Infecté ou pas ? (hijackthis)

paz -  
Bonjour,

suite à https://forums.commentcamarche.net/forum/affich-17700488-surchauffe-du-portable#newanswer ; voici un rapport hijackthis. Merci d'avance à qui l'analysera :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:43:00, on 2010-05-17
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\rsvp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\tlntsvr.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: (no name) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://colruyt.fujiprint.be/Colruyt/UserControls/Part/Upload/ImageUploader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 8789 bytes

12 réponses

  • Votes
  • Date
  • Date décroissante
  1. gen-hackman
    salut :

    DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

    ▶ Télécharge List_Kill'em

    et enregistre le sur ton bureau

    double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

    Laisse coché :

    ♦ Executer Shortcut
    ♦ Executer List_Kill'em

    une fois terminée , clic sur "terminer" et le programme se lancera seul

    choisis l'option Search

    ▶ laisse travailler l'outil

    à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

    ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
    1. paz
      Bonjour ! Merci de votre aide.

      Je ne peux pas désactiver l'antivirus. Depuis quelques jours il n'apparait plus dans ma barre de tâche (en bas à droite). Quand j'essaie de le fermer via le gestionnaire de tâches ça ne marche pas. Dois-je le désinstaller ?
      Quant au parefeu, je l'ai désactivé (et normalement désinstallé) il y a quelques jours aussi.

      J'ai essayé de lancher List_Kill'em, le problème c'est que mon ordinateur portable surchauffe en permanence, et ce genre de test l'éteint (j'utilise EVEREST pour savoir la t° de la sonde, et j'ai arrêté le List_kill'em quand c'était à 98°.. à 102 l'ordinateur s'eteind). L'analyse était à 30%...

      (J'ai déjà ouvert et nettoyé le ventilateur (enlevé la poussière, mais pas enlevé carrément le ventilateur de l'ordinateur, ça j'ose pas), mais ça n'a rien changé.)

      Une suggestion ? Désinstaller complètement l'antivirus (avira) peut-être (qui semble prendre des ressources d'après le gestionnaire de progs) ?
      1. maitreya
        tu as pu voir les grilles de refroidissement au niveau du ventilateur et regarder a travers pour voir si elles n'étaient pas bouchées ?
    2. paz
      J'ai réussi à faire le scan en entier !

      ¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.0.0.3 ¤¤¤¤¤¤¤¤¤¤

      User : barbara (Administrateurs)
      Update on 17/05/2010 by g3n-h@ckm@n ::::: 06.20
      Start at: 11:45:20 | 2010-05-18

      Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
      Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
      Internet Explorer 7.0.5730.11
      Windows Firewall Status : Enabled

      C:\ -> Disque fixe local | 53.2 Go (13.74 Go free) [ACER] | FAT32
      D:\ -> Disque fixe local | 53.69 Go (22.29 Go free) [ACERDATA] | FAT32
      E:\ -> Disque CD-ROM

      Boot: Normal
      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\netdde.exe
      C:\WINDOWS\system32\msdtc.exe
      C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
      C:\Acer\Empowering Technology\admServ.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\WINDOWS\system32\clipsrv.exe
      C:\WINDOWS\eHome\ehRecvr.exe
      C:\WINDOWS\eHome\ehSched.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\sessmgr.exe
      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
      C:\WINDOWS\system32\locator.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\dllhost.exe
      C:\WINDOWS\system32\tlntsvr.exe
      C:\WINDOWS\System32\dmadmin.exe
      C:\WINDOWS\ehome\mcrdsvc.exe
      C:\WINDOWS\system32\dllhost.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\hkcmd.exe
      C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
      C:\PROGRA~1\LAUNCH~1\LManager.exe
      C:\Program Files\USB Disk Win98 Driver\Res.EXE
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\WINDOWS\system32\igfxsrvc.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\igfxpers.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\WINDOWS\system32\wbem\unsecapp.exe
      C:\WINDOWS\system32\igfxext.exe
      C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\List_Kill'em\List_Kill'em.exe
      C:\WINDOWS\system32\cmd.exe
      C:\Program Files\List_Kill'em\pv.exe

      ======================
      Keys "Run"
      ======================

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      eRecoveryService REG_SZ C:\Acer\Empowering Technology\eRecovery\Monitor.exe
      ePower_DMC REG_SZ C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
      Acer ePower Management REG_SZ C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
      LaunchApp REG_SZ Alaunch
      igfxhkcmd REG_SZ C:\WINDOWS\system32\hkcmd.exe
      eDataSecurity Loader REG_SZ C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
      LManager REG_SZ C:\PROGRA~1\LAUNCH~1\LManager.exe
      USB Storage Toolbox REG_SZ C:\Program Files\USB Disk Win98 Driver\Res.EXE
      SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      IMJPMIG8.1 REG_SZ "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
      igfxtray REG_SZ C:\WINDOWS\system32\igfxtray.exe
      igfxpers REG_SZ C:\WINDOWS\system32\igfxpers.exe

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
      HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\C:

      =====================
      Other Keys
      =====================
      1. paz
        =====================
        Other Keys
        =====================

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
        dontdisplaylastusername REG_DWORD 0 (0x0)
        legalnoticecaption REG_SZ
        legalnoticetext REG_SZ
        shutdownwithoutlogon REG_DWORD 1 (0x1)
        undockwithoutlogon REG_DWORD 1 (0x1)
        InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
        InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme

        ===============

        [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
        NoDriveAutoRun REG_BINARY ffffffff

        ===============

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
        NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
        NoDriveTypeAutoRun REG_DWORD 323 (0x143)
        NoDrives REG_DWORD 0 (0x0)
        HonorAutoRunSetting REG_DWORD 1 (0x1)

        ===============

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

        ===============

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
        AutoRestartShell REG_DWORD 1 (0x1)
        DefaultUserName REG_SZ barbara
        LegalNoticeCaption REG_SZ
        LegalNoticeText REG_SZ
        PowerdownAfterShutdown REG_SZ 0
        ReportBootOk REG_SZ 1
        Shell REG_SZ explorer.exe
        ShutdownWithoutLogon REG_SZ 0
        Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
        VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
        SfcQuota REG_DWORD -1 (0xffffffff)
        allocatecdroms REG_SZ 0
        allocatedasd REG_SZ 0
        allocatefloppies REG_SZ 0
        cachedlogonscount REG_SZ 10
        forceunlocklogon REG_DWORD 0 (0x0)
        passwordexpirywarning REG_DWORD 14 (0xe)
        scremoveoption REG_SZ 0
        AllowMultipleTSSessions REG_DWORD 1 (0x1)
        UIHost REG_EXPAND_SZ logonui.exe
        LogonType REG_DWORD 1 (0x1)
        Background REG_SZ 0 0 0
        DebugServerCommand REG_SZ no
        SFCDisable REG_DWORD 0 (0x0)
        WinStationsDisabled REG_SZ 0
        HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
        ShowLogonOptions REG_DWORD 0 (0x0)
        AltDefaultUserName REG_SZ barbara
        AltDefaultDomainName REG_SZ ALASKA
        DefaultDomainName REG_SZ ALASKA
        ChangePasswordUseKerberos REG_DWORD 1 (0x1)

        ===============

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

        ===============

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
        {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

        ===============

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
        %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
        C:\Program Files\MSN\MSNCoreFiles\Install\msnsusii.exe REG_SZ C:\Program Files\MSN\MSNCoreFiles\Install\msnsusii.exe:*:Enabled:MSN
        C:\Program Files\WordBiz\WordBiz.exe REG_SZ C:\Program Files\WordBiz\WordBiz.exe:*:Enabled:WordBiz
        C:\Program Files\AbiSuite2\AbiWord\bin\AbiWord.exe REG_SZ C:\Program Files\AbiSuite2\AbiWord\bin\AbiWord.exe:*:Enabled:AbiWord 2.4
        %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
        C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
        C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
        C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
        C:\Program Files\HP\Digital Imaging\bin\hposid01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe
        C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe
        C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
        C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe
        C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
        C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
        C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
        C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe REG_SZ C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player
        C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
        C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
        C:\Program Files\Skype\Phone\Skype.exe REG_SZ C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
        %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
        %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
        C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
        C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
        2. paz
          ===============
          ActivX controls
          ===============

          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{233C1507-6A77-46A4-9443-F871F945D258}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5ED80217-570B-4DA9-BF44-BE107C0EC166}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7530BFB8-7293-4D34-9923-61A11451AFC5}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
          [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

          ===============
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1BC46932-21B2-4130-86E0-B4EB4F7A7A7B}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5056b317-8d4c-43ee-8543-b9d1e234b8f4}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BDE0FA43-6952-4BA8-8C58-09AF690F88E1}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA5BD6-D931-4001-ABF6-81BAA500360A}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EA29D410-CE41-4953-A862-2DE706A1DAD7}]
          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}]
          1. paz
            ==============
            BHO :
            ======

            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{0347C33E-8762-4905-BF09-768834316C61}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{C08DF07A-3E49-4E25-9AB0-D3882835F153}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

            ===
            DNS
            ===

            HKLM\SYSTEM\CCS\Services\Tcpip\..\{6D9D42F6-1A31-4C6C-BD4C-74B5766B053D}: DhcpNameServer=192.168.1.1
            HKLM\SYSTEM\CS1\Services\Tcpip\..\{6D9D42F6-1A31-4C6C-BD4C-74B5766B053D}: DhcpNameServer=192.168.1.1
            HKLM\SYSTEM\CS2\Services\Tcpip\..\{6D9D42F6-1A31-4C6C-BD4C-74B5766B053D}: DhcpNameServer=192.168.1.1
            HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
            HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
            HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

            ================
            Internet Explorer :
            ================

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
            Local Page REG_SZ C:\windows\system32\blank.htm
            Default_Search_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
            Default_Page_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
            Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            Start Page REG_SZ https://www.google.fr/?gws_rd=ssl
            Local Page REG_SZ C:\windows\system32\blank.htm
            Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

            ========
            Services
            ========

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

            Ndisuio : 0x3 ( OK = 3 )
            EapHost : 0x2 ( OK = 2 )
            SharedAccess : 0x2 ( OK = 2 )
            wuauserv : 0x2 ( OK = 2 )

            ========
            Safemode
            ========

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

            =========
            Atapi.sys
            =========

            C:\WINDOWS\system32\drivers\atapi.sys :
            MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
            SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

            C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys :
            MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
            SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

            C:\WINDOWS\$NtServicePackUninstall$\atapi.sys :
            MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
            SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

            C:\WINDOWS\ServicePackFiles\i386\atapi.sys :
            MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
            SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

            Référence :
            ==========

            Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
            Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
            Win XP_32b : a64013e98426e1877cb653685c5c0009
            Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
            Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
            Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
            Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
            Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
            Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
            Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
            Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
            Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

            =======
            Drive :
            =======

            Défragmenteur de disque Windows
            Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

            Rapport d'analyse
            53.20 Go total, 13.74 Go libre (25%), 22% fragmenté (fragmentation du fichier 42%)

            Vous devriez défragmenter ce volume.

            ¤¤¤¤¤¤¤¤¤¤ Files/folders :

            Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
            Present !! : C:\Program Files\DAEMON Tools Toolbar
            Present !! : C:\Program Files\WindowsUpdate
            Present !! : C:\Program Files\WinPCap
            Present !! : C:\WINDOWS\003078_.tmp
            Present !! : C:\WINDOWS\DUMP6541.tmp
            Present !! : C:\WINDOWS\kb913800.exe
            Present !! : C:\WINDOWS\System32\tmp.MSNFix
            Present !! : C:\WINDOWS\System32\404Fix.exe
            Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
            Present !! : C:\WINDOWS\system32\drivers\mskssrv.sys
            Present !! : C:\WINDOWS\System32\dumphive.exe
            Present !! : C:\WINDOWS\System32\IEDFix.exe
            Present !! : C:\WINDOWS\System32\Process.exe
            Present !! : C:\WINDOWS\System32\SET22F.tmp
            Present !! : C:\WINDOWS\System32\SET230.tmp
            Present !! : C:\WINDOWS\System32\SET231.tmp
            Present !! : C:\WINDOWS\System32\SET23E.tmp
            Present !! : C:\WINDOWS\System32\SET23F.tmp
            Present !! : C:\WINDOWS\System32\SET240.tmp
            Present !! : C:\WINDOWS\System32\SET24E.tmp
            Present !! : C:\WINDOWS\System32\SET24F.tmp
            Present !! : C:\WINDOWS\System32\SET254.tmp
            Present !! : C:\WINDOWS\System32\SET255.tmp
            Present !! : C:\WINDOWS\System32\SET261.tmp
            Present !! : C:\WINDOWS\System32\SET262.tmp
            Present !! : C:\WINDOWS\System32\SET263.tmp
            Present !! : C:\WINDOWS\System32\SET26C.tmp
            Present !! : C:\WINDOWS\System32\SET26D.tmp
            Present !! : C:\WINDOWS\System32\SET26E.tmp
            Present !! : C:\WINDOWS\System32\SET282.tmp
            Present !! : C:\WINDOWS\System32\SET295.tmp
            Present !! : C:\WINDOWS\System32\SET29F.tmp
            Present !! : C:\WINDOWS\System32\SET2A2.tmp
            Present !! : C:\WINDOWS\System32\SET2A5.tmp
            Present !! : C:\WINDOWS\System32\SET2AB.tmp
            Present !! : C:\WINDOWS\System32\SET2B2.tmp
            Present !! : C:\WINDOWS\System32\SET2B4.tmp
            Present !! : C:\WINDOWS\System32\SET33A.tmp
            Present !! : C:\WINDOWS\System32\SET33D.tmp
            Present !! : C:\WINDOWS\System32\SET343.tmp
            Present !! : C:\WINDOWS\System32\SET34A.tmp
            Present !! : C:\WINDOWS\System32\SET34F.tmp
            Present !! : C:\WINDOWS\System32\SET350.tmp
            Present !! : C:\WINDOWS\System32\SET351.tmp
            Present !! : C:\WINDOWS\System32\SET35A.tmp
            Present !! : C:\WINDOWS\System32\SET35B.tmp
            Present !! : C:\WINDOWS\System32\SET35C.tmp
            Present !! : C:\WINDOWS\System32\SET366.tmp
            Present !! : C:\WINDOWS\System32\SET369.tmp
            Present !! : C:\WINDOWS\System32\SET36D.tmp
            Present !! : C:\WINDOWS\System32\SET36E.tmp
            Present !! : C:\WINDOWS\System32\SET375.tmp
            Present !! : C:\WINDOWS\System32\SET376.tmp
            Present !! : C:\WINDOWS\System32\SET386.tmp
            Present !! : C:\WINDOWS\System32\SET38D.tmp
            Present !! : C:\WINDOWS\System32\SET395.tmp
            Present !! : C:\WINDOWS\System32\SET398.tmp
            Present !! : C:\WINDOWS\System32\SET3A0.tmp
            Present !! : C:\WINDOWS\System32\SET3A1.tmp
            Present !! : C:\WINDOWS\System32\SET3A8.tmp
            Present !! : C:\WINDOWS\System32\SET3A9.tmp
            Present !! : C:\WINDOWS\System32\SET3C1.tmp
            Present !! : C:\WINDOWS\System32\SET3C2.tmp
            Present !! : C:\WINDOWS\System32\SET3C3.tmp
            Present !! : C:\WINDOWS\System32\SET3C4.tmp
            Present !! : C:\WINDOWS\System32\SET3C6.tmp
            Present !! : C:\WINDOWS\System32\SET3CA.tmp
            Present !! : C:\WINDOWS\System32\SET3CC.tmp
            Present !! : C:\WINDOWS\System32\SET3CE.tmp
            Present !! : C:\WINDOWS\System32\SET3CF.tmp
            Present !! : C:\WINDOWS\System32\SET3D1.tmp
            Present !! : C:\WINDOWS\System32\SET3D2.tmp
            Present !! : C:\WINDOWS\System32\SET400.tmp
            Present !! : C:\WINDOWS\System32\SET401.tmp
            Present !! : C:\WINDOWS\System32\SET403.tmp
            Present !! : C:\WINDOWS\System32\SET404.tmp
            Present !! : C:\WINDOWS\System32\SET406.tmp
            Present !! : C:\WINDOWS\System32\SET408.tmp
            Present !! : C:\WINDOWS\System32\SET40C.tmp
            Present !! : C:\WINDOWS\System32\SET40E.tmp
            Present !! : C:\WINDOWS\System32\SET40F.tmp
            Present !! : C:\WINDOWS\System32\SET410.tmp
            Present !! : C:\WINDOWS\System32\SET411.tmp
            Present !! : C:\WINDOWS\System32\SET44C.tmp
            Present !! : C:\WINDOWS\System32\SET44E.tmp
            Present !! : C:\WINDOWS\System32\SET451.tmp
            Present !! : C:\WINDOWS\System32\SET454.tmp
            Present !! : C:\WINDOWS\System32\SET45A.tmp
            Present !! : C:\WINDOWS\System32\SET467.tmp
            Present !! : C:\WINDOWS\System32\SET475.tmp
            Present !! : C:\WINDOWS\System32\SrchSTS.exe
            Present !! : C:\WINDOWS\System32\tmp.reg
            Present !! : C:\WINDOWS\System32\VACFix.exe
            Present !! : C:\WINDOWS\System32\VCCLSID.exe
            Present !! : C:\WINDOWS\System32\WS2Fix.exe
            Present !! : C:\Documents and Settings\barbara\Application Data\Update_HP_RedboxHprblog_HPSU.log
            Present !! : C:\Documents and Settings\barbara\Application Data\HPSU_48BitScanUpdate.log
            Present !! : C:\Documents and Settings\barbara\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
            Present !! : C:\Documents and Settings\barbara\LOCAL Settings\Temp\RtkBtMnt.exe

            ¤¤¤¤¤¤¤¤¤¤ Keys :

            Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
            Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoDrives
            Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
            Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
            Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASC3550P
            Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_ASC3550P
            Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_ASC3550P
            Present !! : HKLM\SYSTEM\CurrentControlSet\Services\bcm4sbxp
            Present !! : HKLM\SYSTEM\ControlSet001\Services\bcm4sbxp
            Present !! : HKLM\SYSTEM\ControlSet002\Services\bcm4sbxp
            Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Irmon
            Present !! : HKLM\SYSTEM\CurrentControlSet\Services\Irmon
            Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_Irmon
            Present !! : HKLM\SYSTEM\ControlSet001\Services\Irmon
            Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_Irmon
            Present !! : HKLM\SYSTEM\ControlSet002\Services\Irmon
            Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NPF
            Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NPF
            Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_NPF

            ============

            catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2010-05-18 12:06:09
            Windows 5.1.2600 Service Pack 3 FAT NTAPI

            scanning hidden processes ...

            scanning hidden services ...

            scanning hidden autostart entries ...

            scanning hidden files ...

            scan completed successfully
            hidden processes: 0
            hidden services: 0
            hidden files: 0

            Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

            device: opened successfully
            user: MBR read successfully
            called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spfg.sys >>UNKNOWN [0x86D81938]<<
            kernel: MBR read successfully
            user & kernel MBR OK

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
            FirstRunDisabled REG_DWORD 1 (0x1)
            AntiVirusDisableNotify REG_DWORD 0 (0x0)
            FirewallDisableNotify REG_DWORD 0 (0x0)
            UpdatesDisableNotify REG_DWORD 0 (0x0)
            AntiVirusOverride REG_DWORD 0 (0x0)
            FirewallOverride REG_DWORD 0 (0x0)

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

            End of scan : 12:06:10.37

            (désolée, ça passait pas en un seul message...)
            3. gen-hackman
              ▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
              mais cette fois-ci :

              ▶ choisis l'Option Clean

              ton PC va redemarrer,

              laisse travailler l'outil.

              en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

              ▶ colle le contenu dans ta reponse
              1. paz
                salut,

                bon j'ai essayé à deux reprises l'opération, mais le pc surchauffe et s'éteint. Que faire ?

                Je suis vraiment ennuyée par le fait que je n'ai plus accès au réglage de la luminosité (ePower d'acer (Error initiating..)) depuis que j'ai modifié le démarrage (msconfig).. Si quelqu'un a une alternative à ce problème (pas de solution trouvée sur le net sinon formater), ça me serait utile en attendant de régler le reste ! L'image est très sombre.

                merci.
                1. gen-hackman
                  hello pourquoi avoir modifie le demarrage par msconfig
                  ?G3?-?@¢??@?(TM)©®?

                  Discussions similaires

                  Analyse des logs hijackthis
                  philnoug

                  35 réponses
                  Infecte par un virus
                  sapard

                  3 réponses
                  Pc infecté "Rapport Hijackthis"
                  devillamine

                  53 réponses
                  Mon ordinateur a été infecté par un virus ou
                  henry4002

                  6 réponses
                  Hijackthis
                  The Dj

                  4 réponses