Explorer.exe bloque le démarrage

stradic4000 -  
Bonjour,

explorer.exe bloque le démarrage de certains programmes.
En terminant le processus tout rentre dans l'ordre.

Voici mon rapport
Logfile of random's system information tool 1.06 (written by random/random)
Run by marc at 2010-02-10 23:35:38
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 159 GB (66%) free of 238 GB
Total RAM: 2940 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:35:55, on 10/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SafeNet\SoftRemoteLT\IPSecMon.exe
C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\SafeNet\SoftRemoteLT\SafeCfg.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\oracle\ora92\bin\omtsreco.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\marc\Mes documents\Downloads\RSIT.exe
C:\Program Files\trend micro\marc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SoftRemoteLT.lnk = C:\Program Files\SafeNet\SoftRemoteLT\SafeCfg.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\SafeNet\SoftRemoteLT\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 7156 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-13 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-13 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-08-28 1024000]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-03-13 1443072]
"ACU"=C:\Program Files\Atheros\ACU.exe [2008-04-14 450648]
"Camera Assistant Software"=C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [2008-04-29 417792]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-04-07 16860672]
"topi"=C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [2007-07-10 581632]
"DDWMon"=C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe [2007-04-26 495616]
"SmoothView"=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe [2007-05-11 143360]
"TPSMain"=C:\WINDOWS\system32\TPSMain.exe [2008-07-30 266240]
"THotkey"=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [2008-05-27 360448]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-07-03 141848]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-07-03 170520]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-07-03 150040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
SoftRemoteLT.lnk - C:\Program Files\SafeNet\SoftRemoteLT\SafeCfg.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-05-21 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2009-09-28 87352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 240128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe"="C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe:*:Enabled:IreIke"
"C:\Program Files\SafeNet\SoftRemoteLT\ViewLog.exe"="C:\Program Files\SafeNet\SoftRemoteLT\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog"
"C:\Program Files\SafeNet\SoftRemoteLT\CmonApp.exe"="C:\Program Files\SafeNet\SoftRemoteLT\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp"
"C:\Program Files\SafeNet\SoftRemoteLT\vpn.exe"="C:\Program Files\SafeNet\SoftRemoteLT\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe"="C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe:*:Enabled:IreIke"
"C:\Program Files\SafeNet\SoftRemoteLT\ViewLog.exe"="C:\Program Files\SafeNet\SoftRemoteLT\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog"
"C:\Program Files\SafeNet\SoftRemoteLT\CmonApp.exe"="C:\Program Files\SafeNet\SoftRemoteLT\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp"
"C:\Program Files\SafeNet\SoftRemoteLT\vpn.exe"="C:\Program Files\SafeNet\SoftRemoteLT\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{109a7af9-10f2-11df-be99-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{109a7afa-10f2-11df-be99-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{129488e4-f3ab-11de-be69-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{129488e5-f3ab-11de-be69-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2845b1df-111f-11df-be9b-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3429f7e1-1191-11df-be9c-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3429f7e2-1191-11df-be9c-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3429f7e3-1191-11df-be9c-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{807f4cac-f0d6-11de-be64-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{807f4cad-f0d6-11de-be64-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3063688-111c-11df-be9a-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3063689-111c-11df-be9a-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c306368a-111c-11df-be9a-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c306368c-111c-11df-be9a-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c306368d-111c-11df-be9a-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c306368f-111c-11df-be9a-0026b6154054}]
shell\AutoRun\command - F:\VMC_PBStarter.exe

======List of files/folders created in the last 1 months======

2010-02-10 23:35:39 ----D---- C:\Program Files\trend micro
2010-02-10 23:35:38 ----D---- C:\rsit
2010-02-10 23:20:14 ----D---- C:\WINDOWS\pss
2010-02-04 19:12:34 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
2010-02-04 19:12:31 ----D---- C:\Program Files\Vodafone
2010-02-04 00:38:59 ----A---- C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt
2010-02-04 00:36:46 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #2.txt
2010-02-02 18:36:58 ----A---- C:\WINDOWS\system32\SynTPCo4.dll
2010-02-02 18:36:58 ----A---- C:\WINDOWS\system32\SynTPAPI.dll
2010-02-02 18:36:58 ----A---- C:\WINDOWS\system32\SynCtrl.dll
2010-02-02 18:36:58 ----A---- C:\WINDOWS\system32\SynCOM.dll
2010-02-02 18:36:57 ----D---- C:\Program Files\Synaptics
2010-02-01 12:42:29 ----D---- C:\Program Files\uTorrent
2010-02-01 12:41:20 ----D---- C:\Documents and Settings\marc\Application Data\uTorrent
2010-01-30 22:53:08 ----D---- C:\Program Files\ElcomSoft
2010-01-27 14:54:46 ----D---- C:\Documents and Settings\marc\Application Data\XnView

======List of files/folders modified in the last 1 months======

2010-02-10 23:35:46 ----D---- C:\WINDOWS\Prefetch
2010-02-10 23:35:43 ----D---- C:\WINDOWS\Temp
2010-02-10 23:35:39 ----RD---- C:\Program Files
2010-02-10 23:21:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-10 23:21:16 ----ASH---- C:\boot.ini
2010-02-10 23:21:16 ----A---- C:\WINDOWS\win.ini
2010-02-10 23:21:16 ----A---- C:\WINDOWS\system.ini
2010-02-10 23:20:14 ----D---- C:\WINDOWS
2010-02-08 17:33:02 ----D---- C:\Documents and Settings\marc\Application Data\SQL Developer
2010-02-07 17:05:45 ----D---- C:\Documents and Settings\marc\Application Data\vlc
2010-02-06 13:11:46 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-04 20:15:51 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt
2010-02-04 19:12:57 ----A---- C:\WINDOWS\E220AutoRunLog.tmp
2010-02-04 19:12:53 ----SHD---- C:\WINDOWS\Installer
2010-02-04 19:12:34 ----D---- C:\Program Files\Fichiers communs
2010-02-04 14:23:47 ----D---- C:\Program Files\eMule
2010-02-04 00:53:15 ----SD---- C:\WINDOWS\Tasks
2010-02-04 00:07:13 ----AD---- C:\WINDOWS\system32
2010-02-04 00:07:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-04 00:07:01 ----A---- C:\WINDOWS\imsins.BAK
2010-02-02 23:36:06 ----D---- C:\WINDOWS\security
2010-02-02 23:36:03 ----HD---- C:\WINDOWS\inf
2010-02-02 18:37:06 ----D---- C:\WINDOWS\system32\drivers
2010-02-01 15:41:24 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-01 15:19:53 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-02-01 15:16:35 ----D---- C:\Program Files\BitComet
2010-02-01 11:55:50 ----D---- C:\Downloads
2010-01-28 12:10:13 ----D---- C:\Documents and Settings\marc\Application Data\Adobe
2010-01-28 12:10:13 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-01-27 14:47:21 ----D---- C:\Program Files\Mozilla Firefox
2010-01-27 14:05:37 ----SD---- C:\Documents and Settings\marc\Application Data\Microsoft
2010-01-21 17:16:18 ----D---- C:\Program Files\Fichiers communs\Adobe
2010-01-21 17:14:11 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-21 17:14:11 ----D---- C:\Program Files\Adobe
2010-01-21 11:10:23 ----D---- C:\generix

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-03-13 29704]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2008-03-13 54280]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 IPSECDRV;SafeNet IPSec Plugin; \??\C:\WINDOWS\system32\Drivers\IPSECDRV.sys []
R2 Crypto;Crypto; C:\WINDOWS\system32\drivers\Crypto.sys [2004-11-10 521786]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-03-13 40456]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2008-03-13 71176]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
R2 tdudf;TOSHIBA UDF File System Driver; C:\WINDOWS\system32\DRIVERS\tdudf.sys [2007-03-26 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver; C:\WINDOWS\system32\DRIVERS\trudf.sys [2007-02-19 134016]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-11-28 1161888]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2008-04-08 1309504]
R3 CmBatt;Pilote d'adaptateur secteur Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2003-09-05 139604]
R3 DniVap;SafeNet WAN Miniport (VA); C:\WINDOWS\system32\DRIVERS\vap.sys [2001-12-14 36188]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2008-03-13 30728]
R3 FwLnk;FwLnk Driver; C:\WINDOWS\system32\DRIVERS\FwLnk.sys [2007-04-04 5888]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-05-21 6018464]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-09 4703744]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2008-08-11 10144]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-08-28 220032]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2006-10-18 16128]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 usbvideo;Chicony USB 2.0 Camera; C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
R3 UVCFTR;UVCFTR; C:\WINDOWS\System32\Drivers\UVCFTR_S.SYS [2007-12-17 18432]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2008-02-08 57408]
S3 aaaci4ue;aaaci4ue; C:\WINDOWS\system32\drivers\aaaci4ue.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2007-04-16 100736]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service; C:\WINDOWS\system32\drivers\IntcHdmi.sys [2008-06-13 110080]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RTS5121.sys [2008-05-22 154624]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp.sys [2009-12-17 99152]
S3 VBoxNetFlt;VBoxNetFlt Service; C:\WINDOWS\system32\DRIVERS\VBoxNetFlt.sys [2009-12-17 110096]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-10 18944]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACS;Service de configuration Atheros; C:\WINDOWS\system32\acs.exe [2008-04-14 467028]
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\WINDOWS\system32\agrsmsvc.exe [2006-10-05 9216]
R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-17 40960]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2008-03-13 472320]
R2 IPSECMON;SafeNet Monitor Service; C:\Program Files\SafeNet\SoftRemoteLT\IPSecMon.exe [2005-02-24 65590]
R2 IreIKE;SafeNet IKE Service; C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe [2005-02-24 360498]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-13 153376]
R2 OracleMTSRecoveryService;OracleMTSRecoveryService; C:\oracle\ora92\bin\omtsreco.exe [2002-04-30 57603]
R2 TAPPSRV;TOSHIBA Application Service; C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2008-04-14 34304]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\WINDOWS\system32\TODDSrv.exe [2007-11-21 129632]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\WINDOWS\system32\regedt32.exe [2008-04-14 3584]
S2 SSHNAS;SSHNAS; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-03-13 19200]
S3 OracleOraHome92ClientCache;OracleOraHome92ClientCache; C:\oracle\ora92\BIN\ONRSD.EXE [2002-04-26 242328]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2009-09-28 116032]
S4 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2008-08-11 63040]

-----------------EOF-----------------
Configuration: Windows xp
chrome

17 réponses

  1. nooty
    la meilleure solution: jeter son pc et le remplacer par un mac...
    c'est ce que j'ai fait en 1995, et tout va bien: c'est simple, et çà fonctionne toujours...
    0
    1. stradic4000
      Merci nooty,

      Je bosse aussi sur mac, mais à titre personnel (pour la musique...).
      Dans la boite où je bosse, c'est PC only!!!
      Cordialement,
      stradic
      0
      1. Lyonnais92 Contributeur sécurité
        Bonsoir,

        quelque chose dépend de l'Explorateur Windows qui bloque.

        Pour essayer de trouver (le rapport RSIT ne montre rien sinon qu'il faudra mettre à jour Internet Explorer), fais ceci :

        Ouvre ce lien et télécharge ProcessExplorer.zip de Sysinternals sur ton Bureau :

        https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer?redirectedfrom=MSDN

        Dézippe le et lance le.

        Configure Configure Symbols comme il est dit ici :

        https://forum.sysinternals.com/?TID=10741#47621

        Dans View, Select columns, Process performance, coche la case :

        Context Switch Delta

        Ferme (comme dans l'explorateur Windows) tout ce qui n'est pas explorer.exe.

        Tu dois voir des + en face de ce qui est fermé et - devant explorer.exe;

        Clique sur View,

        coche Show lower pane si tu ne vois pas de V devant

        positionne la souris sur Lower pane view et coche dll (un v doit être devant).

        Clique maintenant sur File puis Save as

        Choisis où tu le sauvegardes (plutôt le Bureau) et le nom. Vérifie que l'extension est txt

        Ouvre le Bloc-Notes et ouvre le fichier que tu viens de sauvegarder.

        Poste le dans ta réponse.
        0
        1. stradic4000
          Bonjour Lyonnais,

          Merci pour ta réponse et pour ton aide.
          Mettre à jour internet explorer, je ne peux pas, l'ERP de ma boite ne tourne que sur IE6 (et oui, ça existe!!).
          Voici le rapport de process explorer et encore merci pour ton aide.

          Cordialement,
          stradic

          Process PID CPU Description Company Name CSwitch Delta
          System Idle Process 0 97.79 2 184
          explorer.exe 752 Explorateur Windows Microsoft Corporation 22
          SynTPEnh.exe 1084 Synaptics TouchPad Enhancements Synaptics, Inc. 311
          egui.exe 1168 Eset GUI ESET 6
          ACU.exe 1212 Atheros Client Utility Atheros Communications, Inc.
          RTHDCPL.exe 644 Realtek HD Audio Control Panel Realtek Semiconductor Corp. 6
          DDWMon.exe 1384 TOSHIBA Direct Disc Writer - Event Monitor TOSHIBA Corporation
          SmoothView.exe 1672 SmoothView TOSHIBA Corporation
          TPSMain.exe 1724 TOSHIBA Corporation 82
          TPSBattM.exe 636 TOSHIBA Corporation
          THotkey.exe 1536 Hotkey Utility TOSHIBA 12
          igfxpers.exe 1656 persistence Module Intel Corporation
          hkcmd.exe 1696 hkcmd Module Intel Corporation
          igfxtray.exe 632 igfxTray Module Intel Corporation
          TOSCDSPD.exe 1628 CD/DVD Drive Acoustic Silencer TOSHIBA
          ctfmon.exe 1580 CTF Loader Microsoft Corporation
          SafeCfg.exe 1044 Secure VPN Client SafeNet 2
          procexp.exe 1388 1.47 Sysinternals Process Explorer Sysinternals - www.sysinternals.com 1 265

          Process: explorer.exe Pid: 752

          Type Name
          Directory \BaseNamedObjects
          Mutant \BaseNamedObjects\_!MSFTHISTORY!_
          Mutant \BaseNamedObjects\_!SHMSFTHISTORY!_
          Mutant \BaseNamedObjects\_SHuassist.mtx
          Section \BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_2f0
          Section \BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_2f0
          Mutant \BaseNamedObjects\c:!documents and settings!marc!cookies!
          Mutant \BaseNamedObjects\c:!documents and settings!marc!local settings!historique!history.ie5!
          Mutant \BaseNamedObjects\c:!documents and settings!marc!local settings!temporary internet files!content.ie5!
          Section \BaseNamedObjects\C:_Documents and Settings_marc_Cookies_index.dat_98304
          Section \BaseNamedObjects\C:_Documents and Settings_marc_Local Settings_Historique_History.IE5_index.dat_1277952
          Section \BaseNamedObjects\C:_Documents and Settings_marc_Local Settings_Temporary Internet Files_Content.IE5_index.dat_7700480
          Section \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Event \BaseNamedObjects\crypt32LogoffEvent
          Mutant \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Mutant \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Mutant \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Mutant \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Mutant \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-3584117069-3394617115-4274750504-1005MUTEX.DefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Section \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-3584117069-3394617115-4274750504-1005SFM.DefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Mutant \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-3584117069-3394617115-4274750504-1005
          Mutant \BaseNamedObjects\ExplorerIsShellMutex
          Event \BaseNamedObjects\hardwaremixercallback
          Event \BaseNamedObjects\HPlugEjectEvent
          Section \BaseNamedObjects\MAPI-HP!801061F98B1CE916
          Section \BaseNamedObjects\MAPI-HP!801062188B1CE916
          Section \BaseNamedObjects\MAPI-HP!801062C48B1CE916
          Section \BaseNamedObjects\MAPI-HP!801062C58B1CE916
          Mutant \BaseNamedObjects\MAPI-HP*801061F98B1CE916
          Mutant \BaseNamedObjects\MAPI-HP*801062188B1CE916
          Mutant \BaseNamedObjects\MAPI-HP*801062C48B1CE916
          Mutant \BaseNamedObjects\MAPI-HP*801062C58B1CE916
          Mutant \BaseNamedObjects\MAPI-HP+801061F98B1CE916
          Mutant \BaseNamedObjects\MAPI-HP+801062188B1CE916
          Mutant \BaseNamedObjects\MAPI-HP+801062C48B1CE916
          Mutant \BaseNamedObjects\MAPI-HP+801062C58B1CE916
          Mutant \BaseNamedObjects\MidiMapper_Configure
          Mutant \BaseNamedObjects\MidiMapper_modLongMessage_RefCnt
          Event \BaseNamedObjects\mixercallback
          Section \BaseNamedObjects\mmGlobalPnpInfo
          Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.ICG
          Mutant \BaseNamedObjects\MSCTF.Shared.MUTEX.ICG
          Section \BaseNamedObjects\MSCTF.Shared.SFM.ICG
          Section \BaseNamedObjects\MSCTF.Shared.SFM.ICG
          Semaphore \BaseNamedObjects\PowerProfileRegistrySemaphore
          Semaphore \BaseNamedObjects\shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
          Semaphore \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
          Semaphore \BaseNamedObjects\shell.{6D5313C0-8C62-11D1-B2CD-006097DF8C11}
          Semaphore \BaseNamedObjects\shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
          Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
          Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
          Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
          Semaphore \BaseNamedObjects\shell.BitBucket.c.DirtyCount
          Semaphore \BaseNamedObjects\shell.BitBucket.c.NextFileNum
          Semaphore \BaseNamedObjects\shell.BitBucket.GlobalDirtyCount
          Semaphore \BaseNamedObjects\shell.BitBucket.NumDeleters
          Event \BaseNamedObjects\ShellReadyEvent
          Mutant \BaseNamedObjects\ShimCacheMutex
          Mutant \BaseNamedObjects\SHIMLIB_LOG_MUTEX
          Section \BaseNamedObjects\ShimSharedMemory
          Section \BaseNamedObjects\UrlZonesSM_marc
          Event \BaseNamedObjects\userenv: User Profile setup event
          Section \BaseNamedObjects\WDMAUD_Callbacks
          Mutant \BaseNamedObjects\WininetConnectionMutex
          Mutant \BaseNamedObjects\WininetProxyRegistryMutex
          Mutant \BaseNamedObjects\WininetStartupMutex
          Mutant \BaseNamedObjects\ZonesCacheCounterMutex
          Mutant \BaseNamedObjects\ZonesCounterMutex
          Mutant \BaseNamedObjects\ZonesLockedCacheCounterMutex
          Desktop \Default
          File \Device\Ip
          File \Device\Ip
          File \Device\Ip
          File \Device\KsecDD
          File \Device\KSENUM#00000001
          File \Device\Tcp
          File \Device\Tcp
          File \Device\Tcp
          File \Device\WMIDataDevice
          File \Device\WMIDataDevice
          File \Dfs
          KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent
          Directory \KnownDlls
          Port \RPC Control\OLE3223DBE025E14BCD953A74D4B161
          Directory \Windows
          WindowStation \Windows\WindowStations\WinSta0
          WindowStation \Windows\WindowStations\WinSta0
          Token AUTORITE NT\SERVICE RÉSEAU:3e4
          Token AUTORITE NT\SYSTEM:3e7
          File C:\Documents and Settings\All Users\Bureau
          File C:\Documents and Settings\All Users\Menu Démarrer
          File C:\Documents and Settings\marc
          File C:\Documents and Settings\marc\Application Data\Microsoft\Internet Explorer\Quick Launch
          File C:\Documents and Settings\marc\Bureau
          File C:\Documents and Settings\marc\Cookies\index.dat
          File C:\Documents and Settings\marc\Local Settings\Application Data\Microsoft\CD Burning
          File C:\Documents and Settings\marc\Local Settings\Historique\History.IE5\index.dat
          File C:\Documents and Settings\marc\Local Settings\Temporary Internet Files\Content.IE5\index.dat
          File C:\Documents and Settings\marc\Menu Démarrer
          File C:\Documents and Settings\marc\Voisinage d'impression
          File C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
          File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c
          Process explorer.exe(752)
          Thread explorer.exe(752): 1020
          Thread explorer.exe(752): 1028
          Thread explorer.exe(752): 1076
          Thread explorer.exe(752): 1076
          Thread explorer.exe(752): 1124
          Thread explorer.exe(752): 1284
          Thread explorer.exe(752): 1700
          Thread explorer.exe(752): 3288
          Thread explorer.exe(752): 3708
          Thread explorer.exe(752): 760
          Thread explorer.exe(752): 996
          Key HKCR
          Key HKCR
          Key HKCR
          Key HKCR\Applications\vlc.exe
          Key HKCR\CLSID
          Key HKCR\CLSID
          Key HKCU
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes
          Key HKCU\Software\Classes\CLSID
          Key HKCU\Software\Classes\http\shell
          Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Global
          Key HKCU\Software\Microsoft\Internet Explorer\Security\P3Sites
          Key HKCU\Software\Microsoft\Plus!\Themes\Apply
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\c
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
          Key HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
          Key HKCU\Software\Microsoft\Windows\Shell
          Key HKCU\Software\Microsoft\Windows\ShellNoRoam
          Key HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\18\Shell
          Key HKCU\Software\Microsoft\Windows\ShellNoRoam\Bags\18\Shell
          Key HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
          Key HKLM
          Key HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v2.0.50727.00000
          Key HKLM\SOFTWARE\Microsoft\COM3
          Key HKLM\SOFTWARE\Microsoft\COM3
          Key HKLM\SOFTWARE\Microsoft\COM3
          Key HKLM\SOFTWARE\Microsoft\COM3
          Key HKLM\SOFTWARE\Microsoft\COM3
          Key HKLM\SOFTWARE\Microsoft\COM3
          Key HKLM\SOFTWARE\Microsoft\Multimedia\Audio\VolumeControl
          Key HKLM\SOFTWARE\Microsoft\Tracing\NETSHELL
          Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
          Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\World Full Access Shared Parameters
          Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
          Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
          Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\c
          Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
          Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
          Key HKLM\SOFTWARE\Microsoft\Windows\Shell
          Key HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder
          Key HKLM\SYSTEM\ControlSet001\Control\Nls\Language Groups
          Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale
          Key HKLM\SYSTEM\ControlSet001\Control\Nls\Locale\Alternate Sorts
          Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters
          Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
          Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
          Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
          Key HKLM\SYSTEM\Setup
          Key HKU
          Key HKU
          Key HKU
          Key HKU
          0
          2. Lyonnais92 Contributeur sécurité
            Bonjour,

            j'ai vu trop tard que c'était un ordi pro. Sinon j'aurai formulé autrement ma remarque sur IE (je sais que des applis ne tournent que sur un navigateur mono-onglet.

            ===

            Dans Lowe Pane view, tu as coché Handle. C'est Dll que je veux regarder.

            J'ai aussi oublié un réglage.

            Clique sur View puis Select Columns.

            Dans L'onglet process image, coche Image path.

            Dans l'onglet Dll, coche Description, Version, Name, Path et Company name

            ===

            Ton problème est récent ?

            Il est spécifique à ton poste de travail ou général à tous les ordis ?

            Tu as souvenir d'avoir fait quelque chose juste avant l'apparition du problème ?

            Tu peux me donner 2 ou 3 programmes qui ne fonctionnent pas (le rapport va m'en donner qui fonctionnent).
            0
            1. stradic4000
              Merci Lyonnais pour ton implication!!!!

              Des souvenirs... J'ai eu deux attaques stoppées par mon anti-virus :
              - kryptic.CCO / kryptic .CCR / kryptic .CCN
              - Bagle.gen.zip ver

              Des programmes qui n'apparaissent pas dans ma barre de menus :
              - mon client vpn (soft remote de SAFENET)
              - la gestion du son windows!!
              - toutes les applis Toshiba

              En gros j'ai l'horloge, les connections réseau et l'antivirus...

              Voici le rapport process explorer, et encore un grand merci :
              Process PID CPU Description Company Name CSwitch Delta Path
              System Idle Process 0 99.23 1 064
              explorer.exe 752 Explorateur Windows Microsoft Corporation 26 C:\WINDOWS\explorer.exe
              SynTPEnh.exe 1084 Synaptics TouchPad Enhancements Synaptics, Inc. 1 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
              egui.exe 1168 Eset GUI ESET 19 C:\Program Files\ESET\ESET Smart Security\egui.exe
              ACU.exe 1212 Atheros Client Utility Atheros Communications, Inc. 4 C:\Program Files\Atheros\ACU.exe
              RTHDCPL.exe 644 Realtek HD Audio Control Panel Realtek Semiconductor Corp. 14 C:\WINDOWS\RTHDCPL.exe
              DDWMon.exe 1384 TOSHIBA Direct Disc Writer - Event Monitor TOSHIBA Corporation C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe
              SmoothView.exe 1672 SmoothView TOSHIBA Corporation C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
              TPSMain.exe 1724 TOSHIBA Corporation 19 C:\WINDOWS\system32\TPSMain.exe
              TPSBattM.exe 636 TOSHIBA Corporation C:\WINDOWS\system32\TPSBattM.exe
              THotkey.exe 1536 Hotkey Utility TOSHIBA 11 C:\Program Files\TOSHIBA\Toshiba Applet\THotkey.exe
              igfxpers.exe 1656 persistence Module Intel Corporation C:\WINDOWS\system32\igfxpers.exe
              hkcmd.exe 1696 hkcmd Module Intel Corporation C:\WINDOWS\system32\hkcmd.exe
              igfxtray.exe 632 igfxTray Module Intel Corporation C:\WINDOWS\system32\igfxtray.exe
              TOSCDSPD.exe 1628 CD/DVD Drive Acoustic Silencer TOSHIBA C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
              ctfmon.exe 1580 CTF Loader Microsoft Corporation C:\WINDOWS\system32\ctfmon.exe
              SafeCfg.exe 1044 Secure VPN Client SafeNet 15 C:\Program Files\SafeNet\SoftRemoteLT\SafeCfg.exe
              chrome.exe 3072 Google Chrome Google Inc. 21 C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
              chrome.exe 3340 Google Chrome Google Inc. 28 C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
              procexp.exe 2352 Sysinternals Process Explorer Sysinternals - www.sysinternals.com 253 C:\Documents and Settings\marc\Local Settings\Temp\ARC64E\procexp.exe

              Process: chrome.exe Pid: 3340

              Name Description Company Name Version Path
              ADVAPI32.dll API avancées Windows 32 Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\ADVAPI32.dll
              avcodec-52.dll C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\3.0.195.27\avcodec-52.dll
              avformat-52.dll C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\3.0.195.27\avformat-52.dll
              avutil-50.dll C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\3.0.195.27\avutil-50.dll
              chrome.dll Google Chrome Google Inc. 3.0.195.27 C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\3.0.195.27\chrome.dll
              chrome.exe Google Chrome Google Inc. 0.0.0.0 C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
              comctl32.dll User Experience Controls Library Microsoft Corporation 6.0.2900.5512 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
              ctype.nls C:\WINDOWS\system32\ctype.nls
              fr.dll C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\3.0.195.27\locales\fr.dll
              GDI32.dll GDI Client DLL Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\GDI32.dll
              icudt38.dll ICU Data DLL IBM Corporation and others 3.8.0.0 C:\Documents and Settings\marc\Local Settings\Application Data\Google\Chrome\Application\3.0.195.27\icudt38.dll
              kernel32.dll DLL du client API BASE Windows NT Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\kernel32.dll
              locale.nls C:\WINDOWS\system32\locale.nls
              LPK.DLL Language Pack Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\LPK.DLL
              LZ32.dll LZ Expand/Compress API DLL Microsoft Corporation 5.1.2600.0 C:\WINDOWS\system32\LZ32.dll
              MSVCP60.dll Microsoft (R) C++ Runtime Library Microsoft Corporation 6.2.3104.0 C:\WINDOWS\system32\MSVCP60.dll
              msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.2600.5512 C:\WINDOWS\system32\msvcrt.dll
              netapi32.dll Net Win32 API DLL Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\netapi32.dll
              ntdll.dll DLL Couche NT Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\ntdll.dll
              ole32.dll Microsoft OLE pour Windows Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\ole32.dll
              OLEACC.dll Active Accessibility Core Component Microsoft Corporation 4.2.5406.0 C:\WINDOWS\system32\OLEACC.dll
              oleaccrc.dll Active Accessibility Resource DLL Microsoft Corporation 4.2.5406.0 C:\WINDOWS\system32\oleaccrc.dll
              OLEAUT32.dll Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\OLEAUT32.dll
              RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\RPCRT4.dll
              Secur32.dll Security Support Provider Interface Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\Secur32.dll
              SHELL32.dll DLL commune du shell Windows Microsoft Corporation 6.0.2900.5512 C:\WINDOWS\system32\SHELL32.dll
              SHLWAPI.dll Bibliothèque d'utilitaires légers du Shell Microsoft Corporation 6.0.2900.5512 C:\WINDOWS\system32\SHLWAPI.dll
              sortkey.nls C:\WINDOWS\system32\sortkey.nls
              sorttbls.nls C:\WINDOWS\system32\sorttbls.nls
              t2embed.dll Microsoft T2Embed Font Embedding Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\t2embed.dll
              unicode.nls C:\WINDOWS\system32\unicode.nls
              USER32.dll DLL client de l'API Utilisateur de Windows XP Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\USER32.dll
              USERENV.dll Userenv Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\USERENV.dll
              USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.420.2600.5512 C:\WINDOWS\system32\USP10.dll
              uxtheme.dll Bibliothèque de thèmes Ux Microsoft Microsoft Corporation 6.0.2900.5512 C:\WINDOWS\system32\uxtheme.dll
              VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\VERSION.dll
              WINMM.dll DLL API MCI Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\WINMM.dll
              WS2_32.DLL Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\WS2_32.DLL
              WS2HELP.dll Application d'assistance de Windows Socket 2.0 pour Windows NT Microsoft Corporation 5.1.2600.5512 C:\WINDOWS\system32\WS2HELP.dll
              0
              1. Lyonnais92 Contributeur sécurité
                Re,

                l'information comme quoi ton antivirus a stoppé une infection bagle change un peu la donne.

                Il est possible que son action ait été "un peu lente" et que tu en ais encore des séquelles.

                On va vérifier :

                Télécharge FindyKill de Chiquitine29 sur ton Bureau :

                http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

                hxxp://pagesperso-orange.fr/NosTools/Chiquitine29/FindyKill.exe
                hxxp://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

                ! Déconnecte-toi d'Internet et ferme toutes applications en cours.

                • Double clique sur "setup.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut.

                • Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...).

                • Double-clique sur le raccourci FindyKill qui est sur ton Bureau pour lancer l'outil.

                • Au menu principal choisis l'option " F " pour français et tape sur [Entrée].

                • Au second menu Choisis l'option " 1 " (Recherche) et tape sur [Entrée]

                Laisse travailler l'outil et ne touche à rien ...

                --> Poste le rapport qui apparait à la fin , sur le forum ...

                ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
                ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

                Aides en images : http://pagesperso-orange.fr/NosTools/findykill.html
                0
                1. stradic4000
                  Merci.
                  Voici le rapport Findykill :
                  Cordialement,
                  stradic

                  ############################## | FindyKill V5.034 |

                  # User : marc (Administrateurs) # R-ACHAT
                  # Update on 08/02/2010 by El Desaparecido
                  # Start at: 13:05:24 | 11/02/2010
                  # Website : http://pagesperso-orange.fr/NosTools/index.html
                  # Contact : FindyKill.Contact@gmail.com

                  # Intel(R) Core(TM)2 Duo CPU T5870 @ 2.00GHz
                  # Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                  # Internet Explorer 6.0.2900.5512
                  # Windows Firewall Status : Disabled
                  # AV : ESET Smart Security 3.0 3.0 [ Enabled | Updated ]
                  # FW : Pare-feu personnel d'ESET[ Enabled ]3.0.650.0

                  # C:\ # Disque fixe local # 232,88 Go (154,73 Go free) # NTFS
                  # D:\ # Disque CD-ROM
                  # E:\ # Disque CD-ROM
                  # F:\ # Disque amovible # 7,45 Go (7,28 Go free) [KINGSTON] # FAT32

                  ############################## | Processus actifs |

                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\csrss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\SafeNet\SoftRemoteLT\IPSecMon.exe
                  C:\Program Files\SafeNet\SoftRemoteLT\IreIKE.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\acs.exe
                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  C:\Program Files\ESET\ESET Smart Security\egui.exe
                  C:\Program Files\Atheros\ACU.exe
                  C:\WINDOWS\RTHDCPL.EXE
                  C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
                  C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
                  C:\WINDOWS\system32\TPSMain.exe
                  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
                  C:\WINDOWS\system32\igfxpers.exe
                  C:\WINDOWS\system32\agrsmsvc.exe
                  C:\WINDOWS\system32\igfxsrvc.exe
                  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
                  C:\WINDOWS\system32\igfxtray.exe
                  C:\WINDOWS\system32\TPSBattM.exe
                  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\SafeNet\SoftRemoteLT\SafeCfg.exe
                  C:\Program Files\ESET\ESET Smart Security\ekrn.exe
                  C:\Program Files\Java\jre6\bin\jqs.exe
                  C:\oracle\ora92\bin\omtsreco.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
                  C:\WINDOWS\system32\TODDSrv.exe
                  C:\WINDOWS\system32\wdfmgr.exe
                  C:\WINDOWS\system32\wbem\wmiapsrv.exe
                  C:\WINDOWS\System32\alg.exe
                  C:\WINDOWS\system32\wbem\wmiprvse.exe

                  ################## | C: |

                  ################## | C:\WINDOWS |

                  ################## | C:\WINDOWS\Prefetch |

                  ################## | C:\WINDOWS\system32 |

                  ################## | C:\WINDOWS\system32\drivers |

                  ################## | C:\Documents and Settings\marc\Application Data |

                  ################## | Zip File ... |

                  ################## | Temporary Internet Files |

                  ################## | Registre |

                  ################## | Etat |

                  # Affichage des fichiers cachés : OK

                  # Mode sans echec : OK

                  # Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
                  # EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
                  # Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 )
                  # SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
                  # wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
                  # wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

                  ################## | ! Fin du rapport # FindyKill V5.034 ! |
                  0
                  1. Lyonnais92 Contributeur sécurité
                    Re,

                    le rapport Findykill est négatif (celui de Process explorer aussi).

                    Je ne suis pas sûr de ce que tu appelles la barre de menu.

                    Il s'agit de la barre en bas du Bureau avec démarrer à gauche et l'heure à droite ? et où s'affichent les programmes en cours d'exécution ?
                    0
                    1. stradic4000
                      Re,

                      Oui, c'est la zone des programmes en cours d'exécution juste à côté de l'heure en bas à droite...
                      En fait, j'ai mon client VPN qui se lance au démarrage et que j'utilise très régulièrement.
                      L' icone n'apparait plus et je dois donc lancer le programme à la main.
                      Au bout de 10 minutes, j'ai un message "Pour protéger votre ordinateur, Windows a fermé ce programme. Explorateur Windows"
                      Quand je ferme le message, mes icônes réapparaissent... et je peux enfin travailler!!!!

                      Cordialement,
                      stradic
                      0
                      1. Lyonnais92 Contributeur sécurité
                        Re,

                        si tu relances l'explorateur Windows, elles redisparaissent ?

                        Fais ceci :

                        Rends toi sur ce site :

                        https://www.virustotal.com/gui/

                        Clique sur parcourir et cherche ce fichier : C:\Windows\explorer.exe

                        Clique sur Send File.

                        Un rapport va s'élaborer ligne à ligne.

                        Attends la fin. Il doit comprendre la taille du fichier envoyé.

                        Sauvegarde le rapport avec le bloc-note.

                        Copie le dans ta réponse.

                        Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant
                        0
                        1. stradic4000
                          Re,

                          Pas grand chose de trouvé... ça se complique!!!

                          ntivirus Version Dernière mise à jour Résultat
                          a-squared 4.5.0.50 2010.02.11 -
                          AhnLab-V3 5.0.0.2 2010.02.11 -
                          AntiVir 7.9.1.160 2010.02.11 -
                          Antiy-AVL 2.0.3.7 2010.02.11 -
                          Authentium 5.2.0.5 2010.02.11 -
                          Avast 4.8.1351.0 2010.02.10 -
                          AVG 9.0.0.730 2010.02.11 -
                          BitDefender 7.2 2010.02.11 -
                          CAT-QuickHeal 10.00 2010.02.11 -
                          ClamAV 0.96.0.0-git 2010.02.11 -
                          Comodo 3899 2010.02.11 -
                          DrWeb 5.0.1.12222 2010.02.11 -
                          eSafe 7.0.17.0 2010.02.10 -
                          eTrust-Vet 35.2.7296 2010.02.11 -
                          F-Prot 4.5.1.85 2010.02.11 -
                          F-Secure 9.0.15370.0 2010.02.11 -
                          Fortinet 4.0.14.0 2010.02.11 -
                          GData 19 2010.02.11 -
                          Ikarus T3.1.1.80.0 2010.02.11 -
                          Jiangmin 13.0.900 2010.02.08 -
                          K7AntiVirus 7.10.970 2010.02.10 -
                          Kaspersky 7.0.0.125 2010.02.11 -
                          McAfee 5888 2010.02.10 -
                          McAfee+Artemis 5888 2010.02.10 -
                          McAfee-GW-Edition 6.8.5 2010.02.11 -
                          Microsoft 1.5406 2010.02.11 -
                          NOD32 4858 2010.02.11 -
                          Norman 6.04.03 2010.02.10 -
                          nProtect 2009.1.8.0 2010.02.11 -
                          Panda 10.0.2.2 2010.02.10 -
                          PCTools 7.0.3.5 2010.02.11 -
                          Prevx 3.0 2010.02.11 -
                          Rising 22.34.01.03 2010.02.11 -
                          Sophos 4.50.0 2010.02.11 -
                          Sunbelt 3.9.2398.2 2010.02.11 -
                          Symantec 20091.2.0.41 2010.02.11 -
                          TheHacker 6.5.1.1.189 2010.02.11 -
                          TrendMicro 9.120.0.1004 2010.02.11 -
                          VBA32 3.12.12.2 2010.02.10 -
                          ViRobot 2010.2.11.2182 2010.02.11 -
                          VirusBuster 5.0.21.0 2010.02.11 -
                          Information additionnelle
                          File size: 1037824 bytes
                          MD5...: f2317622d29f9ff0f88aeecd5f60f0dd
                          SHA1..: d54b0b83de6ee5922dd90db1446872bf32062b25
                          SHA256: 1ab74a4ae472156a5d2c6714e2e1a60e3b32ceb4996f923887a12b6a27315d13
                          ssdeep: 12288:6HmcoCUyZtwAvAs4wTCyrPT7lvGVa/oXqoJpaz/g/J/v1S:4mfty/wAvN7
                          lrPlvGEoXJaz/g/J/t
                          PEiD..: -
                          PEInfo: PE Structure information

                          ( base data )
                          entrypointaddress.: 0x1a55f
                          timedatestamp.....: 0x48025c30 (Sun Apr 13 19:17:04 2008)
                          machinetype.......: 0x14c (I386)

                          ( 4 sections )
                          name viradd virsiz rawdsiz ntrpy md5
                          .text 0x1000 0x44c09 0x44e00 6.38 013207a9f70ec52b78392db51f333ff0
                          .data 0x46000 0x1db4 0x1800 1.30 983f35021232560eaaa99fcbc1b7d359
                          .rsrc 0x48000 0xb3280 0xb3400 6.63 e73694f42fb4ef5e9b8ea017fcf60103
                          .reloc 0xfc000 0x374c 0x3800 6.78 ec335057489badbf6d8142b57175fd91

                          ( 13 imports )
                          > ADVAPI32.dll: RegSetValueW, RegEnumKeyExW, GetUserNameW, RegNotifyChangeKeyValue, RegEnumValueW, RegQueryValueExA, RegOpenKeyExA, RegEnumKeyW, RegCloseKey, RegCreateKeyW, RegQueryInfoKeyW, RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegSetValueExW, RegDeleteValueW, RegQueryValueW
                          > BROWSEUI.dll: -, -, -, -
                          > GDI32.dll: GetStockObject, CreatePatternBrush, OffsetViewportOrgEx, GetLayout, CombineRgn, CreateDIBSection, GetTextExtentPoint32W, StretchBlt, CreateRectRgnIndirect, CreateRectRgn, GetClipRgn, IntersectClipRect, GetViewportOrgEx, SetViewportOrgEx, SelectClipRgn, PatBlt, GetBkColor, CreateCompatibleDC, CreateCompatibleBitmap, OffsetWindowOrgEx, DeleteDC, SetBkColor, BitBlt, ExtTextOutW, GetTextExtentPointW, GetClipBox, GetObjectW, SetTextColor, SetBkMode, CreateFontIndirectW, DeleteObject, GetTextMetricsW, SelectObject, GetDeviceCaps, TranslateCharsetInfo, SetStretchBltMode
                          > KERNEL32.dll: GetSystemDirectoryW, CreateThread, CreateJobObjectW, ExitProcess, SetProcessShutdownParameters, ReleaseMutex, CreateMutexW, SetPriorityClass, GetCurrentProcess, GetStartupInfoW, GetCommandLineW, SetErrorMode, LeaveCriticalSection, EnterCriticalSection, ResetEvent, LoadLibraryExA, CompareFileTime, GetSystemTimeAsFileTime, SetThreadPriority, GetCurrentThreadId, GetThreadPriority, GetCurrentThread, GetUserDefaultLangID, Sleep, GetBinaryTypeW, GetModuleHandleExW, SystemTimeToFileTime, GetLocalTime, GetCurrentProcessId, GetEnvironmentVariableW, UnregisterWait, GlobalGetAtomNameW, GetFileAttributesW, MoveFileW, lstrcmpW, LoadLibraryExW, FindClose, FindNextFileW, FindFirstFileW, lstrcmpiA, SetEvent, AssignProcessToJobObject, GetDateFormatW, GetTimeFormatW, FlushInstructionCache, lstrcpynW, GetSystemWindowsDirectoryW, SetLastError, GetProcessHeap, HeapFree, HeapReAlloc, HeapSize, HeapAlloc, GetUserDefaultLCID, ReadProcessMemory, OpenProcess, InterlockedCompareExchange, LoadLibraryA, QueryPerformanceCounter, UnhandledExceptionFilter, SetUnhandledExceptionFilter, VirtualFree, VirtualAlloc, ResumeThread, TerminateProcess, TerminateThread, GetSystemDefaultLCID, GetLocaleInfoW, CreateEventW, GetLastError, OpenEventW, DelayLoadFailureHook, WaitForSingleObject, GetTickCount, ExpandEnvironmentStringsW, GetModuleFileNameW, GetPrivateProfileStringW, lstrcmpiW, CreateProcessW, FreeLibrary, GetWindowsDirectoryW, LocalAlloc, CreateFileW, DeviceIoControl, LocalFree, GetQueuedCompletionStatus, CreateIoCompletionPort, SetInformationJobObject, CloseHandle, LoadLibraryW, GetModuleHandleW, ActivateActCtx, DeactivateActCtx, GetFileAttributesExW, GetProcAddress, DeleteCriticalSection, CreateEventA, HeapDestroy, InitializeCriticalSection, MulDiv, InitializeCriticalSectionAndSpinCount, lstrlenW, InterlockedDecrement, InterlockedIncrement, GlobalAlloc, InterlockedExchange, GetModuleHandleA, GetVersionExA, GlobalFree, GetProcessTimes, lstrcpyW, GetLongPathNameW, RegisterWaitForSingleObject
                          > msvcrt.dll: _itow, free, memmove, realloc, _except_handler3, malloc, _ftol, _vsnwprintf
                          > ntdll.dll: RtlNtStatusToDosError, NtQueryInformationProcess
                          > ole32.dll: CoFreeUnusedLibraries, RegisterDragDrop, CreateBindCtx, RevokeDragDrop, CoInitializeEx, CoUninitialize, OleInitialize, CoRevokeClassObject, CoRegisterClassObject, CoMarshalInterThreadInterfaceInStream, CoCreateInstance, OleUninitialize, DoDragDrop
                          > OLEAUT32.dll: -, -
                          > SHDOCVW.dll: -, -, -
                          > SHELL32.dll: -, -, SHGetFolderPathW, -, -, -, -, -, ExtractIconExW, -, -, -, -, -, -, -, -, -, -, -, -, -, -, SHGetSpecialFolderLocation, ShellExecuteExW, -, -, -, SHGetSpecialFolderPathW, -, -, -, SHBindToParent, -, -, -, SHParseDisplayName, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, SHChangeNotify, SHGetDesktopFolder, SHAddToRecentDocs, -, -, -, DuplicateIcon, -, -, -, -, -, -, -, -, SHUpdateRecycleBinIcon, SHGetFolderLocation, SHGetPathFromIDListA, -, -, -, -, -, -, -, SHGetPathFromIDListW, -, -, -
                          > SHLWAPI.dll: StrCpyNW, -, -, -, -, StrRetToBufW, StrRetToStrW, -, -, -, -, SHQueryValueExW, PathIsNetworkPathW, -, AssocCreate, -, -, -, -, -, StrCatW, StrCpyW, -, -, -, -, -, -, SHGetValueW, -, StrCmpNIW, PathRemoveBlanksW, PathRemoveArgsW, PathFindFileNameW, StrStrIW, PathGetArgsW, -, StrToIntW, SHRegGetBoolUSValueW, SHRegWriteUSValueW, SHRegCloseUSKey, SHRegCreateUSKeyW, SHRegGetUSValueW, SHSetValueW, -, PathAppendW, PathUnquoteSpacesW, -, -, PathQuoteSpacesW, -, SHSetThreadRef, SHCreateThreadRef, -, -, -, PathCombineW, -, -, -, SHStrDupW, PathIsPrefixW, PathParseIconLocationW, AssocQueryKeyW, -, AssocQueryStringW, StrCmpW, -, -, -, -, -, -, -, -, SHRegQueryUSValueW, SHRegOpenUSKeyW, SHRegSetUSValueW, PathIsDirectoryW, PathFileExistsW, PathGetDriveNumberW, -, StrChrW, PathFindExtensionW, -, -, PathRemoveFileSpecW, PathStripToRootW, -, -, -, SHOpenRegStream2W, -, -, -, StrDupW, SHDeleteValueW, StrCatBuffW, SHDeleteKeyW, StrCmpIW, -, -, wnsprintfW, -, -, StrCmpNW, -, -
                          > USER32.dll: TileWindows, GetDoubleClickTime, GetSystemMetrics, GetSysColorBrush, AllowSetForegroundWindow, LoadMenuW, GetSubMenu, RemoveMenu, SetParent, GetMessagePos, CheckDlgButton, EnableWindow, GetDlgItemInt, SetDlgItemInt, CopyIcon, AdjustWindowRectEx, DrawFocusRect, DrawEdge, ExitWindowsEx, WindowFromPoint, SetRect, AppendMenuW, LoadAcceleratorsW, LoadBitmapW, SendNotifyMessageW, SetWindowPlacement, CheckMenuItem, EndDialog, SendDlgItemMessageW, MessageBeep, GetActiveWindow, PostQuitMessage, MoveWindow, GetDlgItem, RemovePropW, GetClassNameW, GetDCEx, SetCursorPos, ChildWindowFromPoint, ChangeDisplaySettingsW, RegisterHotKey, UnregisterHotKey, SetCursor, SendMessageTimeoutW, GetWindowPlacement, LoadImageW, SetWindowRgn, IntersectRect, OffsetRect, EnumDisplayMonitors, RedrawWindow, SubtractRect, TranslateAcceleratorW, WaitMessage, InflateRect, CallWindowProcW, GetDlgCtrlID, SetCapture, LockSetForegroundWindow, SystemParametersInfoW, FindWindowW, CreatePopupMenu, GetMenuDefaultItem, DestroyMenu, GetShellWindow, EnumChildWindows, GetWindowLongW, SendMessageW, RegisterWindowMessageW, GetKeyState, CopyRect, MonitorFromRect, MonitorFromPoint, RegisterClassW, SetPropW, GetWindowLongA, SetWindowLongW, FillRect, GetCursorPos, MessageBoxW, LoadStringW, ReleaseDC, GetDC, EnumDisplaySettingsExW, EnumDisplayDevicesW, PostMessageW, DispatchMessageW, TranslateMessage, GetMessageW, PeekMessageW, PtInRect, BeginPaint, EndPaint, SetWindowTextW, GetAsyncKeyState, InvalidateRect, GetWindow, ShowWindowAsync, TrackPopupMenuEx, UpdateWindow, DestroyIcon, IsRectEmpty, SetActiveWindow, GetSysColor, DrawTextW, IsHungAppWindow, SetTimer, GetMenuItemID, TrackPopupMenu, EndTask, SendMessageCallbackW, GetClassLongW, LoadIconW, OpenInputDesktop, CloseDesktop, SetScrollPos, ShowWindow, BringWindowToTop, GetDesktopWindow, CascadeWindows, CharUpperBuffW, SwitchToThisWindow, InternalGetWindowText, GetScrollInfo, GetMenuItemCount, CreateWindowExW, DialogBoxParamW, MsgWaitForMultipleObjects, CharNextA, RegisterClipboardFormatW, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, PrintWindow, SetClassLongW, GetPropW, GetNextDlgGroupItem, GetNextDlgTabItem, ChildWindowFromPointEx, IsChild, NotifyWinEvent, TrackMouseEvent, GetCapture, GetAncestor, CharUpperW, SetWindowLongA, DrawCaption, ModifyMenuW, InsertMenuW, IsWindowEnabled, GetMenuState, LoadCursorW, GetParent, IsDlgButtonChecked, DestroyWindow, EnumWindows, IsWindowVisible, GetClientRect, UnionRect, EqualRect, GetWindowThreadProcessId, GetForegroundWindow, KillTimer, GetClassInfoExW, DefWindowProcW, RegisterClassExW, GetIconInfo, SetScrollInfo, GetLastActivePopup, SetForegroundWindow, IsWindow, GetSystemMenu, IsIconic, IsZoomed, EnableMenuItem, SetMenuDefaultItem, MonitorFromWindow, GetMonitorInfoW, GetWindowInfo, GetFocus, SetFocus, MapWindowPoints, ScreenToClient, ClientToScreen, GetWindowRect, SetWindowPos, DeleteMenu, GetMenuItemInfoW, SetMenuItemInfoW, CharNextW
                          > UxTheme.dll: GetThemeBackgroundContentRect, GetThemeBool, GetThemePartSize, DrawThemeParentBackground, OpenThemeData, DrawThemeBackground, GetThemeTextExtent, DrawThemeText, CloseThemeData, SetWindowTheme, GetThemeBackgroundRegion, -, GetThemeMargins, GetThemeColor, GetThemeFont, GetThemeRect, IsAppThemed

                          ( 0 exports )
                          RDS...: NSRL Reference Data Set
                          -
                          pdfid.: -
                          trid..: Win32 Executable Generic (42.3%)
                          Win32 Dynamic Link Library (generic) (37.6%)
                          Generic Win/DOS Executable (9.9%)
                          DOS Executable Generic (9.9%)
                          Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
                          sigcheck:
                          publisher....: Microsoft Corporation
                          copyright....: (c) Microsoft Corporation. Tous droits r_serv_s.
                          product......: Syst_me d_exploitation Microsoft_ Windows_
                          description..: Explorateur Windows
                          original name: EXPLORER.EXE
                          internal name: explorer
                          file version.: 6.00.2900.5512 (xpsp.080413-2105)
                          comments.....: n/a
                          signers......: -
                          signing date.: -
                          verified.....: Unsigned
                          0
                          1. Lyonnais92 Contributeur sécurité
                            Re,

                            c'est compliqué depuis le début lol.

                            Quand tu relances explorer.exe, les icônes disparaissent ?

                            ===

                            Fais ceci :

                            Télécharge la dernière version de ZHPDiag

                            Enregistre le sur ton Bureau.

                            Une fois le téléchargement achevé,fais un double clic sur ZHPDiag.exe et suis les instructions.

                            N'oublie pas de cocher la case qui permet de mettre un raccourci sur le Bureau.

                            pour Xp :Double clique sur le raccourci ZHPDiag sur ton Bureau.

                            pour vista et Seven : fais un clic droit sur le raccourci ZHPDiag sur ton Bureau et choisis "exécuter en tant qu'administrateur".

                            /|\ l'outil a créé 2 icônes ZHPDiag et ZHPFix.

                            Clique sur la loupe pour lancer l'analyse.

                            Laisse l'outil travailler, il peut être assez long.

                            Ferme ZHPDiag en fin d'analyse.

                            Pour transmettre le rapport clique sur Cijoint

                            Clique sur Parcourir et cherche le répertoire où est installé ZHPDiag (en général C:\Program Files\ZHPDiag).

                            Sélectionne le fichier ZHPDiag.txt.

                            Clique sur "Cliquez ici pour déposer le fichier".

                            Un lien de cette forme :

                            http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

                            est ajouté dans la page.

                            Copie ce lien dans ta réponse.
                            0
                            1. stradic4000
                              Quand je relance explorer.exe rien ne se passe.
                              Mes icones restent en place...

                              http://www.cijoint.fr/cjlink.php?file=cj201002/cij6A6KlCp.txt
                              0
                              1. Lyonnais92 Contributeur sécurité
                                Re,

                                les redirections via le fichier hists sont normales ? (liées à ta boîte)

                                ===

                                Télécharge seaf.exe de C__XX

                                http://pagesperso-orange.fr/NosTools/C_XX/SEAF.exe

                                hxxp://sd-1.archive-host.com/membres/up/16506160323759868/SF.exe

                                *Double clique sur SEAF.exe.

                                *Tape explorer.exe dans la fenêtre.

                                *Coche la case devant "Informations supplémentaires ..."

                                *Clique sur le V derrière "Calculer le checksum" et choisis MD5.

                                *Clique sur Lancer la recherche.

                                *Patiente quelques minutes(tu peux suivre l'avancement du scan).

                                *Une fenêtre avec un SEAFlog.txt va s'afficher.

                                *Copie/colle ce rapport dans ta prochaine réponse.
                                0
                                1. stradic4000
                                  Oui, rien de plus normal pour les hosts.

                                  Concernant le rapport SEAFlog, le explorer.exe.txt est un rapport hijack.

                                  1. ========================= SEAF 1.0.0.7 - C_XX
                                  2.
                                  3. Commencé à: 17:53:20 le 11/02/2010
                                  4.
                                  5. Valeur(s) recherchée(s):
                                  6.
                                  7. explorer.exe
                                  8.
                                  9. (!) --- Calcul du Hash "MD5"
                                  10. (!) --- Affichage des ADS
                                  11. (!) --- Informations supplémentaires
                                  12.
                                  13. ====== Fichier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
                                  14.
                                  15. "c:\WINDOWS\explorer.exe" [ ----A---- | 1037824 ]
                                  16. TC: 06/08/2008,10:45:43 | TM: 14/04/2008,13:00:00 | DA: 11/02/2010,17:03:59
                                  17. MD5: f2317622d29f9ff0f88aeecd5f60f0dd
                                  18.
                                  19.
                                  20. CompagnyName: Microsoft Corporation
                                  21. ProductName: Système d'exploitation Microsoft® Windows®
                                  22. InternalName: explorer
                                  23. OriginalFilename: EXPLORER.EXE
                                  24. LegalCopyright: © Microsoft Corporation. Tous droits réservés.
                                  25. ProductVersion: 6.00.2900.5512
                                  26. FileVersion: 6.00.2900.5512 (xpsp.080413-2105)
                                  27.
                                  28. =========================
                                  29.
                                  30. "c:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf" [ ----A---- | 84812 ]
                                  31. TC: 07/02/2010,09:24:04 | TM: 11/02/2010,14:59:43 | DA: 11/02/2010,17:51:49
                                  32. MD5: d5ffbfa32f6983daab1b33cfb542d6e9
                                  33.
                                  34.
                                  35.
                                  36. =========================
                                  37.
                                  38. "c:\Documents and Settings\marc\Recent\explorer.exe.txt.lnk" [ ----A---- | 495 ]
                                  39. TC: 11/02/2010,08:51:04 | TM: 11/02/2010,11:36:59 | DA: 11/02/2010,17:51:49
                                  40. MD5: 59e95d0ff1b8bd19a4188f20614af2ef
                                  41.
                                  42.
                                  43.
                                  44. =========================
                                  45.
                                  46. ====== Dossier(s) (TC: Date de création, TM: Date de modification, DA, Dernier accès) ======
                                  47.
                                  48. Aucun dossier trouvé
                                  49.
                                  50. =========================
                                  51.
                                  52. Fin à: 17:53:27 le 11/02/2010 ( E.O.F )
                                  0
                                  1. Lyonnais92 Contributeur sécurité
                                    Re,

                                    quand explorer.exe plante, as tu un message d'erreur ? un rapport à envoyer à Microsoft ?

                                    Si tu as un message, il dit quoi ?

                                    Si tu as un rapport et que tu l'envoies, tu as un retour ?

                                    ===

                                    Relance Process Explorer.

                                    Mets en surbrillance explorer.exe

                                    Clique sur Process puis Launch Depends.

                                    As tu des lignes en rouge ? Que disent elles ?

                                    As tu des Dll manquantes ? Lesquelles ?

                                    0

                                    Discussions similaires

                                    Clavier bloqué qui n'écrit plus : comment le débloquer
                                    pomad

                                    5 réponses
                                    Problème avec ma x96 Mini android
                                    Booya

                                    1 réponse
                                    Box TV Android est bloqué au niveau du logo de démarrage
                                    Davy

                                    1 réponse
                                    Comment faire pour débloquer mon clavier d'ordinateur ?
                                    nase

                                    21 réponses
                                    PC portable HP. Clavier bloqué et Bios
                                    Linda

                                    15 réponses