . 2009-04-14 18:05 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-04-14 18:04 . 2009-04-14 18:04 762880 ----a-w- c:\windows\system32\MSDTVVDEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 2198528 ----a-w- c:\windows\system32\MSVidCtl.dll
2009-04-14 18:00 . 2009-04-14 18:00 53248 ----a-w- c:\windows\system32\Mcx2Svc.dll
2009-04-14 18:00 . 2009-04-14 18:00 140288 ----a-w- c:\windows\system32\iTVData.dll
2009-04-14 18:00 . 2009-04-14 18:00 65024 ----a-w- c:\windows\system32\cca.dll
2009-04-14 18:00 . 2009-04-14 18:00 65536 ----a-w- c:\windows\system32\sberes.dll
2009-04-14 18:00 . 2009-04-14 18:00 357376 ----a-w- c:\windows\system32\msdri.dll
2009-04-14 18:00 . 2009-04-14 18:00 27136 ----a-w- c:\windows\system32\tvratings.dll
2009-04-14 18:00 . 2009-04-14 18:00 657408 ----a-w- c:\windows\system32\MSDTVADEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 413208 ----a-w- c:\windows\system32\MCEWMDRMNDBootstrap.dll
2009-04-14 18:00 . 2009-04-14 18:00 86016 ----a-w- c:\windows\system32\mcsrchPH.dll
2009-04-14 17:55 . 2009-04-14 17:55 44032 ----a-w- c:\windows\system32\vmclusex.dll
2009-04-14 17:55 . 2009-04-14 17:55 140288 ----a-w- c:\windows\system32\RemoteFileBrowse.dll
2009-04-14 17:54 . 2009-04-14 17:54 12288 ----a-w- c:\windows\system32\rsatclient.dll
2009-04-14 17:52 . 2009-04-14 17:52 9728 ----a-w- c:\windows\system32\ftlx041e.dll
2009-04-14 17:52 . 2009-04-14 17:52 9216 ----a-w- c:\windows\system32\ftlx0411.dll
2009-04-14 17:52 . 2009-04-14 17:52 296960 ----a-w- c:\windows\winhlp32.exe
2009-04-14 17:52 . 2009-04-14 17:52 194560 ----a-w- c:\windows\system32\ftsrch.dll
2009-04-12 19:22 . 2009-04-12 19:22 233888 ----a-w- c:\windows\system32\DreamScene.dll
2009-04-12 19:22 . 2009-04-12 19:22 -------- d-----w- c:\program files\BitLocker
2009-04-12 19:22 . 2009-04-12 19:22 1171848 ----a-w- c:\windows\system32\SecureKeyBackupCPL.dll
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-04-12 16:18 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-04-03 20:25 . 2009-04-12 16:07 56320 ----a-w- c:\windows\system32\xmlfilter.dll
2009-04-03 20:24 . 2009-04-12 16:07 73216 ----a-w- c:\windows\system32\msiexec.exe
2009-04-03 20:18 . 2009-04-12 16:07 37376 ----a-w- c:\windows\system32\cdd.dll
2009-04-03 19:40 . 2009-04-12 16:08 93696 ----a-w- c:\windows\system32\drivers\bridge.sys
2009-04-03 18:54 . 2009-04-12 16:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-04-03 18:52 . 2009-04-12 16:07 2048 ----a-w- c:\windows\system32\mferror.dll
2009-04-03 18:49 . 2009-04-12 16:08 248320 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-04-03 18:48 . 2009-04-12 16:08 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2009-04-03 18:44 . 2009-04-12 16:07 273920 ----a-w- c:\windows\system32\drivers\afd.sys
2009-04-03 18:44 . 2009-04-12 16:08 69120 ----a-w- c:\windows\system32\drivers\rassstp.sys
2009-04-03 18:44 . 2009-04-12 16:07 121344 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2009-04-03 18:44 . 2009-04-12 16:08 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2009-04-03 18:43 . 2009-04-12 16:07 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2009-04-03 18:43 . 2009-04-12 16:08 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2009-04-03 18:43 . 2009-04-12 16:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-04-03 18:43 . 2009-04-12 16:07 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2009-04-03 18:43 . 2009-04-12 16:08 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-04-03 18:43 . 2009-04-12 16:07 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2009-04-03 18:42 . 2009-04-12 16:08 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnhancedStorageShell]
@="{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}"
[HKEY_CLASSES_ROOT\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}]
2009-04-03 20:25 114176 ----a-w- c:\windows\System32\EhStorShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-03 1233920]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-04-14 135680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-30 7289376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-18 1947928]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2009-05-17 557056]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\programme\iTunesHelper.exe" [2009-04-02 342312]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock -.lnk - c:\program files\RocketDock\RocketDock.exe [2009-4-17 495616]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,84,fc,44,8b,bb,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{511A0F25-EB6A-436E-9571-F2D36BD2DDD9}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{A8D388CD-32BD-4AB3-8E7B-BA3702BCF05C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{D3408CDD-83C3-442D-924F-BAC10760A7B8}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{5EEAFA7F-B134-4700-AFD4-B65D369969AD}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{32142CEF-8088-4B87-97FB-4C17ECDAE608}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{3847FD50-F7EF-4537-BDA7-FAB9394ED644}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{D07568B7-4D5B-4BC5-AA1E-758E98210613}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{25DDA7D6-BD8B-4D89-A454-91AF12466375}"= UDP:5353:Adobe CSI CS4
"{63841FEB-4F1E-49BD-9AA5-E81862617A8E}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{13CE020D-7895-4B8C-AA22-17A8DA9C0E72}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C1961A97-BC7A-4851-9F2C-03AD257BF8B5}"= UDP:3703:Adobe Version Cue CS4 Server
"{B847146F-6A13-4E99-8A86-3097550E39E7}"= UDP:3704:Adobe Version Cue CS4 Server
"{1D168581-D9AF-4A4E-A0CC-55DC1081CB22}"= UDP:51000:Adobe Version Cue CS4 Server
"{4C1019E6-D6A6-4763-B7B2-C7A2D4F2FC5D}"= UDP:51001:Adobe Version Cue CS4 Server
"{156B9E22-8E6E-4311-90CF-3D5534BA2795}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{6B7BCBB3-454D-479A-A2EA-1429EFC55B85}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{9FB10FB9-F95B-4992-8626-1FAC9EEE7FAA}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{292EE44C-97B9-48D2-9BE8-608E635357AC}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4DCC8BCA-D4C0-495D-8C6D-6097C322014E}"= UDP:d:\programme\iTunes.exe:iTunes
"{12548456-98C6-4E65-AEC5-7D8AEBC6CE42}"= TCP:d:\programme\iTunes.exe:iTunes
"{94EC5EF2-12F9-4CEE-897E-4F78058E9A47}"= UDP:d:\programme\uTorrent.exe:µTorrent (TCP-In)
"{235F28AE-2E98-4478-B693-27345D9C57D4}"= TCP:d:\programme\uTorrent.exe:µTorrent (UDP-In)
"{D69D428D-B9A1-4610-8D58-3B8865BA75F2}"= UDP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (TCP-In)
"{1C5C82FC-D8A6-4D2A-B25D-B836332E123D}"= TCP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (UDP-In)
"{297B1F05-80DB-4FB1-A030-DD7C76C47908}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [16/05/2009 22:34 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16/05/2009 22:34 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16/05/2009 22:34 108552]
R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [17/05/2009 12:54 79232]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16/05/2009 22:34 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 22:34 298776]
R2 lnssvcVista;Look 'n' Stop Service;c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r --> c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [31/05/2009 17:13 40160]
S4 USB_FPRd;FingerPrinterReader;c:\windows\System32\drivers\UT_FPRd.sys [14/04/2009 20:55 16128]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - sptd

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
SafeBoot-procexp90.Sys

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://unattendshare.free.fr/index2.html
uInternet Settings,ProxyOverride = *.local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programme\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 18:50
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.avi"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ThunderbirdEML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MP3"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AcroExch.Document"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10o"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10p"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10pf"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAV"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMA"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMV"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.xmp"
.
Heure de fin: 2009-05-31 18:52
ComboFix-quarantined-files.txt 2009-05-31 16:52

Avant-CF: 7 200 116 736 octets libres
Après-CF: 8 989 401 088 octets libres

538
0
Réponse 12 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Tu vas pouvoir faire ton scan avec MBAM désormais.
0
Réponse 13 / 26
volavoil
 
voici le rapport rapide de malware
Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2201
Windows 6.0.6002 Service Pack 2

31/05/2009 19:07:21
mbam-log-2009-05-31 (19-07-18).txt

Type de recherche: Examen rapide
Eléments examinés: 70637
Temps écoulé: 2 minute(s), 33 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Iexplor171.exe (Trojan.Dropper) -> No action taken.
0
Réponse 14 / 26
volavoil
 
le rapport du scan rapide est il suffisant ?
0
Réponse 15 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Tu as bien supprimé les infections trouvées par MBAM ?

--> Refais un scan RSIT et poste le rapport log.
0
Réponse 16 / 26
volavoil
 
voici le rapport du log

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-05-31 20:46:26
Microsoft® Windows Vista™ Édition Intégrale Service Pack 2
System drive C: has 8 GB (28%) free of 30 GB
Total RAM: 2046 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:32, on 31/05/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrateur\Desktop\RSIT.exe
C:\Program Files\trend micro\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unattendshare.free.fr/index2.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\programme\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: RocketDock -.lnk = C:\Program Files\RocketDock\RocketDock.exe
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Look 'n' Stop Service (lnssvcVista) - Unknown owner - C:\Program Files\Soft4Ever\looknstop\LnsSvcVista.exe
0
Réponse 17 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
/!\ Seul volavoil peut suivre cette procédure. /!\

1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :

KillAll::

File::
C:\Iexplor179.exe
C:\Iexplor171.exe

Folder::
C:\Program Files\DAEMON Tools Toolbar

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]

--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.

2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt
0
Réponse 18 / 26
volavoil
 
voila

ComboFix 09-05-31.02 - Administrateur 31/05/2009 21:13.2 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6002.2.1252.33.1036.18.2046.1322 [GMT 2:00]
Lancé depuis: c:\users\Administrateur\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Administrateur\Desktop\CFScript.txt
FW: Look 'n' Stop 2.06p3 (Soft4Ever) *disabled* {2A530F53-4A99-4EE0-8471-4A00BA4A47B0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"C:\Iexplor171.exe"
"C:\Iexplor179.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Iexplor171.exe
C:\Iexplor179.exe
c:\program files\DAEMON Tools Toolbar

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-28 au 2009-05-31 ))))))))))))))))))))))))))))))))))))
.

2009-05-31 19:15 . 2009-05-31 19:18 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2009-05-31 15:58 . 2009-05-31 18:46 -------- d-----w- c:\program files\trend micro
2009-05-31 15:58 . 2009-05-31 15:59 -------- d-----w- C:\rsit
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-31 15:13 . 2009-05-31 15:13 -------- d-----w- c:\programdata\Malwarebytes
2009-05-31 15:13 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-30 12:05 . 2009-05-31 16:36 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-28 18:17 . 2009-05-28 18:17 -------- d-----w- c:\program files\Microsoft Works
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\windows\PCHEALTH
2009-05-28 18:16 . 2009-05-28 18:16 -------- d-----w- c:\program files\Microsoft.NET
2009-05-28 18:14 . 2009-05-28 18:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-28 18:13 . 2009-05-28 18:13 -------- d-----w- c:\users\Administrateur\AppData\Local\Microsoft Help
2009-05-28 18:13 . 2009-05-28 18:18 -------- d-----w- c:\programdata\Microsoft Help
2009-05-28 18:10 . 2009-05-28 18:10 -------- d--h--r- C:\MSOCache
2009-05-28 17:46 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Local\QuickPar
2009-05-27 04:57 . 2009-05-31 19:18 -------- d-----r- c:\users\Public\Recorded TV
2009-05-21 16:45 . 2009-05-21 16:45 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Nero
2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\programdata\SlySoft
2009-05-21 16:29 . 2009-05-21 16:38 -------- d-----w- c:\programdata\DVD Shrink
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Yahoo!
2009-05-18 20:31 . 2009-05-18 20:31 -------- d-----w- c:\programdata\Yahoo! Companion
2009-05-18 19:39 . 2009-05-21 13:59 -------- d-----w- c:\users\Administrateur\AppData\Roaming\uTorrent
2009-05-18 17:28 . 2009-05-18 17:28 10134 ----a-r- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-05-18 17:28 . 2009-05-18 17:28 -------- d-----w- c:\program files\Microsoft WSE
2009-05-18 17:23 . 2009-05-18 17:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-18 17:17 . 2009-05-18 17:17 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-05-18 17:14 . 2009-05-18 17:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\DAEMON Tools Lite
2009-05-18 15:13 . 2009-05-16 20:34 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-18 15:13 . 2009-05-16 20:34 12552 ----a-w- c:\programdata\avg8\update\backup\avgrkx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 107912 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-18 15:13 . 2009-05-16 20:34 325640 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-18 15:13 . 2009-05-16 20:34 485144 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-18 15:13 . 2009-05-16 20:34 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-18 15:10 . 2009-05-16 20:34 1057024 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe
2009-05-18 15:10 . 2009-05-16 20:34 745240 ----a-w- c:\programdata\avg8\update\backup\avginet.dll
2009-05-18 15:10 . 2009-05-16 20:34 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-18 15:10 . 2009-05-16 20:34 1424152 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-05-17 15:12 . 2009-05-17 15:12 -------- d-----w- c:\programdata\WindowsSearch
2009-05-17 15:08 . 2009-05-17 15:08 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Media Player Classic
2009-05-17 13:28 . 2009-05-17 14:33 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:34 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Apple Computer
2009-05-17 13:28 . 2009-05-17 13:28 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-17 13:28 . 2009-03-19 14:32 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-17 13:28 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-05-17 13:27 . 2009-05-17 13:27 -------- d-----w- c:\program files\iPod
2009-05-17 13:27 . 2009-05-17 13:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-17 13:26 . 2009-05-17 13:27 -------- d-----w- c:\program files\Common Files\Apple
2009-05-17 13:23 . 2009-05-17 13:23 -------- d-----w- c:\program files\Bonjour
2009-05-17 13:22 . 2009-05-17 13:27 -------- d-----w- c:\programdata\Apple Computer
2009-05-17 13:22 . 2009-05-17 13:23 -------- d-----w- c:\program files\QuickTime
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\users\Administrateur\AppData\Local\Apple
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\program files\Apple Software Update
2009-05-17 13:22 . 2009-05-17 13:22 -------- d-----w- c:\programdata\Apple
2009-05-17 13:04 . 2009-05-31 18:48 -------- d-----w- c:\programdata\FLEXnet
2009-05-17 12:38 . 2009-05-17 12:41 -------- d-----w- c:\users\Administrateur\AppData\Local\looknstop
2009-05-17 11:56 . 2009-05-17 11:56 -------- d-----w- c:\programdata\ALM
2009-05-17 11:41 . 2009-05-17 11:41 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-17 11:16 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2009-05-17 11:07 . 2009-05-17 11:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-17 11:04 . 2009-05-17 11:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-17 10:54 . 2009-05-17 10:54 79232 ----a-w- c:\windows\system32\drivers\lnsfw1.sys
2009-05-17 10:54 . 2009-05-17 10:54 58232 ----a-w- c:\windows\system32\drivers\lnsfw.sys
2009-05-17 10:54 . 2009-05-17 10:54 36864 ----a-w- c:\windows\system32\fwapi.dll
2009-05-17 10:53 . 2009-05-17 10:55 -------- d-----w- c:\program files\Soft4Ever
2009-05-17 10:37 . 2009-05-17 10:38 -------- d-----w- c:\program files\NewsBin
2009-05-17 10:28 . 2009-05-31 15:49 -------- d-----w- c:\users\Administrateur\AppData\Roaming\NewsBin
2009-05-17 10:28 . 2009-05-17 10:28 -------- d-----w- c:\programdata\NewsBin
2009-05-17 10:19 . 2009-05-17 10:26 -------- d-----w- c:\users\Administrateur\AppData\Roaming\GrabIt
2009-05-17 10:12 . 2009-05-17 10:12 -------- d-----w- c:\program files\GrabIt
2009-05-16 21:31 . 2009-05-16 21:31 -------- d-----w- c:\program files\Sunbelt Software
2009-05-16 21:19 . 2009-05-16 21:19 0 ----a-w- c:\windows\nsreg.dat
2009-05-16 21:19 . 2009-05-16 21:35 -------- d-----w- c:\users\Administrateur\AppData\Local\Thunderbird
2009-05-16 21:19 . 2009-05-16 21:19 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Thunderbird
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Roaming\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\users\Administrateur\AppData\Local\ATI
2009-05-16 20:52 . 2009-05-16 20:52 -------- d-----w- c:\programdata\ATI
2009-05-16 20:41 . 2009-05-16 20:41 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-05-16 20:34 . 2009-05-18 15:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-16 20:34 . 2009-05-18 15:12 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-05-16 20:34 . 2009-05-18 15:12 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-16 20:34 . 2009-05-18 15:12 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-16 20:34 . 2009-05-31 09:47 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-16 20:34 . 2009-05-18 15:12 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-16 20:34 . 2009-05-31 13:11 -------- d-----w- c:\programdata\avg8
2009-05-16 20:34 . 2009-05-16 20:34 -------- d-----w- c:\program files\AVG
2009-05-16 20:27 . 2009-05-16 20:27 9158 ----a-w- c:\users\Administrateur\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-05-16 20:27 . 2009-05-16 20:27 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-05-16 20:19 . 2009-05-16 20:19 -------- d-----w- C:\WPI
2009-05-16 20:19 . 2007-03-01 13:38 4390912 ----a-w- c:\windows\RtHDVCpl.exe
2009-05-16 20:19 . 2007-01-16 08:39 1191936 ----a-w- c:\windows\RtlUpd.exe
2009-05-16 20:19 . 2009-05-16 20:25 -------- d-----w- C:\drivers
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Cooliris
2009-05-16 20:15 . 2009-05-16 20:15 -------- d-----w- c:\users\Administrateur\AppData\Local\Mozilla
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Xtremsplit
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-16 20:11 . 2009-05-16 20:11 -------- d-----w- c:\program files\Microsoft
2009-05-16 20:09 . 2009-05-31 14:42 -------- d-----w- c:\users\Administrateur\AppData\Local\Downloaded Installations
2009-05-16 20:09 . 2009-05-16 20:09 -------- d---a-w- C:\WPI_Audio
2009-05-16 20:06 . 2009-05-28 19:25 78736 ----a-w- c:\users\Administrateur\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-16 20:06 . 2009-05-16 20:06 -------- d-----w- c:\program files\System
2009-05-16 20:06 . 2009-03-31 14:21 345670 ----a-w- c:\windows\Windows 7_Calculator.exe
2009-05-16 20:06 . 2009-03-31 02:39 412813 ----a-w- c:\windows\Wordpad_2009.exe
2009-05-16 20:05 . 2008-03-21 23:16 1347584 ----a-w- c:\programdata\Nero\DrWeb\DRWEB32.DLL
2009-05-16 20:05 . 2009-05-31 14:36 -------- d-----w- c:\program files\Common Files\Nero
2009-05-16 20:05 . 2009-05-31 14:30 -------- d-----w- c:\programdata\Nero
2009-05-16 20:05 . 2009-05-31 14:26 -------- d-----w- c:\program files\Nero
2009-05-16 20:05 . 2009-05-16 20:05 -------- d-----w- c:\program files\7-Zip
2009-05-16 20:05 . 2009-05-26 04:46 -------- d-----w- c:\windows\system32\Macromed
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-16 19:42 . 2009-05-31 15:01 -------- d-sh--w- c:\windows\Installer
2009-05-16 19:42 . 2009-05-18 17:14 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-16 19:42 . 2009-05-16 19:42 -------- d-----w- c:\program files\Notepad2
2009-05-16 19:33 . 2009-05-16 21:10 -------- d-----w- c:\windows\system32\RTCOM
2009-05-16 19:33 . 2009-05-16 19:33 -------- d-----w- c:\program files\Realtek
2009-05-09 23:40 . 2009-05-09 23:40 103872 ----a-w- c:\windows\system32\drivers\AnyDVD.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 19:16 . 2009-04-12 15:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-05-31 17:22 . 2008-01-21 08:04 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-05-31 17:22 . 2008-01-21 08:04 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-05-28 18:16 . 2006-11-02 12:35 -------- d-----w- c:\program files\MSBuild
2009-05-17 13:31 . 2009-05-17 13:31 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-05-17 12:46 . 2009-05-16 20:12 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-16 21:42 . 2009-05-16 20:12 -------- d-----w- c:\program files\FileZilla
2009-05-16 20:36 . 2009-05-16 19:43 680 ----a-w- c:\users\Administrateur\AppData\Local\d3d9caps.dat
2009-05-16 20:27 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI Technologies
2009-05-16 20:26 . 2009-05-16 20:26 -------- d-----w- c:\program files\ATI
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\users\Administrateur\AppData\Roaming\Notepad++
2009-05-16 20:12 . 2009-05-16 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\Java
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\HashTab Shell Extension
2009-05-16 20:12 . 2009-05-16 20:12 -------- d-----w- c:\program files\PowerISO
2009-05-16 20:11 . 2009-05-16 20:10 -------- d-----w- c:\program files\Windows Live
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Resource Hacker
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\QuickPar
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Yahoo!
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\programdata\ACD Systems
2009-05-16 20:10 . 2009-05-16 20:10 -------- d-----w- c:\program files\ACD Systems
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Modèles
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Menu Démarrer
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Favoris
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Documents
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\programdata\Bureau
2009-05-16 19:40 . 2009-05-16 19:40 -------- d-sh--we c:\program files\Fichiers communs
2009-05-16 19:27 . 2009-05-16 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-04-19 12:12 . 2009-04-19 12:12 -------- d-----w- c:\program files\CCleaner
2009-04-19 12:11 . 2009-04-19 12:11 -------- d-----w- c:\program files\uTorrent
2009-04-19 08:41 . 2006-11-02 07:26 30051328 ----a-w- c:\windows\system32\imageres.dll
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\IconWorkshopPortable
2009-04-17 11:49 . 2009-04-17 13:10 -------- d-----w- c:\program files\RocketDock
2009-04-17 11:49 . 2009-04-17 13:09 -------- d-----w- c:\program files\Diskeeper
2009-04-17 11:48 . 2009-04-17 13:09 -------- d-----w- c:\program files\PhotoshopPortable
2009-04-17 11:47 . 2009-04-17 13:09 -------- d-----w- c:\program files\NeroPortable
2009-04-14 18:21 . 2009-04-14 18:21 705024 ----a-w- c:\windows\system32\sbe.dll
2009-04-14 18:19 . 2009-04-14 18:19 604672 ----a-w- c:\windows\system32\CPFilters.dll
2009-04-14 18:19 . 2009-04-14 18:19 450048 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-14 18:19 . 2009-04-14 18:19 153088 ----a-w- c:\windows\system32\sbeio.dll
2009-04-14 18:05 . 2009-04-14 18:05 -------- d-----w- c:\program files\Hyper-V
2009-04-14 18:05 . 2009-04-14 18:05 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-04-14 18:05 . 2009-04-14 18:05 43544 ----a-w- c:\windows\system32\wups2.dll
2009-04-14 18:05 . 2009-04-14 18:05 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-04-14 18:05 . 2009-04-14 18:05 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-04-14 18:05 . 2009-04-14 18:05 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-04-14 18:05 . 2009-04-14 18:05 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-04-14 18:05 . 2009-04-14 18:05 34328 ----a-w- c:\windows\system32\wups.dll
2009-04-14 18:05 . 2009-04-14 18:05 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-04-14 18:05 . 2009-04-14 18:05 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-04-14 18:04 . 2009-04-14 18:04 762880 ----a-w- c:\windows\system32\MSDTVVDEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 2198528 ----a-w- c:\windows\system32\MSVidCtl.dll
2009-04-14 18:00 . 2009-04-14 18:00 53248 ----a-w- c:\windows\system32\Mcx2Svc.dll
2009-04-14 18:00 . 2009-04-14 18:00 140288 ----a-w- c:\windows\system32\iTVData.dll
2009-04-14 18:00 . 2009-04-14 18:00 65024 ----a-w- c:\windows\system32\cca.dll
2009-04-14 18:00 . 2009-04-14 18:00 65536 ----a-w- c:\windows\system32\sberes.dll
2009-04-14 18:00 . 2009-04-14 18:00 357376 ----a-w- c:\windows\system32\msdri.dll
2009-04-14 18:00 . 2009-04-14 18:00 27136 ----a-w- c:\windows\system32\tvratings.dll
2009-04-14 18:00 . 2009-04-14 18:00 657408 ----a-w- c:\windows\system32\MSDTVADEC.DLL
2009-04-14 18:00 . 2009-04-14 18:00 413208 ----a-w- c:\windows\system32\MCEWMDRMNDBootstrap.dll
2009-04-14 18:00 . 2009-04-14 18:00 86016 ----a-w- c:\windows\system32\mcsrchPH.dll
2009-04-14 17:55 . 2009-04-14 17:55 44032 ----a-w- c:\windows\system32\vmclusex.dll
2009-04-14 17:55 . 2009-04-14 17:55 140288 ----a-w- c:\windows\system32\RemoteFileBrowse.dll
2009-04-14 17:54 . 2009-04-14 17:54 12288 ----a-w- c:\windows\system32\rsatclient.dll
2009-04-14 17:52 . 2009-04-14 17:52 9728 ----a-w- c:\windows\system32\ftlx041e.dll
2009-04-14 17:52 . 2009-04-14 17:52 9216 ----a-w- c:\windows\system32\ftlx0411.dll
2009-04-14 17:52 . 2009-04-14 17:52 296960 ----a-w- c:\windows\winhlp32.exe
2009-04-14 17:52 . 2009-04-14 17:52 194560 ----a-w- c:\windows\system32\ftsrch.dll
2009-04-12 19:22 . 2009-04-12 19:22 233888 ----a-w- c:\windows\system32\DreamScene.dll
2009-04-12 19:22 . 2009-04-12 19:22 -------- d-----w- c:\program files\BitLocker
2009-04-12 19:22 . 2009-04-12 19:22 1171848 ----a-w- c:\windows\system32\SecureKeyBackupCPL.dll
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Journal
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-04-12 16:19 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-04-12 16:18 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-04-03 20:25 . 2009-04-12 16:07 56320 ----a-w- c:\windows\system32\xmlfilter.dll
2009-04-03 20:24 . 2009-04-12 16:07 73216 ----a-w- c:\windows\system32\msiexec.exe
2009-04-03 20:18 . 2009-04-12 16:07 37376 ----a-w- c:\windows\system32\cdd.dll
2009-04-03 19:40 . 2009-04-12 16:08 93696 ----a-w- c:\windows\system32\drivers\bridge.sys
2009-04-03 18:54 . 2009-04-12 16:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-04-03 18:52 . 2009-04-12 16:07 2048 ----a-w- c:\windows\system32\mferror.dll
2009-04-03 18:49 . 2009-04-12 16:08 248320 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2009-04-03 18:48 . 2009-04-12 16:08 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2009-04-03 18:44 . 2009-04-12 16:07 273920 ----a-w- c:\windows\system32\drivers\afd.sys
2009-04-03 18:44 . 2009-04-12 16:08 69120 ----a-w- c:\windows\system32\drivers\rassstp.sys
2009-04-03 18:44 . 2009-04-12 16:07 121344 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2009-04-03 18:44 . 2009-04-12 16:08 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2009-04-03 18:43 . 2009-04-12 16:07 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys
2009-04-03 18:43 . 2009-04-12 16:08 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2009-04-03 18:43 . 2009-04-12 16:07 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-04-03 18:43 . 2009-04-12 16:07 72192 ----a-w- c:\windows\system32\drivers\tdx.sys
2009-04-03 18:43 . 2009-04-12 16:08 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-04-03 18:43 . 2009-04-12 16:07 185856 ----a-w- c:\windows\system32\drivers\netbt.sys
2009-04-03 18:42 . 2009-04-12 16:08 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-05-31_16.50.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-31 17:15 . 2009-05-31 17:15 44032 c:\windows\assembly\NativeImages_v2.0.50727_32\stdole\52a46f3dd36f111d1836b3097fee5a70\stdole.ni.dll
- 2009-05-17 11:40 . 2009-05-17 11:40 88064 c:\windows\assembly\NativeImages_v2.0.50727_32\InspectVhdDialog\6213ae2ede752dde2a3be772ab2ac04c\InspectVhdDialog.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 88064 c:\windows\assembly\NativeImages_v2.0.50727_32\InspectVhdDialog\6213ae2ede752dde2a3be772ab2ac04c\InspectVhdDialog.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 47616 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiActivScp\78a2e752b27b91e1b4a78bec105d96e4\ehiActivScp.ni.dll
- 2009-05-31 16:45 . 2009-05-31 16:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-05-31 19:16 . 2009-05-31 19:16 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2009-05-31 16:44 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-31 17:22 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-31 17:22 101052 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-05-31 16:44 101052 c:\windows\System32\perfc009.dat
+ 2009-05-31 17:16 . 2009-05-31 17:16 479232 c:\windows\assembly\NativeImages_v2.0.50727_32\vmconnect\ee38c3e6b9f03692bf4ea1462c0bec6b\vmconnect.ni.exe
- 2009-05-17 11:41 . 2009-05-17 11:41 479232 c:\windows\assembly\NativeImages_v2.0.50727_32\vmconnect\ee38c3e6b9f03692bf4ea1462c0bec6b\vmconnect.ni.exe
+ 2009-05-31 17:15 . 2009-05-31 17:15 835072 c:\windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\[u]0/u28a510b64c8632110c43f056e08f45d\ehiVidCtl.ni.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnhancedStorageShell]
@="{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}"
[HKEY_CLASSES_ROOT\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}]
2009-04-03 20:25 114176 ----a-w- c:\windows\System32\EhStorShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-03 1233920]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-04-14 135680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-30 7289376]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-18 1947928]
"Look 'n' Stop"="c:\program files\Soft4Ever\looknstop\looknstop.exe" [2009-05-17 557056]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="d:\programme\iTunesHelper.exe" [2009-04-02 342312]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RocketDock -.lnk - c:\program files\RocketDock\RocketDock.exe [2009-4-17 495616]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableInstallerDetection"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,84,fc,44,8b,bb,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{511A0F25-EB6A-436E-9571-F2D36BD2DDD9}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{A8D388CD-32BD-4AB3-8E7B-BA3702BCF05C}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{D3408CDD-83C3-442D-924F-BAC10760A7B8}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{5EEAFA7F-B134-4700-AFD4-B65D369969AD}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{32142CEF-8088-4B87-97FB-4C17ECDAE608}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{3847FD50-F7EF-4537-BDA7-FAB9394ED644}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{D07568B7-4D5B-4BC5-AA1E-758E98210613}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{25DDA7D6-BD8B-4D89-A454-91AF12466375}"= UDP:5353:Adobe CSI CS4
"{63841FEB-4F1E-49BD-9AA5-E81862617A8E}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{13CE020D-7895-4B8C-AA22-17A8DA9C0E72}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C1961A97-BC7A-4851-9F2C-03AD257BF8B5}"= UDP:3703:Adobe Version Cue CS4 Server
"{B847146F-6A13-4E99-8A86-3097550E39E7}"= UDP:3704:Adobe Version Cue CS4 Server
"{1D168581-D9AF-4A4E-A0CC-55DC1081CB22}"= UDP:51000:Adobe Version Cue CS4 Server
"{4C1019E6-D6A6-4763-B7B2-C7A2D4F2FC5D}"= UDP:51001:Adobe Version Cue CS4 Server
"{156B9E22-8E6E-4311-90CF-3D5534BA2795}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{6B7BCBB3-454D-479A-A2EA-1429EFC55B85}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:Adobe Version Cue CS4 Server
"{9FB10FB9-F95B-4992-8626-1FAC9EEE7FAA}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{292EE44C-97B9-48D2-9BE8-608E635357AC}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4DCC8BCA-D4C0-495D-8C6D-6097C322014E}"= UDP:d:\programme\iTunes.exe:iTunes
"{12548456-98C6-4E65-AEC5-7D8AEBC6CE42}"= TCP:d:\programme\iTunes.exe:iTunes
"{94EC5EF2-12F9-4CEE-897E-4F78058E9A47}"= UDP:d:\programme\uTorrent.exe:µTorrent (TCP-In)
"{235F28AE-2E98-4478-B693-27345D9C57D4}"= TCP:d:\programme\uTorrent.exe:µTorrent (UDP-In)
"{D69D428D-B9A1-4610-8D58-3B8865BA75F2}"= UDP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (TCP-In)
"{1C5C82FC-D8A6-4D2A-B25D-B836332E123D}"= TCP:c:\program files\uTorrent\App\uTorrent\utorrent.exe:µTorrent (UDP-In)
"{297B1F05-80DB-4FB1-A030-DD7C76C47908}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [16/05/2009 22:34 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [16/05/2009 22:34 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [16/05/2009 22:34 108552]
R1 lnsfw1;lnsfw1;c:\windows\System32\drivers\lnsfw1.sys [17/05/2009 12:54 79232]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [16/05/2009 22:34 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [16/05/2009 22:34 298776]
R2 lnssvcVista;Look 'n' Stop Service;c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r --> c:\program files\Soft4Ever\looknstop\LnsSvcVista.exe -r [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S4 USB_FPRd;FingerPrinterReader;c:\windows\System32\drivers\UT_FPRd.sys [14/04/2009 20:55 16128]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - sptd

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://unattendshare.free.fr/index2.html
uInternet Settings,ProxyOverride = *.local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.fr
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - component: c:\users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\programme\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-31 21:17
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2e,74,05,1d,17,af,47,49,b9,a1,75,\

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AIFF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.avi"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.CDA"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ThunderbirdEML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="jpegfile"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.M3U"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MP3"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MPEG"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
@Denied: (2) (Administrator)
"Progid"="AcroExch.Document"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.MIDI"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.AU"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10o"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10p"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v10pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.v10pf"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAV"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WAX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASF"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMA"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMD"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMS"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMV"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.ASX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WMZ"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WPL"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
@Denied: (2) (Administrator)
"Progid"="WMP11.AssocFile.WVX"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"

[HKEY_USERS\S-1-5-21-1368877821-2787237830-2592894067-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.xmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(5732)
c:\program files\RocketDock\RocketDock.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Soft4Ever\looknstop\LnSSvcVista.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\System32\WUDFHost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\System32\wbem\WmiApSrv.exe
.
**************************************************************************
.
Heure de fin: 2009-05-31 21:21 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-31 19:20
ComboFix2.txt 2009-05-31 16:52

Avant-CF: 8 702 521 344 octets libres
Après-CF: 8 457 478 144 octets libres

571
0
Réponse 19 / 26
Destrio5 Messages postés 99820 Statut Modérateur 10 305
 
Fais un scan complet avec AVG.
0
Réponse 20 / 26
volavoil
 
Voici le rapport d avg
par contre juste pour infos, aucun de mes navigateurs n arrivent à aller sur le net ce matin et pourtant thunderbird peut bien aller chercher mes messages... d ou le fait que je reponde depuis l ordi de ma copine

L'Analyse "Analyse complète" est terminée.
Rootkits;"1";"0";"1"
Dossiers sélectionnés pour l'analyse :;"Analyse complète"
Analyse démarrée :;"lundi 1 juin 2009, 09:28:34"
Analyse terminée :;"lundi 1 juin 2009, 11:07:26 (1 heure(s) 38 minute(s) 52 seconde(s))"
Total des objets analysés :;"909722"
Utilisateur ayant exécuté l'analyse :;"Administrateur"

Avertissements
Fichier;"Infection";"Résultat"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite;"Détection de : Tracking cookie.Clickbank ";"Réparé"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite:\clickbank.net.82079eb1;"Détection de : Tracking cookie.Clickbank ";"Placé en quarantaine"
C:\Users\Administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\y9bqbldi.default\cookies.sqlite:\estat.com.efda7a5a;"Détection de : Tracking cookie.Estat ";"Placé en quarantaine"

Rootkits
Fichier;"Infection";"Résultat"
C:\Windows\System32\Drivers\apwnqqjt.SYS;"Pilote masqué";"L'objet est masqué"
0

Discussions similaires

Problème avec "PUADIManager:Win32/OfferCore
Knaki -
bazfile -

3 réponses
PUADlManager:Win32/OfferCore
tenmalade -
tenmalade -

2 réponses
win32:malware-gen bloqué par avast
ikkual -
Utilisateur anonyme -

69 réponses
PUABundler:Win32/CandyOpen : dangereux ?
joubine -
bazfile -

2 réponses
HEUR/APC (cloud) ??
Zetchie -
bazfile -

1 réponse