Probléme de lenteur avec mon PC
Résolu/Fermé
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
-
1 sept. 2010 à 14:58
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 16 sept. 2010 à 16:03
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 16 sept. 2010 à 16:03
A voir également:
- Probléme de lenteur avec mon PC
- Lenteur pc - Guide
- Test performance pc - Guide
- Reinitialiser pc - Guide
- Plus de son sur mon pc - Guide
- Mon pc s'allume mais ne démarre pas windows 10 - Guide
16 réponses
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
1 sept. 2010 à 15:16
1 sept. 2010 à 15:16
slt
regardez ceci: https://www.commentcamarche.net/informatique/windows/223-nettoyer-un-pc-devenu-lent-avec-les-outils-de-windows/
sinon pour voir si une infection n'en est pas responsable:
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
regardez ceci: https://www.commentcamarche.net/informatique/windows/223-nettoyer-un-pc-devenu-lent-avec-les-outils-de-windows/
sinon pour voir si une infection n'en est pas responsable:
Télécharge ici :
http://images.malwareremoval.com/random/RSIT.exe
random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.
Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.
Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
1 sept. 2010 à 15:37
1 sept. 2010 à 15:37
bonjour jlpjlp, merci pour ta réponse
je te colle le rapport de hijackthis:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Pierre at 2010-09-01 15:33:55
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 55 GB (48%) free of 114 GB
Total RAM: 766 MB (29% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:34:00, on 01/09/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Pierre\Bureau\RSIT.exe
C:\Program Files\trend micro\Pierre.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\WANADOO\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: Ouvrir dans WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
je te colle le rapport de hijackthis:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Pierre at 2010-09-01 15:33:55
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 55 GB (48%) free of 114 GB
Total RAM: 766 MB (29% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:34:00, on 01/09/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Pierre\Bureau\RSIT.exe
C:\Program Files\trend micro\Pierre.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\WANADOO\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: Ouvrir dans WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
1 sept. 2010 à 15:39
1 sept. 2010 à 15:39
désactivez le tea timer de spybot qui n'est pas utile et ralenti le pc
puis collez nous un rapport de nettoyage avec le logiciel ad remover
puis collez nous un rapport de nettoyage avec le logiciel ad remover
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
1 sept. 2010 à 15:57
1 sept. 2010 à 15:57
Ok, Merci
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
1 sept. 2010 à 16:33
1 sept. 2010 à 16:33
Voila le rapport de ad...
======= RAPPORT D'AD-REMOVER 2.0.0.1,D | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par C_XX le 26/07/10 à 12:00
Contact: AdRemover.contact[AT]gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 15:58:04 le 01/09/2010, Mode normal
Microsoft Windows XP Professionnel Service Pack 3 (X86)
Pierre@PIERRE ( )
============== ACTION(S) ==============
Service: "Application Updater" Stoppé et supprimé
0,Dossier supprimé: C:\Program Files\Application Updater
0,Dossier supprimé: C:\Documents and Settings\Pierre\Application Data\pdfforge
0,Dossier supprimé: C:\Program Files\pdfforge Toolbar
0,Dossier supprimé: C:\Documents and Settings\Pierre\Application Data\Search Settings
3,Fichier supprimé: C:\WINDOWS\Installer\1665d89.msi
(!) -- Fichiers temporaires supprimés.
1,Clé supprimée: HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
0,Clé supprimée: HKLM\Software\Application Updater
0,Clé supprimée: HKLM\Software\pdfforge
0,Clé supprimée: HKLM\Software\Search Settings
0,Clé supprimée: HKCU\Software\pdfforge
0,Clé supprimée: HKCU\Software\Search Settings
0,Clé supprimée: HKCU\Software\Winsudate
0,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
0,Valeur supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
0,Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Run|winusr
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{B922D405-6D13-4A2B-AE89-08A030DA4402}
============== SCAN ADDITIONNEL ==============
** Internet Explorer Version [8.0.6001.18702] **
[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
========================================
C:\Program Files\Ad-Remover\Quarantine: 31 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 13 Fichier(s)
C:\Ad-Report-CLEAN[1].txt - 01/09/2010 (878 Octet(s))
Fin à: 16:00:33, 01/09/2010
============== E.O.F ==============
======= RAPPORT D'AD-REMOVER 2.0.0.1,D | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par C_XX le 26/07/10 à 12:00
Contact: AdRemover.contact[AT]gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 15:58:04 le 01/09/2010, Mode normal
Microsoft Windows XP Professionnel Service Pack 3 (X86)
Pierre@PIERRE ( )
============== ACTION(S) ==============
Service: "Application Updater" Stoppé et supprimé
0,Dossier supprimé: C:\Program Files\Application Updater
0,Dossier supprimé: C:\Documents and Settings\Pierre\Application Data\pdfforge
0,Dossier supprimé: C:\Program Files\pdfforge Toolbar
0,Dossier supprimé: C:\Documents and Settings\Pierre\Application Data\Search Settings
3,Fichier supprimé: C:\WINDOWS\Installer\1665d89.msi
(!) -- Fichiers temporaires supprimés.
1,Clé supprimée: HKLM\Software\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
0,Clé supprimée: HKLM\Software\Application Updater
0,Clé supprimée: HKLM\Software\pdfforge
0,Clé supprimée: HKLM\Software\Search Settings
0,Clé supprimée: HKCU\Software\pdfforge
0,Clé supprimée: HKCU\Software\Search Settings
0,Clé supprimée: HKCU\Software\Winsudate
0,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
0,Valeur supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
0,Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Run|winusr
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{B922D405-6D13-4A2B-AE89-08A030DA4402}
============== SCAN ADDITIONNEL ==============
** Internet Explorer Version [8.0.6001.18702] **
[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
========================================
C:\Program Files\Ad-Remover\Quarantine: 31 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 13 Fichier(s)
C:\Ad-Report-CLEAN[1].txt - 01/09/2010 (878 Octet(s))
Fin à: 16:00:33, 01/09/2010
============== E.O.F ==============
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
1 sept. 2010 à 16:56
1 sept. 2010 à 16:56
télécharge et mets à jour malwarebyte antimalware puis colle un rapport d'une analyse rapide avec
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
1 sept. 2010 à 17:48
1 sept. 2010 à 17:48
Y a pas l air d'avoir grand chose
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4523
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
01/09/2010 17:47:06
mbam-log-2010-09-01 (17-47-06).txt
Type d'examen: Examen rapide
Elément(s) analysé(s): 142731
Temps écoulé: 17 minute(s), 58 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS (Malware.Trace) -> No action taken.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4523
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
01/09/2010 17:47:06
mbam-log-2010-09-01 (17-47-06).txt
Type d'examen: Examen rapide
Elément(s) analysé(s): 142731
Temps écoulé: 17 minute(s), 58 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS (Malware.Trace) -> No action taken.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
1 sept. 2010 à 21:51
1 sept. 2010 à 21:51
colle le rapport d'un antivirus en ligne comme panda ou kaspersk ou bitdefender
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
2 sept. 2010 à 23:19
2 sept. 2010 à 23:19
Je n'arrive a lancer aucune analyse, explorer se bloque qd le navigateur me demande d accepter le contol activix ??
Merci
Merci
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
3 sept. 2010 à 08:40
3 sept. 2010 à 08:40
tente de faire une analyse en ligne avec firefox
sinon colle le rapport d'une analyse avec dr web
https://www.commentcamarche.net/telecharger/securite/7749-dr-web-cureit/
sinon colle le rapport d'une analyse avec dr web
https://www.commentcamarche.net/telecharger/securite/7749-dr-web-cureit/
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
5 sept. 2010 à 00:21
5 sept. 2010 à 00:21
Je n'est reussi qu'avec dr web
RegUBP2b-Pierre.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Supprimé.;
A0042528.reg;C:\System Volume Information\_restore{ABCD4F26-8176-4D40-A16A-B4B03287030B}\RP437;Trojan.StartPage.1505;Supprimé.;
RegUBP2b-Pierre.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Supprimé.;
A0042528.reg;C:\System Volume Information\_restore{ABCD4F26-8176-4D40-A16A-B4B03287030B}\RP437;Trojan.StartPage.1505;Supprimé.;
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
6 sept. 2010 à 21:37
6 sept. 2010 à 21:37
télécharge combofix (par sUBs) ici :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et enregistre le sur le bureau.
déconnecte toi d'internet et ferme toutes tes applications.
désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)
double-clique sur combofix.exe et suis les instructions
à la fin, il va produire un rapport C:\ComboFix.txt
réactive ton parefeu, ton antivirus, la garde de ton antispyware
copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
Tu as un tutoriel complet ici :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
13 sept. 2010 à 18:38
13 sept. 2010 à 18:38
Voilà le rapport:
encore merci,
ComboFix 10-09-12.04 - Pierre 13/09/2010 17:28:52.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.766.400 [GMT 2:00]
Lancé depuis: c:\documents and settings\Pierre\Bureau\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\start.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll
c:\windows\Web\default.htt
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-13 au 2010-09-13 ))))))))))))))))))))))))))))))))))))
.
2010-09-13 11:54 . 2010-09-13 11:54 -------- d-----w- c:\documents and settings\Pierre\Application Data\Canneverbe Limited
2010-09-13 11:54 . 2010-09-13 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2010-09-13 11:54 . 2009-11-12 12:48 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-09-13 11:54 . 2010-09-13 11:54 -------- d-----w- c:\program files\CDBurnerXP
2010-09-12 17:32 . 2010-09-12 17:32 -------- d-----w- c:\documents and settings\Pierre\Application Data\Apowersoft
2010-09-12 17:32 . 2010-09-12 17:32 -------- d-----w- c:\program files\Apowersoft
2010-09-08 20:47 . 2010-09-08 20:47 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2010-09-05 06:40 . 2010-09-05 06:40 -------- d-----w- C:\found.000
2010-09-04 15:53 . 2010-09-04 19:22 -------- d-----w- c:\documents and settings\Pierre\DoctorWeb
2010-09-01 15:17 . 2010-09-01 15:17 -------- d-----w- c:\documents and settings\Pierre\Application Data\Malwarebytes
2010-09-01 15:17 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-01 15:17 . 2010-09-01 15:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-01 15:17 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-01 15:17 . 2010-09-01 15:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-01 13:57 . 2010-09-01 14:00 -------- d-----w- c:\program files\Ad-Remover
2010-09-01 13:32 . 2010-09-01 13:34 -------- d-----w- c:\program files\trend micro
2010-09-01 13:32 . 2010-09-01 13:33 -------- d-----w- C:\rsit
2010-08-27 16:20 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2010-08-27 16:20 . 2010-08-27 16:22 -------- d-----w- c:\program files\PDFCreator
2010-08-27 16:20 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2010-08-25 10:59 . 2010-08-25 10:59 -------- d-----w- c:\documents and settings\Pierre\Local Settings\Application Data\Help
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-12 17:46 . 2009-07-11 22:29 -------- d-----w- c:\documents and settings\Pierre\Application Data\vlc
2010-09-12 17:43 . 2009-08-02 12:49 -------- d-----w- c:\documents and settings\Pierre\Application Data\dvdcss
2010-09-09 20:49 . 2009-12-22 21:22 -------- d-----w- c:\documents and settings\Pierre\Application Data\MSN6
2010-09-09 08:57 . 2010-01-10 09:18 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-05 19:39 . 2009-07-12 18:49 1 ----a-w- c:\documents and settings\Pierre\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-01 13:51 . 2010-07-09 00:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-13 21:59 . 2010-08-13 21:59 -------- d-----w- c:\program files\Fichiers communs\Java
2010-08-13 21:59 . 2009-07-12 18:44 -------- d-----w- c:\program files\Java
2010-08-11 22:17 . 2005-01-23 17:26 493964 ----a-w- c:\windows\system32\perfh00C.dat
2010-08-11 22:17 . 2005-01-23 17:26 77758 ----a-w- c:\windows\system32\perfc00C.dat
2010-08-05 14:45 . 2010-08-05 14:45 503808 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28d248cc-n\msvcp71.dll
2010-08-05 14:45 . 2010-08-05 14:45 499712 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28d248cc-n\jmc.dll
2010-08-05 14:45 . 2010-08-05 14:45 348160 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28d248cc-n\msvcr71.dll
2010-08-05 14:45 . 2010-08-05 14:45 61440 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-609aed44-n\decora-sse.dll
2010-08-05 14:45 . 2010-08-05 14:45 12800 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-609aed44-n\decora-d3d.dll
2010-07-20 18:32 . 2010-07-14 07:54 -------- d-----w- c:\program files\Google
2010-07-20 17:34 . 2010-07-17 17:49 -------- d-----w- c:\program files\Tansee iPhone Transfer Photo
2010-07-20 17:33 . 2010-07-18 12:44 -------- d-----w- c:\program files\Konvertor
2010-07-20 17:30 . 2010-03-04 19:09 -------- d-----w- c:\program files\AVS4YOU
2010-07-20 17:28 . 2010-07-18 12:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-07-20 16:45 . 2010-07-20 16:45 2659040 ----a-w- c:\documents and settings\Pierre\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTransControlCenter.exe
2010-07-20 16:45 . 2010-07-20 16:44 5165240 ----a-w- c:\documents and settings\Pierre\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTransPhoto.exe
2010-07-18 12:11 . 2010-03-04 19:13 -------- d-----w- c:\documents and settings\Pierre\Application Data\AVS4YOU
2010-07-18 12:10 . 2010-03-04 19:12 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2010-07-17 20:47 . 2010-07-17 20:47 -------- d-----w- c:\documents and settings\Pierre\Application Data\iPodtoComputer
2010-07-17 20:46 . 2010-07-17 20:46 -------- d-----w- c:\program files\Cucusoft
2010-07-17 20:36 . 2010-07-17 20:36 -------- d-----w- c:\documents and settings\Pierre\Application Data\Xilisoft
2010-07-17 17:57 . 2010-07-17 17:55 -------- d-----w- c:\documents and settings\Pierre\Application Data\WindSolutions
2010-07-17 17:57 . 2010-07-17 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\WindSolutions
2010-07-17 17:55 . 2010-07-17 17:55 -------- d-----w- c:\program files\WindSolutions
2010-07-17 08:36 . 2009-07-05 18:36 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 08:36 . 2010-07-17 08:36 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-17 08:33 . 2009-07-05 18:36 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-17 03:00 . 2010-05-16 12:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-14 07:57 . 2010-07-14 07:57 49152 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-14 07:57 . 2010-07-14 07:57 308808 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-14 07:57 . 2010-07-14 07:57 14848 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-14 07:57 . 2010-07-14 07:57 40960 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-07-14 07:57 . 2010-07-14 07:57 341600 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-14 07:56 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-07-14 07:56 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-07-08 17:27 . 2010-07-08 17:27 72504 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-07-05 13:12 . 2009-07-05 18:34 43784 ----a-w- c:\documents and settings\Pierre\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:32 . 2005-01-23 17:27 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:25 . 2005-01-23 17:30 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2005-01-23 17:29 1852032 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2005-01-23 17:28 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2005-01-23 17:22 80384 ----a-w- c:\windows\system32\iccvid.dll
2009-06-29 17:35 . 2009-06-29 17:35 11208 -c-ha-w- c:\program files\folder.htt
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 08:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2010-07-27 06:30 8518656 ----a-w- c:\windows\SYSTEM32\shell32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
"nwiz"="nwiz.exe" [2006-08-16 1617920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16126464]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2010-07-14 202256]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 08:36 12536 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Pierre^Menu Démarrer^Programmes^Démarrage^DeliveryManager.lnk]
path=c:\documents and settings\Pierre\Menu Démarrer\Programmes\Démarrage\DeliveryManager.lnk
backup=c:\windows\pss\DeliveryManager.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Pierre^Menu Démarrer^Programmes^Démarrage^Notification de cadeaux MSN.lnk]
path=c:\documents and settings\Pierre\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk
backup=c:\windows\pss\Notification de cadeaux MSN.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [05/07/2009 20:36 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [05/07/2009 20:36 243024]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [17/07/2010 10:33 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [17/07/2010 10:36 308136]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 camfilt2;camfilt2;c:\windows\SYSTEM32\DRIVERS\camfilt2.sys [16/03/2010 17:20 98432]
S0 Cdr4vsd;Cdr4vsd; [x]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14/07/2010 10:04 135664]
S3 AsAudioDevice_351;AsAudioDevice_351;c:\windows\SYSTEM32\DRIVERS\AsAudioDevice_351.sys [04/01/2010 19:59 16640]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenu du dossier 'Tâches planifiées'
2010-07-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-14 08:04]
2010-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-14 08:04]
2010-09-13 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-1085031214-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
2010-09-13 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-1085031214-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
2010-09-13 c:\windows\Tasks\User_Feed_Synchronization-{59FF59B4-ED1E-45A8-A886-ED1D8B62B479}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/portail
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Ouvrir dans WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-WOOKIT - c:\progra~1\WANADOO\Shell.exe
AddRemove-Notification de cadeaux MSN - c:\documents and settings\Pierre\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-13 17:47
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\.*I61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*P7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*FAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*RAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*RAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PBM*P7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*WBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XBM*WPG*WMXCF*XBM*WPXPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*DCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*DCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*ICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PCD*PBM*P7PCT*PCD*PBPCX*PCT*PCPDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PCT*PCD*PBPCX*PCT*PCPDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PCX*PCT*PCPDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XCF*XBM*WPXPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*VDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*RGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*TGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*DIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*GIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*TIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*TIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*VID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*VIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*BMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*EMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*WMF*WBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PNG*PM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PNM*PNG*PMPPM*PNM*PNPSD*PPM*PNPWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*FPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PPM*PNM*PNPSD*PPM*PNPWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*WPG*WMF*WBXBM*WPG*WMXCF*XBM*WPXPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*ARF*2BP*Y*ART*ARF*2BAVS*ART*ARBMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*ART*ARF*2BAVS*ART*ARBMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PSD*PPM*PNPWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*FTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*CUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*CUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*YUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*AVS*ART*ARBMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*EXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(3184)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lexmark 1200 Series\lxczbmon.exe
c:\windows\RTHDCPL.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-09-13 17:58:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-13 15:58
Avant-CF: 58 313 916 416 octets libres
Après-CF: 58 366 021 632 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout = 30
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn
- - End Of File - - D0A49FFE8AFB5F75560D61DAD8A30119
encore merci,
ComboFix 10-09-12.04 - Pierre 13/09/2010 17:28:52.1.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.766.400 [GMT 2:00]
Lancé depuis: c:\documents and settings\Pierre\Bureau\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\start.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll
c:\windows\Web\default.htt
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((((((( Fichiers créés du 2010-08-13 au 2010-09-13 ))))))))))))))))))))))))))))))))))))
.
2010-09-13 11:54 . 2010-09-13 11:54 -------- d-----w- c:\documents and settings\Pierre\Application Data\Canneverbe Limited
2010-09-13 11:54 . 2010-09-13 11:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2010-09-13 11:54 . 2009-11-12 12:48 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-09-13 11:54 . 2010-09-13 11:54 -------- d-----w- c:\program files\CDBurnerXP
2010-09-12 17:32 . 2010-09-12 17:32 -------- d-----w- c:\documents and settings\Pierre\Application Data\Apowersoft
2010-09-12 17:32 . 2010-09-12 17:32 -------- d-----w- c:\program files\Apowersoft
2010-09-08 20:47 . 2010-09-08 20:47 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2010-09-05 06:40 . 2010-09-05 06:40 -------- d-----w- C:\found.000
2010-09-04 15:53 . 2010-09-04 19:22 -------- d-----w- c:\documents and settings\Pierre\DoctorWeb
2010-09-01 15:17 . 2010-09-01 15:17 -------- d-----w- c:\documents and settings\Pierre\Application Data\Malwarebytes
2010-09-01 15:17 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-01 15:17 . 2010-09-01 15:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-01 15:17 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-01 15:17 . 2010-09-01 15:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-01 13:57 . 2010-09-01 14:00 -------- d-----w- c:\program files\Ad-Remover
2010-09-01 13:32 . 2010-09-01 13:34 -------- d-----w- c:\program files\trend micro
2010-09-01 13:32 . 2010-09-01 13:33 -------- d-----w- C:\rsit
2010-08-27 16:20 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2010-08-27 16:20 . 2010-08-27 16:22 -------- d-----w- c:\program files\PDFCreator
2010-08-27 16:20 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2010-08-25 10:59 . 2010-08-25 10:59 -------- d-----w- c:\documents and settings\Pierre\Local Settings\Application Data\Help
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-12 17:46 . 2009-07-11 22:29 -------- d-----w- c:\documents and settings\Pierre\Application Data\vlc
2010-09-12 17:43 . 2009-08-02 12:49 -------- d-----w- c:\documents and settings\Pierre\Application Data\dvdcss
2010-09-09 20:49 . 2009-12-22 21:22 -------- d-----w- c:\documents and settings\Pierre\Application Data\MSN6
2010-09-09 08:57 . 2010-01-10 09:18 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-05 19:39 . 2009-07-12 18:49 1 ----a-w- c:\documents and settings\Pierre\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-01 13:51 . 2010-07-09 00:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-13 21:59 . 2010-08-13 21:59 -------- d-----w- c:\program files\Fichiers communs\Java
2010-08-13 21:59 . 2009-07-12 18:44 -------- d-----w- c:\program files\Java
2010-08-11 22:17 . 2005-01-23 17:26 493964 ----a-w- c:\windows\system32\perfh00C.dat
2010-08-11 22:17 . 2005-01-23 17:26 77758 ----a-w- c:\windows\system32\perfc00C.dat
2010-08-05 14:45 . 2010-08-05 14:45 503808 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28d248cc-n\msvcp71.dll
2010-08-05 14:45 . 2010-08-05 14:45 499712 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28d248cc-n\jmc.dll
2010-08-05 14:45 . 2010-08-05 14:45 348160 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-28d248cc-n\msvcr71.dll
2010-08-05 14:45 . 2010-08-05 14:45 61440 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-609aed44-n\decora-sse.dll
2010-08-05 14:45 . 2010-08-05 14:45 12800 ----a-w- c:\documents and settings\Pierre\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-609aed44-n\decora-d3d.dll
2010-07-20 18:32 . 2010-07-14 07:54 -------- d-----w- c:\program files\Google
2010-07-20 17:34 . 2010-07-17 17:49 -------- d-----w- c:\program files\Tansee iPhone Transfer Photo
2010-07-20 17:33 . 2010-07-18 12:44 -------- d-----w- c:\program files\Konvertor
2010-07-20 17:30 . 2010-03-04 19:09 -------- d-----w- c:\program files\AVS4YOU
2010-07-20 17:28 . 2010-07-18 12:46 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-07-20 16:45 . 2010-07-20 16:45 2659040 ----a-w- c:\documents and settings\Pierre\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTransControlCenter.exe
2010-07-20 16:45 . 2010-07-20 16:44 5165240 ----a-w- c:\documents and settings\Pierre\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTransPhoto.exe
2010-07-18 12:11 . 2010-03-04 19:13 -------- d-----w- c:\documents and settings\Pierre\Application Data\AVS4YOU
2010-07-18 12:10 . 2010-03-04 19:12 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2010-07-17 20:47 . 2010-07-17 20:47 -------- d-----w- c:\documents and settings\Pierre\Application Data\iPodtoComputer
2010-07-17 20:46 . 2010-07-17 20:46 -------- d-----w- c:\program files\Cucusoft
2010-07-17 20:36 . 2010-07-17 20:36 -------- d-----w- c:\documents and settings\Pierre\Application Data\Xilisoft
2010-07-17 17:57 . 2010-07-17 17:55 -------- d-----w- c:\documents and settings\Pierre\Application Data\WindSolutions
2010-07-17 17:57 . 2010-07-17 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\WindSolutions
2010-07-17 17:55 . 2010-07-17 17:55 -------- d-----w- c:\program files\WindSolutions
2010-07-17 08:36 . 2009-07-05 18:36 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-17 08:36 . 2010-07-17 08:36 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-17 08:33 . 2009-07-05 18:36 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-17 03:00 . 2010-05-16 12:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-14 07:57 . 2010-07-14 07:57 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-14 07:57 . 2010-07-14 07:57 49152 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-14 07:57 . 2010-07-14 07:57 308808 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-14 07:57 . 2010-07-14 07:57 14848 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-14 07:57 . 2010-07-14 07:57 40960 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-07-14 07:57 . 2010-07-14 07:57 341600 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-14 07:56 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-07-14 07:56 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-07-08 17:27 . 2010-07-08 17:27 72504 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
2010-07-05 13:12 . 2009-07-05 18:34 43784 ----a-w- c:\documents and settings\Pierre\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:32 . 2005-01-23 17:27 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:25 . 2005-01-23 17:30 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2005-01-23 17:29 1852032 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2005-01-23 17:28 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2005-01-23 17:22 80384 ----a-w- c:\windows\system32\iccvid.dll
2009-06-29 17:35 . 2009-06-29 17:35 11208 -c-ha-w- c:\program files\folder.htt
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-04-19 08:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2010-07-27 06:30 8518656 ----a-w- c:\windows\SYSTEM32\shell32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]
"nwiz"="nwiz.exe" [2006-08-16 1617920]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16126464]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2010-07-14 202256]
"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 08:36 12536 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Pierre^Menu Démarrer^Programmes^Démarrage^DeliveryManager.lnk]
path=c:\documents and settings\Pierre\Menu Démarrer\Programmes\Démarrage\DeliveryManager.lnk
backup=c:\windows\pss\DeliveryManager.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Pierre^Menu Démarrer^Programmes^Démarrage^Notification de cadeaux MSN.lnk]
path=c:\documents and settings\Pierre\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk
backup=c:\windows\pss\Notification de cadeaux MSN.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 14:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [05/07/2009 20:36 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [05/07/2009 20:36 243024]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [17/07/2010 10:33 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [17/07/2010 10:36 308136]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 13:31 92008]
R3 camfilt2;camfilt2;c:\windows\SYSTEM32\DRIVERS\camfilt2.sys [16/03/2010 17:20 98432]
S0 Cdr4vsd;Cdr4vsd; [x]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14/07/2010 10:04 135664]
S3 AsAudioDevice_351;AsAudioDevice_351;c:\windows\SYSTEM32\DRIVERS\AsAudioDevice_351.sys [04/01/2010 19:59 16640]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenu du dossier 'Tâches planifiées'
2010-07-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2010-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-14 08:04]
2010-09-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-14 08:04]
2010-09-13 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-1085031214-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
2010-09-13 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-1085031214-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
2010-09-13 c:\windows\Tasks\User_Feed_Synchronization-{59FF59B4-ED1E-45A8-A886-ED1D8B62B479}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/portail
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Ouvrir dans WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-WOOKIT - c:\progra~1\WANADOO\Shell.exe
AddRemove-Notification de cadeaux MSN - c:\documents and settings\Pierre\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-13 17:47
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\.*I61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*P7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*FAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*RAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*RAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PBM*P7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*WBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XBM*WPG*WMXCF*XBM*WPXPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*DCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*DCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*ICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PCD*PBM*P7PCT*PCD*PBPCX*PCT*PCPDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PCT*PCD*PBPCX*PCT*PCPDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PCX*PCT*PCPDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XCF*XBM*WPXPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PDB*PCX*PCPDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PDD*PDB*PCPGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*VDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PGM*PDD*PDPIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*RGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*TGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*DIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*GIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PIX*PGM*PDPM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*TIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*TIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*VID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*VIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*BMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*EMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*WMF*WBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PNG*PM]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PNM*PNG*PMPPM*PNM*PNPSD*PPM*PNPWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*FPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*JPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PPM*PNM*PNPSD*PPM*PNPWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*WPG*WMF*WBXBM*WPG*WMXCF*XBM*WPXPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XPM*XCF*XBXWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*ARF*2BP*Y*ART*ARF*2BAVS*ART*ARBMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*ART*ARF*2BAVS*ART*ARBMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PSD*PPM*PNPWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*FTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*CUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*CUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*SUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*YUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*AVS*ART*ARBMP*AVS*ARCUR*BMP*AVCUT*CUR*BMDCM*CUT*CUDCX*DCM*CUDIB*DCX*DCEMF*DIB*DCEXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*MVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*PWP*PSD*PPRAD*PWP*PSRAS*RAD*PWRGB*RAS*RASCT*RGB*RASFW*SCT*RGSGI*SFW*SCSUN*SGI*SFTGA*SUN*SGTIF*TGA*SUTIM*TIF*TGVDA*TIM*TIVID*VDA*TIVIF*VID*VDWBMP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*XWD*XPM*XCYUV*XWD*XP]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\.*EXF*EMF*DIFAX*EXF*EMFPX*FAX*EXFTS*FPX*FAGIF*FTS*FPI61*GIF*FTICO*I61*GIJFF*ICO*I6JP2*JFF*ICJPC*JP2*JFJPG*JPC*JPJPS*JPG*JPMAT*JPS*JPMIF*MAT*JPMNG*MIF*MAMTV*MNG*MIMVG*MTV*MNP7]
@Class="REG_SZ"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(3184)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lexmark 1200 Series\lxczbmon.exe
c:\windows\RTHDCPL.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2010-09-13 17:58:49 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-13 15:58
Avant-CF: 58 313 916 416 octets libres
Après-CF: 58 366 021 632 octets libres
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout = 30
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Professionnel" /fastdetect /NoExecute=OptIn
- - End Of File - - D0A49FFE8AFB5F75560D61DAD8A30119
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
13 sept. 2010 à 20:12
13 sept. 2010 à 20:12
les antivirus en ligne remarchent?
titooof
Messages postés
9
Date d'inscription
mercredi 1 septembre 2010
Statut
Membre
Dernière intervention
15 septembre 2010
15 sept. 2010 à 23:27
15 sept. 2010 à 23:27
ouais, super je te remercie.
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
16 sept. 2010 à 16:03
16 sept. 2010 à 16:03
ils trouvent une infection?
