PC infécté - Windows démarre que en SafeMode

arnolem Messages postés 88 Statut Membre -
Krapsman - 24 août 2009 à 12:45

Bonjour,

Mon PC a été infécté Hier par plusieurs virus.
Il est maintenant impossible de faire lancer Windows Hors du mode sans echec.
Juste après la fenêtre de login de Windows Vista, le chargement reste bloqué sur "Bienvenue ..."

Voici les derniers virus trouvé par Avast au moment de l'infection :

14/07/2009 21:49:17	SYSTEM	1508	Sign of "Win32:LoadAdv-U [Trj]" has been found in "C:\Iexplor701.exe" file.    
14/07/2009 21:53:22	SYSTEM	1508	Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Iexploreiosg.exe" file.
14/07/2009 22:03:47	SYSTEM	1508	Sign of "Win32:Alureon-BY [Rtk]" has been found in "globalroot\systemroot\system32\geyekrupyxuskk.dll" file.  
14/07/2009 22:04:17	SYSTEM	1508	Sign of "Win32:Alureon-BY [Rtk]" has been found in "C:\Windows\System32\geyekrupyxuskk.dll" file.

Comme vous vous en doutez, Spybot ainsi qu'un scan complet Avast ne change rien au problème.

Pourriez-vous m'aider et m'indiquer la marche à suivre pour détécté et corriger le problème ?
Merci par avance.

Configuration: Windows Vista
Dell XPS 420, Intel QuadCore 2.8Ghz, 4Go Ram, GeForce 8800GT

Afficher la suite

A voir également:

PC infécté - Windows démarre que en SafeMode
Windows 10 ne démarre pas - Guide
Downloader for pc - Télécharger - Téléchargement & Transfert
Logiciel optimisation pc windows 11 gratuit - Accueil - Utilitaires
Reinitialiser pc - Guide
Clé windows 10 - Guide

103 réponses

Résumé de la discussion

La problématique porte sur une infection multiple provoquant un blocage du démarrage après la connexion sous Windows Vista, Avast et Spybot n'ayant pas permis de rétablir l'accès hors mode sans échec. La meilleure approche préconisée repose sur l'utilisation de ComboFix avec un script CFScript et la suppression des éléments malveillants détectés, suivie d'un nettoyage complémentaire et d'un restauration système. Le rapport détaillé d'exécution montre la création d'un point de restauration, la remise en œuvre de fichiers et entrées de registre associées au malware, puis la suppression des composants identifiés. En complément, des traces de programmes et services démarrent parfois avec des utilitaires et des jeux, d'où l'intérêt d'un balayage programmé et de la désactivation des éléments non critiques au démarrage.

Réponse 1 / 103

arnolem Messages postés 88 Statut Membre 10

Merci Gen,

Voici le nouveau rapport :

ComboFix 09-08-07.09 - Arnaud 08/08/2009 14:27.8.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3325.2205 [GMT 2:00]
Lancé depuis: c:\users\Arnaud\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Arnaud\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Un nouveau point de restauration a été créé

FILE ::
"c:\windows\system32\drivers\geyekrxcbadtue.dll"
"c:\windows\system32\drivers\geyekrxcbadtue.sys"
"c:\windows\system32\geyekrupyxuskk.dll"
"c:\windows\System32\geyekrxcbadtue.dat"
"c:\windows\system32\geyekrxcbadtue.dll"
"c:\windows\temp\geyekrxcbadtue.tmp"
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-07-08 au 2009-08-08  ))))))))))))))))))))))))))))))))))))
.

2009-08-08 12:37 . 2009-08-08 12:37	--------	d-----w-	c:\users\Public\AppData\Local\temp
2009-08-08 12:37 . 2009-08-08 12:37	--------	d-----w-	c:\users\Default\AppData\Local\temp
2009-08-08 12:37 . 2009-08-08 12:37	--------	d-----w-	c:\users\Arnaud.tmp\AppData\Local\temp
2009-08-08 00:06 . 2009-08-08 00:06	--------	d-----w-	C:\_OTL
2009-07-28 11:12 . 2009-07-28 11:12	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\GameInvest
2009-07-28 11:12 . 2009-07-28 11:12	--------	d-----w-	c:\program files\Gameinvest
2009-07-26 19:49 . 2009-07-27 09:18	--------	d-----w-	c:\program files\Tomtomax Maxi-Box
2009-07-25 21:51 . 2009-07-25 21:51	--------	d-----w-	c:\program files\Disney Interactive Studios
2009-07-20 20:34 . 2009-07-20 20:34	--------	d-----w-	c:\users\Public\Ubisoft
2009-07-20 20:20 . 2009-07-20 20:20	--------	d-----w-	c:\progra~2\Ubisoft
2009-07-18 09:23 . 2009-07-18 09:23	--------	d-----w-	c:\users\Arnaud\DoctorWeb
2009-07-17 21:34 . 2009-08-08 12:39	--------	d-----w-	c:\users\Arnaud\AppData\Local\temp
2009-07-16 23:20 . 2009-06-15 12:42	289792	----a-w-	c:\windows\system32\atmfd.dll
2009-07-16 23:20 . 2009-06-15 14:53	156672	----a-w-	c:\windows\system32\t2embed.dll
2009-07-16 23:20 . 2009-06-15 14:52	23552	----a-w-	c:\windows\system32\lpk.dll
2009-07-16 23:20 . 2009-06-15 14:52	72704	----a-w-	c:\windows\system32\fontsub.dll
2009-07-16 23:20 . 2009-06-15 14:51	10240	----a-w-	c:\windows\system32\dciman32.dll
2009-07-16 22:54 . 2009-03-30 08:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-07-16 22:54 . 2009-03-24 14:07	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-07-16 22:54 . 2009-07-16 22:54	--------	d-----w-	c:\program files\Avira
2009-07-16 22:54 . 2009-07-16 22:54	--------	d-----w-	c:\progra~2\Avira
2009-07-16 17:12 . 2009-07-16 17:12	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\Malwarebytes
2009-07-16 17:12 . 2009-07-13 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-16 17:12 . 2009-07-16 17:12	--------	d-----w-	c:\progra~2\Malwarebytes
2009-07-16 17:12 . 2009-07-13 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-07-16 17:12 . 2009-07-16 17:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-07-15 23:22 . 2009-07-15 23:38	--------	d-----w-	c:\windows\BDOSCAN8
2009-07-14 23:29 . 2009-07-14 23:29	--------	d-----w-	c:\program files\CCleaner
2009-07-14 23:09 . 2009-07-18 09:32	680	----a-w-	c:\users\Arnaud\AppData\Local\d3d9caps.dat
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\progra~2\TomTom
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\TomTom
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\users\Arnaud\AppData\Local\TomTom
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\program files\TomTom International B.V
2009-07-14 16:49 . 2009-07-14 16:49	--------	d-----w-	c:\program files\TomTom HOME 2
2009-07-14 16:49 . 2009-07-14 16:49	--------	d-----w-	c:\program files\TomTom DesktopSuite
2009-07-14 15:17 . 2009-07-14 15:17	15308440	----a-w-	c:\windows\system32\xlive.dll
2009-07-14 15:17 . 2009-07-14 15:17	13642888	----a-w-	c:\windows\system32\xlivefnt.dll
2009-07-14 10:06 . 2009-07-14 10:06	--------	d-----w-	c:\program files\Bullfrog
2009-07-14 10:06 . 1998-07-30 15:40	306688	----a-w-	c:\windows\IsUn040c.exe
2009-07-13 21:40 . 2009-07-13 21:40	--------	d-----w-	c:\users\Arnaud\AppData\Local\CAPCOM
2009-07-13 21:30 . 2009-07-13 21:30	--------	d-----w-	c:\program files\CAPCOM
2009-07-13 21:30 . 2009-03-09 13:27	453456	----a-w-	c:\windows\system32\d3dx10_41.dll
2009-07-13 21:30 . 2009-03-09 13:27	1846632	----a-w-	c:\windows\system32\D3DCompiler_41.dll
2009-07-13 21:30 . 2009-03-16 12:18	69448	----a-w-	c:\windows\system32\XAPOFX1_3.dll
2009-07-13 21:30 . 2009-03-16 12:18	517448	----a-w-	c:\windows\system32\XAudio2_4.dll
2009-07-13 21:30 . 2009-03-16 12:18	235352	----a-w-	c:\windows\system32\xactengine3_4.dll
2009-07-13 21:30 . 2009-03-09 13:27	4178264	----a-w-	c:\windows\system32\D3DX9_41.dll
2009-07-13 21:29 . 2009-07-13 21:29	--------	d-----w-	c:\windows\system32\xlive
2009-07-13 21:29 . 2009-07-13 21:29	--------	d-----w-	c:\program files\Microsoft Games for Windows - LIVE

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-08 12:45 . 2006-11-02 15:48	682318	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-08 12:45 . 2006-11-02 15:48	129520	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-08 12:37 . 2008-01-16 00:56	2140	----a-w-	c:\windows\bthservsdp.dat
2009-08-08 12:25 . 2008-09-16 22:38	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\WTablet
2009-08-08 09:07 . 2009-04-08 17:41	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\Winsplit Revolution
2009-08-08 09:06 . 2009-04-14 18:20	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\FileZilla
2009-08-08 08:49 . 2008-04-23 17:59	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-07-28 13:09 . 2008-01-29 14:08	--------	d-----w-	c:\program files\eMule
2009-07-28 09:55 . 2008-04-24 17:58	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\U3
2009-07-27 18:07 . 2009-01-07 18:54	22328	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2009-07-27 18:07 . 2009-01-07 18:54	103736	----a-w-	c:\windows\system32\PnkBstrB.exe
2009-07-26 22:58 . 2008-02-20 20:59	66872	----a-w-	c:\windows\system32\PnkBstrA.exe
2009-07-25 21:51 . 2008-01-16 01:06	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-07-24 23:32 . 2008-09-24 19:49	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\GrabIt
2009-07-22 14:00 . 2008-12-04 21:57	--------	d-----w-	c:\progra~2\Spybot - Search & Destroy
2009-07-21 21:52 . 2009-08-07 23:42	915456	----a-w-	c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-08-07 23:42	109056	----a-w-	c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-08-07 23:42	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-08-07 23:42	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2009-07-20 20:14 . 2008-09-29 06:01	--------	d-----w-	c:\program files\Ubisoft
2009-07-19 11:52 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-07-17 21:59 . 2009-07-17 21:59	0	--sh--w-	c:\windows\SEA120342.tmp
2009-07-15 23:32 . 2008-01-27 21:44	--------	d-----w-	c:\program files\Alwil Software
2009-07-14 23:09 . 2009-06-29 20:43	--------	d-----w-	c:\program files\WorldOfGoo
2009-07-14 09:15 . 2008-01-23 11:48	--------	d-----w-	c:\program files\Electronic Arts
2009-07-08 19:25 . 2009-07-08 19:25	--------	d-----w-	c:\program files\Euro Truck Simulator
2009-07-08 19:24 . 2009-07-08 19:24	--------	d-----w-	c:\program files\rondomedia
2009-07-08 17:22 . 2009-06-03 17:27	1	----a-w-	c:\users\Arnaud\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-06 18:55 . 2009-06-15 20:39	--------	d-----w-	c:\program files\RocketDock
2009-06-30 17:13 . 2008-01-23 11:52	139152	----a-w-	c:\users\Arnaud\AppData\Roaming\PnkBstrK.sys
2009-06-30 17:13 . 2008-01-23 11:52	139152	----a-w-	c:\users\Arnaud\AppData\Roaming\PnkBstrK.sys
2009-06-30 17:13 . 2009-06-30 17:13	794408	----a-w-	c:\windows\system32\pbsvc.exe
2009-06-29 20:43 . 2009-06-29 20:43	--------	d-----w-	c:\progra~2\2DBoy
2009-06-25 14:36 . 2009-06-30 17:10	1291640	----a-w-	c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
2009-06-25 14:36 . 2009-06-30 17:10	729088	----a-w-	c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
2009-06-19 11:03 . 2009-07-06 16:25	2797468	----a-w-	c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
2009-06-18 20:38 . 2009-06-18 20:24	--------	d-----w-	c:\program files\Drakensang
2009-06-16 10:52 . 2009-06-12 18:21	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\WD
2009-06-15 19:45 . 2009-06-15 19:45	--------	d-----w-	c:\program files\SyncToy 2.0
2009-06-15 19:44 . 2009-06-15 19:44	--------	d-----w-	c:\program files\Microsoft Sync Framework
2009-06-15 19:38 . 2009-06-15 19:38	--------	d-----w-	c:\progra~2\Cobian
2009-06-15 19:38 . 2009-06-15 19:38	--------	d-----w-	c:\program files\Cobian Backup 9
2009-06-15 19:20 . 2009-06-15 19:20	--------	d-----w-	c:\progra~2\MemeoCommon
2009-06-15 19:08 . 2009-06-13 00:26	--------	d-----w-	c:\program files\Common Files\Memeo
2009-06-13 00:29 . 2009-06-12 18:21	--------	d-----w-	c:\program files\Common Files\eSellerate
2009-06-12 18:20 . 2009-06-12 18:20	--------	d-----w-	c:\program files\Western Digital Corporation
2009-06-12 18:20 . 2009-06-12 18:20	--------	d-----w-	c:\program files\Western Digital
2009-06-12 18:11 . 2009-06-12 18:11	--------	d-----w-	c:\program files\SigmaTel
2009-06-12 18:02 . 2008-05-01 17:38	534	----a-w-	c:\windows\system32\drivers\stwrte.log
2009-06-10 17:33 . 2009-06-10 17:33	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-06-03 17:30 . 2008-01-20 12:01	113848	----a-w-	c:\users\Arnaud\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-03 17:25 . 2008-11-19 20:43	410984	----a-w-	c:\windows\system32\deploytk.dll
2009-05-29 18:13 . 2009-05-29 18:13	79888	----a-w-	c:\windows\system32\drivers\VBoxNetAdp.sys
2009-05-29 18:13 . 2009-06-01 22:32	41424	----a-w-	c:\windows\system32\drivers\VBoxUSBMon.sys
2009-05-29 18:13 . 2009-06-01 22:32	100944	----a-w-	c:\windows\system32\drivers\VBoxDrv.sys
2009-05-29 18:12 . 2009-05-29 18:12	133648	----a-w-	c:\windows\system32\VBoxNetFltNotify.dll
2009-05-29 18:12 . 2009-05-29 18:12	87760	----a-w-	c:\windows\system32\drivers\VBoxNetFlt.sys
2009-05-28 22:43 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2009-05-28 22:37 . 2008-10-06 19:33	37665	----a-w-	c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-05-11 19:15 . 2009-05-11 19:13	38208	----a-w-	c:\users\Arnaud\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2008-01-16 08:48 . 2008-01-16 08:40	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((   SnapShot@2009-08-08_09.36.57   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-16 01:06 . 2009-08-08 12:40	33226              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-08-08 12:40	99854              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-01-20 12:02 . 2009-08-08 12:40	24422              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3406532566-97341564-2360706075-1001_UserData.bin
- 2008-09-17 06:09 . 2009-08-08 09:36	13321              c:\windows\System32\config\systemprofile\AppData\Roaming\WTablet\Pen_Tablet.dat
+ 2008-09-17 06:09 . 2009-08-08 12:39	13321              c:\windows\System32\config\systemprofile\AppData\Roaming\WTablet\Pen_Tablet.dat
+ 2008-01-20 11:56 . 2009-08-08 12:24	32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-01-20 11:56 . 2009-08-08 09:14	32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-01-20 11:56 . 2009-08-08 12:24	49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-01-20 11:56 . 2009-08-08 09:14	49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-20 11:56 . 2009-08-08 12:24	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-01-20 11:56 . 2009-08-08 09:14	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-08-08 09:31 . 2009-08-08 09:31	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-08-08 12:38 . 2009-08-08 12:38	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-08-08 09:31 . 2009-08-08 09:31	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-08-08 12:38 . 2009-08-08 12:38	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-08-08 12:32	599056              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-08 09:20	599056              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-08 09:20	106430              c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-08-08 12:32	106430              c:\windows\System32\perfc009.dat
+ 2009-03-19 22:12 . 2009-08-08 12:24	245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-03-19 22:12 . 2009-08-08 09:14	245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\windows sidebar\sidebar.exe" [2009-04-11 1233920]
"Winsplit"="c:\program files\WinSplit Revolution\WinSplit.exe" [2009-02-27 3958784]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-06-03 251240]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 178712]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-22 13535776]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-05-06 405504]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Bluetooth HCI Monitor"="HCIMNTR.DLL" - c:\windows\System32\HCIMNTR.DLL [2006-12-07 9728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk /r \??\C:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Google Update"="c:\users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"Cobian Backup 9 interface"="c:\program files\Cobian Backup 9\cbInterface.exe" -service
"VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):28,cc,b5,66,e6,df,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3406532566-97341564-2360706075-1001]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{373F617E-D6C5-4E1C-8348-62CD5E56CDAB}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{A98A4B19-1ED1-4F36-A333-CF4034B4E480}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{CF1A12AF-C230-4D1C-B502-0AF320F9C76B}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{36E1C542-6B63-4CDC-81A0-F3A207F15A4E}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{D9F024FA-2885-47D1-865F-7C18ED22DA18}"= UDP:c:\windows\System32\mstsc.exe:mstsc.exe
"{28D2DA1F-0671-4391-A0CF-79D52508956E}"= TCP:c:\windows\System32\mstsc.exe:mstsc.exe
"{366B5B1D-4184-4206-A333-5DA5732880F6}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{4C8C9EBC-E1E5-48FF-B5F8-BA0B1E880588}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{0638EBAB-31B6-40EE-96B4-012E5B27ECAA}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{E410D7F0-5526-4DB7-8D40-62902E09075A}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{8D4AD639-5D89-4FE1-85D5-82468A587F19}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{49495BE6-B81D-4DF9-B27D-E4B5840A220B}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{04945C52-B155-412B-8EBF-476F3F3C7A3C}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{F1380852-8C27-4CE5-94E4-4AEC98A91463}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{C3B1DC03-7728-4C82-A669-3970A8241328}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{6CB1B25A-8EDD-4671-9FBB-FE2330F08ECE}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{6781F509-DBF9-4FD0-B29A-88EAE2E56C72}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{ACD5C52A-F653-4E5F-B386-FF25A682D52D}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{5A7C41DC-6503-49EC-8292-9572696971DC}c:\\program files\\adobe\\adobe dreamweaver cs3\\dreamweaver.exe"= UDP:c:\program files\adobe\adobe dreamweaver cs3\dreamweaver.exe:Adobe Dreamweaver CS3
"UDP Query User{31D56222-CDB5-4DF6-95B3-0BDD2067615D}c:\\program files\\adobe\\adobe dreamweaver cs3\\dreamweaver.exe"= TCP:c:\program files\adobe\adobe dreamweaver cs3\dreamweaver.exe:Adobe Dreamweaver CS3
"TCP Query User{F29F7EE4-5890-4D3C-AF50-596E2AC2A837}c:\\users\\public\\partage\\psp\\fs\\usbhostfs\\usbhostfs_pc.exe"= UDP:c:\users\public\partage\psp\fs\usbhostfs\usbhostfs_pc.exe:usbhostfs_pc
"UDP Query User{D05CC71A-F47B-4BAF-A357-4C60119796B0}c:\\users\\public\\partage\\psp\\fs\\usbhostfs\\usbhostfs_pc.exe"= TCP:c:\users\public\partage\psp\fs\usbhostfs\usbhostfs_pc.exe:usbhostfs_pc
"TCP Query User{F84B0111-73C2-46DF-B3E0-7A9CE27703CC}c:\\program files\\valvesoftware\\the orange box\\team fortress 2\\hl2.exe"= UDP:c:\program files\valvesoftware\the orange box\team fortress 2\hl2.exe:hl2
"UDP Query User{50588B6E-BEB4-4DB8-9E55-1601D80F5241}c:\\program files\\valvesoftware\\the orange box\\team fortress 2\\hl2.exe"= TCP:c:\program files\valvesoftware\the orange box\team fortress 2\hl2.exe:hl2
"TCP Query User{3FF74CB2-016D-4921-8F08-47DAAC0F4335}d:\\desktop\\dow\\w40k.exe"= UDP:d:\desktop\dow\w40k.exe:W40k
"UDP Query User{5D8C4E3B-0F48-4406-8F24-29D9BB9F0DE3}d:\\desktop\\dow\\w40k.exe"= TCP:d:\desktop\dow\w40k.exe:W40k
"TCP Query User{05A8417F-F780-44A4-AD4B-94E7888813FF}c:\\server\\wamp\\bin\\apache\\apache2.2.8\\bin\\httpd.exe"= UDP:c:\server\wamp\bin\apache\apache2.2.8\bin\httpd.exe:Apache HTTP Server
"UDP Query User{039EE23D-154E-4D01-B222-915168BEDFAD}c:\\server\\wamp\\bin\\apache\\apache2.2.8\\bin\\httpd.exe"= TCP:c:\server\wamp\bin\apache\apache2.2.8\bin\httpd.exe:Apache HTTP Server
"TCP Query User{EF80C63C-BFBE-4B47-84AF-D193B7DC4604}c:\\program files\\java\\jre1.6.0_05\\bin\\java.exe"= UDP:c:\program files\java\jre1.6.0_05\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{BD7E0911-212D-42F4-A90A-69E589332F38}c:\\program files\\java\\jre1.6.0_05\\bin\\java.exe"= TCP:c:\program files\java\jre1.6.0_05\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{43B3AECF-3FC5-4289-BAAD-6E5CAD3A8A47}c:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"UDP Query User{3800088F-FDD2-4625-B827-6196BC020143}c:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"{D60C2B00-06F1-426E-9601-BCF3398831E5}"= UDP:c:\program files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.1
"{5DF73F1F-F724-4C42-83B7-B5DD69804199}"= TCP:c:\program files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.1
"TCP Query User{C9C598A3-F878-4CC6-8B9D-CB8876104A08}c:\\server\\funambol\\tools\\jre-1.5.0\\jre\\bin\\javaw.exe"= UDP:c:\server\funambol\tools\jre-1.5.0\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{49C155B4-AE9A-4646-972A-093E7BFD1865}c:\\server\\funambol\\tools\\jre-1.5.0\\jre\\bin\\javaw.exe"= TCP:c:\server\funambol\tools\jre-1.5.0\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"TCP Query User{7671D1E9-0575-4824-AF69-3AAE760089D5}c:\\sonyericsson\\javame_sdk_cldc\\ondevicedebug\\bin\\serialproxy.exe"= UDP:c:\sonyericsson\javame_sdk_cldc\ondevicedebug\bin\serialproxy.exe:serialproxy
"UDP Query User{826C6C9D-C3E6-4624-BE0E-F639F777D625}c:\\sonyericsson\\javame_sdk_cldc\\ondevicedebug\\bin\\serialproxy.exe"= TCP:c:\sonyericsson\javame_sdk_cldc\ondevicedebug\bin\serialproxy.exe:serialproxy
"TCP Query User{2C932DE0-5154-48BE-A259-FE3107C0F8BD}c:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"UDP Query User{CF684E29-B1BE-4C24-A396-ED4A8EAFDD71}c:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"TCP Query User{56CF5EDA-F548-42C8-882E-9CF58C8ECEA7}c:\\program files\\eclipse\\eclipse.exe"= UDP:c:\program files\eclipse\eclipse.exe:eclipse
"UDP Query User{F6B154E5-07CE-44B0-8CCF-474E5F53B594}c:\\program files\\eclipse\\eclipse.exe"= TCP:c:\program files\eclipse\eclipse.exe:eclipse
"TCP Query User{3C726F3E-DEA3-460C-9A89-A6563B786687}c:\\program files\\adobe\\adobe flash cs3\\flash.exe"= UDP:c:\program files\adobe\adobe flash cs3\flash.exe:Adobe Flash CS3
"UDP Query User{74134E6E-1FC3-495A-B6CD-788FF06B76D9}c:\\program files\\adobe\\adobe flash cs3\\flash.exe"= TCP:c:\program files\adobe\adobe flash cs3\flash.exe:Adobe Flash CS3
"TCP Query User{99022749-D781-4FF1-A153-FA03FD72AF7D}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{EEACFC11-D003-45DF-968C-6D3BBCBAE4D0}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"TCP Query User{D3B4CB3D-DC6E-4FEE-95A3-541BCF050D92}c:\\program files\\the all-seeing eye\\eye.exe"= UDP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{5CCE720F-2E27-4EDF-BE05-C6D03E8DF11A}c:\\program files\\the all-seeing eye\\eye.exe"= TCP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{D7635049-A767-4D0B-B25E-F4C6BECC4CCC}c:\\program files\\java\\jdk1.6.0_06\\jre\\bin\\java.exe"= UDP:c:\program files\java\jdk1.6.0_06\jre\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{9BE3CC14-50B5-4442-B25C-AA5CE3B5AE06}c:\\program files\\java\\jdk1.6.0_06\\jre\\bin\\java.exe"= TCP:c:\program files\java\jdk1.6.0_06\jre\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{F396EE4B-8F60-437F-B9EA-D928704A6F5F}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{9003354A-766C-4025-9B75-711E3E92B91B}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{A95865BA-06DA-4638-A77E-15096A4B3F28}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{06551EBB-CCB6-4D33-B84F-5639CD62A604}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{B57C2B71-EC2B-42EE-9A91-1C9629F98ACD}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) 
"{950C1677-5176-4CC2-A72E-198F5E25D9B0}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) 
"TCP Query User{64404219-31AC-4134-B019-5BC68AEB3F58}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{E6FFE79D-AE19-4262-8C0F-9BA1ACFBC7F0}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{13E63711-82FB-47D4-BDD6-256BCEEBD4C4}c:\\program files\\ubisoft\\gearbox software\\brothersinarmseib\\system\\eib.exe"= UDP:c:\program files\ubisoft\gearbox software\brothersinarmseib\system\eib.exe:Brothers In Arms Earned In Blood
"UDP Query User{DF28E79B-8C80-49C6-9406-99CEED4E829B}c:\\program files\\ubisoft\\gearbox software\\brothersinarmseib\\system\\eib.exe"= TCP:c:\program files\ubisoft\gearbox software\brothersinarmseib\system\eib.exe:Brothers In Arms Earned In Blood
"{D1F51F17-2EC5-4A8F-850F-AB250D715E07}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{D0B5C8B6-7A65-4113-802E-3E4341BB1B0B}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{C1D9F7E3-B83E-4FD8-A29D-FB1C42581984}"= UDP:5353:Adobe CSI CS4
"TCP Query User{C8A8C6EB-DBC9-4B37-94D4-547DD2226D37}c:\\program files\\adobe\\adobe dreamweaver cs4\\dreamweaver.exe"= UDP:c:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe:Adobe Dreamweaver CS4
"UDP Query User{5BCFD77B-3470-4431-B64C-682DD1B33966}c:\\program files\\adobe\\adobe dreamweaver cs4\\dreamweaver.exe"= TCP:c:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe:Adobe Dreamweaver CS4
"TCP Query User{C192E90A-A41E-4080-9831-0D989C68F245}c:\\program files\\thq\\company of heroes\\reliccoh.exe"= UDP:c:\program files\thq\company of heroes\reliccoh.exe:RelicCOH
"UDP Query User{AA2B472A-DC53-4C1C-ACF5-CFC3B7A52A2E}c:\\program files\\thq\\company of heroes\\reliccoh.exe"= TCP:c:\program files\thq\company of heroes\reliccoh.exe:RelicCOH
"TCP Query User{7D037934-0572-4EC6-A595-3DA932757CCB}c:\\program files\\sacred 2 - fallen angel\\system\\s2gs.exe"= UDP:c:\program files\sacred 2 - fallen angel\system\s2gs.exe:Sacred 2 - Game Server
"UDP Query User{3BFB13CC-2381-4E8C-BA9F-8DF7EC30E405}c:\\program files\\sacred 2 - fallen angel\\system\\s2gs.exe"= TCP:c:\program files\sacred 2 - fallen angel\system\s2gs.exe:Sacred 2 - Game Server
"TCP Query User{9A5245D7-AE25-4903-A3E2-C3B9FDF9DB41}c:\\program files\\zattoo\\zattood.exe"= UDP:c:\program files\zattoo\zattood.exe:zattood
"UDP Query User{1054147E-3FB6-440F-A372-A4895DB9423D}c:\\program files\\zattoo\\zattood.exe"= TCP:c:\program files\zattoo\zattood.exe:zattood
"{9660EF6E-E6AB-40D0-A0B5-E92ED8CF0A90}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{AD1DAA71-D608-4721-829C-6F9E7230FEC2}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{FFF5BF6A-1F63-4E7F-86A8-2465DD732E5D}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{E1693AB1-3C92-47BA-A7CC-3E361A877F96}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{3AFC3205-83D1-48A6-ACD6-80BBC7F2B745}"= UDP:c:\program files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II
"{7CC7BB16-7191-47B1-BD03-C8DB6809A759}"= TCP:c:\program files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II
"TCP Query User{26182D67-DF15-4F8A-AECE-1C3BC72BE657}c:\\program files\\electronic arts\\la bataille pour la terre du milieu ii\\patchget.dat"= UDP:c:\program files\electronic arts\la bataille pour la terre du milieu ii\patchget.dat:patchgrabber
"UDP Query User{06D0999A-D645-45AB-8F47-7824DE49F280}c:\\program files\\electronic arts\\la bataille pour la terre du milieu ii\\patchget.dat"= TCP:c:\program files\electronic arts\la bataille pour la terre du milieu ii\patchget.dat:patchgrabber
"TCP Query User{80BFE8E8-E399-4C84-B051-07FE4064755B}c:\\program files\\codemasters\\rise of the argonauts\\binaries\\riseoftheargonauts.exe"= UDP:c:\program files\codemasters\rise of the argonauts\binaries\riseoftheargonauts.exe:RiseOfTheArgonauts
"UDP Query User{B5F1459D-1E70-4E00-BB4E-14A3B50F44D7}c:\\program files\\codemasters\\rise of the argonauts\\binaries\\riseoftheargonauts.exe"= TCP:c:\program files\codemasters\rise of the argonauts\binaries\riseoftheargonauts.exe:RiseOfTheArgonauts
"TCP Query User{7130FEAE-F557-4608-8292-7BFABCA6AEB7}c:\\program files\\ea games\\medal of honor batailles du pacifique(tm)\\mohpa.exe"= UDP:c:\program files\ea games\medal of honor batailles du pacifique(tm)\mohpa.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{243B9457-3D62-4774-B6F5-52F33256517D}c:\\program files\\ea games\\medal of honor batailles du pacifique(tm)\\mohpa.exe"= TCP:c:\program files\ea games\medal of honor batailles du pacifique(tm)\mohpa.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{39503B98-9CB1-4E59-BE66-8FA1FEDF70B5}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= UDP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"UDP Query User{C621ED52-A516-4780-B702-0EE7E2BE62AC}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= TCP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"TCP Query User{77C03D24-EEDB-47A6-9FD8-B08F6F3352DA}c:\\users\\arnaud\\appdata\\local\\temp\\rar$ex06.207\\teeworlds-0.5.0-win32\\teeworlds_srv.exe"= UDP:c:\users\arnaud\appdata\local\temp\rar$ex06.207\teeworlds-0.5.0-win32\teeworlds_srv.exe:teeworlds_srv.exe
"UDP Query User{9AFCF61E-E252-4594-8286-BF39D014B0BF}c:\\users\\arnaud\\appdata\\local\\temp\\rar$ex06.207\\teeworlds-0.5.0-win32\\teeworlds_srv.exe"= TCP:c:\users\arnaud\appdata\local\temp\rar$ex06.207\teeworlds-0.5.0-win32\teeworlds_srv.exe:teeworlds_srv.exe
"TCP Query User{31C7F24F-6297-4542-A557-E330756C0998}c:\\program files\\activision\\call of duty - world at war\\codwaw.exe"= UDP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop
"UDP Query User{19903E64-C041-434E-B419-A6D207992F30}c:\\program files\\activision\\call of duty - world at war\\codwaw.exe"= TCP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop
"TCP Query User{CCD487EE-FE58-4262-9E1F-970D492E16CD}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= UDP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"UDP Query User{642E4DDB-EFC1-49C9-B715-4D701BD0A85F}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= TCP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"TCP Query User{6AA20FC4-C9A7-4FAB-A16F-02D3D631AAC5}c:\\program files\\the all-seeing eye\\eye.exe"= UDP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{CB0E63E6-FA40-4EB9-BA56-7684DA2F0987}c:\\program files\\the all-seeing eye\\eye.exe"= TCP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{A38FA83D-41B9-4C01-9508-15A27760E554}c:\\program files\\activision\\call of duty 4 - modern warfare\\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp
"UDP Query User{3DFDAEEA-20CF-4576-8FDA-3950C8D72B86}c:\\program files\\activision\\call of duty 4 - modern warfare\\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp
"TCP Query User{F6FFCAFD-F22F-4362-B880-F9073C68A3E6}e:\\epsonnet easyinstall\\easyinstall.exe"= UDP:e:\epsonnet easyinstall\easyinstall.exe:EasyInstall
"UDP Query User{6433C94A-C710-441B-A728-9D186EE55E50}e:\\epsonnet easyinstall\\easyinstall.exe"= TCP:e:\epsonnet easyinstall\easyinstall.exe:EasyInstall
"TCP Query User{D072A2C7-7E66-4F3A-9E5D-D2C0C1BFF909}c:\\program files\\teeworlds\\teeworlds_srv.exe"= UDP:c:\program files\teeworlds\teeworlds_srv.exe:teeworlds_srv
"UDP Query User{09A7B6B4-77EA-4351-9C68-8AC6850B2081}c:\\program files\\teeworlds\\teeworlds_srv.exe"= TCP:c:\program files\teeworlds\teeworlds_srv.exe:teeworlds_srv
"TCP Query User{4C6BAF7A-292E-4487-9DDA-6161493A7243}c:\\server\\wamp\\bin\\apache\\apache2.2.11\\bin\\httpd.exe"= UDP:c:\server\wamp\bin\apache\apache2.2.11\bin\httpd.exe:Apache HTTP Server
"UDP Query User{2630AB3D-D2D0-4840-BAA8-C48F07DAA25C}c:\\server\\wamp\\bin\\apache\\apache2.2.11\\bin\\httpd.exe"= TCP:c:\server\wamp\bin\apache\apache2.2.11\bin\httpd.exe:Apache HTTP Server
"TCP Query User{EEA7D74F-5AC4-42B1-9F23-864E136635A7}c:\\program files\\filezilla ftp client\\filezilla.exe"= UDP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client
"UDP Query User{BAA31DF5-EED4-4A06-BE8D-B199A1B32BC8}c:\\program files\\filezilla ftp client\\filezilla.exe"= TCP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client
"{316CF86A-2AFF-4BE8-8786-15136BA7D4D8}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{ADD03CBB-5E8E-4FDC-8AC9-F59BFD6639FA}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"TCP Query User{FDED4996-0EA6-44AB-B81A-D4809152EC38}c:\\program files\\activision\\call of duty - world at war\\codwawmp.exe"= UDP:c:\program files\activision\call of duty - world at war\codwawmp.exe:Call of Duty(R): World at War Multiplayer
"UDP Query User{7832A5D4-82CB-432F-B4EC-1BAB1A783B4C}c:\\program files\\activision\\call of duty - world at war\\codwawmp.exe"= TCP:c:\program files\activision\call of duty - world at war\codwawmp.exe:Call of Duty(R): World at War Multiplayer
"{9702A650-8581-48CB-8924-ADCCBE9AF43D}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{6A1BA2C6-FC14-4FB7-A90A-FC4B908AFAAE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{2571D7BA-34F9-4AA6-9042-9CE5EC92BF2C}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{1E1BCAD8-E179-4C90-8126-05D9FFD96C6F}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{6E1190EF-5708-43DC-9604-914498CE2ED5}"= UDP:c:\program files\EA GAMES\Battlefield Heroes\BFHeroes.exe:BFHeroes.exe
"{5D7987AE-6D14-48CD-AB24-FCF9BFBEC9E5}"= TCP:c:\program files\EA GAMES\Battlefield Heroes\BFHeroes.exe:BFHeroes.exe
"TCP Query User{27C90F00-2B14-4A97-A0D1-02FEF19B7A67}c:\\users\\arnaud\\desktop\\games\\quake\\quake3.exe"= UDP:c:\users\arnaud\desktop\games\quake\quake3.exe:quake3.exe
"UDP Query User{D390EFDA-6599-4316-86DE-2179F9CF906B}c:\\users\\arnaud\\desktop\\games\\quake\\quake3.exe"= TCP:c:\users\arnaud\desktop\games\quake\quake3.exe:quake3.exe
"{1BF9896D-694E-4B61-B424-F2687253B022}"= UDP:c:\program files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe:STREET FIGHTER IV
"{61630A33-4A1C-4B66-9C67-03696A02860B}"= TCP:c:\program files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe:STREET FIGHTER IV
"{0B039811-C9DC-4DD0-80EF-B90048CBB78F}"= UDP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{36123CC1-C3E2-42E4-AD30-946186102192}"= TCP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{520DEAEE-FD33-4F5C-B215-C57E6BA7A440}"= UDP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{FB488450-541D-48D1-A761-0A8722CFB794}"= TCP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{DB9BCD20-D7FD-4413-9402-E4FFC85A05D4}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{BC430A2C-82D6-4E8F-9AB7-15EA97E5A7C4}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{067BE2E4-09EA-4346-B696-E26B51244927}"= UDP:c:\program files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboardingGame.exe:Shaun White Snowboarding Game
"{F415803F-BE42-4FEB-8DE8-F54B7408B929}"= TCP:c:\program files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboardingGame.exe:Shaun White Snowboarding Game
"{F1506C55-35A0-4662-B2E0-F876616E6AC7}"= UDP:c:\program files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboarding.exe:Shaun White Snowboarding Update
"{B7E388B5-DDF8-43E2-88B5-6E1F511C1F6E}"= TCP:c:\program files\Ubisoft\Shaun White Snowboarding\ShaunWhiteSnowboarding.exe:Shaun White Snowboarding Update

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DoNotAllowExceptions"= 0 (0x0)

R1 VBoxDrv;VirtualBox Service;c:\windows\System32\drivers\VBoxDrv.sys [02/06/2009 00:32 100944]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\System32\drivers\VBoxUSBMon.sys [02/06/2009 00:32 41424]
R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [11/09/2007 02:45 124832]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [17/07/2009 00:54 108289]
R2 CobianBackupAmanita;Cobian Backup 9 service;c:\program files\Cobian Backup 9\cbService.exe [15/06/2009 21:38 583168]
R2 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [17/09/2008 00:37 3024168]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [03/06/2009 14:46 92008]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [24/07/2008 15:22 102400]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\System32\drivers\VBoxNetAdp.sys [29/05/2009 20:13 79888]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\System32\drivers\VBoxNetFlt.sys [29/05/2009 20:12 87760]
S2 AdobeActiveFileMonitor6.0AdobeActiveFileMonitor6.0AdobeActiveFileMonitor6.0AeLookupSvc;Adobe Active File Monitor V6 AdobeActiveFileMonitor6.0AdobeActiveFileMonitor6.0AdobeActiveFileMonitor6.0AeLookupSvc;c:\windows\TEMP\iemvgutsqt.exe service --> c:\windows\TEMP\iemvgutsqt.exe service [?]
S2 AdobeActiveFileMonitor6.0AdobeActiveFileMonitor6.0AeLookupSvc;Adobe Active File Monitor V6 AdobeActiveFileMonitor6.0AdobeActiveFileMonitor6.0AeLookupSvc;c:\windows\TEMP\rnxcyepicb.exe service --> c:\windows\TEMP\rnxcyepicb.exe service [?]
S2 AdobeActiveFileMonitor6.0AeLookupSvc;Adobe Active File Monitor V6 AdobeActiveFileMonitor6.0AeLookupSvc;c:\windows\TEMP\wqwwceuhrv.exe service --> c:\windows\TEMP\wqwwceuhrv.exe service [?]
S3 epmntdrv;epmntdrv;c:\windows\System32\epmntdrv.sys [05/01/2009 18:00 9728]
S3 EuGdiDrv;EuGdiDrv;c:\windows\System32\EuGdiDrv.sys [05/01/2009 18:00 3072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [15/04/2008 20:23 13352]
S3 IntelDH;IntelDH Driver;c:\windows\System32\drivers\IntelDH.sys [16/01/2008 03:16 5632]
S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;c:\windows\System32\drivers\libusb0.sys [27/10/2007 20:05 29184]
S3 NURRPJXTJGUJA;NURRPJXTJGUJA;c:\users\Arnaud\AppData\Local\Temp\NURRPJXTJGUJA.exe --> c:\users\Arnaud\AppData\Local\Temp\NURRPJXTJGUJA.exe [?]
S3 VHA;VHA;c:\users\Arnaud\AppData\Local\Temp\VHA.exe --> c:\users\Arnaud\AppData\Local\Temp\VHA.exe [?]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\System32\drivers\wacmoumonitor.sys [17/09/2008 00:37 15144]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\System32\drivers\wdcsam.sys [10/07/2008 14:47 11520]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
rsmsvcs	REG_MULTI_SZ   	ntmssvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
FF - ProfilePath - c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\
FF - component: c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 14:39
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(1544)
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\System32\NLSData000c.dll
c:\windows\system32\btncopy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\EPSON\eEBAPI\eEBSvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
c:\windows\System32\stacsv.exe
c:\windows\System32\iashost.exe
c:\windows\System32\WTablet\Pen_TabletUser.exe
c:\windows\System32\conime.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Heure de fin: 2009-08-08 14:51 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-08-08 12:51
ComboFix2.txt  2009-08-08 09:47

Avant-CF: 83 761 889 280 octets libres
Après-CF: 83 739 201 536 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=14 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14
461	--- E O F ---	2009-08-08 00:12

Réponse 2 / 103

gen-hackman

salut :

/!\ ATTENTION SUIVRE SCRUPULEUSEMENT A LA LETTRE CES INDICATIONS/!\

♦ Surtout , penses à l'enregistrement à renommer Comfix en "ton prenom.exe"

_________________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================</gras>

♦ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil:

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Avant d'utiliser ComboFix :
______________________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

♦ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

♦ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

>> Reviens sur le forum, et

♦ copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

Réponse 3 / 103

arnolem Messages postés 88 Statut Membre 10

Voici le rapport :

ComboFix 09-07-14.08 - Arnaud 15/07/2009 19:05.1.4 - NTFSx86 NETWORK
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.3325.2640 [GMT 2:00]
Lancé depuis: c:\users\Arnaud\Downloads\Chrome Downloads\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 081123-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1229 [VPS 081123-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1156096930-2836191889-3919688664-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3406532566-97341564-2360706075-1008
c:\$recycle.bin\S-1-5-21-3406532566-97341564-2360706075-500
c:\progra~2\Microsoft\Network\Downloader\qmgr0.dat
c:\progra~2\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\jestertb.dll

----- BITS: Il y a peut-être des sites infectés -----

hxxp://binuser.fileave.com
.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-06-15 au 2009-07-15  ))))))))))))))))))))))))))))))))))))
.

2009-07-15 17:14 . 2009-07-15 17:15	--------	d-----w-	c:\users\Arnaud\AppData\Local\temp
2009-07-14 23:29 . 2009-07-14 23:29	--------	d-----w-	c:\program files\CCleaner
2009-07-14 23:09 . 2009-07-15 16:47	680	----a-w-	c:\users\Arnaud\AppData\Local\d3d9caps.dat
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\progra~2\TomTom
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\TomTom
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\users\Arnaud\AppData\Local\TomTom
2009-07-14 16:50 . 2009-07-14 16:50	--------	d-----w-	c:\program files\TomTom International B.V
2009-07-14 16:49 . 2009-07-14 16:49	--------	d-----w-	c:\program files\TomTom HOME 2
2009-07-14 16:49 . 2009-07-14 16:49	--------	d-----w-	c:\program files\TomTom DesktopSuite
2009-07-14 14:18 . 2009-07-14 14:19	--------	d-----w-	c:\program files\Watchmen The End is Nigh
2009-07-14 10:06 . 2009-07-14 10:06	--------	d-----w-	c:\program files\Bullfrog
2009-07-14 10:06 . 1998-07-30 15:40	306688	----a-w-	c:\windows\IsUn040c.exe
2009-07-13 21:40 . 2009-07-13 21:40	--------	d-----w-	c:\users\Arnaud\AppData\Local\CAPCOM
2009-07-13 21:30 . 2009-07-13 21:30	--------	d-----w-	c:\program files\CAPCOM
2009-07-13 21:30 . 2009-03-09 13:27	453456	----a-w-	c:\windows\system32\d3dx10_41.dll
2009-07-13 21:30 . 2009-03-09 13:27	1846632	----a-w-	c:\windows\system32\D3DCompiler_41.dll
2009-07-13 21:30 . 2009-03-16 12:18	69448	----a-w-	c:\windows\system32\XAPOFX1_3.dll
2009-07-13 21:30 . 2009-03-16 12:18	517448	----a-w-	c:\windows\system32\XAudio2_4.dll
2009-07-13 21:30 . 2009-03-16 12:18	235352	----a-w-	c:\windows\system32\xactengine3_4.dll
2009-07-13 21:30 . 2009-03-09 13:27	4178264	----a-w-	c:\windows\system32\D3DX9_41.dll
2009-07-13 21:29 . 2009-07-13 21:29	--------	d-----w-	c:\windows\system32\xlive
2009-07-13 21:29 . 2009-07-13 21:29	--------	d-----w-	c:\program files\Microsoft Games for Windows - LIVE
2009-07-08 19:25 . 2009-07-08 19:25	--------	d-----w-	c:\program files\Euro Truck Simulator
2009-07-08 19:24 . 2009-07-08 19:24	--------	d-----w-	c:\program files\rondomedia
2009-07-08 19:23 . 2000-08-19 17:29	268048	----a-w-	c:\windows\system32\dxtmeta2.dll
2009-07-06 16:25 . 2009-06-19 11:03	2797468	----a-w-	c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
2009-06-30 17:13 . 2009-06-30 17:13	794408	----a-w-	c:\windows\system32\pbsvc.exe
2009-06-30 17:10 . 2009-06-25 14:36	1291640	----a-w-	c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
2009-06-30 17:10 . 2009-06-25 14:36	729088	----a-w-	c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
2009-06-29 20:43 . 2009-06-29 20:43	--------	d-----w-	c:\progra~2\2DBoy
2009-06-29 20:43 . 2009-07-14 23:09	--------	d-----w-	c:\program files\WorldOfGoo
2009-06-24 17:47 . 2008-04-07 04:38	22872	----a-r-	c:\windows\system32\AdobePDFUI.dll
2009-06-18 20:37 . 2008-10-10 02:52	2036576	----a-w-	c:\windows\system32\D3DCompiler_40.dll
2009-06-18 20:36 . 2008-10-27 08:04	514384	----a-w-	c:\windows\system32\XAudio2_3.dll
2009-06-18 20:36 . 2008-10-27 08:04	235856	----a-w-	c:\windows\system32\xactengine3_3.dll
2009-06-18 20:36 . 2008-10-27 08:04	23376	----a-w-	c:\windows\system32\X3DAudio1_5.dll
2009-06-18 20:36 . 2008-10-27 08:04	70992	----a-w-	c:\windows\system32\XAPOFX1_2.dll
2009-06-18 20:36 . 2008-10-10 02:52	452440	----a-w-	c:\windows\system32\d3dx10_40.dll
2009-06-18 20:36 . 2008-10-10 02:52	4379984	----a-w-	c:\windows\system32\D3DX9_40.dll
2009-06-18 20:24 . 2009-06-18 20:38	--------	d-----w-	c:\program files\Drakensang
2009-06-15 20:39 . 2009-07-06 18:55	--------	d-----w-	c:\program files\RocketDock
2009-06-15 19:45 . 2009-06-15 19:45	--------	d-----w-	c:\program files\SyncToy 2.0
2009-06-15 19:44 . 2009-06-15 19:44	--------	d-----w-	c:\program files\Microsoft Sync Framework
2009-06-15 19:38 . 2009-06-15 19:38	--------	d-----w-	c:\progra~2\Cobian
2009-06-15 19:38 . 2009-06-15 19:38	--------	d-----w-	c:\program files\Cobian Backup 9
2009-06-15 19:20 . 2009-06-15 19:20	--------	d-----w-	c:\progra~2\MemeoCommon

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-15 16:39 . 2006-11-02 15:48	681554	----a-w-	c:\windows\system32\perfh00C.dat
2009-07-15 16:39 . 2006-11-02 15:48	129126	----a-w-	c:\windows\system32\perfc00C.dat
2009-07-14 23:32 . 2008-12-04 21:57	--------	d-----w-	c:\progra~2\Spybot - Search & Destroy
2009-07-14 20:09 . 2008-01-16 00:56	2140	----a-w-	c:\windows\bthservsdp.dat
2009-07-14 17:41 . 2009-01-07 18:54	22328	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2009-07-14 17:41 . 2009-01-07 18:54	103736	----a-w-	c:\windows\system32\PnkBstrB.exe
2009-07-14 10:57 . 2008-09-24 19:49	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\GrabIt
2009-07-14 09:15 . 2008-01-23 11:48	--------	d-----w-	c:\program files\Electronic Arts
2009-07-14 08:51 . 2008-09-16 22:38	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\WTablet
2009-07-08 17:22 . 2009-06-03 17:27	1	----a-w-	c:\users\Arnaud\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-30 17:13 . 2008-01-23 11:52	139152	----a-w-	c:\users\Arnaud\AppData\Roaming\PnkBstrK.sys
2009-06-30 17:13 . 2008-01-23 11:52	139152	----a-w-	c:\users\Arnaud\AppData\Roaming\PnkBstrK.sys
2009-06-30 17:13 . 2008-02-20 20:59	75064	----a-w-	c:\windows\system32\PnkBstrA.exe
2009-06-25 22:20 . 2009-04-14 18:20	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\FileZilla
2009-06-16 10:52 . 2009-06-12 18:21	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\WD
2009-06-15 19:08 . 2009-06-13 00:26	--------	d-----w-	c:\program files\Common Files\Memeo
2009-06-13 00:29 . 2009-06-12 18:21	--------	d-----w-	c:\program files\Common Files\eSellerate
2009-06-12 18:20 . 2009-06-12 18:20	--------	d-----w-	c:\program files\Western Digital Corporation
2009-06-12 18:20 . 2009-06-12 18:20	--------	d-----w-	c:\program files\Western Digital
2009-06-12 18:11 . 2009-06-12 18:11	--------	d-----w-	c:\program files\SigmaTel
2009-06-12 18:11 . 2008-01-16 01:06	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-06-12 18:02 . 2008-05-01 17:38	534	----a-w-	c:\windows\system32\drivers\stwrte.log
2009-06-10 17:33 . 2009-06-10 17:33	--------	d-----w-	c:\program files\Windows Live SkyDrive
2009-06-03 17:30 . 2008-01-20 12:01	113848	----a-w-	c:\users\Arnaud\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-03 17:27 . 2009-06-03 17:27	--------	d-----w-	c:\users\Arnaud\AppData\Roaming\OpenOffice.org
2009-06-03 17:26 . 2009-06-03 17:25	--------	d-----w-	c:\program files\OpenOffice.org 3
2009-06-03 17:25 . 2008-11-19 20:43	410984	----a-w-	c:\windows\system32\deploytk.dll
2009-06-03 17:25 . 2009-06-03 17:25	--------	d-----w-	c:\program files\Java
2009-06-03 06:21 . 2008-05-03 12:18	--------	d-----w-	c:\progra~2\Roxio
2009-06-01 22:32 . 2009-06-01 22:32	--------	d-----w-	c:\program files\Sun
2009-05-29 18:13 . 2009-05-29 18:13	79888	----a-w-	c:\windows\system32\drivers\VBoxNetAdp.sys
2009-05-29 18:13 . 2009-06-01 22:32	41424	----a-w-	c:\windows\system32\drivers\VBoxUSBMon.sys
2009-05-29 18:13 . 2009-06-01 22:32	100944	----a-w-	c:\windows\system32\drivers\VBoxDrv.sys
2009-05-29 18:12 . 2009-05-29 18:12	133648	----a-w-	c:\windows\system32\VBoxNetFltNotify.dll
2009-05-29 18:12 . 2009-05-29 18:12	87760	----a-w-	c:\windows\system32\drivers\VBoxNetFlt.sys
2009-05-28 22:43 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Sidebar
2009-05-28 22:43 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Collaboration
2009-05-28 22:43 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Calendar
2009-05-28 22:43 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-05-28 22:43 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Photo Gallery
2009-05-28 22:43 . 2006-11-02 12:37	--------	d-----w-	c:\program files\Windows Defender
2009-05-28 22:43 . 2006-11-02 10:25	665600	----a-w-	c:\windows\inf\drvindex.dat
2009-05-28 22:42 . 2009-05-28 22:42	0	---ha-w-	c:\windows\system32\drivers\Msft_User_AuxiliaryDisplayEnhancedDriver_01_00_00.Wdf
2009-05-28 22:37 . 2008-10-06 19:33	37665	----a-w-	c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-05-25 23:20 . 2008-10-21 16:42	--------	d-----w-	c:\program files\TortoiseSVN
2009-05-25 23:20 . 2009-05-21 22:08	--------	d-----w-	c:\program files\Common Files\TortoiseOverlays
2009-05-21 21:59 . 2008-12-04 21:57	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-05-11 19:15 . 2009-05-11 19:13	38208	----a-w-	c:\users\Arnaud\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-05-09 05:50 . 2009-06-11 18:16	915456	----a-w-	c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-11 18:16	71680	----a-w-	c:\windows\system32\iesetup.dll
2009-04-23 12:15 . 2009-06-11 18:17	784896	----a-w-	c:\windows\system32\rpcrt4.dll
2009-04-23 12:14 . 2009-06-11 11:00	623616	----a-w-	c:\windows\system32\localspl.dll
2009-04-21 22:20 . 2009-04-21 22:20	14311680	----a-w-	c:\windows\system32\xlive.dll
2009-04-21 22:20 . 2009-04-21 22:20	13642496	----a-w-	c:\windows\system32\xlivefnt.dll
2009-04-21 11:39 . 2009-06-11 18:17	2034688	----a-w-	c:\windows\system32\win32k.sys
2009-06-17 21:50 . 2008-07-20 20:14	134648	----a-w-	c:\program files\mozilla firefox\components\brwsrcmp.dll
2008-01-23 11:47 . 2008-01-23 11:47	0	--sh--w-	c:\windows\SEA120342.tmp
2008-01-16 08:48 . 2008-01-16 08:40	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-11-02 07:26	80384	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\windows sidebar\sidebar.exe" [2009-04-11 1233920]
"Winsplit"="c:\program files\WinSplit Revolution\WinSplit.exe" [2009-02-27 3958784]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-06-03 251240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 178712]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-22 13535776]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-05-06 405504]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560]
"Bluetooth HCI Monitor"="HCIMNTR.DLL" - c:\windows\System32\HCIMNTR.DLL [2006-12-07 9728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AdobeBridge"=
"Google Update"="c:\users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"Cobian Backup 9 interface"="c:\program files\Cobian Backup 9\cbInterface.exe" -service
"VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):28,cc,b5,66,e6,df,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3406532566-97341564-2360706075-1001]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{373F617E-D6C5-4E1C-8348-62CD5E56CDAB}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{A98A4B19-1ED1-4F36-A333-CF4034B4E480}"= TCP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{CF1A12AF-C230-4D1C-B502-0AF320F9C76B}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{36E1C542-6B63-4CDC-81A0-F3A207F15A4E}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{D9F024FA-2885-47D1-865F-7C18ED22DA18}"= UDP:c:\windows\System32\mstsc.exe:mstsc.exe
"{28D2DA1F-0671-4391-A0CF-79D52508956E}"= TCP:c:\windows\System32\mstsc.exe:mstsc.exe
"{366B5B1D-4184-4206-A333-5DA5732880F6}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{4C8C9EBC-E1E5-48FF-B5F8-BA0B1E880588}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{0638EBAB-31B6-40EE-96B4-012E5B27ECAA}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{E410D7F0-5526-4DB7-8D40-62902E09075A}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{8D4AD639-5D89-4FE1-85D5-82468A587F19}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{49495BE6-B81D-4DF9-B27D-E4B5840A220B}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{04945C52-B155-412B-8EBF-476F3F3C7A3C}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{F1380852-8C27-4CE5-94E4-4AEC98A91463}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{C3B1DC03-7728-4C82-A669-3970A8241328}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{6CB1B25A-8EDD-4671-9FBB-FE2330F08ECE}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{6781F509-DBF9-4FD0-B29A-88EAE2E56C72}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{ACD5C52A-F653-4E5F-B386-FF25A682D52D}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{5A7C41DC-6503-49EC-8292-9572696971DC}c:\\program files\\adobe\\adobe dreamweaver cs3\\dreamweaver.exe"= UDP:c:\program files\adobe\adobe dreamweaver cs3\dreamweaver.exe:Adobe Dreamweaver CS3
"UDP Query User{31D56222-CDB5-4DF6-95B3-0BDD2067615D}c:\\program files\\adobe\\adobe dreamweaver cs3\\dreamweaver.exe"= TCP:c:\program files\adobe\adobe dreamweaver cs3\dreamweaver.exe:Adobe Dreamweaver CS3
"TCP Query User{F29F7EE4-5890-4D3C-AF50-596E2AC2A837}c:\\users\\public\\partage\\psp\\fs\\usbhostfs\\usbhostfs_pc.exe"= UDP:c:\users\public\partage\psp\fs\usbhostfs\usbhostfs_pc.exe:usbhostfs_pc
"UDP Query User{D05CC71A-F47B-4BAF-A357-4C60119796B0}c:\\users\\public\\partage\\psp\\fs\\usbhostfs\\usbhostfs_pc.exe"= TCP:c:\users\public\partage\psp\fs\usbhostfs\usbhostfs_pc.exe:usbhostfs_pc
"TCP Query User{F84B0111-73C2-46DF-B3E0-7A9CE27703CC}c:\\program files\\valvesoftware\\the orange box\\team fortress 2\\hl2.exe"= UDP:c:\program files\valvesoftware\the orange box\team fortress 2\hl2.exe:hl2
"UDP Query User{50588B6E-BEB4-4DB8-9E55-1601D80F5241}c:\\program files\\valvesoftware\\the orange box\\team fortress 2\\hl2.exe"= TCP:c:\program files\valvesoftware\the orange box\team fortress 2\hl2.exe:hl2
"TCP Query User{3FF74CB2-016D-4921-8F08-47DAAC0F4335}d:\\desktop\\dow\\w40k.exe"= UDP:d:\desktop\dow\w40k.exe:W40k
"UDP Query User{5D8C4E3B-0F48-4406-8F24-29D9BB9F0DE3}d:\\desktop\\dow\\w40k.exe"= TCP:d:\desktop\dow\w40k.exe:W40k
"TCP Query User{05A8417F-F780-44A4-AD4B-94E7888813FF}c:\\server\\wamp\\bin\\apache\\apache2.2.8\\bin\\httpd.exe"= UDP:c:\server\wamp\bin\apache\apache2.2.8\bin\httpd.exe:Apache HTTP Server
"UDP Query User{039EE23D-154E-4D01-B222-915168BEDFAD}c:\\server\\wamp\\bin\\apache\\apache2.2.8\\bin\\httpd.exe"= TCP:c:\server\wamp\bin\apache\apache2.2.8\bin\httpd.exe:Apache HTTP Server
"TCP Query User{EF80C63C-BFBE-4B47-84AF-D193B7DC4604}c:\\program files\\java\\jre1.6.0_05\\bin\\java.exe"= UDP:c:\program files\java\jre1.6.0_05\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{BD7E0911-212D-42F4-A90A-69E589332F38}c:\\program files\\java\\jre1.6.0_05\\bin\\java.exe"= TCP:c:\program files\java\jre1.6.0_05\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{43B3AECF-3FC5-4289-BAAD-6E5CAD3A8A47}c:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"UDP Query User{3800088F-FDD2-4625-B827-6196BC020143}c:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"{D60C2B00-06F1-426E-9601-BCF3398831E5}"= UDP:c:\program files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.1
"{5DF73F1F-F724-4C42-83B7-B5DD69804199}"= TCP:c:\program files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:Sony Ericsson Media Manager 1.1
"TCP Query User{C9C598A3-F878-4CC6-8B9D-CB8876104A08}c:\\server\\funambol\\tools\\jre-1.5.0\\jre\\bin\\javaw.exe"= UDP:c:\server\funambol\tools\jre-1.5.0\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{49C155B4-AE9A-4646-972A-093E7BFD1865}c:\\server\\funambol\\tools\\jre-1.5.0\\jre\\bin\\javaw.exe"= TCP:c:\server\funambol\tools\jre-1.5.0\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"TCP Query User{7671D1E9-0575-4824-AF69-3AAE760089D5}c:\\sonyericsson\\javame_sdk_cldc\\ondevicedebug\\bin\\serialproxy.exe"= UDP:c:\sonyericsson\javame_sdk_cldc\ondevicedebug\bin\serialproxy.exe:serialproxy
"UDP Query User{826C6C9D-C3E6-4624-BE0E-F639F777D625}c:\\sonyericsson\\javame_sdk_cldc\\ondevicedebug\\bin\\serialproxy.exe"= TCP:c:\sonyericsson\javame_sdk_cldc\ondevicedebug\bin\serialproxy.exe:serialproxy
"TCP Query User{2C932DE0-5154-48BE-A259-FE3107C0F8BD}c:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"UDP Query User{CF684E29-B1BE-4C24-A396-ED4A8EAFDD71}c:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:c:\program files\sony ericsson\update service\update service.exe:Update Service
"TCP Query User{56CF5EDA-F548-42C8-882E-9CF58C8ECEA7}c:\\program files\\eclipse\\eclipse.exe"= UDP:c:\program files\eclipse\eclipse.exe:eclipse
"UDP Query User{F6B154E5-07CE-44B0-8CCF-474E5F53B594}c:\\program files\\eclipse\\eclipse.exe"= TCP:c:\program files\eclipse\eclipse.exe:eclipse
"TCP Query User{3C726F3E-DEA3-460C-9A89-A6563B786687}c:\\program files\\adobe\\adobe flash cs3\\flash.exe"= UDP:c:\program files\adobe\adobe flash cs3\flash.exe:Adobe Flash CS3
"UDP Query User{74134E6E-1FC3-495A-B6CD-788FF06B76D9}c:\\program files\\adobe\\adobe flash cs3\\flash.exe"= TCP:c:\program files\adobe\adobe flash cs3\flash.exe:Adobe Flash CS3
"TCP Query User{99022749-D781-4FF1-A153-FA03FD72AF7D}c:\\program files\\flashget\\flashget.exe"= UDP:c:\program files\flashget\flashget.exe:FlashGet
"UDP Query User{EEACFC11-D003-45DF-968C-6D3BBCBAE4D0}c:\\program files\\flashget\\flashget.exe"= TCP:c:\program files\flashget\flashget.exe:FlashGet
"TCP Query User{D3B4CB3D-DC6E-4FEE-95A3-541BCF050D92}c:\\program files\\the all-seeing eye\\eye.exe"= UDP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{5CCE720F-2E27-4EDF-BE05-C6D03E8DF11A}c:\\program files\\the all-seeing eye\\eye.exe"= TCP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{D7635049-A767-4D0B-B25E-F4C6BECC4CCC}c:\\program files\\java\\jdk1.6.0_06\\jre\\bin\\java.exe"= UDP:c:\program files\java\jdk1.6.0_06\jre\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{9BE3CC14-50B5-4442-B25C-AA5CE3B5AE06}c:\\program files\\java\\jdk1.6.0_06\\jre\\bin\\java.exe"= TCP:c:\program files\java\jdk1.6.0_06\jre\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{F396EE4B-8F60-437F-B9EA-D928704A6F5F}c:\\program files\\videolan\\vlc\\vlc.exe"= UDP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{9003354A-766C-4025-9B75-711E3E92B91B}c:\\program files\\videolan\\vlc\\vlc.exe"= TCP:c:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{A95865BA-06DA-4638-A77E-15096A4B3F28}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{06551EBB-CCB6-4D33-B84F-5639CD62A604}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{B57C2B71-EC2B-42EE-9A91-1C9629F98ACD}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) 
"{950C1677-5176-4CC2-A72E-198F5E25D9B0}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) 
"TCP Query User{64404219-31AC-4134-B019-5BC68AEB3F58}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{E6FFE79D-AE19-4262-8C0F-9BA1ACFBC7F0}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{13E63711-82FB-47D4-BDD6-256BCEEBD4C4}c:\\program files\\ubisoft\\gearbox software\\brothersinarmseib\\system\\eib.exe"= UDP:c:\program files\ubisoft\gearbox software\brothersinarmseib\system\eib.exe:Brothers In Arms Earned In Blood
"UDP Query User{DF28E79B-8C80-49C6-9406-99CEED4E829B}c:\\program files\\ubisoft\\gearbox software\\brothersinarmseib\\system\\eib.exe"= TCP:c:\program files\ubisoft\gearbox software\brothersinarmseib\system\eib.exe:Brothers In Arms Earned In Blood
"{D1F51F17-2EC5-4A8F-850F-AB250D715E07}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{D0B5C8B6-7A65-4113-802E-3E4341BB1B0B}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{C1D9F7E3-B83E-4FD8-A29D-FB1C42581984}"= UDP:5353:Adobe CSI CS4
"TCP Query User{C8A8C6EB-DBC9-4B37-94D4-547DD2226D37}c:\\program files\\adobe\\adobe dreamweaver cs4\\dreamweaver.exe"= UDP:c:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe:Adobe Dreamweaver CS4
"UDP Query User{5BCFD77B-3470-4431-B64C-682DD1B33966}c:\\program files\\adobe\\adobe dreamweaver cs4\\dreamweaver.exe"= TCP:c:\program files\adobe\adobe dreamweaver cs4\dreamweaver.exe:Adobe Dreamweaver CS4
"TCP Query User{C192E90A-A41E-4080-9831-0D989C68F245}c:\\program files\\thq\\company of heroes\\reliccoh.exe"= UDP:c:\program files\thq\company of heroes\reliccoh.exe:RelicCOH
"UDP Query User{AA2B472A-DC53-4C1C-ACF5-CFC3B7A52A2E}c:\\program files\\thq\\company of heroes\\reliccoh.exe"= TCP:c:\program files\thq\company of heroes\reliccoh.exe:RelicCOH
"TCP Query User{7D037934-0572-4EC6-A595-3DA932757CCB}c:\\program files\\sacred 2 - fallen angel\\system\\s2gs.exe"= UDP:c:\program files\sacred 2 - fallen angel\system\s2gs.exe:Sacred 2 - Game Server
"UDP Query User{3BFB13CC-2381-4E8C-BA9F-8DF7EC30E405}c:\\program files\\sacred 2 - fallen angel\\system\\s2gs.exe"= TCP:c:\program files\sacred 2 - fallen angel\system\s2gs.exe:Sacred 2 - Game Server
"TCP Query User{9A5245D7-AE25-4903-A3E2-C3B9FDF9DB41}c:\\program files\\zattoo\\zattood.exe"= UDP:c:\program files\zattoo\zattood.exe:zattood
"UDP Query User{1054147E-3FB6-440F-A372-A4895DB9423D}c:\\program files\\zattoo\\zattood.exe"= TCP:c:\program files\zattoo\zattood.exe:zattood
"{9660EF6E-E6AB-40D0-A0B5-E92ED8CF0A90}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{AD1DAA71-D608-4721-829C-6F9E7230FEC2}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{FFF5BF6A-1F63-4E7F-86A8-2465DD732E5D}"= UDP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{E1693AB1-3C92-47BA-A7CC-3E361A877F96}"= TCP:c:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{3AFC3205-83D1-48A6-ACD6-80BBC7F2B745}"= UDP:c:\program files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II
"{7CC7BB16-7191-47B1-BD03-C8DB6809A759}"= TCP:c:\program files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II
"TCP Query User{26182D67-DF15-4F8A-AECE-1C3BC72BE657}c:\\program files\\electronic arts\\la bataille pour la terre du milieu ii\\patchget.dat"= UDP:c:\program files\electronic arts\la bataille pour la terre du milieu ii\patchget.dat:patchgrabber
"UDP Query User{06D0999A-D645-45AB-8F47-7824DE49F280}c:\\program files\\electronic arts\\la bataille pour la terre du milieu ii\\patchget.dat"= TCP:c:\program files\electronic arts\la bataille pour la terre du milieu ii\patchget.dat:patchgrabber
"TCP Query User{80BFE8E8-E399-4C84-B051-07FE4064755B}c:\\program files\\codemasters\\rise of the argonauts\\binaries\\riseoftheargonauts.exe"= UDP:c:\program files\codemasters\rise of the argonauts\binaries\riseoftheargonauts.exe:RiseOfTheArgonauts
"UDP Query User{B5F1459D-1E70-4E00-BB4E-14A3B50F44D7}c:\\program files\\codemasters\\rise of the argonauts\\binaries\\riseoftheargonauts.exe"= TCP:c:\program files\codemasters\rise of the argonauts\binaries\riseoftheargonauts.exe:RiseOfTheArgonauts
"TCP Query User{7130FEAE-F557-4608-8292-7BFABCA6AEB7}c:\\program files\\ea games\\medal of honor batailles du pacifique(tm)\\mohpa.exe"= UDP:c:\program files\ea games\medal of honor batailles du pacifique(tm)\mohpa.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{243B9457-3D62-4774-B6F5-52F33256517D}c:\\program files\\ea games\\medal of honor batailles du pacifique(tm)\\mohpa.exe"= TCP:c:\program files\ea games\medal of honor batailles du pacifique(tm)\mohpa.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{39503B98-9CB1-4E59-BE66-8FA1FEDF70B5}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= UDP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"UDP Query User{C621ED52-A516-4780-B702-0EE7E2BE62AC}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= TCP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"TCP Query User{77C03D24-EEDB-47A6-9FD8-B08F6F3352DA}c:\\users\\arnaud\\appdata\\local\\temp\\rar$ex06.207\\teeworlds-0.5.0-win32\\teeworlds_srv.exe"= UDP:c:\users\arnaud\appdata\local\temp\rar$ex06.207\teeworlds-0.5.0-win32\teeworlds_srv.exe:teeworlds_srv.exe
"UDP Query User{9AFCF61E-E252-4594-8286-BF39D014B0BF}c:\\users\\arnaud\\appdata\\local\\temp\\rar$ex06.207\\teeworlds-0.5.0-win32\\teeworlds_srv.exe"= TCP:c:\users\arnaud\appdata\local\temp\rar$ex06.207\teeworlds-0.5.0-win32\teeworlds_srv.exe:teeworlds_srv.exe
"TCP Query User{31C7F24F-6297-4542-A557-E330756C0998}c:\\program files\\activision\\call of duty - world at war\\codwaw.exe"= UDP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop
"UDP Query User{19903E64-C041-434E-B419-A6D207992F30}c:\\program files\\activision\\call of duty - world at war\\codwaw.exe"= TCP:c:\program files\activision\call of duty - world at war\codwaw.exe:Call of Duty(R): World at War Campaign/Coop
"TCP Query User{CCD487EE-FE58-4262-9E1F-970D492E16CD}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= UDP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"UDP Query User{642E4DDB-EFC1-49C9-B715-4D701BD0A85F}c:\\users\\arnaud\\desktop\\teeworlds-0.4.3-win32\\teeworlds_srv.exe"= TCP:c:\users\arnaud\desktop\teeworlds-0.4.3-win32\teeworlds_srv.exe:teeworlds_srv.exe
"TCP Query User{480B40D0-ED97-4F80-B8C4-701128FF2D78}c:\\program files\\ubisoft\\shaun white snowboarding\\shaunwhitesnowboardinggame.exe"= UDP:c:\program files\ubisoft\shaun white snowboarding\shaunwhitesnowboardinggame.exe:ShaunWhiteSnowboardingGame
"UDP Query User{58C53D53-1A9B-41A2-B908-49F614E5EA2B}c:\\program files\\ubisoft\\shaun white snowboarding\\shaunwhitesnowboardinggame.exe"= TCP:c:\program files\ubisoft\shaun white snowboarding\shaunwhitesnowboardinggame.exe:ShaunWhiteSnowboardingGame
"TCP Query User{6AA20FC4-C9A7-4FAB-A16F-02D3D631AAC5}c:\\program files\\the all-seeing eye\\eye.exe"= UDP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{CB0E63E6-FA40-4EB9-BA56-7684DA2F0987}c:\\program files\\the all-seeing eye\\eye.exe"= TCP:c:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{A38FA83D-41B9-4C01-9508-15A27760E554}c:\\program files\\activision\\call of duty 4 - modern warfare\\iw3mp.exe"= UDP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp
"UDP Query User{3DFDAEEA-20CF-4576-8FDA-3950C8D72B86}c:\\program files\\activision\\call of duty 4 - modern warfare\\iw3mp.exe"= TCP:c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe:iw3mp
"TCP Query User{F6FFCAFD-F22F-4362-B880-F9073C68A3E6}e:\\epsonnet easyinstall\\easyinstall.exe"= UDP:e:\epsonnet easyinstall\easyinstall.exe:EasyInstall
"UDP Query User{6433C94A-C710-441B-A728-9D186EE55E50}e:\\epsonnet easyinstall\\easyinstall.exe"= TCP:e:\epsonnet easyinstall\easyinstall.exe:EasyInstall
"TCP Query User{D072A2C7-7E66-4F3A-9E5D-D2C0C1BFF909}c:\\program files\\teeworlds\\teeworlds_srv.exe"= UDP:c:\program files\teeworlds\teeworlds_srv.exe:teeworlds_srv
"UDP Query User{09A7B6B4-77EA-4351-9C68-8AC6850B2081}c:\\program files\\teeworlds\\teeworlds_srv.exe"= TCP:c:\program files\teeworlds\teeworlds_srv.exe:teeworlds_srv
"TCP Query User{4C6BAF7A-292E-4487-9DDA-6161493A7243}c:\\server\\wamp\\bin\\apache\\apache2.2.11\\bin\\httpd.exe"= UDP:c:\server\wamp\bin\apache\apache2.2.11\bin\httpd.exe:Apache HTTP Server
"UDP Query User{2630AB3D-D2D0-4840-BAA8-C48F07DAA25C}c:\\server\\wamp\\bin\\apache\\apache2.2.11\\bin\\httpd.exe"= TCP:c:\server\wamp\bin\apache\apache2.2.11\bin\httpd.exe:Apache HTTP Server
"TCP Query User{EEA7D74F-5AC4-42B1-9F23-864E136635A7}c:\\program files\\filezilla ftp client\\filezilla.exe"= UDP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client
"UDP Query User{BAA31DF5-EED4-4A06-BE8D-B199A1B32BC8}c:\\program files\\filezilla ftp client\\filezilla.exe"= TCP:c:\program files\filezilla ftp client\filezilla.exe:FileZilla FTP Client
"{316CF86A-2AFF-4BE8-8786-15136BA7D4D8}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{ADD03CBB-5E8E-4FDC-8AC9-F59BFD6639FA}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"TCP Query User{FDED4996-0EA6-44AB-B81A-D4809152EC38}c:\\program files\\activision\\call of duty - world at war\\codwawmp.exe"= UDP:c:\program files\activision\call of duty - world at war\codwawmp.exe:Call of Duty(R): World at War Multiplayer
"UDP Query User{7832A5D4-82CB-432F-B4EC-1BAB1A783B4C}c:\\program files\\activision\\call of duty - world at war\\codwawmp.exe"= TCP:c:\program files\activision\call of duty - world at war\codwawmp.exe:Call of Duty(R): World at War Multiplayer
"{9702A650-8581-48CB-8924-ADCCBE9AF43D}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{6A1BA2C6-FC14-4FB7-A90A-FC4B908AFAAE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{2571D7BA-34F9-4AA6-9042-9CE5EC92BF2C}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{1E1BCAD8-E179-4C90-8126-05D9FFD96C6F}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{6E1190EF-5708-43DC-9604-914498CE2ED5}"= UDP:c:\program files\EA GAMES\Battlefield Heroes\BFHeroes.exe:BFHeroes.exe
"{5D7987AE-6D14-48CD-AB24-FCF9BFBEC9E5}"= TCP:c:\program files\EA GAMES\Battlefield Heroes\BFHeroes.exe:BFHeroes.exe
"TCP Query User{27C90F00-2B14-4A97-A0D1-02FEF19B7A67}c:\\users\\arnaud\\desktop\\games\\quake\\quake3.exe"= UDP:c:\users\arnaud\desktop\games\quake\quake3.exe:quake3.exe
"UDP Query User{D390EFDA-6599-4316-86DE-2179F9CF906B}c:\\users\\arnaud\\desktop\\games\\quake\\quake3.exe"= TCP:c:\users\arnaud\desktop\games\quake\quake3.exe:quake3.exe
"{1BF9896D-694E-4B61-B424-F2687253B022}"= UDP:c:\program files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe:STREET FIGHTER IV
"{61630A33-4A1C-4B66-9C67-03696A02860B}"= TCP:c:\program files\CAPCOM\STREETFIGHTERIV\StreetFighterIV.exe:STREET FIGHTER IV
"{0B039811-C9DC-4DD0-80EF-B90048CBB78F}"= UDP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{36123CC1-C3E2-42E4-AD30-946186102192}"= TCP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{520DEAEE-FD33-4F5C-B215-C57E6BA7A440}"= UDP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{FB488450-541D-48D1-A761-0A8722CFB794}"= TCP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{DB9BCD20-D7FD-4413-9402-E4FFC85A05D4}"= UDP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009
"{BC430A2C-82D6-4E8F-9AB7-15EA97E5A7C4}"= TCP:c:\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:Pro Evolution Soccer 2009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"DoNotAllowExceptions"= 0 (0x0)

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\System32\drivers\VBoxNetAdp.sys [29/05/2009 20:13 79888]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\System32\drivers\VBoxNetFlt.sys [29/05/2009 20:12 87760]
S1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [02/04/2008 19:29 114768]
S1 VBoxDrv;VirtualBox Service;c:\windows\System32\drivers\VBoxDrv.sys [02/06/2009 00:32 100944]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\System32\drivers\VBoxUSBMon.sys [02/06/2009 00:32 41424]
S2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [11/09/2007 02:45 124832]
S2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [02/04/2008 19:29 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [27/01/2008 23:44 51792]
S2 CobianBackupAmanita;Cobian Backup 9 service;c:\program files\Cobian Backup 9\cbService.exe [15/06/2009 21:38 583168]
S2 TabletServicePen;TabletServicePen;c:\windows\System32\Pen_Tablet.exe [17/09/2008 00:37 3024168]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [03/06/2009 14:46 92008]
S2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [24/07/2008 15:22 102400]
S3 epmntdrv;epmntdrv;c:\windows\System32\epmntdrv.sys [05/01/2009 18:00 9728]
S3 EuGdiDrv;EuGdiDrv;c:\windows\System32\EuGdiDrv.sys [05/01/2009 18:00 3072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [15/04/2008 20:23 13352]
S3 IntelDH;IntelDH Driver;c:\windows\System32\drivers\IntelDH.sys [16/01/2008 03:16 5632]
S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;c:\windows\System32\drivers\libusb0.sys [27/10/2007 20:05 29184]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\System32\drivers\wacmoumonitor.sys [17/09/2008 00:37 15144]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\System32\drivers\wdcsam.sys [10/07/2008 14:47 11520]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
rsmsvcs	REG_MULTI_SZ   	ntmssvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-RunOnce-<NO NAME> - (no file)


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
FF - ProfilePath - c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\
FF - component: c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll
FF - plugin: c:\users\Arnaud\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\users\Arnaud\AppData\Roaming\Mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-15 19:14
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-07-15 19:18
ComboFix-quarantined-files.txt  2009-07-15 17:18

Avant-CF: 107 328 643 072 octets libres
Après-CF: 107 405 172 736 octets libres

401	--- E O F ---	2009-07-13 16:57

Réponse 4 / 103

gen-hackman

Télécharge OTL de OLDTimer

et enregistre le sur ton Bureau.

Double clic sur OTL.exe pour le lancer.

Coche les 2 cases Lop et Purity

Coche la case devant scan all users

Clic sur Run Scan.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

Clique sur Parcourir et cherche le fichier ci-dessus.

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

Tu feras la meme chose avec le "Extra.txt" s'il t'est demandé

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question

Réponse 5 / 103

arnolem Messages postés 88 Statut Membre 10

Merci énormément pour cette réponse.

Voici le rapport :
http://www.cijoint.fr/cjlink.php?file=cj200907/cijtOPHLwb.txt

Et le extras.txt si tu en as besoin : http://www.cijoint.fr/cjlink.php?file=cj200907/cijvh6B0h1.txt

Réponse 6 / 103

gen-hackman

Télécharge HostXpert sur ton Bureau :

---> Décompresse-le (Clic droit >> Extraire ici)

---> Double-clique sur HostsXpert pour le lancer

---> clique sur le bouton "Restore MS Hosts File" puis ferme le programme

PS : Avant de cliquer sur le bouton "Restore MS Hosts File", vérifie que le cadenas en haut à gauche est ouvert sinon tu vas avoir un message d'erreur.

s'il est fermé , clique dessus :)

ensuite :

Télécharge Zeb-Restore http://telechargement.zebulon.fr/zeb-restore.html enregistre ce fichier sur le bureau.

-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe
- Coche la case devant :sites de confiance
- Ne coche aucune autre case
-Clique sur Restaurer
-Redémarre ton PC

ensuite :

Double clic sur OTL.exe pour le lancer.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans la zone sous Customs Scans/Fixes

:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
TeaTimer.exe
mdpfsruokw.exe
mdpfsruokw.exe

:services
AdobeActiveFileMonitor6.0AeLookupSvc

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} https://www.eset.com/ (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

:files
C:\Windows\TEMP\mdpfsruokw.exe
C:\Windows\System32\lsprst7.dll
C:\Windows\System32\ssprs.dll

:commands
[emptytemp]
[start explorer]
[reboot]

Clique sur RunFix pour lancer la suppression.

Poste le rapport.

==========

Réponse 7 / 103

arnolem Messages postés 88 Statut Membre 10

Merci, faut il redémarrer en mode sans échec avant le scan ?

Réponse 8 / 103

arnolem Messages postés 88 Statut Membre 10

Je ne sais pas si ça a bien fonctionné. Déja lors du lancement, j'ai eu deux avertissement comme quoi les DLL n'était pas faite pour windows.

Ensuite, ça a redémarré (mode sans echec) mais il n'a rien executé au redémarrage. Il ne m'a pas non plus donné de rapport.

Lorsque j'ai lancé OTL, j'ai eu ce rapport :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named TeaTimer.exe was found!
No active process named mdpfsruokw.exe was found!
No active process named mdpfsruokw.exe was found!
========== SERVICES/DRIVERS ==========

Service\Driver AdobeActiveFileMonitor6.0AeLookupSvc deleted successfully.
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\Windows\Downloaded Program Files\swdir.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {56762DEC-6B0D-4AB4-A8AD-989993B5D08B}
C:\Windows\Downloaded Program Files\OnlineScanner.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{E31004D1-A431-41B8-826F-E902F9D95C81} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E31004D1-A431-41B8-826F-E902F9D95C81}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
========== FILES ==========
C:\Windows\TEMP\mdpfsruokw.exe moved successfully.
LoadLibrary failed for C:\Windows\System32\lsprst7.dll
C:\Windows\System32\lsprst7.dll NOT unregistered.
C:\Windows\System32\lsprst7.dll moved successfully.
LoadLibrary failed for C:\Windows\System32\ssprs.dll
C:\Windows\System32\ssprs.dll NOT unregistered.
C:\Windows\System32\ssprs.dll moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Arnaud
->Temp folder emptied: 73459489 bytes
->Temporary Internet Files folder emptied: 1813696 bytes
->Java cache emptied: 2826404 bytes
->FireFox cache emptied: 60534587 bytes
->Google Chrome cache emptied: 59157252 bytes
 
User: Arnaud.tmp
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
C:\Windows\45235788142C44BE8A4DDDE9A84492E5.TMP folder deleted successfully.
%systemroot% .tmp files removed: 155648 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 188,78 mb
 
 
OTL by OldTimer - Version 3.0.7.1 log created on 07162009_003836

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Réponse 9 / 103

arnolem Messages postés 88 Statut Membre 10

Pour être sur de ne rien oublié, j'ai relancé un rapport en suivant les instructions du message #3.
Voici le rapport :

OTL logfile created on: 16/07/2009 00:56:12 - Run 2
OTL by OldTimer - Version 3.0.7.1     Folder = C:\Users\Arnaud\Downloads\Chrome Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18783)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 100,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 478,80 Gb Total Space | 100,16 Gb Free Space | 20,92% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 87,80 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 117,32 Gb Total Space | 44,22 Gb Free Space | 37,69% Space Free | Partition Type: NTFS
 
Computer Name: XPS
Current User Name: Arnaud
Logged in as Administrator.
 
Current Boot Mode: SafeMode with Networking
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2009/04/11 08:27:36 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\Explorer.EXE
PRC - [2009/05/09 14:09:24 | 00,606,720 | ---- | M] (http://tortoisesvn.net) -- C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
PRC - [2008/01/19 00:33:40 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe
PRC - [2009/04/11 08:28:08 | 00,037,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\unsecapp.exe
PRC - [2009/04/11 08:28:15 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wmiprvse.exe
PRC - [2009/06/19 03:39:20 | 00,759,280 | ---- | M] (Google Inc.) -- C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2009/06/19 03:39:20 | 00,759,280 | ---- | M] (Google Inc.) -- C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2009/06/19 03:39:20 | 00,759,280 | ---- | M] (Google Inc.) -- C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2008/01/19 00:33:20 | 00,151,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\notepad.exe
PRC - [2009/07/15 23:47:46 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Users\Arnaud\Downloads\Chrome Downloads\OTL.exe
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - [2007/09/11 02:45:04 | 00,124,832 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0 [Auto | Stopped])
SRV - [2009/02/05 23:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Stopped])
SRV - [2009/02/05 23:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Stopped])
SRV - [2009/02/05 23:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Stopped])
SRV - [2009/02/05 23:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Stopped])
SRV - [2009/03/30 06:42:14 | 00,066,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009/01/22 11:38:38 | 00,583,168 | ---- | M] (Luis Cobian) -- C:\Program Files\Cobian Backup 9\cbService.exe -- (CobianBackupAmanita [Auto | Stopped])
SRV - [2008/01/16 03:07:04 | 00,072,704 | ---- | M] (Creative Labs) -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe -- (Creative Labs Licensing Service [Disabled | Stopped])
SRV - [2007/10/26 15:28:06 | 01,524,512 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND [Auto | Stopped])
SRV - [2008/01/19 00:33:10 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehRecvr.exe -- (ehRecvr [On_Demand | Stopped])
SRV - [2006/11/02 14:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched [On_Demand | Stopped])
SRV - [2006/11/02 14:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart [Auto | Stopped])
SRV - [2006/12/19 19:23:20 | 00,094,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exe -- (EpsonBidirectionalService [Auto | Stopped])
SRV - [2009/04/11 08:28:25 | 01,017,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wevtsvc.dll -- (Eventlog [Auto | Running])
SRV - [2008/09/30 23:51:47 | 00,655,624 | ---- | M] (Acresso Software Inc.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2009/02/18 20:39:20 | 00,043,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2007/07/26 21:03:46 | 00,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe -- (IAANTMON [Auto | Stopped])
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2009/02/18 20:38:42 | 00,879,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2003/06/20 00:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM [Auto | Stopped])
SRV - [2009/02/18 20:38:43 | 00,129,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
SRV - [2008/08/23 01:35:00 | 00,118,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvvsvc.exe -- (nvsvc [Auto | Stopped])
SRV - [2006/10/26 15:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2009/06/30 19:13:12 | 00,075,064 | ---- | M] () -- C:\Windows\System32\PnkBstrA.exe -- (PnkBstrA [On_Demand | Stopped])
SRV - [2007/05/31 11:21:18 | 00,183,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr [Disabled | Stopped])
SRV - [2007/09/06 18:10:26 | 01,010,160 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9 [On_Demand | Stopped])
SRV - [2007/05/06 17:11:36 | 00,094,208 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\STacSV.exe -- (STacSV [Auto | Stopped])
SRV - [2007/07/11 11:33:28 | 00,069,632 | R--- | M] (MicroVision Development, Inc.) -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr [On_Demand | Stopped])
SRV - [2008/04/03 07:59:48 | 03,024,168 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen [Auto | Stopped])
SRV - [2009/06/03 14:46:36 | 00,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService [Auto | Stopped])
SRV - [2008/12/10 01:10:14 | 00,024,636 | ---- | M] (Apache Software Foundation) -- C:\server\wamp\bin\apache\apache2.2.11\bin\httpd.exe -- (wampapache [On_Demand | Stopped])
SRV - [2009/02/15 01:22:12 | 06,558,336 | ---- | M] () -- C:\server\wamp\bin\mysql\mysql5.1.32\bin\mysqld.exe -- (wampmysqld [On_Demand | Stopped])
SRV - [2007/05/31 11:21:24 | 00,379,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm [Disabled | Stopped])
SRV - [2008/07/24 15:22:50 | 00,102,400 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe -- (WDBtnMgrSvc.exe [Auto | Stopped])
SRV - [2008/01/19 00:38:26 | 00,272,952 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend [Auto | Running])
SRV - [2008/01/19 00:33:40 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [Disabled | Stopped])
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - [2008/01/18 22:53:32 | 00,045,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DRIVERS\61883.sys -- (61883 [On_Demand | Stopped])
DRV - [2006/11/02 11:51:38 | 00,420,968 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx [Disabled | Stopped])
DRV - [2006/11/02 11:51:32 | 00,297,576 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci [Disabled | Stopped])
DRV - [2006/11/02 11:50:35 | 00,098,408 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m [Disabled | Stopped])
DRV - [2006/11/02 11:51:00 | 00,147,048 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320 [Disabled | Stopped])
DRV - [2006/11/02 11:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx [Disabled | Stopped])
DRV - [2008/01/16 10:48:51 | 00,017,592 | ---- | M] (Acer Laboratories Inc.) -- C:\Windows\system32\drivers\aliide.sys -- (aliide [Disabled | Stopped])
DRV - [2006/11/02 11:50:09 | 00,067,688 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\arc.sys -- (arc [Disabled | Stopped])
DRV - [2006/11/02 11:50:10 | 00,067,688 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas [Disabled | Stopped])
DRV - [2009/02/05 23:07:12 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\Windows\System32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Stopped])
DRV - [2009/02/05 23:06:59 | 00,051,792 | ---- | M] (ALWIL Software) -- C:\Windows\System32\DRIVERS\aswMonFlt.sys -- (aswMonFlt [Auto | Stopped])
DRV - [2009/02/05 23:06:10 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr [System | Running])
DRV - [2009/02/05 23:07:23 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP [System | Stopped])
DRV - [2009/02/05 23:06:20 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2008/01/18 22:53:32 | 00,040,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DRIVERS\avc.sys -- (Avc [On_Demand | Stopped])
DRV - [2006/11/02 10:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo [On_Demand | Stopped])
DRV - [2006/11/02 10:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp [On_Demand | Stopped])
DRV - [2006/11/02 10:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brserid.sys -- (Brserid [Disabled | Stopped])
DRV - [2006/11/02 10:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm [Disabled | Stopped])
DRV - [2006/11/02 10:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm [Disabled | Stopped])
DRV - [2006/11/02 10:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer [On_Demand | Stopped])
DRV - [2007/04/02 06:42:02 | 00,079,664 | ---- | M] (Broadcom Corporation.) -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio [On_Demand | Stopped])
DRV - [2007/04/02 06:42:04 | 00,080,688 | ---- | M] (Broadcom Corporation.) -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt [On_Demand | Stopped])
DRV - [2007/04/02 06:42:08 | 00,016,432 | ---- | M] (Broadcom Corporation.) -- C:\Windows\System32\DRIVERS\btwrchid.sys -- (btwrchid [On_Demand | Stopped])
DRV - [2007/02/03 11:25:56 | 01,075,360 | ---- | M] (Logitech Inc.) -- C:\Windows\System32\DRIVERS\Camdrl.sys -- (CamDrL [On_Demand | Stopped])
DRV - [2008/01/16 10:48:51 | 00,019,128 | ---- | M] (CMD Technology, Inc.) -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide [Disabled | Stopped])
DRV - [2007/01/18 17:28:02 | 00,005,275 | ---- | M] (Cisco Systems, Inc.) -- C:\Windows\System32\DRIVERS\CVirtA.sys -- (CVirtA [On_Demand | Stopped])
DRV - [2007/10/26 15:27:00 | 00,306,300 | ---- | M] (Cisco Systems, Inc.) -- C:\Windows\System32\Drivers\CVPNDRVA.sys -- (CVPNDRVA [Auto | Stopped])
DRV - [2007/01/31 14:45:06 | 00,127,376 | ---- | M] (Deterministic Networks, Inc.) -- C:\Windows\System32\DRIVERS\dne2000.sys -- (DNE [On_Demand | Running])
DRV - [2007/09/12 10:44:34 | 00,228,224 | ---- | M] (Intel Corporation) -- C:\Windows\System32\DRIVERS\e1e6032.sys -- (e1express [On_Demand | Running])
DRV - [2006/11/02 09:30:54 | 00,117,760 | ---- | M] (Intel Corporation) -- C:\Windows\System32\DRIVERS\E1G60I32.sys -- (E1G60 [On_Demand | Stopped])
DRV - [2007/08/07 21:48:33 | 00,025,160 | ---- | M] (Elaborate Bytes AG) -- C:\Windows\System32\Drivers\ElbyCDIO.sys -- (ElbyCDIO [System | Stopped])
DRV - [2007/02/16 02:56:49 | 00,011,984 | ---- | M] (Elaborate Bytes AG) -- C:\Windows\System32\Drivers\ElbyDelay.sys -- (ElbyDelay [On_Demand | Running])
DRV - [2006/11/02 11:51:34 | 00,316,520 | ---- | M] (Emulex) -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor [Disabled | Stopped])
DRV - [2008/11/25 18:18:24 | 00,009,728 | ---- | M] () -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv [On_Demand | Stopped])
DRV - [2008/11/25 18:18:24 | 00,003,072 | ---- | M] () -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv [On_Demand | Stopped])
DRV - [2008/04/15 20:23:01 | 00,013,352 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\Windows\System32\DRIVERS\ggflt.sys -- (ggflt [On_Demand | Stopped])
DRV - [2008/04/15 20:23:01 | 00,020,520 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\Windows\System32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped])
DRV - [2008/04/28 22:09:56 | 00,025,280 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\System32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped])
DRV - [2006/11/02 11:50:10 | 00,037,480 | ---- | M] (Hewlett-Packard Company) -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs [Disabled | Stopped])
DRV - [2007/08/29 10:56:54 | 00,305,688 | ---- | M] (Intel Corporation) -- C:\Windows\system32\drivers\iastor.sys -- (iaStor [Boot | Running])
DRV - [2006/11/02 11:51:25 | 00,232,040 | ---- | M] (Intel Corporation) -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV [Disabled | Stopped])
DRV - [2006/11/02 11:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp [Disabled | Stopped])
DRV - [2008/01/16 03:16:58 | 00,005,632 | ---- | M] (Intel Corporation) -- C:\Windows\System32\Drivers\IntelDH.sys -- (IntelDH [On_Demand | Stopped])
DRV - [2006/11/02 11:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi [Disabled | Stopped])
DRV - [2006/11/02 11:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid [Disabled | Stopped])
DRV - [2006/04/22 22:34:34 | 00,029,184 | ---- | M] (http://libusb-win32.sourceforge.net) -- C:\Windows\System32\DRIVERS\libusb0.sys -- (libusb0 [On_Demand | Stopped])
DRV - [2006/11/02 11:50:04 | 00,065,640 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC [Disabled | Stopped])
DRV - [2006/11/02 11:50:05 | 00,065,640 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS [Disabled | Stopped])
DRV - [2006/11/02 11:50:10 | 00,065,640 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI [Disabled | Stopped])
DRV - [2007/10/12 04:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta [On_Demand | Stopped])
DRV - [2006/11/02 11:49:53 | 00,028,776 | ---- | M] (LSI Logic Corporation) -- C:\Windows\system32\drivers\megasas.sys -- (megasas [Disabled | Stopped])
DRV - [2006/11/02 11:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x [Disabled | Stopped])
DRV - [2008/01/18 22:53:30 | 00,052,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DRIVERS\msdv.sys -- (MSDV [On_Demand | Stopped])
DRV - [2006/11/02 11:50:19 | 00,045,160 | ---- | M] (IBM Corporation) -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960 [Disabled | Stopped])
DRV - [2006/11/02 09:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi [Disabled | Stopped])
DRV - [2008/08/23 01:35:00 | 07,475,488 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\DRIVERS\nvlddmkm.sys -- (nvlddmkm [On_Demand | Stopped])
DRV - [2006/11/02 11:50:24 | 00,088,680 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid [Disabled | Stopped])
DRV - [2006/11/02 11:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor [Disabled | Stopped])
DRV - [2008/02/06 04:00:00 | 00,044,608 | ---- | M] (Sonic Solutions) -- C:\Windows\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2006/11/02 11:51:45 | 00,900,712 | ---- | M] (QLogic Corporation) -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300 [Disabled | Stopped])
DRV - [2006/11/02 11:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx [Disabled | Stopped])
DRV - [2006/11/02 09:36:43 | 02,028,032 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\System32\DRIVERS\atikmdag.sys -- (R300 [On_Demand | Stopped])
DRV - [2007/11/02 15:22:36 | 00,083,496 | ---- | M] (MCCI Corporation) -- C:\Windows\System32\DRIVERS\s217bus.sys -- (s217bus [On_Demand | Stopped])
DRV - [2007/11/02 15:22:36 | 00,015,016 | ---- | M] (MCCI Corporation) -- C:\Windows\System32\DRIVERS\s217mdfl.sys -- (s217mdfl [On_Demand | Stopped])
DRV - [2007/11/02 15:22:36 | 00,109,992 | ---- | M] (MCCI Corporation) -- C:\Windows\System32\DRIVERS\s217mdm.sys -- (s217mdm [On_Demand | Stopped])
DRV - [2007/11/02 15:22:38 | 00,103,976 | ---- | M] (MCCI Corporation) -- C:\Windows\System32\DRIVERS\s217mgmt.sys -- (s217mgmt [On_Demand | Stopped])
DRV - [2007/11/02 15:22:38 | 00,024,872 | ---- | M] (MCCI Corporation) -- C:\Windows\System32\DRIVERS\s217nd5.sys -- (s217nd5 [On_Demand | Stopped])
DRV - [2007/11/02 15:22:38 | 00,100,008 | ---- | M] (MCCI Corporation) -- C:\Windows\System32\DRIVERS\s217obex.sys -- (s217obex [On_Demand | Stopped])
DRV - [2007/11/02 15:22:38 | 00,105,896 | ---- | M] (MCCI) -- C:\Windows\System32\DRIVERS\s217unic.sys -- (s217unic [On_Demand | Stopped])
DRV - [2006/11/02 08:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv [Auto | Stopped])
DRV - [2006/11/02 11:50:10 | 00,038,504 | ---- | M] (Silicon Integrated Systems Corp.) -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2 [Disabled | Stopped])
DRV - [2006/11/02 11:50:16 | 00,071,784 | ---- | M] (Silicon Integrated Systems) -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4 [Disabled | Stopped])
DRV - [2007/05/06 17:12:02 | 00,326,656 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA [On_Demand | Stopped])
DRV - [2006/11/02 11:50:05 | 00,035,944 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx [Disabled | Stopped])
DRV - [2006/11/02 11:49:56 | 00,031,848 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi [Disabled | Stopped])
DRV - [2006/11/02 11:50:03 | 00,034,920 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3 [Disabled | Stopped])
DRV - [2006/11/02 11:51:25 | 00,235,112 | ---- | M] (ULi Electronics Inc.) -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci [Disabled | Stopped])
DRV - [2006/11/02 11:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata [Disabled | Stopped])
DRV - [2006/11/02 11:50:45 | 00,115,816 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2 [Disabled | Stopped])
DRV - [2009/04/11 06:42:54 | 00,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbaudio.sys -- (usbaudio [On_Demand | Stopped])
DRV - [2009/05/29 20:13:32 | 00,100,944 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\DRIVERS\VBoxDrv.sys -- (VBoxDrv [System | Stopped])
DRV - [2009/05/29 20:13:40 | 00,079,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\DRIVERS\VBoxNetAdp.sys -- (VBoxNetAdp [On_Demand | Running])
DRV - [2009/05/29 20:12:24 | 00,087,760 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\DRIVERS\VBoxNetFlt.sys -- (VBoxNetFlt [On_Demand | Running])
DRV - [2009/05/29 20:13:38 | 00,041,424 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\DRIVERS\VBoxUSBMon.sys -- (VBoxUSBMon [System | Stopped])
DRV - [2007/06/16 23:16:39 | 00,031,616 | ---- | M] (Elaborate Bytes AG) -- C:\Windows\System32\DRIVERS\VClone.sys -- (VClone [System | Running])
DRV - [2008/01/16 10:48:51 | 00,020,152 | ---- | M] (VIA Technologies, Inc.) -- C:\Windows\system32\drivers\viaide.sys -- (viaide [Disabled | Stopped])
DRV - [2006/11/02 11:50:41 | 00,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid [Disabled | Stopped])
DRV - [2008/03/17 13:14:52 | 00,015,144 | ---- | M] (Wacom Technology) -- C:\Windows\System32\DRIVERS\wacmoumonitor.sys -- (wacmoumonitor [On_Demand | Stopped])
DRV - [2007/02/16 11:12:36 | 00,011,312 | ---- | M] (Wacom Technology) -- C:\Windows\System32\DRIVERS\wacommousefilter.sys -- (wacommousefilter [On_Demand | Running])
DRV - [2007/02/16 10:30:12 | 00,012,848 | ---- | M] (Wacom Technology) -- C:\Windows\System32\DRIVERS\wacomvhid.sys -- (wacomvhid [On_Demand | Running])
DRV - [2007/02/15 16:11:28 | 00,011,440 | ---- | M] (Wacom Technology) -- C:\Windows\System32\DRIVERS\WacomVKHid.sys -- (WacomVKHid [On_Demand | Running])
DRV - [2008/07/10 14:47:22 | 00,011,520 | ---- | M] (Western Digital Technologies) -- C:\Windows\System32\DRIVERS\wdcsam.sys -- (WDC_SAM [On_Demand | Stopped])
DRV - [2009/04/11 06:42:52 | 00,031,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DRIVERS\WinUSB.SYS -- (WinUsb [On_Demand | Stopped])
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
IE - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\S-1-5-21-3406532566-97341564-2360706075-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:4.0.21.0
FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.0.2
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.3.3
FF - prefs.js..extensions.enabledItems: firecookie@janodvarko.cz:0.8
FF - prefs.js..extensions.enabledItems: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.8.5.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: LogMeInClient@logmein.com:1.0.0.381
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.0
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:3.5.0
FF - prefs.js..extensions.enabledItems: smush@smush.it:0.5
FF - prefs.js..extensions.enabledItems: TabSidebar@blueprintit.co.uk:2.0.1
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.7
FF - prefs.js..extensions.enabledItems: yslow@yahoo-inc.com:2.0.0b4
FF - prefs.js..extensions.enabledItems: {3713a489-0634-4472-8456-dc7abd7eba00}:1.2.2
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/04/13 14:06:47 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/06/17 23:50:22 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/06/17 23:50:22 | 00,000,000 | ---D | M]
 
[2009/07/14 18:50:16 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Extensions
[2008/07/20 22:14:46 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/07/14 18:50:16 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2009/07/14 19:14:10 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions
[2009/02/03 02:58:38 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{3713a489-0634-4472-8456-dc7abd7eba00}
[2009/07/06 18:25:58 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
[2009/02/20 01:29:47 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2009/06/23 21:11:15 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/07/06 18:25:57 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2009/06/30 19:10:10 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\battlefieldheroespatcher@ea.com
[2009/03/16 23:29:08 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\firebug@software.joehewitt.com
[2009/02/20 01:29:47 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\firecookie@janodvarko.cz
[2008/08/21 20:53:12 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\LogMeInClient@logmein.com
[2008/12/18 20:16:59 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\smush@smush.it
[2009/05/22 00:18:02 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\TabSidebar@blueprintit.co.uk
[2009/07/09 18:34:43 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\mozilla\Firefox\Profiles\vmmsm9sp.default\extensions\yslow@yahoo-inc.com
[2008/04/09 23:12:08 | 00,000,662 | ---- | M] () -- C:\Users\Arnaud\AppData\Roaming\Mozilla\FireFox\Profiles\vmmsm9sp.default\searchplugins\documentation-php.xml
[2008/03/10 23:48:13 | 00,001,274 | ---- | M] () -- C:\Users\Arnaud\AppData\Roaming\Mozilla\FireFox\Profiles\vmmsm9sp.default\searchplugins\trombino-altitude.xml
[2009/07/14 19:14:10 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/06/17 23:50:22 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/11/19 22:43:27 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
[2009/06/03 19:25:52 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/06/17 23:50:21 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/06/17 23:50:21 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/06/03 19:25:46 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009/06/17 23:50:21 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2007/03/22 20:23:30 | 00,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
[2008/06/11 23:45:28 | 00,103,792 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2008/03/12 20:54:38 | 00,144,984 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nppl3260.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2008/01/31 23:33:17 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2008/03/12 20:54:47 | 00,008,192 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprjplug.dll
[2008/03/12 20:54:34 | 00,094,208 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprpjplug.dll
[2009/05/06 00:04:58 | 00,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2009/05/06 00:04:58 | 00,000,757 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2009/05/06 00:04:58 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/05/06 00:04:58 | 00,000,748 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\MediaDICO-fr.xml
[2009/05/06 00:04:58 | 00,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2009/05/06 00:04:58 | 00,000,652 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml
 
O1 HOSTS File: (698 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (IE Developer Toolbar BHO) - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast!] C:\Programmes\Alwil Software\Avast4\ashDisp.exe File not found
O4 - HKLM..\Run: [Bluetooth HCI Monitor] C:\Windows\System32\HCIMNTR.DLL (Logitech Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (WDC)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001..\Run: [Sidebar] C:\Program Files\windows sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001..\Run: [Winsplit] C:\Program Files\WinSplit Revolution\WinSplit.exe ()
O4 - HKLM..\RunOnce: []  File not found
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Ajouter à un fichier PDF existant - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir au format Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xporter vers Microsoft Excel - C:\Programmes\Microsoft Office\OFFICE11\EXCEL.EXE File not found
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O9 - Extra Button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programmes\Microsoft Office\OFFICE11\REFIEBAR.DLL File not found
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\wshbth.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-3406532566-97341564-2360706075-1001\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} http://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programmes\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll File not found
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programmes\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll File not found
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programmes\Common Files\microsoft shared\Web Components\11\OWC11.DLL File not found
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\Explorer.exe (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 23:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[1 C:\Windows\*.tmp files]
[2009/07/16 00:51:12 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Documents\Downloads
[2009/07/16 00:38:36 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/07/16 00:32:16 | 00,000,121 | ---- | C] () -- C:\Users\Arnaud\Desktop\PC infécté - Windows démarre que en SafeMode.url
[2009/07/15 19:18:36 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\AppData\Local\temp
[2009/07/15 19:18:32 | 00,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2009/07/15 19:04:49 | 00,219,648 | ---- | C] () -- C:\Windows\PEV.exe
[2009/07/15 19:04:49 | 00,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2009/07/15 19:04:49 | 00,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2009/07/15 19:04:49 | 00,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2009/07/15 19:04:49 | 00,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2009/07/15 19:04:49 | 00,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2009/07/15 19:04:49 | 00,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2009/07/15 19:04:49 | 00,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2009/07/15 19:04:35 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT
[2009/07/15 19:04:34 | 00,000,000 | --SD | C] -- C:\ComboFix
[2009/07/15 19:03:18 | 00,000,000 | ---D | C] -- C:\Qoobox
[2009/07/15 01:29:41 | 00,001,674 | ---- | C] () -- C:\Users\Arnaud\Desktop\CCleaner.lnk
[2009/07/15 01:29:40 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2009/07/15 01:09:47 | 00,000,680 | ---- | C] () -- C:\Users\Arnaud\AppData\Local\d3d9caps.dat
[2009/07/14 18:50:30 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Documents\TomTom
[2009/07/14 18:50:26 | 00,000,000 | ---D | C] -- C:\ProgramData\TomTom
[2009/07/14 18:50:14 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\AppData\Roaming\TomTom
[2009/07/14 18:50:14 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\AppData\Local\TomTom
[2009/07/14 18:50:10 | 00,000,000 | ---D | C] -- C:\Program Files\TomTom International B.V
[2009/07/14 18:49:47 | 00,000,000 | ---D | C] -- C:\Program Files\TomTom HOME 2
[2009/07/14 18:49:10 | 00,000,000 | ---D | C] -- C:\Program Files\TomTom DesktopSuite
[2009/07/14 16:18:19 | 00,000,000 | ---D | C] -- C:\Program Files\Watchmen The End is Nigh
[2009/07/14 12:06:40 | 00,000,955 | ---- | C] () -- C:\Users\Public\Desktop\Theme Park World.lnk
[2009/07/14 12:06:07 | 00,000,000 | ---D | C] -- C:\Program Files\Bullfrog
[2009/07/14 12:06:01 | 00,306,688 | ---- | C] (InstallShield Software Corporation) -- C:\Windows\IsUn040c.exe
[2009/07/14 12:05:30 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Documents\LEGO Interactive
[2009/07/14 11:16:05 | 00,001,969 | ---- | C] () -- C:\Users\Public\Desktop\BattleForge™.lnk
[2009/07/13 23:40:07 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\AppData\Local\CAPCOM
[2009/07/13 23:30:10 | 00,000,000 | ---D | C] -- C:\Program Files\CAPCOM
[2009/07/13 23:30:03 | 01,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_41.dll
[2009/07/13 23:30:03 | 00,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll
[2009/07/13 23:30:02 | 04,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2009/07/13 23:30:02 | 00,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll
[2009/07/13 23:30:02 | 00,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll
[2009/07/13 23:30:02 | 00,069,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll
[2009/07/13 23:29:49 | 00,000,000 | ---D | C] -- C:\Windows\System32\xlive
[2009/07/13 23:29:48 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Games for Windows - LIVE
[2009/07/08 22:45:48 | 00,001,091 | ---- | C] () -- C:\Users\Arnaud\Documents\arnolem@free.fr Archive des dossiers de partage.lnk
[2009/07/08 21:27:33 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Documents\Euro Truck Simulator
[2009/07/08 21:25:55 | 00,000,960 | ---- | C] () -- C:\Users\Public\Desktop\Euro Truck Simulator.lnk
[2009/07/08 21:25:48 | 00,000,000 | ---D | C] -- C:\Program Files\Euro Truck Simulator
[2009/07/08 21:24:08 | 00,000,000 | ---D | C] -- C:\Program Files\rondomedia
[2009/07/08 21:23:10 | 00,268,048 | ---- | C] (MetaCreations Corporation) -- C:\Windows\System32\dxtmeta2.dll
[2009/07/08 19:40:51 | 00,054,156 | -H-- | C] () -- C:\Windows\QTFont.qfn
[2009/07/08 19:40:51 | 00,001,409 | ---- | C] () -- C:\Windows\QTFont.for
[2009/07/06 18:56:24 | 00,189,488 | ---- | C] () -- C:\Windows\System32\PnkBstrB.xtr
[2009/07/01 12:19:57 | 00,001,080 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3406532566-97341564-2360706075-1001UA.job
[2009/07/01 12:19:57 | 00,001,028 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3406532566-97341564-2360706075-1001Core.job
[2009/06/30 21:36:12 | 00,778,640 | ---- | C] () -- C:\Users\Arnaud\Desktop\july-09-when_the_day_comes-calendar-1920x1200.jpg
[2009/06/30 19:13:12 | 00,794,408 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2009/06/29 22:43:49 | 00,000,000 | ---D | C] -- C:\ProgramData\2DBoy
[2009/06/29 22:43:31 | 00,001,706 | ---- | C] () -- C:\Users\Public\Desktop\World of Goo.lnk
[2009/06/29 22:43:24 | 00,000,000 | ---D | C] -- C:\Program Files\WorldOfGoo
[2009/06/26 12:01:24 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Desktop\Bilan aumônerie 2008-2009
[2009/06/24 19:47:48 | 00,022,872 | R--- | C] (Adobe Systems Inc.) -- C:\Windows\System32\AdobePDFUI.dll
[2009/06/22 00:56:42 | 00,585,650 | ---- | C] () -- C:\Users\Arnaud\Desktop\P1000413.JPG
[2009/06/18 22:44:24 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Documents\Mes Créations
[2009/06/18 22:38:23 | 00,000,000 | ---D | C] -- C:\Users\Arnaud\Documents\Drakensang
[2009/06/18 22:37:00 | 02,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll
[2009/06/18 22:36:59 | 04,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll
[2009/06/18 22:36:59 | 00,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll
[2009/06/18 22:36:59 | 00,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_40.dll
[2009/06/18 22:36:59 | 00,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll
[2009/06/18 22:36:59 | 00,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll
[2009/06/18 22:36:59 | 00,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll
[2009/06/18 22:24:14 | 00,000,000 | ---D | C] -- C:\Program Files\Drakensang
[2009/05/29 00:33:06 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/04/22 00:19:06 | 00,172,173 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009/03/02 01:08:41 | 00,000,029 | ---- | C] () -- C:\Windows\ONSICON.INI
[2009/03/02 01:08:34 | 00,000,024 | ---- | C] () -- C:\Windows\SWISV3.ini
[2009/01/29 00:54:27 | 00,000,000 | ---- | C] () -- C:\Windows\EEventManager.INI
[2009/01/28 23:01:37 | 00,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009/01/14 03:06:03 | 00,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2009/01/07 20:54:48 | 00,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009/01/05 18:01:12 | 00,000,011 | ---- | C] () -- C:\Windows\EuBcd.ini
[2009/01/05 18:00:45 | 00,472,064 | ---- | C] () -- C:\Windows\System32\NTFSFormat.dll
[2009/01/05 18:00:45 | 00,180,736 | ---- | C] () -- C:\Windows\System32\DeviceManager.dll
[2009/01/05 18:00:45 | 00,139,776 | ---- | C] () -- C:\Windows\System32\NTFSCopy.dll
[2009/01/05 18:00:45 | 00,093,184 | ---- | C] () -- C:\Windows\System32\Partition.dll
[2009/01/05 18:00:45 | 00,086,528 | ---- | C] () -- C:\Windows\System32\NTFSLib.dll
[2009/01/05 18:00:45 | 00,086,016 | ---- | C] () -- C:\Windows\System32\ResizeNTFS.dll
[2009/01/05 18:00:45 | 00,068,096 | ---- | C] () -- C:\Windows\System32\Device.dll
[2009/01/05 18:00:45 | 00,065,536 | ---- | C] () -- C:\Windows\System32\FatCopy.dll
[2009/01/05 18:00:45 | 00,061,952 | ---- | C] () -- C:\Windows\System32\FatResizeMove.dll
[2009/01/05 18:00:45 | 00,045,568 | ---- | C] () -- C:\Windows\System32\FileSystemCheck.dll
[2009/01/05 18:00:45 | 00,031,744 | ---- | C] () -- C:\Windows\System32\FatLib.dll
[2009/01/05 18:00:45 | 00,025,088 | ---- | C] () -- C:\Windows\System32\FATFileSystemAnalyser.dll
[2009/01/05 18:00:45 | 00,024,576 | ---- | C] () -- C:\Windows\System32\NTFSFileSystemAnalyser.dll
[2009/01/05 18:00:45 | 00,022,016 | ---- | C] () -- C:\Windows\System32\FatFormat.dll
[2009/01/05 18:00:45 | 00,021,504 | ---- | C] () -- C:\Windows\System32\Fixup.dll
[2009/01/05 18:00:45 | 00,017,920 | ---- | C] () -- C:\Windows\System32\SectorCopy.dll
[2009/01/05 18:00:45 | 00,014,848 | ---- | C] () -- C:\Windows\System32\FileSystemAnalyser.dll
[2009/01/05 18:00:45 | 00,014,848 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2009/01/05 18:00:45 | 00,010,752 | ---- | C] () -- C:\Windows\System32\DeviceAdapter.dll
[2009/01/05 18:00:45 | 00,009,728 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2009/01/05 18:00:45 | 00,006,656 | ---- | C] () -- C:\Windows\System32\CallbackOperator.dll
[2009/01/05 18:00:45 | 00,003,072 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2009/01/04 22:33:54 | 00,006,656 | ---- | C] () -- C:\Windows\System32\CNMVS58.DLL
[2008/12/09 22:10:51 | 00,000,035 | ---- | C] () -- C:\Windows\Worldbuilder.INI
[2008/11/05 22:06:48 | 00,000,030 | ---- | C] () -- C:\Windows\wininit.ini
[2008/10/07 10:13:22 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 00,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008/10/01 18:54:13 | 00,851,968 | ---- | C] () -- C:\Windows\System32\usbpadcp.dll
[2008/06/05 09:58:26 | 00,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008/05/03 19:22:56 | 00,000,319 | ---- | C] () -- C:\Windows\game.ini
[2008/04/23 19:44:15 | 00,000,020 | ---- | C] () -- C:\Windows\mafosav.INI
[2008/04/21 23:17:17 | 00,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2008/03/21 18:11:19 | 00,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/03/21 18:11:19 | 00,383,238 | ---- | C] () -- C:\Windows\System32\libmp3lame-0.dll
[2008/02/01 00:04:24 | 00,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2008/02/01 00:04:24 | 00,001,025 | ---- | C] () -- C:\Windows\System32\clauth2.dll
[2008/02/01 00:04:24 | 00,001,025 | ---- | C] () -- C:\Windows\System32\clauth1.dll
[2008/01/22 22:52:40 | 00,000,498 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/01/22 22:23:47 | 02,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2008/01/16 10:49:18 | 00,876,544 | ---- | C] () -- C:\Windows\System32\TEACico2.dll
[2008/01/04 23:58:50 | 03,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/01/04 23:57:22 | 00,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008/01/04 23:57:22 | 00,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008/01/04 23:56:24 | 00,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2007/10/26 15:28:18 | 00,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2007/02/13 13:14:18 | 00,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2007/02/03 09:59:04 | 00,050,127 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2006/11/02 14:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 12:25:44 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 12:23:31 | 00,000,356 | ---- | C] () -- C:\Windows\system.ini
[2006/11/02 12:23:31 | 00,000,128 | ---- | C] () -- C:\Windows\win.ini
[2006/11/02 09:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2001/11/14 14:56:00 | 01,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

Réponse 10 / 103

arnolem Messages postés 88 Statut Membre 10

Et la suite du rapport :

 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[1 C:\Windows\*.tmp files]
[2009/07/16 00:54:55 | 01,507,870 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2009/07/16 00:54:55 | 00,681,554 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2009/07/16 00:54:55 | 00,598,628 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2009/07/16 00:54:55 | 00,129,126 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2009/07/16 00:54:55 | 00,106,002 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2009/07/16 00:50:21 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009/07/16 00:48:37 | 00,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/07/16 00:48:37 | 00,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/07/16 00:48:36 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009/07/16 00:32:16 | 00,000,121 | ---- | M] () -- C:\Users\Arnaud\Desktop\PC infécté - Windows démarre que en SafeMode.url
[2009/07/15 23:45:19 | 00,000,680 | ---- | M] () -- C:\Users\Arnaud\AppData\Local\d3d9caps.dat
[2009/07/15 19:14:58 | 00,000,356 | ---- | M] () -- C:\Windows\system.ini
[2009/07/15 18:30:00 | 00,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{E1418D4C-9646-412E-916B-17D9E7829843}.job
[2009/07/15 18:24:00 | 00,001,080 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3406532566-97341564-2360706075-1001UA.job
[2009/07/15 01:29:41 | 00,001,674 | ---- | M] () -- C:\Users\Arnaud\Desktop\CCleaner.lnk
[2009/07/15 00:19:45 | 00,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2009/07/14 22:09:54 | 00,002,140 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2009/07/14 22:01:56 | 00,186,368 | ---- | M] () -- C:\Users\Arnaud\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/14 19:41:21 | 00,022,328 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009/07/14 19:41:10 | 00,103,736 | ---- | M] () -- C:\Windows\System32\PnkBstrB.exe
[2009/07/14 12:24:00 | 00,001,028 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3406532566-97341564-2360706075-1001Core.job
[2009/07/14 12:06:40 | 00,000,955 | ---- | M] () -- C:\Users\Public\Desktop\Theme Park World.lnk
[2009/07/14 11:16:05 | 00,001,969 | ---- | M] () -- C:\Users\Public\Desktop\BattleForge™.lnk
[2009/07/13 05:48:54 | 00,219,648 | ---- | M] () -- C:\Windows\PEV.exe
[2009/07/08 22:45:48 | 00,001,091 | ---- | M] () -- C:\Users\Arnaud\Documents\arnolem@free.fr Archive des dossiers de partage.lnk
[2009/07/08 21:27:07 | 00,000,960 | ---- | M] () -- C:\Users\Public\Desktop\Euro Truck Simulator.lnk
[2009/07/08 21:01:03 | 00,189,488 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2009/07/08 19:40:51 | 00,054,156 | -H-- | M] () -- C:\Windows\QTFont.qfn
[2009/07/08 19:40:51 | 00,001,409 | ---- | M] () -- C:\Windows\QTFont.for
[2009/06/30 21:36:12 | 00,778,640 | ---- | M] () -- C:\Users\Arnaud\Desktop\july-09-when_the_day_comes-calendar-1920x1200.jpg
[2009/06/30 19:13:27 | 00,139,152 | ---- | M] () -- C:\Users\Arnaud\AppData\Roaming\PnkBstrK.sys
[2009/06/30 19:13:12 | 00,794,408 | ---- | M] () -- C:\Windows\System32\pbsvc.exe
[2009/06/30 19:13:12 | 00,075,064 | ---- | M] () -- C:\Windows\System32\PnkBstrA.exe
[2009/06/29 22:43:31 | 00,001,706 | ---- | M] () -- C:\Users\Public\Desktop\World of Goo.lnk
[2009/06/22 00:57:59 | 00,585,650 | ---- | M] () -- C:\Users\Arnaud\Desktop\P1000413.JPG
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2009/07/15 11:26:30 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming
[2008/11/01 15:17:43 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Axure
[2009/04/02 00:14:58 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Classes de site
[2008/11/19 22:39:54 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\com.adobe.ExMan
[2008/11/06 23:10:30 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/02/25 19:50:10 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\com.agileagenda.AgileAgenda.3126D95AA5D8E45032EDE3346A3ACAD9D4261DC0.1
[2008/02/25 19:58:21 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\com.finetune.apollo.FinetuneDesktop.E6C85CA21D452B4523849661A41AAEA17DDAC421.1
[2009/04/02 21:58:21 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\DassaultSystemes
[2008/11/18 02:01:42 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\DesktopKeeley.67EC435B62486C772528D0A6C46FFC4DE1624B6B.1
[2008/01/23 00:00:19 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Download Manager
[2008/02/04 21:34:02 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Dynamique
[2008/01/29 16:08:04 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\eMule
[2009/01/28 23:22:04 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\EPSON
[2009/06/26 00:20:06 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\FileZilla
[2008/04/28 20:00:35 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\FlashGet
[2008/09/29 08:12:05 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Gearbox Software
[2009/07/14 12:57:16 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\GrabIt
[2008/05/05 23:17:33 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Hamachi
[2008/10/01 18:52:40 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Leadertech
[2006/11/02 14:37:34 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Media Center Programs
[2008/01/22 21:47:33 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\MessengerGadget
[2009/03/31 01:58:52 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Notepad++
[2009/06/03 19:27:05 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\OpenOffice.org
[2008/10/26 17:15:31 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Roxio
[2008/11/25 20:23:27 | 00,000,000 | RH-D | M] -- C:\Users\Arnaud\AppData\Roaming\SecuROM
[2009/04/01 22:13:29 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Sites
[2008/04/17 23:33:08 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Sony
[2008/09/29 22:39:05 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Spore
[2008/10/21 18:43:33 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Subversion
[2009/01/30 01:22:05 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Teeworlds
[2009/01/04 19:05:10 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Thinstall
[2009/07/14 18:50:14 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\TomTom
[2008/10/26 19:55:54 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\TortoiseSVN
[2008/04/24 19:58:37 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\U3
[2008/10/26 18:32:41 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\ValuSoft
[2009/06/16 12:52:52 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\WD
[2009/04/08 19:44:23 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Winsplit Revolution
[2009/07/14 10:51:13 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\WTablet
[2008/03/12 22:15:22 | 00,000,000 | ---D | M] -- C:\Users\Arnaud\AppData\Roaming\Xi
[2006/11/02 14:37:34 | 00,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming
[2006/11/02 14:37:34 | 00,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Media Center Programs
[2006/11/02 14:37:34 | 00,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming
[2006/11/02 14:37:34 | 00,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Media Center Programs
[2009/07/14 12:24:00 | 00,001,028 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3406532566-97341564-2360706075-1001Core.job
[2009/07/15 18:24:00 | 00,001,080 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3406532566-97341564-2360706075-1001UA.job
[2009/07/16 00:48:36 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT
[2009/07/14 22:09:55 | 00,032,564 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009/07/15 18:30:00 | 00,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{E1418D4C-9646-412E-916B-17D9E7829843}.job
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 64 bytes -> C:\Users\Arnaud\Desktop\firefox2.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Arnaud\Desktop\firefox.avi:TOC.WMV
@Alternate Data Stream - 143 bytes -> C:\Users\Arnaud\AppData\Roaming\Valeurs séparées par des virgules (Windows).EML:OECustomProperty
< End of report >

Réponse 11 / 103

gen-hackman

♦ Passer de Avast à AntiVir :

♦ Télécharge Désinstalleur d'Avast!.

♦ redemarre en mode sans echec :

Comment aller en Mode sans échec
1) Redémarres ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

♦ Désinstalle via Ajout/Suppression de Programmes (si présents) :

* Avast!

♦ ensuite execute le desinstaller

Ceci effacera la majorité des traces du produit Avast! d'Alwil Software.

♦ redemarre

♦ Télécharge Ccleaner sur ton Bureau. :

♦ Clique sur "download the latest version"
♦ Installe-le en laissant seulement les options suivantes cochées :

- Ajouter un raccourci sur le Bureau
- Contrôler automatiquement les mises à jour de CCleaner

♦ Lance le Nettoyage
♦ Clique sur Chercher des erreurs et sauvegarde si tu le souhaites.

plus de precision sur la configuration de ccleaner te seront donnees plus tard

tuto Comment utiliser CCleaner.
***************

♦ Télécharge Antivir en Francais ou Antivir en Francais sur ton Bureau.:

♦ Double clique sur l'exécutable téléchargé pour lancer l'installation.
♦ À la fin de l'installation, clique sur Finish.
♦ Ouvre Antivir, assure-toi qu’il soit bien à jour !
♦ Dans l'onglet Protection Locale, choisis Contrôler.
♦ Active la recherche de rootkits via le + de Recherche de Rootkits, puis dans Sélection manuelle, coche tout (tes partitions de disque dur).
♦ Clique sur la loupe du milieu pour lancer le scan en tant qu'Administrateur.
♦ Poste moi le rapport généré : Pour cela, clique sur l'onglet Aperçu, puis choisis Rapports, tu trouveras son rapport..
♦ Sélectionne le rapport et clique sur l'icône "Afficher le fichier de rapport du rapport sélectionné.

♦ Note : Pour une éradication des menaces plus efficace, lance le scan en mode sans échec.

Pourquoi changer ? :Avast Vs Antivir

Tuto de configuration en vidéo (Merci Nico)

Réponse 12 / 103

arnolem Messages postés 88 Statut Membre 10

Merci, le rapport est en route mais ça risque d'être long.
Je te donnerais le rapport demain.

Merci beaucoup pour ton aide

Réponse 13 / 103

gen-hackman

;)

Réponse 14 / 103

arnolem Messages postés 88 Statut Membre 10

Bon, le scan est toujours en route, il s'est permis de faire une petite pause cette nuit et je viens tout juste de le relancer.
Je te post le rapport dès que possible.

Merci

Réponse 15 / 103

gen-hackman

salut :

ok

Réponse 16 / 103

arnolem Messages postés 88 Statut Membre 10

Quoi de neuf docteur ?

Voici le rapport :



Avira AntiVir Personal
Date de création du fichier de rapport : jeudi 16 juillet 2009  01:43

La recherche porte sur 1038808 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme :      Windows Vista
Version de Windows :(Service Pack 2)  [6.0.6002]
Mode Boot :       Mode sans échec avec assistance réseau
Identifiant :     Arnaud
Nom de l'ordinateur :XPS

Informations de version :
BUILD.DAT     : 8.2.0.52       16931 Bytes  02/12/2008 14:55:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  18/11/2008 07:21:00
AVSCAN.DLL    : 8.1.4.1        49921 Bytes  21/07/2008 12:44:27
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 11:44:16
LUKERES.DLL   : 8.1.4.0        13057 Bytes  04/07/2008 06:30:27
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 10:30:36
ANTIVIR1.VDF  : 7.1.0.56      411136 Bytes  09/11/2008 15:57:13
ANTIVIR2.VDF  : 7.1.0.89      221184 Bytes  16/11/2008 15:16:47
ANTIVIR3.VDF  : 7.1.0.97       45056 Bytes  17/11/2008 15:38:59
Version du moteur: 8.2.0.31  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  14/10/2008 09:05:56
AESCRIPT.DLL  : 8.1.1.15      332156 Bytes  11/11/2008 13:00:07
AESCN.DLL     : 8.1.1.5       123251 Bytes  07/11/2008 14:06:41
AERDL.DLL     : 8.1.1.3       438645 Bytes  04/11/2008 12:58:38
AEPACK.DLL    : 8.1.3.4       393591 Bytes  11/11/2008 08:41:39
AEOFFICE.DLL  : 8.1.0.30      196986 Bytes  07/11/2008 14:06:41
AEHEUR.DLL    : 8.1.0.71     1487222 Bytes  07/11/2008 14:06:41
AEHELP.DLL    : 8.1.1.3       119157 Bytes  07/11/2008 14:06:41
AEGEN.DLL     : 8.1.1.0       319859 Bytes  07/11/2008 14:06:41
AEEMU.DLL     : 8.1.0.9       393588 Bytes  14/10/2008 09:05:56
AECORE.DLL    : 8.1.4.1       172405 Bytes  07/11/2008 14:06:41
AEBB.DLL      : 8.1.0.3        53618 Bytes  14/10/2008 09:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 07:40:02
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 08:27:58
AVREP.DLL     : 8.0.0.2        98344 Bytes  31/07/2008 11:02:15
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 10:26:37
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 07:29:19
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 11:27:46
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 16:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 11:49:36
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 11:05:07
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  04/07/2008 06:23:16
RCTEXT.DLL    : 8.0.52.1       86273 Bytes  17/07/2008 09:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Sélection manuelle
Fichier de configuration.........: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, D:, F:, G:, I:, K:, Z:, 
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: arrêt
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: élevé

Début de la recherche : jeudi 16 juillet 2009  01:43

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'chrome.exe' - '1' module(s) sont contrôlés
Processus de recherche 'chrome.exe' - '1' module(s) sont contrôlés
Processus de recherche 'WmiPrvSE.exe' - '1' module(s) sont contrôlés
Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmpnscfg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'TSVNCache.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsm.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wininit.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'28' processus ont été contrôlés avec '28' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [1381]: Le nombre maximal de secrets pouvant être stockés sur un système donné a été dépassé.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD1
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD2
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD3
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD4
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [1381]: Le nombre maximal de secrets pouvant être stockés sur un système donné a été dépassé.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage 'F:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'F:\' !
Secteur d'amorçage 'G:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'G:\' !
Secteur d'amorçage 'I:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'I:\' !
Secteur d'amorçage 'K:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'K:\' !
Secteur d'amorçage 'Z:\'
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [1381]: Le nombre maximal de secrets pouvant être stockés sur un système donné a été dépassé.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '44' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\' <RAID>
C:\pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Program Files\Sacred 2 - Fallen Angel\system\paul.dll.CK1
    [RESULTAT]  Contient le code suspect : HEUR/Malware
    [REMARQUE]  Le résultat positif a été classé comme suspect.
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4ad3b72c.qua' !
C:\Users\Arnaud\Downloads\Chrome Downloads\ComboFix.exe
    [0] Type d'archive: RAR SFX (self extracting)
      --> 32788R22FWJFW\n.pif
          [RESULTAT]  Contient le code suspect : HEUR/Crypted.E
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4acbd780.qua' !
Recherche débutant dans 'D:\'
Impossible d'ouvrir le chemin à contrôler D:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'F:\'
Impossible d'ouvrir le chemin à contrôler F:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'G:\'
Impossible d'ouvrir le chemin à contrôler G:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'I:\'
Impossible d'ouvrir le chemin à contrôler I:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'K:\'
Impossible d'ouvrir le chemin à contrôler K:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'Z:\' <Photos>


Fin de la recherche : jeudi 16 juillet 2009  10:31
Temps nécessaire:  8:47:40 Heure(s)

La recherche a été effectuée intégralement

  72003 Les répertoires ont été contrôlés
 1986103 Des fichiers ont été contrôlés
      0 Des virus ou programmes indésirables ont été trouvés
      2 Des fichiers ont été classés comme suspects
      0 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      2 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      1 Impossible de contrôler des fichiers
 1986100 Fichiers non infectés
   7034 Les archives ont été contrôlées
      8 Avertissements
      2 Consignes

Réponse 17 / 103

gen-hackman

tu n as pas suivi le tuto de configuration

Réponse 18 / 103

arnolem Messages postés 88 Statut Membre 10

Je me suis peut être trompé de rapport, c'est mieux ça :



Avira AntiVir Personal
Date de création du fichier de rapport : jeudi 16 juillet 2009  01:43

La recherche porte sur 1038808 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme :      Windows Vista
Version de Windows :(Service Pack 2)  [6.0.6002]
Mode Boot :       Mode sans échec avec assistance réseau
Identifiant :     Arnaud
Nom de l'ordinateur :XPS

Informations de version :
BUILD.DAT     : 8.2.0.52       16931 Bytes  02/12/2008 14:55:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  18/11/2008 07:21:00
AVSCAN.DLL    : 8.1.4.1        49921 Bytes  21/07/2008 12:44:27
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 11:44:16
LUKERES.DLL   : 8.1.4.0        13057 Bytes  04/07/2008 06:30:27
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 10:30:36
ANTIVIR1.VDF  : 7.1.0.56      411136 Bytes  09/11/2008 15:57:13
ANTIVIR2.VDF  : 7.1.0.89      221184 Bytes  16/11/2008 15:16:47
ANTIVIR3.VDF  : 7.1.0.97       45056 Bytes  17/11/2008 15:38:59
Version du moteur: 8.2.0.31  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  14/10/2008 09:05:56
AESCRIPT.DLL  : 8.1.1.15      332156 Bytes  11/11/2008 13:00:07
AESCN.DLL     : 8.1.1.5       123251 Bytes  07/11/2008 14:06:41
AERDL.DLL     : 8.1.1.3       438645 Bytes  04/11/2008 12:58:38
AEPACK.DLL    : 8.1.3.4       393591 Bytes  11/11/2008 08:41:39
AEOFFICE.DLL  : 8.1.0.30      196986 Bytes  07/11/2008 14:06:41
AEHEUR.DLL    : 8.1.0.71     1487222 Bytes  07/11/2008 14:06:41
AEHELP.DLL    : 8.1.1.3       119157 Bytes  07/11/2008 14:06:41
AEGEN.DLL     : 8.1.1.0       319859 Bytes  07/11/2008 14:06:41
AEEMU.DLL     : 8.1.0.9       393588 Bytes  14/10/2008 09:05:56
AECORE.DLL    : 8.1.4.1       172405 Bytes  07/11/2008 14:06:41
AEBB.DLL      : 8.1.0.3        53618 Bytes  14/10/2008 09:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 07:40:02
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 08:27:58
AVREP.DLL     : 8.0.0.2        98344 Bytes  31/07/2008 11:02:15
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 10:26:37
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 07:29:19
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 11:27:46
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 16:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 11:49:36
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 11:05:07
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  04/07/2008 06:23:16
RCTEXT.DLL    : 8.0.52.1       86273 Bytes  17/07/2008 09:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Sélection manuelle
Fichier de configuration.........: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, D:, F:, G:, I:, K:, Z:, 
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: arrêt
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: élevé

Début de la recherche : jeudi 16 juillet 2009  01:43

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés
Processus de recherche 'chrome.exe' - '1' module(s) sont contrôlés
Processus de recherche 'chrome.exe' - '1' module(s) sont contrôlés
Processus de recherche 'WmiPrvSE.exe' - '1' module(s) sont contrôlés
Processus de recherche 'unsecapp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmpnscfg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'TSVNCache.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsm.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wininit.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'28' processus ont été contrôlés avec '28' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [1381]: Le nombre maximal de secrets pouvant être stockés sur un système donné a été dépassé.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD1
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD2
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD3
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage maître HD4
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [1381]: Le nombre maximal de secrets pouvant être stockés sur un système donné a été dépassé.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur
Secteur d'amorçage 'F:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'F:\' !
Secteur d'amorçage 'G:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'G:\' !
Secteur d'amorçage 'I:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'I:\' !
Secteur d'amorçage 'K:\'
    [INFO]      Aucun support de données inséré dans le lecteur 'K:\' !
Secteur d'amorçage 'Z:\'
    [INFO]      Aucun virus trouvé !
    [AVERTISSEMENT] Erreur système [1381]: Le nombre maximal de secrets pouvant être stockés sur un système donné a été dépassé.
    [INFO]      Veuillez relancer la recherche avec les droits d'administrateur

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '44' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\' <RAID>
C:\pagefile.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\Program Files\Sacred 2 - Fallen Angel\system\paul.dll.CK1
    [RESULTAT]  Contient le code suspect : HEUR/Malware
    [REMARQUE]  Le résultat positif a été classé comme suspect.
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4ad3b72c.qua' !
C:\Users\Arnaud\Downloads\Chrome Downloads\ComboFix.exe
    [0] Type d'archive: RAR SFX (self extracting)
      --> 32788R22FWJFW\n.pif
          [RESULTAT]  Contient le code suspect : HEUR/Crypted.E
    [REMARQUE]  Le fichier a été déplacé dans le répertoire de quarantaine sous le nom '4acbd780.qua' !
Recherche débutant dans 'D:\'
Impossible d'ouvrir le chemin à contrôler D:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'F:\'
Impossible d'ouvrir le chemin à contrôler F:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'G:\'
Impossible d'ouvrir le chemin à contrôler G:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'I:\'
Impossible d'ouvrir le chemin à contrôler I:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'K:\'
Impossible d'ouvrir le chemin à contrôler K:\ !
Erreur système [21]: Le périphérique n'est pas prêt.
Recherche débutant dans 'Z:\' <Photos>


Fin de la recherche : jeudi 16 juillet 2009  10:31
Temps nécessaire:  8:47:40 Heure(s)

La recherche a été effectuée intégralement

  72003 Les répertoires ont été contrôlés
 1986103 Des fichiers ont été contrôlés
      0 Des virus ou programmes indésirables ont été trouvés
      2 Des fichiers ont été classés comme suspects
      0 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      2 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      1 Impossible de contrôler des fichiers
 1986100 Fichiers non infectés
   7034 Les archives ont été contrôlées
      8 Avertissements
      2 Consignes

Réponse 19 / 103

gen-hackman

Recherche de Rootkits............: arrêt

ceci doit etre sur marche

Réponse 20 / 103

arnolem Messages postés 88 Statut Membre 10

Ah ok, je viens de voir, tu parle du tuto vidéo ?

Donc je fais ça et ensuite, je refais un scan ? c'est bien ça ?

Newsletters