Virus GOOGLE? "302 Moved"

Theo59 -  
Bonjour à tous,

Depuis quelques jours j'ai un problème assez majeur sur google.

En effet, lorsque je fais une recherche deux scénarios se présentent :

- Page blanche avec le message "302 MovedThe document has moved here"
- Les résultats sont souvent incohérent avec des sites de vente qui redirigent vers MFEED et il m'est impossible d'accéder aux pages souhaitées (lorsque la recherche s'avère payante) sans être redirigé vers une saloperie.

Parallèlement, depuis quelques jours j'ai l'impression que ma machine tourne légèrement au ralentit.

J'ai télécharger Hijackthis et j'attends vos instructions!

D'avance merci

Théo

PS: aucun problème sur les autres moteurs de recherche et idem avec tous les navigateurs.
Configuration: Windows XP / Firefox 3.6

15 réponses

  • Votes
  • Date
  • Date décroissante
  1. gen-hackman
    salut forcement internet explorer est toujours touché en premier ^^ vive IE !!! ^^

    poste le rapport de hijackthis
    5. Theo59
      Merci les gars de votre aide.

      Voici le rapport :

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 16:00:41, on 16/03/2010
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16981)
      Boot mode: Normal

      Running processes:
      C:\windows\System32\smss.exe
      C:\windows\system32\winlogon.exe
      C:\windows\system32\services.exe
      C:\windows\system32\lsass.exe
      C:\windows\system32\svchost.exe
      C:\windows\System32\svchost.exe
      C:\windows\system32\svchost.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\windows\system32\spoolsv.exe
      C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
      C:\windows\system32\nvsvc32.exe
      C:\windows\system32\PnkBstrA.exe
      C:\windows\system32\PnkBstrB.exe
      C:\windows\system32\svchost.exe
      C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
      C:\windows\Explorer.EXE
      C:\windows\SOUNDMAN.EXE
      C:\Program Files\D-Tools\daemon.exe
      C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
      C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
      C:\windows\system32\RUNDLL32.EXE
      H:\Steam\Steam.exe
      C:\windows\system32\ctfmon.exe
      C:\windows\system32\rundll32.exe
      C:\Program Files\Logitech\SetPoint\SetPoint.exe
      C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
      C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
      C:\windows\system32\wuauclt.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Skype\Phone\Skype.exe
      C:\Program Files\Skype\Plugin Manager\skypePM.exe
      C:\Documents and Settings\Lo\Bureau\HiJackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
      O1 - Hosts: 89.149.249.180 www.google.com
      O1 - Hosts: 89.149.249.180 www.google.de
      O1 - Hosts: 89.149.249.180 www.google.fr
      O1 - Hosts: 89.149.249.180 www.google.co.uk
      O1 - Hosts: 89.149.249.180 www.google.com.br
      O1 - Hosts: 89.149.249.180 www.google.it
      O1 - Hosts: 89.149.249.180 www.google.es
      O1 - Hosts: 89.149.249.180 www.google.co.jp
      O1 - Hosts: 89.149.249.180 www.google.com.mx
      O1 - Hosts: 89.149.249.180 www.google.ca
      O1 - Hosts: 89.149.249.180 www.google.com.au
      O1 - Hosts: 89.149.249.180 www.google.nl
      O1 - Hosts: 89.149.249.180 www.google.co.za
      O1 - Hosts: 89.149.249.180 www.google.be
      O1 - Hosts: 89.149.249.180 www.google.gr
      O1 - Hosts: 89.149.249.180 www.google.at
      O1 - Hosts: 89.149.249.180 www.google.se
      O1 - Hosts: 89.149.249.180 www.google.ch
      O1 - Hosts: 89.149.249.180 www.google.pt
      O1 - Hosts: 89.149.249.180 www.google.dk
      O1 - Hosts: 89.149.249.180 www.google.fi
      O1 - Hosts: 89.149.249.180 www.google.ie
      O1 - Hosts: 89.149.249.180 www.google.no
      O1 - Hosts: 89.149.249.180 search.yahoo.com
      O1 - Hosts: 89.149.249.180 us.search.yahoo.com
      O1 - Hosts: 89.149.249.180 uk.search.yahoo.com
      O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\windows\system32\PSDrvCheck.exe -CheckReg
      O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKCU\..\Run: [Steam] "H:\Steam\Steam.exe" -silent
      O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Startup: IcoSauve.lnk = C:\WINDOWS\system32\IcoSauve.exe
      O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
      O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
      O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
      O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{CEE7DF7E-5F54-45D4-AABB-0675D5B69689}: NameServer = 212.27.40.240,212.27.40.241
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
      O20 - AppInit_DLLs: C:\WINDOWS\system32\wbsys.dll
      O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
      O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
      O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
      O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
      O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
      O23 - Service: PnkBstrB - Unknown owner - C:\windows\system32\PnkBstrB.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
      1. gen-hackman
        DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

        ▶ Télécharge List_Kill'em et enregistre le sur ton bureau

        double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

        une fois terminée , clic sur "terminer" et le programme se lancera seul

        choisis choisis l'option Search

        un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.

        ▶ laisse travailler l'outil

        à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

        un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

        ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

        1. Theo59
          Je précise que pour malwarebyte j'ai fait plsuieurs scans les jours précédents en mettant en quarantaine quelques saloperies
          1. Theo59
            gen-hackman,

            Voici le rapport :

            List'em by g3n-h@ckm@n 1.5.0.1

            User : Lo (Administrateurs)
            Update on 16/03/2010 by g3n-h@ckm@n ::::: 15.00
            Start at: 16:08:51 | 16/03/2010
            Contact : https://forums.commentcamarche.net/forum/virus-securite-7

            AMD Athlon(tm) 64 Processor 3500+
            Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
            Internet Explorer 7.0.5730.11
            Windows Firewall Status : Disabled

            A:\ -> Lecteur de disquettes 3 ½ pouces
            C:\ -> Disque fixe local | 38,16 Go (3,35 Go free) | NTFS
            D:\ -> Disque CD-ROM
            E:\ -> Disque fixe local | 10,17 Go (10,11 Go free) [Shared] | NTFS
            F:\ -> Disque fixe local | 117,19 Go (14,23 Go free) [Pif!!] | NTFS
            G:\ -> Disque CD-ROM
            H:\ -> Disque fixe local | 116,57 Go (52,51 Go free) [Paf!!] | NTFS
            K:\ -> Disque CD-ROM
            L:\ -> Disque CD-ROM

            Boot: Normal

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

            C:\windows\System32\smss.exe
            C:\windows\system32\csrss.exe
            C:\windows\system32\winlogon.exe
            C:\windows\system32\services.exe
            C:\windows\system32\lsass.exe
            C:\windows\system32\svchost.exe
            C:\windows\system32\svchost.exe
            C:\windows\System32\svchost.exe
            C:\windows\system32\svchost.exe
            C:\windows\system32\svchost.exe
            C:\windows\system32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\windows\system32\spoolsv.exe
            C:\windows\system32\svchost.exe
            C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
            C:\Program Files\Java\jre6\bin\jqs.exe
            C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
            C:\windows\system32\nvsvc32.exe
            C:\windows\system32\PnkBstrA.exe
            C:\windows\system32\PnkBstrB.exe
            C:\windows\system32\svchost.exe
            C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
            C:\windows\Explorer.EXE
            C:\windows\SOUNDMAN.EXE
            C:\Program Files\D-Tools\daemon.exe
            C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
            C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
            C:\windows\system32\RUNDLL32.EXE
            H:\Steam\Steam.exe
            C:\windows\system32\ctfmon.exe
            C:\windows\system32\rundll32.exe
            C:\Program Files\Logitech\SetPoint\SetPoint.exe
            C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
            C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
            C:\windows\System32\alg.exe
            C:\windows\system32\wbem\wmiprvse.exe
            C:\windows\system32\wuauclt.exe
            C:\Program Files\Mozilla Firefox\firefox.exe
            C:\Program Files\Skype\Phone\Skype.exe
            C:\Program Files\Skype\Plugin Manager\skypePM.exe
            C:\windows\system32\wuauclt.exe
            C:\Program Files\List_Kill'em\List_Kill'em.exe
            C:\windows\system32\cmd.exe
            C:\windows\system32\wbem\wmiprvse.exe
            C:\Program Files\List_Kill'em\pv.exe

            ======================
            Keys "Run"
            ======================
            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            Steam REG_SZ "H:\Steam\Steam.exe" -silent
            ctfmon.exe REG_SZ C:\windows\system32\ctfmon.exe

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            NvCplDaemon REG_SZ RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
            nwiz REG_SZ nwiz.exe /install
            SoundMan REG_SZ SOUNDMAN.EXE
            DAEMON Tools-1033 REG_SZ "C:\Program Files\D-Tools\daemon.exe" -lang 1033
            SmcService REG_SZ C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
            PinnacleDriverCheck REG_SZ C:\windows\system32\PSDrvCheck.exe -CheckReg
            Control Center REG_SZ C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
            Logitech Hardware Abstraction Layer REG_SZ KHALMNPR.EXE
            Kernel and Hardware Abstraction Layer REG_SZ KHALMNPR.EXE
            avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            SunJavaUpdateSched REG_SZ "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
            NvMediaCenter REG_SZ RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

            =====================
            Other Keys
            =====================
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
            dontdisplaylastusername REG_DWORD 1 (0x1)
            legalnoticecaption REG_SZ
            legalnoticetext REG_SZ
            shutdownwithoutlogon REG_DWORD 1 (0x1)
            undockwithoutlogon REG_DWORD 1 (0x1)
            SynchronousMachineGroupPolicy REG_DWORD 0 (0x0)
            SynchronousUserGroupPolicy REG_DWORD 0 (0x0)
            DisableRegistryTools REG_DWORD 0 (0x0)

            ===============
            [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
            NoDriveTypeAutoRun REG_DWORD 323 (0x143)
            NoStrCmpLogical REG_DWORD 0 (0x0)
            NoToolbarsOnTaskbar REG_DWORD 0 (0x0)
            LockTaskbar REG_DWORD 0 (0x0)
            NoResolveTrack REG_DWORD 0 (0x0)
            NoResolveSearch REG_DWORD 0 (0x0)
            NoNetworkConnections REG_DWORD 1 (0x1)
            NoRecentDocsMenu REG_DWORD 0 (0x0)
            NoSMMyPictures REG_DWORD 0 (0x0)
            NoRecentDocsHistory REG_DWORD 0 (0x0)
            NoStartMenuMFUprogramsList REG_DWORD 0 (0x0)
            NoUserNameInStartMenu REG_DWORD 0 (0x0)
            ClearRecentDocsOnExit REG_DWORD 0 (0x0)
            MaxRecentDocs REG_DWORD 15 (0xf)
            NoInstrumentation REG_DWORD 0 (0x0)
            NoCDBurning REG_DWORD 1 (0x1)
            MemCheckBoxInRunDlg REG_DWORD 1 (0x1)
            NoSMBalloonTip REG_DWORD 0 (0x0)
            DisallowCpl REG_DWORD 1 (0x1)
            NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
            NoDrives REG_DWORD 0 (0x0)
            NoSMHelp REG_DWORD 0 (0x0)
            HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisallowCpl

            ===============
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
            NoRemoteRecursiveEvents REG_DWORD 1 (0x1)
            NoLowDiskSpaceChecks REG_DWORD 1 (0x1)
            NoSimpleStartMenu REG_DWORD 0 (0x0)
            NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
            NoDriveTypeAutoRun REG_DWORD 323 (0x143)
            NoDrives REG_DWORD 0 (0x0)
            HonorAutoRunSetting REG_DWORD 1 (0x1)

            ===============
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
            AppInit_DLLS REG_SZ C:\WINDOWS\system32\wbsys.dll

            ===============
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
            AutoRestartShell REG_DWORD 1 (0x1)
            DefaultDomainName REG_SZ PINGPING
            DefaultUserName REG_SZ Lo
            LegalNoticeCaption REG_SZ
            LegalNoticeText REG_SZ
            PowerdownAfterShutdown REG_SZ 1
            ReportBootOk REG_SZ 1
            Shell REG_SZ Explorer.exe
            ShutdownWithoutLogon REG_SZ 0
            System REG_SZ
            Userinit REG_SZ C:\windows\system32\userinit.exe,
            VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
            SfcQuota REG_DWORD -1 (0xffffffff)
            allocatecdroms REG_SZ 0
            allocatedasd REG_SZ 0
            allocatefloppies REG_SZ 0
            cachedlogonscount REG_SZ 10
            forceunlocklogon REG_DWORD 0 (0x0)
            passwordexpirywarning REG_DWORD 14 (0xe)
            scremoveoption REG_SZ 0
            AllowMultipleTSSessions REG_DWORD 1 (0x1)
            UIHost REG_EXPAND_SZ logonui.exe
            LogonType REG_DWORD 1 (0x1)
            Background REG_SZ 0 0 0
            DebugServerCommand REG_SZ no
            SFCDisable REG_DWORD 0 (0x0)
            WinStationsDisabled REG_SZ 0
            HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
            ShowLogonOptions REG_DWORD 0 (0x0)
            AltDefaultUserName REG_SZ Lo
            AltDefaultDomainName REG_SZ PINGPING
            SFCScan REG_DWORD 1 (0x1)
            KeepRasConnections REG_SZ 1
            AutoAdminLogon REG_SZ 0

            ===============
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

            ===============
            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
            {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
            {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} REG_SZ

            ===============
            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
            %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
            %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
            C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE REG_SZ C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
            C:\Program Files\Pinnacle\MediaCenter\PMC.exe REG_SZ C:\Program Files\Pinnacle\MediaCenter\PMC.exe:LocalSubNet:Enabled:Pmc.exe
            C:\Program Files\Pinnacle\MediaCenter\PSST.exe REG_SZ C:\Program Files\Pinnacle\MediaCenter\PSST.exe:LocalSubNet:Enabled:PSST.exe
            C:\Program Files\Pinnacle\Shared Files\Programs\MediaManager\PMSManager.exe REG_SZ C:\Program Files\Pinnacle\Shared Files\Programs\MediaManager\PMSManager.exe:LocalSubNet:Enabled:PMSManager.exe
            C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSInstallInit.exe REG_SZ C:\Program Files\Pinnacle\Shared Files\Programs\MediaServer\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe
            C:\WINDOWS\system32\PnkBstrA.exe REG_SZ C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA
            C:\WINDOWS\system32\PnkBstrB.exe REG_SZ C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB
            C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
            C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
            C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice
            C:\Program Files\Skype\Plugin Manager\skypePM.exe REG_SZ C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
            H:\Steam\Steam.exe REG_SZ H:\Steam\Steam.exe:*:Enabled:Steam
            C:\Program Files\Vuze\Azureus.exe REG_SZ C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze
            C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe REG_SZ C:\Program Files\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe:LocalSubNet:Disabled:PMCService
            H:\Steam\SteamApps\common\company of heroes\RelicCOH.exe REG_SZ H:\Steam\SteamApps\common\company of heroes\RelicCOH.exe:*:Enabled:Company of Heroes
            H:\Steam\SteamApps\common\company of heroes\help.htm REG_SZ H:\Steam\SteamApps\common\company of heroes\help.htm:*:Enabled:Company of Heroes
            C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
            %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
            %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
            C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

            ===============
            ActivX controls
            ===============
            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}]
            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]

            ===============
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0F117471-D44C-6A37-B717-0D06DF0B9A62}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}]

            ==============
            BHO :
            ======
            [<NO NAME> REG_SZ ]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

            ===
            DNS
            ===

            HKLM\SYSTEM\CCS\Services\Tcpip\..\{5D753F21-B6D0-4409-9C09-147387EFCDC8}: DhcpNameServer=89.2.0.1 89.2.0.2
            HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5A3346F-47FB-4B79-BB25-4EB14BDF2C5B}: DhcpNameServer=194.98.65.65 194.2.0.20
            HKLM\SYSTEM\CCS\Services\Tcpip\..\{CEE7DF7E-5F54-45D4-AABB-0675D5B69689}: NameServer=212.27.40.240,212.27.40.241
            HKLM\SYSTEM\CS2\Services\Tcpip\..\{C5A3346F-47FB-4B79-BB25-4EB14BDF2C5B}: DhcpNameServer=194.98.65.65 194.2.0.20
            HKLM\SYSTEM\CS2\Services\Tcpip\..\{C732DC1D-03FB-45FC-8E6A-47D9906AC0E0}: DhcpNameServer=89.2.0.1 89.2.0.2
            HKLM\SYSTEM\CS2\Services\Tcpip\..\{CEE7DF7E-5F54-45D4-AABB-0675D5B69689}: NameServer=212.27.40.240,212.27.40.241
            HKLM\SYSTEM\CS3\Services\Tcpip\..\{5D753F21-B6D0-4409-9C09-147387EFCDC8}: DhcpNameServer=89.2.0.1 89.2.0.2
            HKLM\SYSTEM\CS3\Services\Tcpip\..\{C5A3346F-47FB-4B79-BB25-4EB14BDF2C5B}: DhcpNameServer=194.98.65.65 194.2.0.20
            HKLM\SYSTEM\CS3\Services\Tcpip\..\{CEE7DF7E-5F54-45D4-AABB-0675D5B69689}: NameServer=212.27.40.240,212.27.40.241
            HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
            HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
            HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2

            ================
            Internet Explorer :
            ================
            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            Start Page REG_SZ https://www.google.fr/?gws_rd=ssl

            ========
            Services
            ========
            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

            Ndisuio : 0x3 ( OK = 3 )
            SharedAccess : 0x2 ( OK = 2 )
            wuauserv : 0x2 ( OK = 2 )

            =========
            Atapi.sys
            =========

            %%%% HASHDEEP-1.0
            %%%% size,md5,sha256,filename
            ## Invoked from: C:\Program Files\List_Kill'em
            ## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
            ##
            95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\ERDNT\cache\atapi.sys
            %%%% HASHDEEP-1.0
            %%%% size,md5,sha256,filename
            ## Invoked from: C:\Program Files\List_Kill'em
            ## C:\> hashdeep.exe C:\WINDOWS\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\atapi.sys
            ##
            96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\atapi.sys
            %%%% HASHDEEP-1.0
            %%%% size,md5,sha256,filename
            ## Invoked from: C:\Program Files\List_Kill'em
            ## C:\> hashdeep.exe C:\WINDOWS\system32\dllcache\atapi.sys
            ##
            95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\dllcache\atapi.sys
            %%%% HASHDEEP-1.0
            %%%% size,md5,sha256,filename
            ## Invoked from: C:\Program Files\List_Kill'em
            ## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
            ##
            95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\drivers\atapi.sys

            Référence :
            ==========

            Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
            Win XP_32b : a64013e98426e1877cb653685c5c0009
            Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
            Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
            Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
            Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
            Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
            Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
            Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
            Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

            =======
            Drive :
            =======

            Défragmenteur de disque Windows
            Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

            Rapport d'analyse
            38,16 Go total, 3,36 Go libre (8%), 29% fragmenté (fragmentation du fichier 53%)

            Vous devriez défragmenter ce volume.

            ¤¤¤¤¤¤¤¤¤¤ Files/folders :

            Present !! : C:\Documents and Settings\All Users\Application Data\.zreglib
            Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
            Present !! : C:\windows\iun6002.exe
            Present !! : C:\windows\System32\_*.dll
            Present !! : C:\windows\System32\RemSvc.exe
            Present !! : C:\windows\System32\SET*.tmp
            Present !! : C:\Documents and Settings\Lo\LOCAL Settings\Temp\contentDATs.exe
            Present !! : C:\Documents and Settings\Lo\LOCAL Settings\Temp\SecurityScan_Release.exe
            Present !! : C:\Documents and Settings\Lo\LOCAL Settings\Temp\isconfig.dat
            Present !! : C:\Documents and Settings\Lo\LOCAL Settings\Temp\Perflib_Perfdata_918.dat
            Present !! : C:\Documents and Settings\Lo\LOCAL Settings\Temp\Perflib_Perfdata_c24.dat
            Present !! : C:\Documents and Settings\Lo\LOCAL Settings\Temp\GLF5D.tmp.tbVuze.dll

            ¤¤¤¤¤¤¤¤¤¤ Keys :

            Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
            Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl
            Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
            Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures
            Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
            Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
            Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"

            ============

            catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2010-03-16 16:48:21
            Windows 5.1.2600 Service Pack 2 FAT NTAPI

            scanning hidden processes ...

            scanning hidden services ...

            scanning hidden autostart entries ...

            scanning hidden files ...

            scan completed successfully
            hidden processes: 0
            hidden services: 0
            hidden files: 0

            Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

            device: opened successfully
            user: MBR read successfully
            called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvatabus.sys
            kernel: MBR read successfully
            user & kernel MBR OK

            ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

            End of scan : 16:49:00,87
            1. gen-hackman
              ▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
              mais cette fois-ci :

              ▶ choisis l'option clean

              ton PC va redemarrer,

              laisse travailler l'outil.

              en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

              ▶ colle le contenu dans ta reponse
              1. Theo59
                Au redémarrage le scan s'est lancé.

                A la fin j'ai eu un message d'erreur me disant qu'un fichier .bat était manquant.

                Suite à ca j'ai eu un catchme.zip sur mon bureau qui contenait un catchme.txt :

                catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2010-03-16 16:48:21
                Windows 5.1.2600 Service Pack 2 FAT NTAPI

                scanning hidden processes ...

                scanning hidden services ...

                scanning hidden autostart entries ...

                scanning hidden files ...

                scan completed successfully
                hidden processes: 0
                hidden services: 0
                hidden files: 0
                1. gen-hackman
                  en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

                  ▶ colle le contenu dans ta reponse
                  1. Theo59
                    J'ai réedité l'opération mais aucun rapport n'apparait sur mon bureau :/
                    2. Theo59
                      Je refais demain mais en notant cette fois ci!

                      Je te tiens au jus.

                      Merci encore.