A voir également:
- Rapport rsit
- Impossible d'afficher le rapport de tableau croisé dynamique sur un rapport existant ✓ - Forum Excel
- Rapport de stage - Guide
- Exemple de rapport de travail word ✓ - Forum Word
- Avant propos rapport de stage - Forum Programmation
- Impossible d'afficher le tableau dynamique sur un rapport existant - Forum Bureautique
7 réponses
Bonsoir
Le premier rapport n'est pas complet ;mais tu peux déja faire ceci:
# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
Télécharge et install UsbFix de C_XX
Ici : : http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
Tutorial de Malekal_Morte si besoin, merci à lui : https://www.malekal.com/usbfix-supprimer-virus-usb/
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
# Clic droit "Exécuter en tant qu'administrateur" sur le raccourci UsbFix présent sur ton bureau.
# Choisi l option 1 (Recherche)
# Laisse travailler l outil.
# Ensuite post le rapport UsbFix.txt qui apparaîtra.
# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )
@+
Le premier rapport n'est pas complet ;mais tu peux déja faire ceci:
# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
Télécharge et install UsbFix de C_XX
Ici : : http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
Tutorial de Malekal_Morte si besoin, merci à lui : https://www.malekal.com/usbfix-supprimer-virus-usb/
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir
# Clic droit "Exécuter en tant qu'administrateur" sur le raccourci UsbFix présent sur ton bureau.
# Choisi l option 1 (Recherche)
# Laisse travailler l outil.
# Ensuite post le rapport UsbFix.txt qui apparaîtra.
# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )
@+
bonjour guillaume voila le rapport de malwarebytes ,le dernier en date
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3690
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005
04/02/2010 22:20:55
mbam-log-2010-02-04 (22-20-55).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 265779
Temps écoulé: 59 minute(s), 50 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Users\pink\AppData\Roaming\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000001FC11589E2E59D837 (Trojan.Dropper) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3690
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005
04/02/2010 22:20:55
mbam-log-2010-02-04 (22-20-55).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 265779
Temps écoulé: 59 minute(s), 50 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Users\pink\AppData\Roaming\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.
C:\Windows\Temp\TMP00000001FC11589E2E59D837 (Trojan.Dropper) -> Quarantined and deleted successfully.
bonjour guillaume voici le rapport d'UsbFix comme tu me l avais demande par contre je n ai pas pu avoir le rapport rsit en mode normal ,mon pc est trop lent et je n arrive plus acceder au bureau de windows en mode normal je ne sais pas pour quoi voila le rapport
############################## | UsbFix V6.087 |
User : pink (Administrateurs) # PC-DE-PINK
Update on 04/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 23:43:49 | 05/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Core(TM)2 Duo CPU T7300 @ 2.00GHz
Microsoft® Windows Vista™ Professionnel (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 7.0.6002.18005
Windows Firewall Status : Disabled
C:\ -> Disque fixe local # 72,97 Go (31,98 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque fixe local # 1,55 Go (1,12 Go free) [OS_TOOLS] # NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 1,89 Go (1,77 Go free) [USB2GO ALI] # FAT
I:\ -> Disque CD-ROM # 5,45 Mo (0 Mo free) [U3 System] # CDFS
J:\ -> Disque amovible # 973,16 Mo (971,91 Mo free) [SCANDISK AL] # FAT
K:\ -> Disque fixe local # 298,08 Go (297,61 Go free) [ext ally] # NTFS
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\AEADISRV.EXE
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\System32\IFXTCS.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\oodag.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Windows\system32\runonce.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\PresentationSettings.exe
C:\Windows\system32\igfxsrvc.exe
################## | Elements infectieux |
Supprimé ! C:\$Recycle.Bin\S-1-5-20
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1048705490-3314177153-1035306432-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1781800892-3585499076-1573027979-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1003
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1004
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-501
Supprimé ! C:\$Recycle.Bin\S-1-5-21-918056312-2952985149-2686913973-500
Supprimé ! E:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1003
Supprimé ! E:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1004
Supprimé ! E:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-501
Supprimé ! H:\log.txt
Non supprimé ! I:\autorun.inf
Supprimé ! J:\SYSTEM
Supprimé ! K:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1003
################## | Registre |
Supprimé ! [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
################## | Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{0cb30e92-6091-11dd-b821-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{210277f0-ee32-11dd-80a0-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2697f3ff-c144-11dd-934f-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2697f422-c144-11dd-934f-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2fdf3866-e3f7-11dd-8db5-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2fdf386b-e3f7-11dd-8db5-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{513a068b-10ba-11de-8870-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{5fbb8279-8e46-11de-903a-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{8618075e-07fc-11de-97b1-001e37a04fa4}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{94ab9377-e80d-11de-a8b3-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{9af4edde-cc44-11dd-89e8-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{ae83b0cd-9eac-11dd-b742-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{b263e572-6f84-11dd-938c-001e37a04fa4}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{bda8346e-0e38-11de-a55f-001e37a04fa4}\Shell\1\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{bda83473-0e38-11de-a55f-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{be73dd13-94c7-11de-8a1c-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{d98aed6f-0cc0-11de-a27b-001e37a04fa4}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[05/02/2010 13:24|--a------|2917] C:\aaw7boot.log
[11/04/2009 07:36|-rahs----|333257] C:\bootmgr
[04/06/2009 00:44|--a------|1677656] C:\ciam_install.log
[21/07/2009 23:22|--a------|9363] C:\Ciam_LogFile.log
[04/07/2007 12:57|--a------|0] C:\C_USERPART
[04/06/2009 01:22|--a------|186] C:\hpqlb.log
[03/05/2009 10:56|-rahs----|0] C:\IO.SYS
[14/10/2009 15:35|--a------|78] C:\lxdx.log
[03/05/2009 10:56|-rahs----|0] C:\MSDOS.SYS
[21/07/2009 23:22|--a------|184] C:\NONAME.LOG
[27/11/2008 18:11|--a------|262144] C:\ntuser.dat
[27/11/2008 18:11|--ah-----|5120] C:\ntuser.dat.LOG1
[27/11/2008 18:11|--ah-----|0] C:\ntuser.dat.LOG2
[27/11/2008 18:11|--ahs----|65536] C:\ntuser.dat{84dd1b4a-bca4-11dd-ac62-001e37a04fa4}.TM.blf
[27/11/2008 18:11|--ahs----|524288] C:\ntuser.dat{84dd1b4a-bca4-11dd-ac62-001e37a04fa4}.TMContainer00000000000000000001.regtrans-ms
[27/11/2008 18:11|--ahs----|524288] C:\ntuser.dat{84dd1b4a-bca4-11dd-ac62-001e37a04fa4}.TMContainer00000000000000000002.regtrans-ms
[29/02/2004 16:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[04/06/2009 00:46|--a------|3494] C:\ptsteLog.txt
[30/08/2009 16:10|--a------|11] C:\trace.ini
[05/02/2010 23:54|--a------|7731] C:\UsbFix.txt
[29/08/2009 19:14|--ahs----|4096] C:\VSNAP.IDX
[21/04/2009 22:45|--a------|19182] C:\WirelessDiagLog.csv
[25/07/2008 18:26|--a------|50] E:\HP_WINRE
[21/11/2009 21:57|--a------|73138176] H:\APPLICATION.zip
[21/11/2009 22:05|--a------|52428800] H:\Acronis True Image Home 2010+serial.zip
[03/02/2010 21:04|--a------|16384] H:\info.txt
[29/10/2009 17:33|--a------|34304] H:\Formatage rapide ou normal.doc
[03/02/2010 23:34|--a------|1497989] H:\UsbFix.exe
[04/02/2010 00:20|--a------|4792] H:\UsbFix.txt
[11/12/2006 21:03|-r-------|277] I:\autorun.inf
[07/12/2006 19:45|-r-------|1095224] I:\LaunchU3.exe
[11/12/2006 21:26|-r-------|4557609] I:\LaunchPad.zip
[10/12/2008 18:41|--a------|685] J:\CLEF ET CERTIFICAT.cer
[07/12/2006 19:45|-ra------|1095224] J:\LaunchU3.exe
[04/02/2010 02:14|---hs----|85] K:\desktop.ini
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix.
# E:\autorun.inf -> Dossier créé par UsbFix.
# H:\autorun.inf -> Dossier créé par UsbFix.
# J:\autorun.inf -> Dossier créé par UsbFix.
# K:\autorun.inf -> Dossier créé par UsbFix.
################## | Upload |
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-pink.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.087 ! |
############################## | UsbFix V6.087 |
User : pink (Administrateurs) # PC-DE-PINK
Update on 04/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 23:43:49 | 05/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Core(TM)2 Duo CPU T7300 @ 2.00GHz
Microsoft® Windows Vista™ Professionnel (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 7.0.6002.18005
Windows Firewall Status : Disabled
C:\ -> Disque fixe local # 72,97 Go (31,98 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque fixe local # 1,55 Go (1,12 Go free) [OS_TOOLS] # NTFS
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 1,89 Go (1,77 Go free) [USB2GO ALI] # FAT
I:\ -> Disque CD-ROM # 5,45 Mo (0 Mo free) [U3 System] # CDFS
J:\ -> Disque amovible # 973,16 Mo (971,91 Mo free) [SCANDISK AL] # FAT
K:\ -> Disque fixe local # 298,08 Go (297,61 Go free) [ext ally] # NTFS
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\AEADISRV.EXE
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\ifxspmgt.exe
C:\Windows\System32\IFXTCS.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\oodag.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Intel\AMT\UNS.exe
C:\Windows\system32\runonce.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\PresentationSettings.exe
C:\Windows\system32\igfxsrvc.exe
################## | Elements infectieux |
Supprimé ! C:\$Recycle.Bin\S-1-5-20
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1048705490-3314177153-1035306432-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1781800892-3585499076-1573027979-500
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1003
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1004
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-501
Supprimé ! C:\$Recycle.Bin\S-1-5-21-918056312-2952985149-2686913973-500
Supprimé ! E:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1003
Supprimé ! E:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1004
Supprimé ! E:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-501
Supprimé ! H:\log.txt
Non supprimé ! I:\autorun.inf
Supprimé ! J:\SYSTEM
Supprimé ! K:\$Recycle.Bin\S-1-5-21-3303094250-2052613164-1373151634-1003
################## | Registre |
Supprimé ! [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
################## | Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{0cb30e92-6091-11dd-b821-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{210277f0-ee32-11dd-80a0-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2697f3ff-c144-11dd-934f-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2697f422-c144-11dd-934f-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2fdf3866-e3f7-11dd-8db5-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{2fdf386b-e3f7-11dd-8db5-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{513a068b-10ba-11de-8870-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{5fbb8279-8e46-11de-903a-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{8618075e-07fc-11de-97b1-001e37a04fa4}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{94ab9377-e80d-11de-a8b3-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{9af4edde-cc44-11dd-89e8-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{ae83b0cd-9eac-11dd-b742-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{b263e572-6f84-11dd-938c-001e37a04fa4}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{bda8346e-0e38-11de-a55f-001e37a04fa4}\Shell\1\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{bda83473-0e38-11de-a55f-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{be73dd13-94c7-11de-8a1c-001e37a04fa4}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{d98aed6f-0cc0-11de-a27b-001e37a04fa4}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[05/02/2010 13:24|--a------|2917] C:\aaw7boot.log
[11/04/2009 07:36|-rahs----|333257] C:\bootmgr
[04/06/2009 00:44|--a------|1677656] C:\ciam_install.log
[21/07/2009 23:22|--a------|9363] C:\Ciam_LogFile.log
[04/07/2007 12:57|--a------|0] C:\C_USERPART
[04/06/2009 01:22|--a------|186] C:\hpqlb.log
[03/05/2009 10:56|-rahs----|0] C:\IO.SYS
[14/10/2009 15:35|--a------|78] C:\lxdx.log
[03/05/2009 10:56|-rahs----|0] C:\MSDOS.SYS
[21/07/2009 23:22|--a------|184] C:\NONAME.LOG
[27/11/2008 18:11|--a------|262144] C:\ntuser.dat
[27/11/2008 18:11|--ah-----|5120] C:\ntuser.dat.LOG1
[27/11/2008 18:11|--ah-----|0] C:\ntuser.dat.LOG2
[27/11/2008 18:11|--ahs----|65536] C:\ntuser.dat{84dd1b4a-bca4-11dd-ac62-001e37a04fa4}.TM.blf
[27/11/2008 18:11|--ahs----|524288] C:\ntuser.dat{84dd1b4a-bca4-11dd-ac62-001e37a04fa4}.TMContainer00000000000000000001.regtrans-ms
[27/11/2008 18:11|--ahs----|524288] C:\ntuser.dat{84dd1b4a-bca4-11dd-ac62-001e37a04fa4}.TMContainer00000000000000000002.regtrans-ms
[29/02/2004 16:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[04/06/2009 00:46|--a------|3494] C:\ptsteLog.txt
[30/08/2009 16:10|--a------|11] C:\trace.ini
[05/02/2010 23:54|--a------|7731] C:\UsbFix.txt
[29/08/2009 19:14|--ahs----|4096] C:\VSNAP.IDX
[21/04/2009 22:45|--a------|19182] C:\WirelessDiagLog.csv
[25/07/2008 18:26|--a------|50] E:\HP_WINRE
[21/11/2009 21:57|--a------|73138176] H:\APPLICATION.zip
[21/11/2009 22:05|--a------|52428800] H:\Acronis True Image Home 2010+serial.zip
[03/02/2010 21:04|--a------|16384] H:\info.txt
[29/10/2009 17:33|--a------|34304] H:\Formatage rapide ou normal.doc
[03/02/2010 23:34|--a------|1497989] H:\UsbFix.exe
[04/02/2010 00:20|--a------|4792] H:\UsbFix.txt
[11/12/2006 21:03|-r-------|277] I:\autorun.inf
[07/12/2006 19:45|-r-------|1095224] I:\LaunchU3.exe
[11/12/2006 21:26|-r-------|4557609] I:\LaunchPad.zip
[10/12/2008 18:41|--a------|685] J:\CLEF ET CERTIFICAT.cer
[07/12/2006 19:45|-ra------|1095224] J:\LaunchU3.exe
[04/02/2010 02:14|---hs----|85] K:\desktop.ini
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix.
# E:\autorun.inf -> Dossier créé par UsbFix.
# H:\autorun.inf -> Dossier créé par UsbFix.
# J:\autorun.inf -> Dossier créé par UsbFix.
# K:\autorun.inf -> Dossier créé par UsbFix.
################## | Upload |
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-pink.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.087 ! |
Bonjour
Toujours UAC désactivé:
1)Ton PC démarre t' il en mode normal? Il ne manque que le bureau?
2)Désinstalle Tunes up.
3)Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Ou ici : https://forospyware.com
>Renomme le pour l’enregistrer sur ton bureau en asdehi (tout simplement pour que l’infection ne le contre pas)
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
- Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordinateur (plantage complet)
::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes
@+
Toujours UAC désactivé:
1)Ton PC démarre t' il en mode normal? Il ne manque que le bureau?
2)Désinstalle Tunes up.
3)Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Ou ici : https://forospyware.com
>Renomme le pour l’enregistrer sur ton bureau en asdehi (tout simplement pour que l’infection ne le contre pas)
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
- Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordinateur (plantage complet)
::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes
@+
bonjour guillaume impossible a désinstaller-tuneup-utilities même avec le logiciel revo, ensuite une fois [ lance mon pc a plante complètement la je ne sais plus quoi faire en tout cas il est vraiment costaud ce cheval de troie ,j aurais aimer le trouver et supprimer avec ton aide par ce qu il m a vraiment défier, lol mais je crois que le plus sage est de lui céder place et formater mon disque dur mais la encore je ne possède pas de cd d installation et vu que je n arrive accéder a mon pc en mode normal ca va etre compliquer donc je suis un peu coincer. merci pour l aide que tu m apportes j attends tes conseilles
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
bonjour guillaume finalement j ai réussi avoir le rapport de combo mais en mode sans échec seulement voila le rapport
ComboFix 10-02-05.04 - pink 06/02/2010 22:04:12.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Professionnel 6.0.6002.2.1252.33.1036.18.3062.2590 [GMT 1:00]
Lancé depuis: H:\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\pink\AppData\Roaming\Desktopicon
c:\users\pink\AppData\Roaming\Desktopicon\config.ini
c:\users\pink\AppData\Roaming\inst.exe
c:\windows\patchw32.dll
c:\windows\pw32a.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-06 au 2010-02-06 ))))))))))))))))))))))))))))))))))))
.
2010-02-06 21:46 . 2010-02-06 21:48 -------- d-----w- c:\users\pink\AppData\Local\temp
2010-02-06 21:46 . 2010-02-06 21:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-06 19:09 . 2010-02-06 19:09 -------- d-----w- c:\program files\VS Revo Group
2010-02-05 22:55 . 2010-02-05 22:55 14004 ----a-w- C:\UsbFix_Upload_Me_PC-de-pink.zip
2010-02-04 19:45 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-04 19:45 . 2010-02-04 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 19:45 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-03 23:14 . 2010-02-05 22:55 -------- d-----w- C:\UsbFix
2010-02-03 20:00 . 2010-02-05 23:02 -------- d-----w- C:\rsit
2010-02-03 00:48 . 2010-02-03 00:48 -------- d-----w- c:\program files\Lavasoft
2010-02-03 00:29 . 2010-02-03 00:43 -------- d-----w- c:\program files\Trojan Remover
2010-01-26 16:36 . 2010-01-26 16:37 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-26 12:48 . 2010-02-05 23:02 -------- d-----w- c:\program files\Trend Micro
2010-01-12 21:09 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-12 21:09 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 19:43 . 2009-07-29 20:11 5656 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-06 19:43 . 2009-07-29 20:11 5415456 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-06 19:43 . 2009-07-29 20:11 46532 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-06 19:43 . 2009-07-29 20:11 1032224 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-06 19:42 . 2006-11-09 19:30 12 ----a-w- c:\windows\bthservsdp.dat
2010-02-06 19:36 . 2009-07-29 20:11 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-05 22:49 . 2006-11-02 15:47 687282 ----a-w- c:\windows\system32\perfh00C.dat
2010-02-05 22:49 . 2006-11-02 15:47 131396 ----a-w- c:\windows\system32\perfc00C.dat
2010-02-05 12:36 . 2008-12-30 18:51 -------- d-----w- c:\programdata\Lavasoft
2010-02-05 02:24 . 2009-10-10 19:33 -------- d-----w- c:\program files\Full Tilt Poker
2010-02-04 21:42 . 2009-07-12 19:49 -------- d-----w- c:\users\pink\AppData\Roaming\vlc
2010-02-03 01:32 . 2009-05-03 17:14 -------- d-----w- c:\program files\P2P_Torrent
2010-02-03 00:18 . 2008-07-29 16:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-31 02:25 . 2009-12-03 23:12 -------- d-----w- c:\program files\SpeedFan
2010-01-27 12:24 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 17:11 . 2009-04-09 20:30 -------- d-----w- c:\programdata\NOS
2010-01-26 16:12 . 2008-09-29 21:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 02:34 . 2008-08-23 14:06 1356 ----a-w- c:\users\pink\AppData\Local\d3d9caps.dat
2010-01-19 22:36 . 2009-09-24 18:19 -------- d-----w- c:\users\pink\AppData\Roaming\BitTorrent
2010-01-14 10:12 . 2009-10-03 15:26 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 22:47 . 2007-07-04 12:17 -------- d-----w- c:\program files\Java
2009-12-19 16:23 . 2009-12-19 16:23 -------- d-----w- c:\program files\SPlayer
2009-12-17 21:32 . 2009-08-18 20:50 -------- d-----w- c:\users\pink\AppData\Roaming\Azureus
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\programdata\TomTom
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\users\pink\AppData\Roaming\TomTom
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom International B.V
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom HOME 2
2009-12-13 17:41 . 2009-12-13 17:41 -------- d-----w- c:\program files\TomTom DesktopSuite
2009-11-26 23:43 . 2009-11-26 23:43 872960 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-26 23:43 . 2009-11-26 23:43 340480 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 10:48 . 2009-11-26 23:43 43008 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 10:48 . 2009-11-26 23:43 346624 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-17 20:20 . 2009-11-17 20:03 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-11-09 12:31 . 2009-12-09 16:38 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30 . 2009-12-09 16:38 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 10:36 . 2009-12-09 16:38 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-03-08 18:52 . 2009-03-08 18:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-08-05 13:52 . 2008-08-05 13:52 23 --sha-w- c:\windows\System32\cdbe7_g.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2009-06-03 677144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-19 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-19 150552]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-09-26 316720]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 07:04 49152 ----a-r- c:\windows\System32\DeviceNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~2\adialhk.dll c:\progra~1\KASPER~1\KASPER~2\kloehk.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS\0autocheck autochk *
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ SbHpNp scecli
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 11:30 217544 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atchk]
2009-06-04 00:22 408088 ----a-w- c:\program files\Intel\AMT\atchk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connexion SFR 9props.exe]
2009-10-15 08:53 959808 ----a-w- c:\program files\SFR\Kit\9props.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-08-19 10:59 173592 ----a-w- c:\windows\System32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 09:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWWANGSAssistant]
2007-02-26 09:07 3946040 ----a-w- c:\swsetup\HPQWWAN\HPWWanGSAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-08-25 08:57 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-08-19 10:59 141848 ----a-w- c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-09-11 02:40 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-10-18 13:27 455968 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 18:16 2331936 ----a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2009-04-07 23:39 2553088 ----a-w- c:\windows\System32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete]
2007-02-20 12:48 331552 ----a-w- c:\program files\PDF Complete\pdfsty.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-08-19 10:59 150552 ----a-w- c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
2007-01-09 13:52 145184 ----a-w- c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2007-02-21 15:14 1183744 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ST Recovery Launcher]
2007-03-09 14:24 44168 ----a-w- c:\windows\SMINST\Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-03-28 01:05 1045800 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2008-05-02 04:15 15872 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):41,86,29,06,17,21,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3303094250-2052613164-1373151634-1003]
"EnableNotificationsRef"=dword:00000008
R0 dlkmdldr;dlkmdldr;c:\windows\System32\drivers\dlkmdldr.sys [04/06/2009 13:08 13424]
R0 SafeBoot;SafeBoot;c:\windows\System32\drivers\SafeBoot.sys [14/08/2007 16:59 101167]
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [09/10/2006 12:31 44720]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/06/2007 15:22 13184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\System32\drivers\psd.sys [04/06/2009 00:31 38816]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/2008 16:29 33808]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [30/08/2009 15:10 721904]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/2008 16:28 20496]
S1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/08/2007 16:59 5840]
S2 DisplayLinkService;DisplayLink Service;c:\program files\DisplayLink Core Software\DisplayLinkService.exe [10/03/2009 06:47 447848]
S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\Common Files\BinarySense\disksvc.exe" --> c:\program files\Common Files\BinarySense\disksvc.exe [?]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [06/09/2007 12:26 221184]
S2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [04/07/2007 19:05 24880]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [04/07/2007 12:52 539936]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [01/09/2009 15:47 1153368]
S2 SWIHPWMI;SWIHPWMI;c:\program files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [04/12/2006 15:13 292384]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 12:31 92008]
S2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [25/07/2008 21:16 1464856]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [31/03/2009 19:41 498432]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\System32\drivers\btnetBus.sys [07/12/2008 11:44 30088]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [02/11/2009 23:18 193840]
S3 DAMDrv;DAMDrv;c:\windows\System32\drivers\DAMDrv.sys [08/06/2007 07:49 30008]
S3 dlkmd;dlkmd;c:\windows\System32\drivers\dlkmd.sys [04/06/2009 13:08 367728]
S3 FLCDLOCK;Verrouillage des périphériques / Audition HP ProtectTools;c:\windows\System32\flcdlock.exe [08/06/2007 08:06 172131]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/2008 17:02 26640]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\System32\drivers\WUSB54GCx86.sys [08/11/2008 14:10 256000]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [04/03/2009 09:49 4232704]
S3 rismc32;RICOH Smart Card Reader;c:\windows\System32\drivers\rismc32.sys [20/12/2006 02:08 47616]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\System32\drivers\smscirda.sys [25/04/2007 12:32 31232]
S3 WSDPrintDevice;Prise en charge de l’impression WSD via UMB;c:\windows\System32\drivers\WSDPrint.sys [01/08/2008 14:27 16896]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - ECACHE
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-10-18 13:25 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'
2010-02-06 c:\windows\Tasks\User_Feed_Synchronization-{B2C91C8A-1CE6-4532-B768-2552B02DCEB7}.job
- c:\windows\system32\msfeedssync.exe [2008-08-01 07:33]
.
.
------- Examen supplémentaire -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
FF - component: c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-RunOnce-<NO NAME> - (no file)
MSConfigStartUp-HP Software Update - c:\program files\Hp\HP Software Update\HPWuSchd2.exe
MSConfigStartUp-Norton Ghost 14 - c:\program files\Norton Ghost\Agent\VProTray.exe
MSConfigStartUp-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
MSConfigStartUp-Service Scheduler2 Acronis - c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-TrueImageMonitor - c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
MSConfigStartUp-VirtualCloneDrive - c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-06 22:47
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.032"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.abr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ani"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bay"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bw"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cs1"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cur"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dcx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dib"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djv"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djvu"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.emf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.eps"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.erf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fff"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.hdr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icl"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icn"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ilbm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.int"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.inta"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.iw4"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2c"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2k"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jfif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jp2"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpk"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mef"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mos"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pct"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pgm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pic"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pict"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pix"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.psp"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspbrush"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspimage"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ras"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgba"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rle"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rsb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.sgi"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.thm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.wmf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xpm"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E…¸Î®X[^%¼pXýåÀHÄå T%Òk¼…Gûî|Ö—ŸrQøb¨njF×ÒÐ=Çó÷—!çÔÖByŽœraàÂ0<å…07ïÓË…æ=ÌïÓÛûë¨Ûhb½Å÷³¾itG0䣪n,/2ÀÿŸÛýG´·«h<é]&啉¼‚pPü¯ðDiÇõ‡HVCÂ$›p+´tQ›PÙ-䝿ÿ`ÏÙ†3¼Tø:-˜V‡Ç>Ámteüßá"‰¿i¢:THÄŸ©5ù
g÷£g›6že|]™CgêªgØ-5õÙ¦ –¡
…ü†w4mŒæ§Ê36ta×#*ÈAGL„È®D¨Êt G§ )sÀõî òRí.Yös‰c.“;ÞaÌ©5!6€:òUµ‚ÉjìÅsv+í1ØáœÇcÐØè¤”ŸX‘0ÄuاNíÇ€6ÑVL›ZÍ©n9/âú˜ëä:áCL<hEŒ“1 Á.»:’šM˜v+„fò_dMÙµ3–G©¨e~X…;!H£t¦’âÏ„õ)Œ+)ЏA[b„˜®wQ//AÑì„öG]uiáSÁz9æòÊ¿ßç\»jÞ*˜£ãžô=æ–XÉÿ«ï8á¢O?ûe@…2Ç~Oõ™ex›D['žühÐO‹ªr¤òõ6â³,-Å%I>“¾Š:Tö-ï)éä5íøÉéìÆÕpRŽ}Ÿdl͇¢¹ñ©çÎx%Š£¢H¤î®¢€5Ó2Ï]„!1¿Ø±0ÄvÑ~z(ŽGµ?‰R5…ß±¨Â?öý+ãVÍš®öã³)IƒhhP"ÓúaIBOQVéº'ò²aMž?kXˆo¿\2†îHÐéq–€ê½*“^røžwYòhÁ¦1ù®€¿}dÅðšñB= hŽ>„C™(Ú“”1ô½Ic¾D4þ>BÔ[6öâãü@foЫw.³n ñäÑ‚âˆRU
”oŒœÒz?ÉÉ#vFäÙwqb¼£¾lûbƒsv̤CÌ–ž«L ÿ_Ø/ÌìXg.,¶~r¢ó¾Z]ž¸³=`¤†´InBë¾HT’•:L®Tt^ÄyM·Ùâš=q=Q$å`6gè‹€I6úèŠ8kpD¸°t!è³ñ[¸Ê«ÚBD¾Æ9š¯‘Y{‹ê«‰ïTÃ[sÈ0OêÑEDJ/s0¸m`kvJm¢®z–¾µ:6
«Ôö÷ÈnºqÃzÊOvIȰ×&ÌJžg©4w2» {=
ComboFix 10-02-05.04 - pink 06/02/2010 22:04:12.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Professionnel 6.0.6002.2.1252.33.1036.18.3062.2590 [GMT 1:00]
Lancé depuis: H:\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\pink\AppData\Roaming\Desktopicon
c:\users\pink\AppData\Roaming\Desktopicon\config.ini
c:\users\pink\AppData\Roaming\inst.exe
c:\windows\patchw32.dll
c:\windows\pw32a.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-06 au 2010-02-06 ))))))))))))))))))))))))))))))))))))
.
2010-02-06 21:46 . 2010-02-06 21:48 -------- d-----w- c:\users\pink\AppData\Local\temp
2010-02-06 21:46 . 2010-02-06 21:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-06 19:09 . 2010-02-06 19:09 -------- d-----w- c:\program files\VS Revo Group
2010-02-05 22:55 . 2010-02-05 22:55 14004 ----a-w- C:\UsbFix_Upload_Me_PC-de-pink.zip
2010-02-04 19:45 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-04 19:45 . 2010-02-04 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 19:45 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-03 23:14 . 2010-02-05 22:55 -------- d-----w- C:\UsbFix
2010-02-03 20:00 . 2010-02-05 23:02 -------- d-----w- C:\rsit
2010-02-03 00:48 . 2010-02-03 00:48 -------- d-----w- c:\program files\Lavasoft
2010-02-03 00:29 . 2010-02-03 00:43 -------- d-----w- c:\program files\Trojan Remover
2010-01-26 16:36 . 2010-01-26 16:37 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-26 12:48 . 2010-02-05 23:02 -------- d-----w- c:\program files\Trend Micro
2010-01-12 21:09 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-12 21:09 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 19:43 . 2009-07-29 20:11 5656 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-06 19:43 . 2009-07-29 20:11 5415456 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-06 19:43 . 2009-07-29 20:11 46532 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-06 19:43 . 2009-07-29 20:11 1032224 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-06 19:42 . 2006-11-09 19:30 12 ----a-w- c:\windows\bthservsdp.dat
2010-02-06 19:36 . 2009-07-29 20:11 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-05 22:49 . 2006-11-02 15:47 687282 ----a-w- c:\windows\system32\perfh00C.dat
2010-02-05 22:49 . 2006-11-02 15:47 131396 ----a-w- c:\windows\system32\perfc00C.dat
2010-02-05 12:36 . 2008-12-30 18:51 -------- d-----w- c:\programdata\Lavasoft
2010-02-05 02:24 . 2009-10-10 19:33 -------- d-----w- c:\program files\Full Tilt Poker
2010-02-04 21:42 . 2009-07-12 19:49 -------- d-----w- c:\users\pink\AppData\Roaming\vlc
2010-02-03 01:32 . 2009-05-03 17:14 -------- d-----w- c:\program files\P2P_Torrent
2010-02-03 00:18 . 2008-07-29 16:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-31 02:25 . 2009-12-03 23:12 -------- d-----w- c:\program files\SpeedFan
2010-01-27 12:24 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 17:11 . 2009-04-09 20:30 -------- d-----w- c:\programdata\NOS
2010-01-26 16:12 . 2008-09-29 21:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 02:34 . 2008-08-23 14:06 1356 ----a-w- c:\users\pink\AppData\Local\d3d9caps.dat
2010-01-19 22:36 . 2009-09-24 18:19 -------- d-----w- c:\users\pink\AppData\Roaming\BitTorrent
2010-01-14 10:12 . 2009-10-03 15:26 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 22:47 . 2007-07-04 12:17 -------- d-----w- c:\program files\Java
2009-12-19 16:23 . 2009-12-19 16:23 -------- d-----w- c:\program files\SPlayer
2009-12-17 21:32 . 2009-08-18 20:50 -------- d-----w- c:\users\pink\AppData\Roaming\Azureus
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\programdata\TomTom
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\users\pink\AppData\Roaming\TomTom
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom International B.V
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom HOME 2
2009-12-13 17:41 . 2009-12-13 17:41 -------- d-----w- c:\program files\TomTom DesktopSuite
2009-11-26 23:43 . 2009-11-26 23:43 872960 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-26 23:43 . 2009-11-26 23:43 340480 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 10:48 . 2009-11-26 23:43 43008 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 10:48 . 2009-11-26 23:43 346624 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-17 20:20 . 2009-11-17 20:03 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-11-09 12:31 . 2009-12-09 16:38 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30 . 2009-12-09 16:38 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 10:36 . 2009-12-09 16:38 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-03-08 18:52 . 2009-03-08 18:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-08-05 13:52 . 2008-08-05 13:52 23 --sha-w- c:\windows\System32\cdbe7_g.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2009-06-03 677144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-19 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-19 150552]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-09-26 316720]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 07:04 49152 ----a-r- c:\windows\System32\DeviceNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~2\adialhk.dll c:\progra~1\KASPER~1\KASPER~2\kloehk.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS\0autocheck autochk *
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ SbHpNp scecli
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 11:30 217544 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atchk]
2009-06-04 00:22 408088 ----a-w- c:\program files\Intel\AMT\atchk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connexion SFR 9props.exe]
2009-10-15 08:53 959808 ----a-w- c:\program files\SFR\Kit\9props.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-08-19 10:59 173592 ----a-w- c:\windows\System32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 09:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWWANGSAssistant]
2007-02-26 09:07 3946040 ----a-w- c:\swsetup\HPQWWAN\HPWWanGSAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-08-25 08:57 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-08-19 10:59 141848 ----a-w- c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-09-11 02:40 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-10-18 13:27 455968 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 18:16 2331936 ----a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2009-04-07 23:39 2553088 ----a-w- c:\windows\System32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete]
2007-02-20 12:48 331552 ----a-w- c:\program files\PDF Complete\pdfsty.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-08-19 10:59 150552 ----a-w- c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
2007-01-09 13:52 145184 ----a-w- c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2007-02-21 15:14 1183744 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ST Recovery Launcher]
2007-03-09 14:24 44168 ----a-w- c:\windows\SMINST\Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-03-28 01:05 1045800 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2008-05-02 04:15 15872 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):41,86,29,06,17,21,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3303094250-2052613164-1373151634-1003]
"EnableNotificationsRef"=dword:00000008
R0 dlkmdldr;dlkmdldr;c:\windows\System32\drivers\dlkmdldr.sys [04/06/2009 13:08 13424]
R0 SafeBoot;SafeBoot;c:\windows\System32\drivers\SafeBoot.sys [14/08/2007 16:59 101167]
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [09/10/2006 12:31 44720]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/06/2007 15:22 13184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\System32\drivers\psd.sys [04/06/2009 00:31 38816]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/2008 16:29 33808]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [30/08/2009 15:10 721904]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/2008 16:28 20496]
S1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/08/2007 16:59 5840]
S2 DisplayLinkService;DisplayLink Service;c:\program files\DisplayLink Core Software\DisplayLinkService.exe [10/03/2009 06:47 447848]
S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\Common Files\BinarySense\disksvc.exe" --> c:\program files\Common Files\BinarySense\disksvc.exe [?]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [06/09/2007 12:26 221184]
S2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [04/07/2007 19:05 24880]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [04/07/2007 12:52 539936]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [01/09/2009 15:47 1153368]
S2 SWIHPWMI;SWIHPWMI;c:\program files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [04/12/2006 15:13 292384]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 12:31 92008]
S2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [25/07/2008 21:16 1464856]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [31/03/2009 19:41 498432]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\System32\drivers\btnetBus.sys [07/12/2008 11:44 30088]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [02/11/2009 23:18 193840]
S3 DAMDrv;DAMDrv;c:\windows\System32\drivers\DAMDrv.sys [08/06/2007 07:49 30008]
S3 dlkmd;dlkmd;c:\windows\System32\drivers\dlkmd.sys [04/06/2009 13:08 367728]
S3 FLCDLOCK;Verrouillage des périphériques / Audition HP ProtectTools;c:\windows\System32\flcdlock.exe [08/06/2007 08:06 172131]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/2008 17:02 26640]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\System32\drivers\WUSB54GCx86.sys [08/11/2008 14:10 256000]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [04/03/2009 09:49 4232704]
S3 rismc32;RICOH Smart Card Reader;c:\windows\System32\drivers\rismc32.sys [20/12/2006 02:08 47616]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\System32\drivers\smscirda.sys [25/04/2007 12:32 31232]
S3 WSDPrintDevice;Prise en charge de l’impression WSD via UMB;c:\windows\System32\drivers\WSDPrint.sys [01/08/2008 14:27 16896]
--- Autres Services/Pilotes en mémoire ---
*NewlyCreated* - ECACHE
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-10-18 13:25 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'
2010-02-06 c:\windows\Tasks\User_Feed_Synchronization-{B2C91C8A-1CE6-4532-B768-2552B02DCEB7}.job
- c:\windows\system32\msfeedssync.exe [2008-08-01 07:33]
.
.
------- Examen supplémentaire -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
FF - component: c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
.
- - - - ORPHELINS SUPPRIMES - - - -
HKLM-RunOnce-<NO NAME> - (no file)
MSConfigStartUp-HP Software Update - c:\program files\Hp\HP Software Update\HPWuSchd2.exe
MSConfigStartUp-Norton Ghost 14 - c:\program files\Norton Ghost\Agent\VProTray.exe
MSConfigStartUp-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
MSConfigStartUp-Service Scheduler2 Acronis - c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-TrueImageMonitor - c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
MSConfigStartUp-VirtualCloneDrive - c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-06 22:47
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.032"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.abr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ani"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bay"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bw"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cs1"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cur"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dcx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dib"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djv"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djvu"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.emf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.eps"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.erf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fff"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.hdr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icl"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icn"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ilbm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.int"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.inta"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.iw4"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2c"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2k"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jfif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jp2"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpk"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mef"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mos"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pct"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pgm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pic"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pict"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pix"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.psp"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspbrush"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspimage"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ras"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgba"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rle"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rsb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.sgi"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.thm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.wmf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xpm"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E…¸Î®X[^%¼pXýåÀHÄå T%Òk¼…Gûî|Ö—ŸrQøb¨njF×ÒÐ=Çó÷—!çÔÖByŽœraàÂ0<å…07ïÓË…æ=ÌïÓÛûë¨Ûhb½Å÷³¾itG0䣪n,/2ÀÿŸÛýG´·«h<é]&啉¼‚pPü¯ðDiÇõ‡HVCÂ$›p+´tQ›PÙ-䝿ÿ`ÏÙ†3¼Tø:-˜V‡Ç>Ámteüßá"‰¿i¢:THÄŸ©5ù
g÷£g›6že|]™CgêªgØ-5õÙ¦ –¡
…ü†w4mŒæ§Ê36ta×#*ÈAGL„È®D¨Êt G§ )sÀõî òRí.Yös‰c.“;ÞaÌ©5!6€:òUµ‚ÉjìÅsv+í1ØáœÇcÐØè¤”ŸX‘0ÄuاNíÇ€6ÑVL›ZÍ©n9/âú˜ëä:áCL<hEŒ“1 Á.»:’šM˜v+„fò_dMÙµ3–G©¨e~X…;!H£t¦’âÏ„õ)Œ+)ЏA[b„˜®wQ//AÑì„öG]uiáSÁz9æòÊ¿ßç\»jÞ*˜£ãžô=æ–XÉÿ«ï8á¢O?ûe@…2Ç~Oõ™ex›D['žühÐO‹ªr¤òõ6â³,-Å%I>“¾Š:Tö-ï)éä5íøÉéìÆÕpRŽ}Ÿdl͇¢¹ñ©çÎx%Š£¢H¤î®¢€5Ó2Ï]„!1¿Ø±0ÄvÑ~z(ŽGµ?‰R5…ß±¨Â?öý+ãVÍš®öã³)IƒhhP"ÓúaIBOQVéº'ò²aMž?kXˆo¿\2†îHÐéq–€ê½*“^røžwYòhÁ¦1ù®€¿}dÅðšñB= hŽ>„C™(Ú“”1ô½Ic¾D4þ>BÔ[6öâãü@foЫw.³n ñäÑ‚âˆRU
”oŒœÒz?ÉÉ#vFäÙwqb¼£¾lûbƒsv̤CÌ–ž«L ÿ_Ø/ÌìXg.,¶~r¢ó¾Z]ž¸³=`¤†´InBë¾HT’•:L®Tt^ÄyM·Ùâš=q=Q$å`6gè‹€I6úèŠ8kpD¸°t!è³ñ[¸Ê«ÚBD¾Æ9š¯‘Y{‹ê«‰ïTÃ[sÈ0OêÑEDJ/s0¸m`kvJm¢®z–¾µ:6
«Ôö÷ÈnºqÃzÊOvIȰ×&ÌJžg©4w2» {=
bonjour guillaume j ai reussi a lancer combofix en mode normal voici le dernier rapport merci
ComboFix 10-02-05.04 - pink 07/02/2010 21:01:48.2.2 - x86
Microsoft® Windows Vista™ Professionnel 6.0.6002.2.1252.33.1036.18.3062.1955 [GMT 1:00]
Lancé depuis: H:\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
----- BITS: Il y a peut-être des sites infectés -----
hxxp://armmf.adobe.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-07 au 2010-02-07 ))))))))))))))))))))))))))))))))))))
.
2010-02-07 20:08 . 2010-02-07 20:08 -------- d-----w- c:\users\pink\AppData\Local\temp
2010-02-07 20:08 . 2010-02-07 20:08 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-02-07 20:08 . 2010-02-07 20:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-06 19:09 . 2010-02-06 19:09 -------- d-----w- c:\program files\VS Revo Group
2010-02-05 22:55 . 2010-02-05 22:55 14004 ----a-w- C:\UsbFix_Upload_Me_PC-de-pink.zip
2010-02-04 19:45 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-04 19:45 . 2010-02-04 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 19:45 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-03 23:14 . 2010-02-05 22:55 -------- d-----w- C:\UsbFix
2010-02-03 20:00 . 2010-02-05 23:02 -------- d-----w- C:\rsit
2010-02-03 00:48 . 2010-02-03 00:48 -------- d-----w- c:\program files\Lavasoft
2010-02-03 00:29 . 2010-02-03 00:43 -------- d-----w- c:\program files\Trojan Remover
2010-01-26 16:36 . 2010-01-26 16:37 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-26 12:48 . 2010-02-05 23:02 -------- d-----w- c:\program files\Trend Micro
2010-01-12 21:09 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-12 21:09 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-07 19:58 . 2009-07-29 20:11 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-07 19:48 . 2006-11-02 15:47 687282 ----a-w- c:\windows\system32\perfh00C.dat
2010-02-07 19:48 . 2006-11-02 15:47 131396 ----a-w- c:\windows\system32\perfc00C.dat
2010-02-07 19:28 . 2009-07-29 20:11 5656 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-07 19:28 . 2009-07-29 20:11 5415456 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-07 19:28 . 2009-07-29 20:11 46532 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-07 19:28 . 2009-07-29 20:11 1032224 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-07 19:28 . 2006-11-09 19:30 1076 ----a-w- c:\windows\bthservsdp.dat
2010-02-07 18:50 . 2009-12-03 23:12 -------- d-----w- c:\program files\SpeedFan
2010-02-06 23:44 . 2008-07-29 16:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-05 12:36 . 2008-12-30 18:51 -------- d-----w- c:\programdata\Lavasoft
2010-02-05 02:24 . 2009-10-10 19:33 -------- d-----w- c:\program files\Full Tilt Poker
2010-02-04 21:42 . 2009-07-12 19:49 -------- d-----w- c:\users\pink\AppData\Roaming\vlc
2010-02-03 01:32 . 2009-05-03 17:14 -------- d-----w- c:\program files\P2P_Torrent
2010-01-27 12:24 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 17:11 . 2009-04-09 20:30 -------- d-----w- c:\programdata\NOS
2010-01-26 16:12 . 2008-09-29 21:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 02:34 . 2008-08-23 14:06 1356 ----a-w- c:\users\pink\AppData\Local\d3d9caps.dat
2010-01-19 22:36 . 2009-09-24 18:19 -------- d-----w- c:\users\pink\AppData\Roaming\BitTorrent
2010-01-14 10:12 . 2009-10-03 15:26 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 22:47 . 2007-07-04 12:17 -------- d-----w- c:\program files\Java
2009-12-19 16:23 . 2009-12-19 16:23 -------- d-----w- c:\program files\SPlayer
2009-12-17 21:32 . 2009-08-18 20:50 -------- d-----w- c:\users\pink\AppData\Roaming\Azureus
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\programdata\TomTom
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\users\pink\AppData\Roaming\TomTom
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom International B.V
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom HOME 2
2009-12-13 17:41 . 2009-12-13 17:41 -------- d-----w- c:\program files\TomTom DesktopSuite
2009-11-26 23:43 . 2009-11-26 23:43 872960 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-26 23:43 . 2009-11-26 23:43 340480 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 10:48 . 2009-11-26 23:43 43008 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 10:48 . 2009-11-26 23:43 346624 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-17 20:20 . 2009-11-17 20:03 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-03-08 18:52 . 2009-03-08 18:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-08-05 13:52 . 2008-08-05 13:52 23 --sha-w- c:\windows\System32\cdbe7_g.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2009-06-03 677144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-19 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-19 150552]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-09-26 316720]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-07-29 208616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 07:04 49152 ----a-r- c:\windows\System32\DeviceNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~2\adialhk.dll c:\progra~1\KASPER~1\KASPER~2\kloehk.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS\0autocheck autochk *
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ SbHpNp scecli
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 11:30 217544 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atchk]
2009-06-04 00:22 408088 ----a-w- c:\program files\Intel\AMT\atchk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connexion SFR 9props.exe]
2009-10-15 08:53 959808 ----a-w- c:\program files\SFR\Kit\9props.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-08-19 10:59 173592 ----a-w- c:\windows\System32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 09:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWWANGSAssistant]
2007-02-26 09:07 3946040 ----a-w- c:\swsetup\HPQWWAN\HPWWanGSAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-08-25 08:57 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-08-19 10:59 141848 ----a-w- c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-09-11 02:40 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-10-18 13:27 455968 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 18:16 2331936 ----a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2009-04-07 23:39 2553088 ----a-w- c:\windows\System32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete]
2007-02-20 12:48 331552 ----a-w- c:\program files\PDF Complete\pdfsty.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-08-19 10:59 150552 ----a-w- c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
2007-01-09 13:52 145184 ----a-w- c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2007-02-21 15:14 1183744 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ST Recovery Launcher]
2007-03-09 14:24 44168 ----a-w- c:\windows\SMINST\Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-03-28 01:05 1045800 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2008-05-02 04:15 15872 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):41,86,29,06,17,21,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3303094250-2052613164-1373151634-1003]
"EnableNotificationsRef"=dword:00000008
R0 dlkmdldr;dlkmdldr;c:\windows\System32\drivers\dlkmdldr.sys [04/06/2009 13:08 13424]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/2008 16:29 33808]
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [09/10/2006 12:31 44720]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/06/2007 15:22 13184]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/2008 16:28 20496]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\System32\drivers\psd.sys [04/06/2009 00:31 38816]
R1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/08/2007 16:59 5840]
R2 DisplayLinkService;DisplayLink Service;c:\program files\DisplayLink Core Software\DisplayLinkService.exe [10/03/2009 06:47 447848]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [06/09/2007 12:26 221184]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [04/07/2007 19:05 24880]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [04/07/2007 12:52 539936]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [01/09/2009 15:47 1153368]
R2 SWIHPWMI;SWIHPWMI;c:\program files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [04/12/2006 15:13 292384]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 12:31 92008]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [25/07/2008 21:16 1464856]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [31/03/2009 19:41 498432]
R3 dlkmd;dlkmd;c:\windows\System32\drivers\dlkmd.sys [04/06/2009 13:08 367728]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/2008 17:02 26640]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [04/03/2009 09:49 4232704]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [30/08/2009 15:10 721904]
S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\Common Files\BinarySense\disksvc.exe" --> c:\program files\Common Files\BinarySense\disksvc.exe [?]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\System32\drivers\btnetBus.sys [07/12/2008 11:44 30088]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [02/11/2009 23:18 193840]
S3 DAMDrv;DAMDrv;c:\windows\System32\drivers\DAMDrv.sys [08/06/2007 07:49 30008]
S3 FLCDLOCK;Verrouillage des périphériques / Audition HP ProtectTools;c:\windows\System32\flcdlock.exe [08/06/2007 08:06 172131]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\System32\drivers\WUSB54GCx86.sys [08/11/2008 14:10 256000]
S3 rismc32;RICOH Smart Card Reader;c:\windows\System32\drivers\rismc32.sys [20/12/2006 02:08 47616]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\System32\drivers\smscirda.sys [25/04/2007 12:32 31232]
S3 WSDPrintDevice;Prise en charge de l’impression WSD via UMB;c:\windows\System32\drivers\WSDPrint.sys [01/08/2008 14:27 16896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-10-18 13:25 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'
2010-02-07 c:\windows\Tasks\User_Feed_Synchronization-{B2C91C8A-1CE6-4532-B768-2552B02DCEB7}.job
- c:\windows\system32\msfeedssync.exe [2008-08-01 07:33]
.
.
------- Examen supplémentaire -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
FF - component: c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 21:08
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.032"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.abr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ani"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bay"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bw"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cs1"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cur"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dcx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dib"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djv"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djvu"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.emf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.eps"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.erf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fff"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.hdr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icl"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icn"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ilbm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.int"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.inta"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.iw4"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2c"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2k"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jfif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jp2"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpk"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mef"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mos"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pct"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pgm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pic"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pict"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pix"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.psp"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspbrush"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspimage"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ras"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgba"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rle"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rsb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.sgi"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.thm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.wmf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xpm"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0015\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0016\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0017\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(776)
c:\windows\SbHpNp.dll
.
Heure de fin: 2010-02-07 21:11:25
ComboFix-quarantined-files.txt 2010-02-07 20:11
Avant-CF: 34 990 415 872 octets libres
Après-CF: 34 940 571 648 octets libres
- - End Of File - - A67D99D79EEE6968F8C60E77EB9EAD3B
ComboFix 10-02-05.04 - pink 07/02/2010 21:01:48.2.2 - x86
Microsoft® Windows Vista™ Professionnel 6.0.6002.2.1252.33.1036.18.3062.1955 [GMT 1:00]
Lancé depuis: H:\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
----- BITS: Il y a peut-être des sites infectés -----
hxxp://armmf.adobe.com
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-07 au 2010-02-07 ))))))))))))))))))))))))))))))))))))
.
2010-02-07 20:08 . 2010-02-07 20:08 -------- d-----w- c:\users\pink\AppData\Local\temp
2010-02-07 20:08 . 2010-02-07 20:08 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-02-07 20:08 . 2010-02-07 20:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-06 19:09 . 2010-02-06 19:09 -------- d-----w- c:\program files\VS Revo Group
2010-02-05 22:55 . 2010-02-05 22:55 14004 ----a-w- C:\UsbFix_Upload_Me_PC-de-pink.zip
2010-02-04 19:45 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-04 19:45 . 2010-02-04 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 19:45 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-03 23:14 . 2010-02-05 22:55 -------- d-----w- C:\UsbFix
2010-02-03 20:00 . 2010-02-05 23:02 -------- d-----w- C:\rsit
2010-02-03 00:48 . 2010-02-03 00:48 -------- d-----w- c:\program files\Lavasoft
2010-02-03 00:29 . 2010-02-03 00:43 -------- d-----w- c:\program files\Trojan Remover
2010-01-26 16:36 . 2010-01-26 16:37 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-26 12:48 . 2010-02-05 23:02 -------- d-----w- c:\program files\Trend Micro
2010-01-12 21:09 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-12 21:09 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-07 19:58 . 2009-07-29 20:11 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-07 19:48 . 2006-11-02 15:47 687282 ----a-w- c:\windows\system32\perfh00C.dat
2010-02-07 19:48 . 2006-11-02 15:47 131396 ----a-w- c:\windows\system32\perfc00C.dat
2010-02-07 19:28 . 2009-07-29 20:11 5656 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-07 19:28 . 2009-07-29 20:11 5415456 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-07 19:28 . 2009-07-29 20:11 46532 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-07 19:28 . 2009-07-29 20:11 1032224 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-07 19:28 . 2006-11-09 19:30 1076 ----a-w- c:\windows\bthservsdp.dat
2010-02-07 18:50 . 2009-12-03 23:12 -------- d-----w- c:\program files\SpeedFan
2010-02-06 23:44 . 2008-07-29 16:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-05 12:36 . 2008-12-30 18:51 -------- d-----w- c:\programdata\Lavasoft
2010-02-05 02:24 . 2009-10-10 19:33 -------- d-----w- c:\program files\Full Tilt Poker
2010-02-04 21:42 . 2009-07-12 19:49 -------- d-----w- c:\users\pink\AppData\Roaming\vlc
2010-02-03 01:32 . 2009-05-03 17:14 -------- d-----w- c:\program files\P2P_Torrent
2010-01-27 12:24 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 17:11 . 2009-04-09 20:30 -------- d-----w- c:\programdata\NOS
2010-01-26 16:12 . 2008-09-29 21:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-24 02:34 . 2008-08-23 14:06 1356 ----a-w- c:\users\pink\AppData\Local\d3d9caps.dat
2010-01-19 22:36 . 2009-09-24 18:19 -------- d-----w- c:\users\pink\AppData\Roaming\BitTorrent
2010-01-14 10:12 . 2009-10-03 15:26 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 22:47 . 2007-07-04 12:17 -------- d-----w- c:\program files\Java
2009-12-19 16:23 . 2009-12-19 16:23 -------- d-----w- c:\program files\SPlayer
2009-12-17 21:32 . 2009-08-18 20:50 -------- d-----w- c:\users\pink\AppData\Roaming\Azureus
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\programdata\TomTom
2009-12-13 17:43 . 2009-12-13 17:43 -------- d-----w- c:\users\pink\AppData\Roaming\TomTom
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom International B.V
2009-12-13 17:42 . 2009-12-13 17:42 -------- d-----w- c:\program files\TomTom HOME 2
2009-12-13 17:41 . 2009-12-13 17:41 -------- d-----w- c:\program files\TomTom DesktopSuite
2009-11-26 23:43 . 2009-11-26 23:43 872960 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-26 23:43 . 2009-11-26 23:43 340480 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 10:48 . 2009-11-26 23:43 43008 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 10:48 . 2009-11-26 23:43 346624 ----a-w- c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-17 20:20 . 2009-11-17 20:03 131584 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-03-08 18:52 . 2009-03-08 18:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-08-05 13:52 . 2008-08-05 13:52 23 --sha-w- c:\windows\System32\cdbe7_g.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2009-06-03 677144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-19 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-19 150552]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-09-26 316720]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-07-29 208616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2007-06-08 07:04 49152 ----a-r- c:\windows\System32\DeviceNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~2\adialhk.dll c:\progra~1\KASPER~1\KASPER~2\kloehk.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ OODBS\0autocheck autochk *
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ SbHpNp scecli
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 00:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 11:30 217544 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atchk]
2009-06-04 00:22 408088 ----a-w- c:\program files\Intel\AMT\atchk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Connexion SFR 9props.exe]
2009-10-15 08:53 959808 ----a-w- c:\program files\SFR\Kit\9props.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-08-19 10:59 173592 ----a-w- c:\windows\System32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 09:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWWANGSAssistant]
2007-02-26 09:07 3946040 ----a-w- c:\swsetup\HPQWWAN\HPWWanGSAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-08-25 08:57 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-08-19 10:59 141848 ----a-w- c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
2006-09-11 02:40 218032 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-10-18 13:27 455968 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart]
2009-07-22 18:16 2331936 ----a-w- c:\program files\Nokia\Nokia Music\NokiaMusic.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2009-04-07 23:39 2553088 ----a-w- c:\windows\System32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete]
2007-02-20 12:48 331552 ----a-w- c:\program files\PDF Complete\pdfsty.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-08-19 10:59 150552 ----a-w- c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
2007-01-09 13:52 145184 ----a-w- c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-02-26 07:36 177456 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2007-02-21 15:14 1183744 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ST Recovery Launcher]
2007-03-09 14:24 44168 ----a-w- c:\windows\SMINST\Launcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-03-28 01:05 1045800 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2008-05-02 04:15 15872 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):41,86,29,06,17,21,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3303094250-2052613164-1373151634-1003]
"EnableNotificationsRef"=dword:00000008
R0 dlkmdldr;dlkmdldr;c:\windows\System32\drivers\dlkmdldr.sys [04/06/2009 13:08 13424]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/2008 16:29 33808]
R0 SbAlg;SbAlg;c:\windows\System32\drivers\SbAlg.sys [09/10/2006 12:31 44720]
R0 SbFsLock;SbFsLock;c:\windows\System32\drivers\SbFsLock.sys [14/06/2007 15:22 13184]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/2008 16:28 20496]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\System32\drivers\psd.sys [04/06/2009 00:31 38816]
R1 RsvLock;RsvLock;c:\windows\System32\drivers\rsvlock.sys [14/08/2007 16:59 5840]
R2 DisplayLinkService;DisplayLink Service;c:\program files\DisplayLink Core Software\DisplayLinkService.exe [10/03/2009 06:47 447848]
R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [06/09/2007 12:26 221184]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [04/07/2007 19:05 24880]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [04/07/2007 12:52 539936]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [01/09/2009 15:47 1153368]
R2 SWIHPWMI;SWIHPWMI;c:\program files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [04/12/2006 15:13 292384]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 12:31 92008]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [25/07/2008 21:16 1464856]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [31/03/2009 19:41 498432]
R3 dlkmd;dlkmd;c:\windows\System32\drivers\dlkmd.sys [04/06/2009 13:08 367728]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/2008 17:02 26640]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [04/03/2009 09:49 4232704]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [30/08/2009 15:10 721904]
S2 HDD & SSD access service;HDD & SSD access service;"c:\program files\Common Files\BinarySense\disksvc.exe" --> c:\program files\Common Files\BinarySense\disksvc.exe [?]
S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\System32\drivers\btnetBus.sys [07/12/2008 11:44 30088]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [02/11/2009 23:18 193840]
S3 DAMDrv;DAMDrv;c:\windows\System32\drivers\DAMDrv.sys [08/06/2007 07:49 30008]
S3 FLCDLOCK;Verrouillage des périphériques / Audition HP ProtectTools;c:\windows\System32\flcdlock.exe [08/06/2007 08:06 172131]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;c:\windows\System32\drivers\WUSB54GCx86.sys [08/11/2008 14:10 256000]
S3 rismc32;RICOH Smart Card Reader;c:\windows\System32\drivers\rismc32.sys [20/12/2006 02:08 47616]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\System32\drivers\smscirda.sys [25/04/2007 12:32 31232]
S3 WSDPrintDevice;Prise en charge de l’impression WSD via UMB;c:\windows\System32\drivers\WSDPrint.sys [01/08/2008 14:27 16896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-10-18 13:25 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'
2010-02-07 c:\windows\Tasks\User_Feed_Synchronization-{B2C91C8A-1CE6-4532-B768-2552B02DCEB7}.job
- c:\windows\system32\msfeedssync.exe [2008-08-01 07:33]
.
.
------- Examen supplémentaire -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?hl=fr&source=iglk
FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
FF - component: c:\users\pink\AppData\Roaming\Mozilla\Firefox\Profiles\8tfmwdno.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 21:08
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.032"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.abr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ani"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bay"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.bw"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cs1"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.cur"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dcx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.dib"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djv"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.djvu"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.emf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.eps"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.erf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fff"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.fpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.hdr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icl"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.icn"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ilbm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.int"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.inta"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.iw4"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2c"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.j2k"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jfif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jp2"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpk"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.jpx"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mef"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.mos"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pbr"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pct"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pgm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pic"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pict"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pix"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.psp"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspbrush"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.pspimage"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ras"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rgba"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rle"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.rsb"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.sgi"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.thm"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3303094250-2052613164-1373151634-1003)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttc"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.ttf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.wmf"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xif"
[HKEY_USERS\S-1-5-21-3303094250-2052613164-1373151634-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Gestionnaire de photos 2009.xpm"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0015\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0016\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0017\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'lsass.exe'(776)
c:\windows\SbHpNp.dll
.
Heure de fin: 2010-02-07 21:11:25
ComboFix-quarantined-files.txt 2010-02-07 20:11
Avant-CF: 34 990 415 872 octets libres
Après-CF: 34 940 571 648 octets libres
- - End Of File - - A67D99D79EEE6968F8C60E77EB9EAD3B
Bonjour
De retour après une semaine de vacances au ski.
1)Envoie ce fichier comme demandé;merci
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-pink.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
2)As tu retrouver ton bureau?
Comment se comporte ton PC?
@+
De retour après une semaine de vacances au ski.
1)Envoie ce fichier comme demandé;merci
Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-pink.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
2)As tu retrouver ton bureau?
Comment se comporte ton PC?
@+
4 févr. 2010 à 00:30
############################## | UsbFix V6.087 |
User : pink () # PC-DE-PINK
Update on 04/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 00:17:26 | 04/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Core(TM)2 Duo CPU T7300 @ 2.00GHz
Microsoft® Windows Vista™ Professionnel (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 7.0.6002.18005
Windows Firewall Status : Enabled
C:\ -> Disque fixe local # 72,97 Go (31,55 Go free) # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque fixe local # 1,55 Go (1,02 Go free) [OS_TOOLS] # NTFS
F:\ -> Disque CD-ROM
H:\ -> Disque amovible # 1,89 Go (1,77 Go free) [USB2GO ALI] # FAT
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWWSC.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\wbem\wmiprvse.exe
################## | Elements infectieux |
H:\log.txt
################## | Registre |
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
################## | Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\F
shell\AutoRun\command =F:\wd_windows_tools\setup.exe
HKCU\..\..\Explorer\MountPoints2\H
shell\AutoRun\command =H:\start.exe
HKCU\..\..\Explorer\MountPoints2\{0cb30e92-6091-11dd-b821-001e37a04fa4}
shell\AutoRun\command =G:\LaunchU3.exe -a
HKCU\..\..\Explorer\MountPoints2\{210277f0-ee32-11dd-80a0-001e37a04fa4}
shell\AutoRun\command =G:\start.exe
HKCU\..\..\Explorer\MountPoints2\{2697f3ff-c144-11dd-934f-001e37a04fa4}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
HKCU\..\..\Explorer\MountPoints2\{2697f422-c144-11dd-934f-001e37a04fa4}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
HKCU\..\..\Explorer\MountPoints2\{2fdf3866-e3f7-11dd-8db5-001e37a04fa4}
shell\AutoRun\command =G:\ntdetec1.exe
shell\explore\Command =G:\ntdetec1.exe
shell\open\Command =G:\ntdetec1.exe
HKCU\..\..\Explorer\MountPoints2\{2fdf386b-e3f7-11dd-8db5-001e37a04fa4}
shell\AutoRun\command =H:\start.exe
HKCU\..\..\Explorer\MountPoints2\{513a068b-10ba-11de-8870-001e37a04fa4}
shell\AutoRun\command =opgde.exe
shell\open\Command =opgde.exe
HKCU\..\..\Explorer\MountPoints2\{5fbb8279-8e46-11de-903a-001e37a04fa4}
shell\AutoRun\command =G:\InstallTomTomHOME.exe
HKCU\..\..\Explorer\MountPoints2\{8618075e-07fc-11de-97b1-001e37a04fa4}
shell\Auto\command =AdobeR.exe e
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{94ab9377-e80d-11de-a8b3-001e37a04fa4}
shell\AutoRun\command =H:\InstallTomTomHOME.exe
HKCU\..\..\Explorer\MountPoints2\{9af4edde-cc44-11dd-89e8-001e37a04fa4}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
HKCU\..\..\Explorer\MountPoints2\{ae83b0cd-9eac-11dd-b742-001e37a04fa4}
shell\AutoRun\command =setupSNK.exe
HKCU\..\..\Explorer\MountPoints2\{b263e572-6f84-11dd-938c-001e37a04fa4}
shell\Auto\command =AdobeR.exe e
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
HKCU\..\..\Explorer\MountPoints2\{bda8346e-0e38-11de-a55f-001e37a04fa4}
shell\1\Comµ(*h'žTÆÄl™¹ÂÐæ.£$°b&æüÇpçåD~J•”LWšØÍ@šÇ/ż,°Ã™‹k噞ÜjvÜûàÎX–ŸŽÀbɛܱdza`r&¨x€ÔE,62¼v`”!#¾€y‰§>|øÆ(¼Ê5TÑšQ””É{8áVG|ÿHVóiÇ¡ÀŽð/ØWéEÔ*6Äù«I¾U.°@\¶¤Q~š*Ü+¤ý‰ý“ÿ"QGû øºM.¯ü‚_ð1äïb¹:š îªh†††±ê#²¢DÊ2PTÐ!ærDY§Ì¸Ü+ äÜë=7Uðg<:.7nÁÓg³úÄâ:BåbKÐùxü¥óSôn±ûÒd+ñèñWÛ69‹FïhÉž"=V#Ã"'K•°‡À¬çø~ëB¥õóˆiƒ"kÔÄš¯g®
Âyœ¦º–Æ›Ž‘
`¯|nRG?× ™ ¥'ºÓm.ñ:G&Ì!8Á£Æ ¢AxàÁáJãbô?Ê5êÊ
2žô×ãžVjÌD:_௓.ëO°‚k i5Eµ³åΩtžGÒ„?ƒNÇH ±k³·CÊ_õ˜!ÜøS·§{ãל«ó‚¹¾fòzÖ^:æ8¼¢t{aõi,"á&Í¿°>ä—ÅßHÊ·7“AÈäÒ¸£q7úÃû>'¡FÀÀ´8MÅU³½
²r!ÌŒdfqH)–šÑšIÒ˜ÃB¹Âá91cPZHÔ”kò_§¢-¯«®í&=Áw•¡x\RͨyÞIa|™‰¶Ð9^›dËžÒ_"Œ½¨™Øç£t7¡;¡š¼µ*^lòw
¼~Æí`Séå®<ÔzPÄÛ¦Gé&/ÜW¬èó–äì*´ÜŸ+;º
Jk'ýn0E¶†¢*X)Ô
4 févr. 2010 à 18:29
1) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir
# Clic droit"exécuter en temps qu'administrateur" sur le raccourci UsbFix présent sur ton bureau
# choisi l option 2 (Suppression)
# Ton bureau disparaîtra et le pc redémarrera.
# Au redémarrage, UsbFix scannera ton pc, laisse travailler l outil.
# Ensuite post le rapport UsbFix.txt qui apparaîtra avec le bureau.
# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:UsbFix.txt )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )
2)=> Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac
* Va dans démarrer puis panneau de configuration
* Double Clique sur l'icône "Comptes d'utilisateurs"
* Clique ensuite sur désactiver et valide.
3)Télécharge Malwarebytes anti malware ici
http://www.malwarebytes.org/mbam.php
* Installe le (choisis bien "français" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/
* Potasse le tuto pour te familiariser avec le prg :
https://forum.pcastuces.com/sujet.asp?f=31&s=3
(cela dis, il est très simple d’utilisation).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
* Lance Malwarebyte's .
Fais un examen dit "Complet" .
--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
--> à la fin tu cliques sur "résultat" .
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
Poste les rapports au fur et à mesure ;merci
@+