svchost.exe Fermé

Question

Bonjour,
voila au démarrage j'ai droit à:

"svchost.exe erreur d'application
l'instruction à "0x595c17c2" emploi l'adresse mémoire "0x595c17c2"de peut pas etre "read""
que faire???
merci!

gen-hackman · Answer

salut :

&#9654 Télécharge et install UsbFix par Chiquitine29

 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

&#9654 Double clic sur le raccourci UsbFix présent sur ton bureau .

&#9654 Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

&#9654 Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

&#9654 Laisse travailler l'outil.

&#9654 Ensuite post le rapport UsbFix.txt qui apparaitra.

Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

 Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

siron · Answer

je n'ai pas de clé usb ni rein d'autre à connecter c'est grave??

gen-hackman · Answer

non fais sans...pas de mp3 , mp4 non plus ? appareil photo...

siron · Answer

ça arrive!

gen-hackman · Answer

ok ;)

ne te sers pas trop du pc pendant les scans , ca peut fausser les resultats ^^

siron · Answer

ça reste bloqué sur "demarrage"

gen-hackman · Answer

comment ca ?

mmmmmmmmm · Answer

"usbfix s'apprête à démarrer
veillez pacientez"
et voila... je patience!!! mais rien!!!

gen-hackman · Answer

essaie de le faire en mode sans echec

mmmmmmmmm · Answer

plus tard!!! merci a plus!!

mmmmmmmmm · Answer

c'est possible que tu m'interprete ce rapport combofix avant??? merci!!


ComboFix 09-11-18.01 - HarryPotter 17/11/2009 19:11.1.1 - FAT32x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.768.472 [GMT 1:00]
Lancé depuis: d:\documents and settings\HarryPotter\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\system32\i

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Legacy_SZSERVICE
-------\Service_Boonty Games


((((((((((((((((((((((((((((( Fichiers créés du 2009-10-17 au 2009-11-17 ))))))))))))))))))))))))))))))))))))
.

2009-11-17 17:07 . 2009-11-17 17:07 -------- d-----w- D:sit
2009-11-17 06:32 . 2009-03-30 09:32 96104 ----a-w- d:\windows\system32\drivers\avipbb.sys
2009-11-17 06:32 . 2009-03-24 15:08 55640 ----a-w- d:\windows\system32\drivers\avgntflt.sy­s
2009-11-17 06:32 . 2009-02-13 11:28 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sy­s
2009-11-17 06:32 . 2009-02-13 11:17 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys­
2009-11-17 06:32 . 2009-11-17 06:32 -------- d-----w- d:\program files\Avira
2009-11-16 18:50 . 2009-11-16 18:50 -------- d-----w- d:\program files\Malwarebytes'
2009-11-16 18:38 . 2009-09-10 13:54 38224 ----a-w- d:\windows\system32\drivers\mbamswissar­my.sys
2009-11-16 18:38 . 2009-09-10 13:53 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-11-16 18:38 . 2009-11-16 18:38 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2009-11-11 19:08 . 2009-11-11 19:05 267264 ----a-w- d:\windows\system32\wyvodiqu.exe
2009-11-11 19:06 . 2009-11-11 19:05 267264 ----a-w- d:\windows\system32\dihytu.exe
2009-11-11 13:02 . 2009-11-11 12:02 102400 --sh--r- d:\windows\9new.exe
2009-11-09 20:26 . 2009-11-09 20:26 -------- d-----w- d:\documents and settings\LocalService\Local Settings\Application Data\Temp
2009-10-25 21:19 . 2009-10-25 21:19 -------- d-----w- D:\FOUND.023

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-05 12:27 . 2005-10-19 23:17 56 ---ha-w- d:\windows\popcinfo.dat
2009-10-20 10:04 . 2008-04-29 16:09 1 ----a-w- d:\documents and settings\HarryPotter\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-10-17 19:39 . 2009-10-17 19:39 -------- d-----w- d:\documents and settings\All Users\Application Data\NortonInstaller
2009-10-10 15:14 . 2009-10-10 15:14 -------- d-----w- d:\program files\Microsoft Sync Framework
2009-10-10 15:13 . 2009-10-10 15:13 -------- d-----w- d:\program files\Microsoft SQL Server Compact Edition
2009-09-29 22:26 . 2009-09-29 22:26 -------- d-----w- d:\program files\Jeux.fr
2009-09-03 21:12 . 2009-09-03 21:12 152576 ----a-w- d:\documents and settings\HarryPotter\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-26 12:59 . 2009-08-26 12:59 78848 ----a-w- d:\windows\system32\drivers\SSHDRV85.sy­s
2008-03-09 20:23 . 2008-03-09 20:23 0 ----a-w- d:\program files	emp01
2005-10-29 10:37 . 2005-10-29 10:37 774144 ----a-w- d:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"TomTomHOME.exe"="d:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-07 247144]
"BitTorrent DNA"="d:\program files\DNA\btdna.exe" [2009-11-13 323392]
"SUPERAntiSpyware"="d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-13 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2005-10-28 155648]
"AdobeCS4ServiceManager"="d:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"TkBellExe"="d:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-07-04 198160]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"woociv"="d:\windows\system32\dihytu.exe" [2009-11-11 267264]
"Malwarebytes Anti-Malware (reboot)"="d:\program files\Malwarebytes'\mbam.exe" [2009-09-10 1312080]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"woociv"="d:\windows\system32\dihytu.exe" [2009-11-11 267264]

d:\documents and settings\HarryPotter\Menu D‚marrer\Programmes\D‚marrage\
Yahoo! Widgets.lnk - d:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2009-11-11 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SASWinLogon]
2009-11-11 11:45 548352 ----a-w- d:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=d:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"d:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"d:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"d:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"=
"d:\Program Files\DNA\btdna.exe"=
"d:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"d:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 pctmp;PC Tools Firewall Memory Protection Driver;d:\windows\system32\drivers\pctmp.sys [10/01/2008 18:05 40856]
R1 pctssipc;PC Tools Security Suite IPC Driver;d:\windows\system32\drivers\pctssipc.sys [10/01/2008 18:05 18328]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 13:53 9968]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [27/02/2007 12:39 74480]
R1 SSHDRV76;SSHDRV76;d:\windows\system32\drivers\SSHDRV76.sys [09/07/2009 21:28 53760]
R1 SSHDRV85;SSHDRV85;d:\windows\system32\drivers\SSHDRV85.sys [26/08/2009 13:59 78848]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [17/11/2009 07:32 108289]
R2 TomTomHOMEService;TomTomHOMEService;d:\program files\TomTom HOME 2\TomTomHOMEService.exe [07/08/2009 16:31 92008]
R3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 17:51 4096]
S2 aiahuaftuealiw;AOL Connectivity Service;d:\windows\system32\wyvodiqu.exe [11/11/2009 20:08 267264]
S2 gupdate1c987c68a1a6ad2;Google Update Service (gupdate1c987c68a1a6ad2);d:\program files\Google\Update\GoogleUpdate.exe [05/02/2009 20:18 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;d:\windows\system32\drivers\ASPI32.SYS [21/03/2008 11:21 16512]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-11-17 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 19:18]

2009-11-17 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 19:18]

2009-10-29 d:\windows\Tasks\NSSstub.job
- d:\windows\system32\Adobe\Shockwave 11
ssstub.exe [2009-10-17 16:39]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.msnjeux.com/online2/MSN_INTL_FRANCE/zuma/zylomgamesplayer.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader.cab
DPF: {E1342154-4889-42B5-BEF6-19237577048F} - hxxp://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/zuma/oberongamesloader.cab
FF - ProfilePath - d:\documents and settings\HarryPotter\Application Data\Mozilla\Firefox\Profiles\ju8usffo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q=
FF - plugin: c:\program files\Real\RealPlayer\Netscape6
ppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6
prjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6
prpjplug.dll
FF - plugin: d:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
FF - plugin: d:\program files\Google\Update\1.2.183.13
pGoogleOneClick8.dll
FF - plugin: d:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pgcplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
picdclient.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pracplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pyaxmpb.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pzylomgamesplayer.dll
FF - plugin: d:\program files\Real\RealArcade\Plugins\Mozilla
pracplug.dll
FF - plugin: d:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: d:\windows\System32\Rawflow
picdclient.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-photo_id - d:\documents and settings\HarryPotter\photo_id.exe
Notify-WgaLogon - (no file)
AddRemove-burnatonce_is1 - d:\program files\burnatonce\unins000.exe
AddRemove-Steam App 7710 - d:\program files\Steam\steam.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 19:27
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1220945662-1454471165-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ca,52,88,28,7e,e2,3b,cc,c1,67,08,e3,6d,b8,5d,e5,22,47,8e,7c,29,35,9c,
86,51,fd,e6,50,2f,11,c1,3d,22,1d,33,fe,e1,6f,ed,fb,b7,00,56,74,2d,31,ff,ca,\
"??"=hex:54,91,eb,dd,75,18,da,c3,ed,6e,dd,e8,34,bd,c8,e3

[HKEY_USERS\S-1-5-21-1220945662-1454471165-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:40,c3,69,56,1c,b0,e8,6b,41,db,1d,8b,81,cd,fc,51,25,e6,ef,5f,57,
78,74,5f,1b,68,99,a9,60,b1,62,26,25,03,65,8f,c7,7b,f1,e4,f9,06,8b,4b,38,83,\
"rkeysecu"=hex:b3,a6,db,3c,87,0c,3e,99,24,5e,0d,1c,06,b7,47,de
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(916)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\Ati2evxx.dll
d:\program files\Fichiers communs\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3948)
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
d:\program files\Fichiers communs\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\program files\PC Tools Firewall Plus\FWService.exe
d:\windows\system32\Ati2evxx.exe
d:\program files\Lavasoft\Ad-Aware\aawservice.exe
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\windows\System32\dllhost.exe
d:\windows\System32\CTsvcCDA.EXE
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\program files\Analog Devices\SoundMAX\SMAgent.exe
d:\windows\system32\dwwin.exe
.
**************************************************************************
.
Heure de fin: 2009-11-17 19:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-11-17 18:32

Avant-CF: 15 412 559 872 octets libres
Après-CF: 15 296 069 632 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Le bon qui marche" /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Le mauvais qui rampe"

- - End Of File - - 276578AF88320665C5A2F93059C2BAB3

gen-hackman · Answer

qui t a demandé d'utiliser combofix ? 

tu te fais aider ailleurs en meme temps ??

veux-tu planter ton pc ?

mmmmmmmmm · Answer

oui, on m'a demander de le faire!!!
mais on a supprimer le forum ou c'etait demandé alors maintenenat j'ai ça:


ComboFix 09-11-18.01 - HarryPotter 17/11/2009 20:43.2.1 - FAT32x86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.768.406 [GMT 1:00]
Lancé depuis: d:\documents and settings\HarryPotter\Bureau\ComboFix.exe
Commutateurs utilisés :: d:\documents and settings\HarryPotter\Bureau\CFScript
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}

FILE ::
"d:\windows\9new.exe"
"d:\windows\system32\dihytu.exe"
"d:\windows\system32\wyvodiqu.exe"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

d:\windows\9new.exe
d:\windows\system32\dihytu.exe
d:\windows\system32\wyvodiqu.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AIAHUAFTUEALIW
-------\Service_aiahuaftuealiw


(((((((((((((((((((((((((((((   Fichiers créés du 2009-10-17 au 2009-11-17  ))))))))))))))))))))))))))))))))))))
.

2009-11-17 19:05 . 2009-11-17 19:05	--------	d-----w-	D:\UsbFix
2009-11-17 17:07 . 2009-11-17 17:07	--------	d-----w-	D:sit
2009-11-17 06:32 . 2009-03-30 09:32	96104	----a-w-	d:\windows\system32\drivers\avipbb.sys
2009-11-17 06:32 . 2009-03-24 15:08	55640	----a-w-	d:\windows\system32\drivers\avgntflt.sys
2009-11-17 06:32 . 2009-02-13 11:28	22360	----a-w-	d:\windows\system32\drivers\avgntmgr.sys
2009-11-17 06:32 . 2009-02-13 11:17	45416	----a-w-	d:\windows\system32\drivers\avgntdd.sys
2009-11-17 06:32 . 2009-11-17 06:32	--------	d-----w-	d:\program files\Avira
2009-11-16 18:50 . 2009-11-16 18:50	--------	d-----w-	d:\program files\Malwarebytes'
2009-11-16 18:38 . 2009-09-10 13:54	38224	----a-w-	d:\windows\system32\drivers\mbamswissarmy.sys
2009-11-16 18:38 . 2009-09-10 13:53	19160	----a-w-	d:\windows\system32\drivers\mbam.sys
2009-11-16 18:38 . 2009-11-16 18:38	--------	d-----w-	d:\program files\Malwarebytes' Anti-Malware
2009-11-09 20:26 . 2009-11-09 20:26	--------	d-----w-	d:\documents and settings\LocalService\Local Settings\Application Data\Temp
2009-10-25 21:19 . 2009-10-25 21:19	--------	d-----w-	D:\FOUND.023

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-05 12:27 . 2005-10-19 23:17	56	---ha-w-	d:\windows\popcinfo.dat
2009-10-20 10:04 . 2008-04-29 16:09	1	----a-w-	d:\documents and settings\HarryPotter\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-10-17 19:39 . 2009-10-17 19:39	--------	d-----w-	d:\documents and settings\All Users\Application Data\NortonInstaller
2009-10-10 15:14 . 2009-10-10 15:14	--------	d-----w-	d:\program files\Microsoft Sync Framework
2009-10-10 15:13 . 2009-10-10 15:13	--------	d-----w-	d:\program files\Microsoft SQL Server Compact Edition
2009-09-29 22:26 . 2009-09-29 22:26	--------	d-----w-	d:\program files\Jeux.fr
2009-09-03 21:12 . 2009-09-03 21:12	152576	----a-w-	d:\documents and settings\HarryPotter\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-26 12:59 . 2009-08-26 12:59	78848	----a-w-	d:\windows\system32\drivers\SSHDRV85.sys
2008-03-09 20:23 . 2008-03-09 20:23	0	----a-w-	d:\program files	emp01
2005-10-29 10:37 . 2005-10-29 10:37	774144	----a-w-	d:\program files\RngInterstitial.dll
.

------- Sigcheck -------

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . d:\windows\system32\drivers\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\atapi.sys
[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\atapi.sys
[-] 2001-08-28 . A64013E98426E1877CB653685C5C0009 . 86656 . . [5.1.2600.0] . . d:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . d:\windows\system32\drivers\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\asyncmac.sys
[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\asyncmac.sys

[-] 2001-08-28 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . d:\windows\system32\drivers\beep.sys
[-] 2001-08-28 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . d:\windows\system32\dllcache\beep.sys
[-] 2001-08-28 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . d:\windows\ERDNT\cache\beep.sys

[-] 2004-08-20 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . d:\windows\system32\drivers\kbdclass.sys
[-] 2004-08-20 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\kbdclass.sys
[-] 2004-08-20 . E798705E8DC7FAB596EF6BFDF167E007 . 25216 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\kbdclass.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . d:\windows\system32\drivers
dis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache
dis.sys
[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386
dis.sys

[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . d:\windows\$hf_mig$\KB930916\SP2QFE
tfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . d:\windows\system32\drivers
tfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . d:\windows\system32\dllcache
tfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . d:\windows\ERDNT\cache
tfs.sys
[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386
tfs.sys

[-] 2001-08-28 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . d:\windows\system32\drivers
ull.sys
[-] 2001-08-28 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . d:\windows\system32\dllcache
ull.sys
[-] 2001-08-28 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . d:\windows\ERDNT\cache
ull.sys

[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . d:\windows\$hf_mig$\KB917953\SP2QFE	cpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . d:\windows\$hf_mig$\KB917953\SP2GDR	cpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . d:\windows\system32\drivers	cpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . d:\windows\system32\dllcache	cpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . d:\windows\ERDNT\cache	cpip.sys
[-] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386	cpip.sys

[-] 2004-08-20 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . d:\windows\system32\browser.dll
[-] 2004-08-20 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\browser.dll
[-] 2004-08-20 . 75AC49029966BFFEA09F96C1C194F684 . 77312 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\browser.dll

[-] 2004-08-20 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . d:\windows\system32\lsass.exe
[-] 2004-08-20 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\lsass.exe
[-] 2004-08-20 . 259AF82A0932EEA4F316F92DB94707B6 . 13312 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\lsass.exe

[-] 2005-08-22 . 0D55724D88488BBFC53BC2EA219240F3 . 197632 . . [5.1.2600.2743] . . d:\windows\$hf_mig$\KB905414\SP2GDR
etman.dll
[-] 2005-08-22 . 31748843AD5811351B115CC52CEA8D77 . 197632 . . [5.1.2600.2743] . . d:\windows\$hf_mig$\KB905414\SP2QFE
etman.dll
[-] 2005-08-22 . 0D55724D88488BBFC53BC2EA219240F3 . 197632 . . [5.1.2600.2743] . . d:\windows\system32
etman.dll
[-] 2005-08-22 . 0D55724D88488BBFC53BC2EA219240F3 . 197632 . . [5.1.2600.2743] . . d:\windows\ERDNT\cache
etman.dll
[-] 2004-08-20 . 237F77C91B70469E3AF9F7FD0A524954 . 198144 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386
etman.dll

[-] 2004-08-20 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . d:\windows\system32\qmgr.dll
[-] 2004-08-20 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . d:\windows\ERDNT\cache\qmgr.dll
[-] 2004-08-20 . 659F7B6C502051BFA37910614B225548 . 382464 . . [6.6.2600.2180] . . d:\windows\ServicePackFiles\i386\qmgr.dll
[-] 2004-07-01 . C3F35AA3E4E791EA8425B5DBAE01E283 . 360960 . . [6.6.2600.1569] . . d:\windows\system32\bits\qmgr.dll

[-] 2005-07-26 . CB7D37602638369A516757E994CBB31D . 397824 . . [5.1.2600.2726] . . d:\windows\system32pcss.dll
[-] 2005-07-26 . CB7D37602638369A516757E994CBB31D . 397824 . . [5.1.2600.2726] . . d:\windows\$hf_mig$\KB902400\SP2GDRpcss.dll
[-] 2005-07-26 . CB7D37602638369A516757E994CBB31D . 397824 . . [5.1.2600.2726] . . d:\windows\ERDNT\cachepcss.dll
[-] 2005-07-26 . B38D431ACE730452CD1FEE4FB7ECD6E2 . 398336 . . [5.1.2600.2726] . . d:\windows\$hf_mig$\KB902400\SP2QFEpcss.dll
[-] 2004-08-20 . C6FE0B727A5D13419D480150631ADC09 . 395776 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386pcss.dll

[-] 2004-08-20 . 63DCDE1A0D86EEB8924D6738FF616EAD . 108544 . . [5.1.2600.2180] . . d:\windows\system32\services.exe
[-] 2004-08-20 . 63DCDE1A0D86EEB8924D6738FF616EAD . 108544 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\services.exe
[-] 2004-08-20 . 63DCDE1A0D86EEB8924D6738FF616EAD . 108544 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\services.exe

[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . d:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-11 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . d:\windows\$hf_mig$\KB896423\SP2GDR\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . d:\windows\system32\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . d:\windows\ERDNT\cache\spoolsv.exe
[-] 2004-08-20 . DF9FC62AD51CB082B0AE371919A232CB . 57856 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\spoolsv.exe

[-] 2004-08-20 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . d:\windows\system32\winlogon.exe
[-] 2004-08-20 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\winlogon.exe
[-] 2004-08-20 . 123EEA158F74D0F67A51DCDF065D1091 . 506368 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . d:\windows\$hf_mig$\KB923191\SP2QFE\comctl32.dll
[-] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . d:\windows\system32\comctl32.dll
[-] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . d:\windows\system32\dllcache\comctl32.dll
[-] 2006-08-25 . 5BBCD65CFD7610F36BCA96B72BBAED4B . 617472 . . [5.82] . . d:\windows\ERDNT\cache\comctl32.dll
[-] 2004-08-20 . 7D3AA1F0E765054CB5F30114F2DB6888 . 611328 . . [5.82] . . d:\windows\ServicePackFiles\i386\comctl32.dll

[-] 2004-08-20 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . d:\windows\system32\cryptsvc.dll
[-] 2004-08-20 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\cryptsvc.dll
[-] 2004-08-20 . CD73133EB24C572019944001FAD1B8D9 . 60416 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\cryptsvc.dll

[-] 2005-07-26 05:39 . D9CDB9380E0EFC9E97CC589B5F484B94 . 243200 . . [2001.12.4414.308] . . d:\windows\system32\es.dll
[-] 2005-07-26 05:39 . D9CDB9380E0EFC9E97CC589B5F484B94 . 243200 . . [2001.12.4414.308] . . d:\windows\$hf_mig$\KB902400\SP2GDR\es.dll
[-] 2005-07-26 05:39 . D9CDB9380E0EFC9E97CC589B5F484B94 . 243200 . . [2001.12.4414.308] . . d:\windows\ERDNT\cache\es.dll
[-] 2005-07-26 05:29 . B56B69129181FF63BAED5EDE65DCC9B1 . 243200 . . [2001.12.4414.308] . . d:\windows\$hf_mig$\KB902400\SP2QFE\es.dll
[-] 2004-08-20 00:09 . FDE7FBE9CC9DD9484DF3E0241737C091 . 243200 . . [2001.12.4414.258] . . d:\windows\ServicePackFiles\i386\es.dll

[-] 2004-08-20 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . d:\windows\system32\imm32.dll
[-] 2004-08-20 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\imm32.dll
[-] 2004-08-20 . E55DAFA1A354BD5CB69151563DC9748A . 110080 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\imm32.dll

[-] 2007-04-16 . 62E3F0E9ABFCBCEE62C51546F622C455 . 1051136 . . [5.1.2600.3119] . . d:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2007-04-16 . 6F1FE2AE7B22EB9CED1BFF533C9455EA . 1049600 . . [5.1.2600.3119] . . d:\windows\system32\kernel32.dll
[-] 2007-04-16 . 6F1FE2AE7B22EB9CED1BFF533C9455EA . 1049600 . . [5.1.2600.3119] . . d:\windows\system32\dllcache\kernel32.dll
[-] 2007-04-16 . 6F1FE2AE7B22EB9CED1BFF533C9455EA . 1049600 . . [5.1.2600.3119] . . d:\windows\ERDNT\cache\kernel32.dll
[-] 2006-07-05 . FB85EF2A6713E3A58A497E093626B93C . 1050112 . . [5.1.2600.2945] . . d:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2006-07-05 . CE4AF1FA47A29ADF97CB107775CE395C . 1049088 . . [5.1.2600.2945] . . d:\windows\$hf_mig$\KB917422\SP2GDR\kernel32.dll
[-] 2004-08-20 . C88F74591579DBDE273C61312B2D3886 . 1048576 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\kernel32.dll

[-] 2005-09-01 . D9BD4CCA0533401B6609E47FF74F40DC . 19968 . . [5.1.2600.2751] . . d:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . 8D9A075C065DFE1228688D10155D6624 . 19968 . . [5.1.2600.2751] . . d:\windows\$hf_mig$\KB900725\SP2GDR\linkinfo.dll
[-] 2005-09-01 . 8D9A075C065DFE1228688D10155D6624 . 19968 . . [5.1.2600.2751] . . d:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 8D9A075C065DFE1228688D10155D6624 . 19968 . . [5.1.2600.2751] . . d:\windows\ERDNT\cache\linkinfo.dll
[-] 2004-08-20 . 6C411ABBEEF0CA1D991F8A8F449D2B5F . 18944 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\linkinfo.dll

[-] 2004-08-20 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . d:\windows\system32\lpk.dll
[-] 2004-08-20 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\lpk.dll
[-] 2004-08-20 . 3236A6A1650E6C055FD5E87D7C4A05AD . 22016 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\lpk.dll

[-] 2007-10-31 . 89397AFC934A509580FF089035E71DA8 . 3590656 . . [7.00.6000.16587] . . d:\windows\system32\mshtml.dll
[-] 2007-10-31 . 89397AFC934A509580FF089035E71DA8 . 3590656 . . [7.00.6000.16587] . . d:\windows\system32\dllcache\mshtml.dll
[-] 2007-10-31 . 89397AFC934A509580FF089035E71DA8 . 3590656 . . [7.00.6000.16587] . . d:\windows\ERDNT\cache\mshtml.dll
[-] 2007-10-30 . EB4E53C96D5FB4A9A3F1EAEB782D8862 . 3593216 . . [7.00.6000.20710] . . d:\windows\$hf_mig$\KB942615-IE7\SP2QFE\mshtml.dll
[-] 2007-08-22 . 8DCC33B8D7E1C3ECD4DC3F9A9B8493D3 . 3079168 . . [6.00.2900.3199] . . d:\windows\ie7\mshtml.dll
[-] 2007-08-22 . 6B815842B4A9CDED3D7E9846639E69FA . 3085824 . . [6.00.2900.3199] . . d:\windows\$hf_mig$\KB939653\SP2QFE\mshtml.dll
[-] 2007-08-13 . C6EC2493346ED8888A549F59210A8ED3 . 3578368 . . [7.00.5730.13] . . d:\windows\ie7updates\KB942615-IE7\mshtml.dll
[-] 2004-08-20 . 7CA9E0D2C4DCA6B710FD57F40E597337 . 3003392 . . [6.00.2900.2180] . . d:\windows\ServicePackFiles\i386\mshtml.dll

[-] 2004-08-20 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . d:\windows\system32\msvcrt.dll
[-] 2004-08-20 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . d:\windows\ERDNT\cache\msvcrt.dll
[-] 2004-08-20 . B89F48FDFD6C3312B92D5D633C23F075 . 343040 . . [7.0.2600.2180] . . d:\windows\ServicePackFiles\i386\msvcrt.dll
[-] 2001-08-28 12:00 . E826A484EDE25C3AE19F1B8086511F4B . 267536 . . [4.20.6201] . . d:\windows\setupupd\winnt32\win9xupg\msvcrt.dll

[-] 2004-08-20 . 6FA2DDF70DC9B762EBF8920F89B6BEA3 . 247808 . . [5.1.2600.2180] . . d:\windows\system32\mswsock.dll
[-] 2004-08-20 . 6FA2DDF70DC9B762EBF8920F89B6BEA3 . 247808 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\mswsock.dll
[-] 2004-08-20 . 6FA2DDF70DC9B762EBF8920F89B6BEA3 . 247808 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\mswsock.dll

[-] 2004-08-20 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . d:\windows\system32
etlogon.dll
[-] 2004-08-20 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache
etlogon.dll
[-] 2004-08-20 . D4CFAC76926C24E32B7F25A35C31BC6E . 407040 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386
etlogon.dll

[-] 2007-02-28 . 8E244108562E0E452EB68DFF64CB08A9 . 2184192 . . [5.1.2600.3093] . . d:\windows\$hf_mig$\KB931784\SP2QFE
toskrnl.exe
[-] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . d:\windows\system32
toskrnl.exe
[-] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . d:\windows\system32\dllcache
toskrnl.exe
[-] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . d:\windows\Driver Cache\i386
toskrnl.exe
[-] 2007-02-28 . 7D6D19AAC51A4325F6039F083C22303C . 2182400 . . [5.1.2600.3093] . . d:\windows\ERDNT\cache
toskrnl.exe
[-] 2005-03-02 . 3E2A0A4A0C0B19FC113618A9562A3B2A . 2181632 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE
toskrnl.exe
[-] 2005-03-02 . 63729DD0F2AAE36CC52B89C05505146C . 2181376 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2GDR
toskrnl.exe
[-] 2004-08-20 . 7D38CE4398E6AA6339B4644FEADCC0D8 . 2183040 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386
toskrnl.exe

[-] 2004-08-20 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . d:\windows\system32\powrprof.dll
[-] 2004-08-20 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . d:\windows\ERDNT\cache\powrprof.dll
[-] 2004-08-20 . 29D5E58FB089C41898A81BD4C8970F22 . 17408 . . [6.00.2900.2180] . . d:\windows\ServicePackFiles\i386\powrprof.dll

[-] 2004-08-20 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . d:\windows\system32\scecli.dll
[-] 2004-08-20 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\scecli.dll
[-] 2004-08-20 . 58D439F6EF73A2D9288B204E819F4BBD . 186368 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\scecli.dll

[-] 2004-08-20 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . d:\windows\system32\sfc.dll
[-] 2004-08-20 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\sfc.dll
[-] 2004-08-20 . BB695F18354B38CFF693E67EE7A30C22 . 5120 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\sfc.dll

[-] 2004-08-20 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . d:\windows\system32\svchost.exe
[-] 2004-08-20 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\svchost.exe
[-] 2004-08-20 . 2979B03D5382A602623C0535B16AB9C0 . 14336 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\svchost.exe

[-] 2005-07-08 . C9FA05D271A0066764FE75BE38E24D69 . 249344 . . [5.1.2600.2716] . . d:\windows\$hf_mig$\KB893756\SP2QFE	apisrv.dll
[-] 2005-07-08 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . d:\windows\$hf_mig$\KB893756\SP2GDR	apisrv.dll
[-] 2005-07-08 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . d:\windows\system32	apisrv.dll
[-] 2005-07-08 . 720DA0C9DB8996AD9B7F5164B2242DAA . 249344 . . [5.1.2600.2716] . . d:\windows\ERDNT\cache	apisrv.dll
[-] 2004-08-20 . 5CC2A233DAC03CAF99D20B87598675CD . 246272 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386	apisrv.dll

[-] 2007-03-08 . 4D88AAF39ADABFE45958EA1384E2C4FF . 579072 . . [5.1.2600.3099] . . d:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . 753354F594809A9B96F73999B435A533 . 578560 . . [5.1.2600.3099] . . d:\windows\system32\user32.dll
[-] 2007-03-08 . 753354F594809A9B96F73999B435A533 . 578560 . . [5.1.2600.3099] . . d:\windows\system32\dllcache\user32.dll
[-] 2007-03-08 . 753354F594809A9B96F73999B435A533 . 578560 . . [5.1.2600.3099] . . d:\windows\ERDNT\cache\user32.dll
[-] 2005-03-02 . C34920EB988CE98910BD6B0417F334EB . 578048 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . 0DF75FB73F705B011630159A43D7C354 . 578048 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2GDR\user32.dll
[-] 2004-08-20 . 61C8C283AD063BB697AE61A155C64A5A . 578048 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\user32.dll

[-] 2004-08-20 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . d:\windows\system32\userinit.exe
[-] 2004-08-20 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\userinit.exe
[-] 2004-08-20 . 84717891F0734C611721F56C60B5FBC3 . 25088 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\userinit.exe

[-] 2007-10-10 . BC5119C53BDD48DABC628D448A3BDCCB . 824832 . . [7.00.6000.16574] . . d:\windows\system32\wininet.dll
[-] 2007-10-10 . BC5119C53BDD48DABC628D448A3BDCCB . 824832 . . [7.00.6000.16574] . . d:\windows\system32\dllcache\wininet.dll
[-] 2007-10-10 . BC5119C53BDD48DABC628D448A3BDCCB . 824832 . . [7.00.6000.16574] . . d:\windows\ERDNT\cache\wininet.dll
[-] 2007-10-10 . 871AE10D6AE8877E9636AE5017953D52 . 825344 . . [7.00.6000.20696] . . d:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-08-22 . 18048557AA56DE4B1955FDF7A21F9B24 . 663040 . . [6.00.2900.3199] . . d:\windows\ie7\wininet.dll
[-] 2007-08-22 . 4F6A45B54D26708E2C2BF2C43D83EDEA . 669696 . . [6.00.2900.3199] . . d:\windows\$hf_mig$\KB939653\SP2QFE\wininet.dll
[-] 2007-08-13 . A4A0FC92358F39538A6494C42EF99FE9 . 818688 . . [7.00.5730.13] . . d:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2004-08-20 . 4E958B97EFC3D801F49283D1820F48B7 . 660480 . . [6.00.2900.2180] . . d:\windows\ServicePackFiles\i386\wininet.dll

[-] 2004-08-20 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . d:\windows\system32\ws2_32.dll
[-] 2004-08-20 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\ws2_32.dll
[-] 2004-08-20 . EED74B969B2CA1ACC558FF60FB420E28 . 82944 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\ws2_32.dll

[-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . d:\windows\explorer.exe
[-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . d:\windows\system32\dllcache\explorer.exe
[-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . d:\windows\ERDNT\cache\explorer.exe
[-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . d:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-20 . 2A7BD330924252A2FD80344FC949BB72 . 1036288 . . [6.00.2900.2180] . . d:\windows\ServicePackFiles\i386\explorer.exe

[-] 2004-08-20 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . d:\windows\system32\srsvc.dll
[-] 2004-08-20 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\srsvc.dll
[-] 2004-08-20 . CE978404558CE2D82896AC2032F06DBF . 171008 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\srsvc.dll

[-] 2004-08-20 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . d:\windows\system32\wscntfy.exe
[-] 2004-08-20 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\wscntfy.exe
[-] 2004-08-20 . 8558905BA81F6EFAAF9667139BB117DD . 13824 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\wscntfy.exe

[-] 2004-08-20 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . d:\windows\system32\xmlprov.dll
[-] 2004-08-20 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\xmlprov.dll
[-] 2004-08-20 . 912591E2055E26566D1CB54092A7E8B0 . 129536 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\xmlprov.dll

[-] 2004-08-20 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . d:\windows\system32\eventlog.dll
[-] 2004-08-20 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\eventlog.dll
[-] 2004-08-20 . 49B1376885340BF9EA0D99F71557B59A . 55808 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\eventlog.dll

[-] 2004-08-20 . 6D8F3AC555E3F8A569AA9B2A817698C1 . 1548288 . . [5.1.2600.2180] . . d:\windows\system32\sfcfiles.dll
[-] 2004-08-20 . 6D8F3AC555E3F8A569AA9B2A817698C1 . 1548288 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\sfcfiles.dll
[-] 2004-08-20 . 6D8F3AC555E3F8A569AA9B2A817698C1 . 1548288 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\sfcfiles.dll

[-] 2004-08-20 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . d:\windows\system32\ctfmon.exe
[-] 2004-08-20 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\ctfmon.exe
[-] 2004-08-20 . 64E41E8FEE655B03E3F19DED21BA5118 . 15360 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\ctfmon.exe

[-] 2006-12-19 . D7DFBD1EFA149EC158363B974DAE0C6B . 135168 . . [6.00.2900.3051] . . d:\windows\system32\shsvcs.dll
[-] 2006-12-19 . D7DFBD1EFA149EC158363B974DAE0C6B . 135168 . . [6.00.2900.3051] . . d:\windows\system32\dllcache\shsvcs.dll
[-] 2006-12-19 . D7DFBD1EFA149EC158363B974DAE0C6B . 135168 . . [6.00.2900.3051] . . d:\windows\ERDNT\cache\shsvcs.dll
[-] 2006-12-19 . 1839CDF416A5AA8BF2EFE377F57452CC . 135680 . . [6.00.2900.3051] . . d:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[-] 2004-08-20 . ABA25E49F6589FD73F1143FDC39A6B46 . 135168 . . [6.00.2900.2180] . . d:\windows\ServicePackFiles\i386\shsvcs.dll

[-] 2004-08-20 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . d:\windows\system32egsvc.dll
[-] 2004-08-20 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . d:\windows\ERDNT\cacheegsvc.dll
[-] 2004-08-20 . B6F76CE10953A141545A0D01F1776885 . 59904 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386egsvc.dll

[-] 2004-08-20 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . d:\windows\system32\schedsvc.dll
[-] 2004-08-20 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\schedsvc.dll
[-] 2004-08-20 . A65E74CC5831CED5762AA16033ED20EE . 193024 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\schedsvc.dll

[-] 2004-08-20 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . d:\windows\system32\ssdpsrv.dll
[-] 2004-08-20 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\ssdpsrv.dll
[-] 2004-08-20 . DCB185C829538971E47AFFE77BA138C3 . 71680 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\ssdpsrv.dll

[-] 2004-08-20 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . d:\windows\system32	ermsrv.dll
[-] 2004-08-20 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache	ermsrv.dll
[-] 2004-08-20 . 78F90C3E230AD122BCB116ABAD5FEFE9 . 297984 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386	ermsrv.dll

[-] 2004-08-20 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . d:\windows\system32\appmgmts.dll
[-] 2004-08-20 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\appmgmts.dll
[-] 2004-08-20 . 7E9D138DC991BCCE6E6026CD74E69CC4 . 176640 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\appmgmts.dll

[-] 2001-08-28 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . d:\windows\system32\drivers\acpiec.sys
[-] 2001-08-28 . E4ABC1212B70BB03D35E60681C447210 . 12032 . . [5.1.2600.0] . . d:\windows\ERDNT\cache\acpiec.sys

[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . d:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . d:\windows\system32\drivers\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . d:\windows\Driver Cache\i386\aec.sys
[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . d:\windows\ERDNT\cache\aec.sys
[-] 2004-08-04 06:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . d:\windows\ServicePackFiles\i386\aec.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . d:\windows\system32\drivers\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . d:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\ip6fw.sys
[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\ip6fw.sys

[-] 2006-11-01 19:18 . FCD58951B3B2392007E0EE34D2CF944F . 927504 . . [4.1.0.61] . . d:\windows\system32\mfc40u.dll
[-] 2006-11-01 19:18 . FCD58951B3B2392007E0EE34D2CF944F . 927504 . . [4.1.0.61] . . d:\windows\system32\dllcache\mfc40u.dll
[-] 2006-11-01 19:18 . FCD58951B3B2392007E0EE34D2CF944F . 927504 . . [4.1.0.61] . . d:\windows\ERDNT\cache\mfc40u.dll

[-] 2004-08-20 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . d:\windows\system32\msgsvc.dll
[-] 2004-08-20 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . d:\windows\ERDNT\cache\msgsvc.dll
[-] 2004-08-20 . DE71362123E81D268088E78543752576 . 33792 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\msgsvc.dll

[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . d:\windows\system32\MsPMSNSv.dll
[-] 2006-10-18 20:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . d:\windows\ERDNT\cache\MsPMSNSv.dll
[-] 2005-01-28 12:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . d:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-20 00:09 . 535D54D2AF721A3497F058CAA2C63447 . 52736 . . [9.0.1.56] . . d:\windows\ServicePackFiles\i386\mspmsnsv.dll

[-] 2007-02-28 . 7A56A64EB50399613587E90292DD2AAB . 2061440 . . [5.1.2600.3093] . . d:\windows\$hf_mig$\KB931784\SP2QFE
tkrnlpa.exe
[-] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . d:\windows\system32
tkrnlpa.exe
[-] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . d:\windows\system32\dllcache
tkrnlpa.exe
[-] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . d:\windows\Driver Cache\i386
tkrnlpa.exe
[-] 2007-02-28 . A1D5231403329478AE4FE2778C55C77F . 2059648 . . [5.1.2600.3093] . . d:\windows\ERDNT\cache
tkrnlpa.exe
[-] 2005-03-02 . 5311776074B6C13F983DC75BAEAC9C0C . 2059008 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2QFE
tkrnlpa.exe
[-] 2005-03-02 . 73FA9C95D235844A36968C7852C7DBDD . 2058880 . . [5.1.2600.2622] . . d:\windows\$hf_mig$\KB890859\SP2GDR
tkrnlpa.exe
[-] 2004-08-20 . F252FAE094C54572ECE38A039F2103C4 . 2058880 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386
tkrnlpa.exe

[-] 2004-08-20 00:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . d:\windows\system32
tmssvc.dll
[-] 2004-08-20 00:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . d:\windows\ERDNT\cache
tmssvc.dll
[-] 2004-08-20 00:09 . 951543FFB84012D13F4CB09DA2EACE96 . 438272 . . [5.1.2400.2180] . . d:\windows\ServicePackFiles\i386
tmssvc.dll

[-] 2007-02-05 . 385DB2591BF11955F26E0A97728B1B31 . 185344 . . [5.1.2600.3077] . . d:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll
[-] 2007-02-05 . 96B3C690ED82E36E04C130F916E3AE91 . 185344 . . [5.1.2600.3077] . . d:\windows\system32\upnphost.dll
[-] 2007-02-05 . 96B3C690ED82E36E04C130F916E3AE91 . 185344 . . [5.1.2600.3077] . . d:\windows\system32\dllcache\upnphost.dll
[-] 2007-02-05 . 96B3C690ED82E36E04C130F916E3AE91 . 185344 . . [5.1.2600.3077] . . d:\windows\ERDNT\cache\upnphost.dll
[-] 2004-08-20 . 0B6A726C2DE9BBB80A48459F0C318F44 . 185344 . . [5.1.2600.2180] . . d:\windows\ServicePackFiles\i386\upnphost.dll
.
(((((((((((((((((((((((((((((   SnapShot@2009-11-17_18.26.59   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-17 19:58 . 2009-11-17 19:58	16384              d:\windows	emp\Perflib_Perfdata_7e0.dat
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"TomTomHOME.exe"="d:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-08-07 247144]
"BitTorrent DNA"="d:\program files\DNA\btdna.exe" [2009-11-13 323392]
"SUPERAntiSpyware"="d:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-13 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2005-10-28 155648]
"AdobeCS4ServiceManager"="d:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"TkBellExe"="d:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-07-04 198160]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Malwarebytes Anti-Malware (reboot)"="d:\program files\Malwarebytes'\mbam.exe" [2009-09-10 1312080]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

d:\documents and settings\HarryPotter\Menu D‚marrer\Programmes\D‚marrage\
Yahoo! Widgets.lnk - d:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]

d:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2009-11-11 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SASWinLogon]
2009-11-11 11:45	548352	----a-w-	d:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=d:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"d:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\Real\RealPlayer\realplay.exe"=
"d:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"d:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"=
"d:\Program Files\DNA\btdna.exe"=
"d:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"d:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 pctmp;PC Tools Firewall Memory Protection Driver;d:\windows\system32\drivers\pctmp.sys [10/01/2008 18:05 40856]
R1 pctssipc;PC Tools Security Suite IPC Driver;d:\windows\system32\drivers\pctssipc.sys [10/01/2008 18:05 18328]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 13:53 9968]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [27/02/2007 12:39 74480]
R1 SSHDRV76;SSHDRV76;d:\windows\system32\drivers\SSHDRV76.sys [09/07/2009 21:28 53760]
R1 SSHDRV85;SSHDRV85;d:\windows\system32\drivers\SSHDRV85.sys [26/08/2009 13:59 78848]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;d:\program files\Avira\AntiVir Desktop\sched.exe [17/11/2009 07:32 108289]
R2 TomTomHOMEService;TomTomHOMEService;d:\program files\TomTom HOME 2\TomTomHOMEService.exe [07/08/2009 16:31 92008]
R3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 17:51 4096]
S2 gupdate1c987c68a1a6ad2;Google Update Service (gupdate1c987c68a1a6ad2);d:\program files\Google\Update\GoogleUpdate.exe [05/02/2009 20:18 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;d:\windows\system32\drivers\ASPI32.SYS [21/03/2008 11:21 16512]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mbr
.
Contenu du dossier 'Tâches planifiées'

2009-11-17 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 19:18]

2009-11-17 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 19:18]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.fr/
mWindow Title = 
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.msnjeux.com/online2/MSN_INTL_FRANCE/zuma/zylomgamesplayer.cab
DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader.cab
DPF: {E1342154-4889-42B5-BEF6-19237577048F} - hxxp://msnfr.oberon-media.com/online2/MSN_INTL_FRANCE/zuma/oberongamesloader.cab
FF - ProfilePath - d:\documents and settings\HarryPotter\Application Data\Mozilla\Firefox\Profiles\ju8usffo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q=
FF - plugin: c:\program files\Real\RealPlayer\Netscape6
ppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6
prjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6
prpjplug.dll
FF - plugin: d:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
FF - plugin: d:\program files\Google\Update\1.2.183.13
pGoogleOneClick8.dll
FF - plugin: d:\program files\Microsoft\Office Live
pOLW.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pgcplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
picdclient.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pracplug.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pyaxmpb.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins
pzylomgamesplayer.dll
FF - plugin: d:\program files\Real\RealArcade\Plugins\Mozilla
pracplug.dll
FF - plugin: d:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: d:\windows\System32\Rawflow
picdclient.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-17 20:59
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1220945662-1454471165-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ca,52,88,28,7e,e2,3b,cc,c1,67,08,e3,6d,b8,5d,e5,22,47,8e,7c,29,35,9c,
   86,51,fd,e6,50,2f,11,c1,3d,22,1d,33,fe,e1,6f,ed,fb,b7,00,56,74,2d,31,ff,ca,\
"??"=hex:54,91,eb,dd,75,18,da,c3,ed,6e,dd,e8,34,bd,c8,e3

[HKEY_USERS\S-1-5-21-1220945662-1454471165-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:40,c3,69,56,1c,b0,e8,6b,41,db,1d,8b,81,cd,fc,51,25,e6,ef,5f,57,
   78,74,5f,1b,68,99,a9,60,b1,62,26,25,03,65,8f,c7,7b,f1,e4,f9,06,8b,4b,38,83,\
"rkeysecu"=hex:b3,a6,db,3c,87,0c,3e,99,24,5e,0d,1c,06,b7,47,de
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(912)
d:\program files\SUPERAntiSpyware\SASWINLO.DLL
d:\windows\system32\Ati2evxx.dll
d:\program files\Fichiers communs\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3368)
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\program files\PC Tools Firewall Plus\FWService.exe
d:\windows\system32\Ati2evxx.exe
d:\program files\Lavasoft\Ad-Aware\aawservice.exe
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\windows\System32\dllhost.exe
d:\windows\System32\CTsvcCDA.EXE
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
d:\program files\Analog Devices\SoundMAX\SMAgent.exe
.
**************************************************************************
.
Heure de fin: 2009-11-17 21:04 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-11-17 20:04
ComboFix2.txt  2009-11-17 18:32

Avant-CF: 15 325 921 280 octets libres
Après-CF: 15 307 210 752 octets libres

- - End Of File - - CD5ABEE38FB5BD0A2C31B6F0455165B7

mmmmmmmmm · Answer

je suis dsl, lol, c'est un peu le bazard pour moi tout ça!!!

mmmmmmmmm · Answer

maintenait usbfix fonctionne et j'obtiens ceci: 


############################## | UsbFix V6.054 |

User : HarryPotter () # DUMBLEDORE
Update on 17/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 21:11:51 | 17/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Sempron(TM) 2500+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.26 [ (!) Disabled | (!) Outdated ]
FW : PC Tools Firewall Plus[ Enabled ]3.0.0

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 17,74 Go (7,59 Go free) # NTFS
D:\ -> Disque fixe local # 58,57 Go (14,29 Go free) [DISQUE LOCA] # FAT32
E:\ -> Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 7,73 Go (1,31 Go free) [M450] # FAT32

############################## | Processus actifs |

D:\WINDOWS\System32\smss.exe 752
D:\WINDOWS\system32\csrss.exe 880
D:\WINDOWS\system32\winlogon.exe 912
D:\WINDOWS\system32\services.exe 956
D:\WINDOWS\system32\lsass.exe 976
D:\WINDOWS\system32\Ati2evxx.exe 1156
D:\WINDOWS\system32\svchost.exe 1188
D:\Program Files\PC Tools Firewall Plus\FWService.exe 1292
D:\WINDOWS\system32\svchost.exe 1360
D:\WINDOWS\system32\svchost.exe 1572
D:\WINDOWS\system32\Ati2evxx.exe 1688
D:\WINDOWS\System32\svchost.exe 1720
D:\WINDOWS\system32\svchost.exe 1892
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe 1996
D:\Program Files\QuickTime\qttask.exe 1040
D:\Program Files\Fichiers communs\Real\Update_OBealsched.exe 1216
D:\Program Files\Java\jre6\bin\jusched.exe 1244
D:\WINDOWS\system32\spoolsv.exe 1376
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1400
D:\Program Files\Windows Live\Messenger\msnmsgr.exe 1504
D:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe 1540
D:\Program Files\DNA\btdna.exe 1656
D:\Program Files\Avira\AntiVir Desktop\sched.exe 1696
D:\Program Files\Avira\AntiVir Desktop\avguard.exe 592
D:\WINDOWS\System32\dllhost.exe 684
D:\WINDOWS\System32\CTsvcCDA.EXE 840
D:\Program Files\Java\jre6\bin\jqs.exe 2016
D:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2236
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 2384
D:\WINDOWS\System32\svchost.exe 2588
D:\Program Files\TomTom HOME 2\TomTomHOMEService.exe 2612
D:\WINDOWS\System32\alg.exe 2264
D:\WINDOWS\system32\svchost.exe 3968
D:\WINDOWS\explorer.exe 3368
D:\WINDOWS\system32
otepad.exe 3352
D:\Program Files\Mozilla Firefox\firefox.exe 3112
D:\WINDOWS\System32\wbem\wmiprvse.exe 340

################## | Fichiers # Dossiers infectieux |

D:\WINDOWS
igzss.txt 

################## | Registre # Clés infectieuses |

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"  
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives" 
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  

################## | Registre # Mountpoints2 |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.054 ! |

gen-hackman · Answer

le topic n a pas ete supprimé je pense que tu l'as perdu car c'est un connaiseur qui t'a fait executer CFScript

^^Marie^^ · Answer

Bonsoir

Continue sur ta discussion initiale et merci d'éviter les changements de pseudos
https://forums.commentcamarche.net/forum/affich-15242413-virus

+

Svchost.exe

17 réponses

Discussions similaires

Newsletters