pc hyper lent souris incontrolable Résolu

Question

Bonjour, 

j ai un gros soucis mon pc marche très lentement
. quand je veux ouvrir par exemple une icone que j'ai sur mon bureau , j'ai un mal fou et l'icone suit le curseur de ma souris.
j'ai un rapport ci dessous merci d'avance pour la suite..

Rapport de ZHPDiag v1.26.582 par Nicolas Coolman, Update du 03/09/2010
Run by HP_Propriétaire at 05/09/2010 11:49:45
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\ Web Browser
MSIE: Internet Explorer v8.0.6001.18702

---\ System Information
Platform : Microsoft Windows XP (5.1.2600) Service Pack 3
Processor: x86 Family 15 Model 12 Stepping 0, AuthenticAMD
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1023 MB (40% free)
System drive C: has 36 GB (25%) free of 144 GB

---\ Logged in mode
Computer Name: NOM-641695C7437
User Name: HP_Propriétaire
All Users Names: SUPPORT_fddfa904, SUPPORT_388945a0, HP_Propriétaire, HelpAssistant, ASPNET, Administrateur, 
Unselected Option:  O1,O45,O61,O65,O82
Logged in as Administrator

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 36 Go of 144 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 58 Go of 153 Go)
E:\ Hard drive, Flash drive, Thumb drive (Free 1 Go of 5 Go)
F:\ CD-ROM drive (Not Inserted)
G:\ CD-ROM drive (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
J:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
K:\ Floppy drive, Flash card reader, USB Key (Not Inserted)


---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: OK


---\ Processus lancés
[MD5.279764BFCE70AF320AA48E9C4A4B4721] - (.Lavasoft - Ad-Aware Service Application.) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe   [1355928]
[MD5.9015BC03F62940527EC92D45EE89E46F] - (.Avira GmbH - Antivirus Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe   [108289]
[MD5.B8720A787C1223492E6F319465E996CE] - (.Avira GmbH - Antivirus On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe   [185089]
[MD5.557F35D1CA42AEA14A6690E21887A31F] - (.Apple Inc. - Apple Mobile Device Service.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe   [144712]
[MD5.3F56903E124E820AEECE6D471583C6C1] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe   [238888]
[MD5.B0C9FFF54F16DF2012F53A34736A0975] - (.France Telecom SA - Orange Connection Kit.) -- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe   [69632]
[MD5.67CF1F160CE06E45793EFB6D2FA41E16] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 61.72.) -- C:\WINDOWS\system32
vsvc32.exe   [114755]
[MD5.D31F88C5F19EEFA366A415D6BC5F2ABC] - (.HP - PML Driver.) -- C:\WINDOWS\system32\HPZipm12.exe   [69632]
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe   [135664]
[MD5.7234E4B852F8FA0C48FF0E4FD7394490] - (.Sunbelt Software - Sunbelt Firewall Service.) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe   [1234480]
[MD5.A464B1F7249B9893AB3F08CDA55F18E5] - (.Sunbelt Software - Sunbelt Firewall GUI.) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe   [1967664]
[MD5.06A1ECB63DF139EC639E084D4AB3C9D7] - (.Hewlett-Packard Company - hpsysdrv.) -- C:\windows\system\hpsysdrv.exe   [52736]
[MD5.A6FD829F428F6445B8F72FF725438590] - (.Hewlett-Packard - HPHmon06.) -- C:\WINDOWS\system32\hphmon06.exe   [659456]
[MD5.4A95F15B706B8FD9EC8715B6401EAB7B] - (.Hewlett-Packard Company - KBD EXE.) -- C:\HP\KBD\KBD.EXE   [61440]
[MD5.ECDCFBEA4CAEAF2DD5E9D0092396DFC1] - (.Silicon Integrated Systems Corporation - SiS Compatible Super VGA Keyboard Daemon.) -- C:\WINDOWS\system32\keyhook.exe   [249856]
[MD5.E7BE65BF79906AEBC698E077D53F6A1C] - (.Agere Systems - SoftModem Messaging Applet.) -- C:\WINDOWS\AGRSMMSG.exe   [88363]
[MD5.D40191AA225638AB20E59524CDD74030] - (.THOMSON Telecom Belgium - SpeedTouch Statistics.) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe   [866816]
[MD5.C52E2D526A576D0917A8829D325DDE86] - (.Pas de propriétaire - UMonit MFC Application.) -- C:\WINDOWS\system32\UMonit.exe   [200704]
[MD5.C5F49EEBA10F86A5AF1C2D7B126A90FF] - (.Sony Corporation - Content Transfer Walkman Detector.) -- C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe   [423200]
[MD5.29680A793F690EEF4AAA68479D2A6DF8] - (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe   [209153]
[MD5.72DE9723E5203A5C5D284C6D001A1D14] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe   [717552]
[MD5.E00765FD4417D4C60325BD49279D5C62] - (.Orange - Executable Orange Inside.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe   [812032]
[MD5.527F995C40417C0F4EBB74ACA98F915A] - (.France Telecom SA - Orange Connection Kit.) -- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe   [90112]
[MD5.ABC9091B6D438381DBACFD1A82E0C0EA] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe   [282624]
[MD5.682DB04704A74F228A080B31003B6FC6] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe   [974848]
[MD5.CAF2CCB6E9F5FDBE99EE8904EB9DC506] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe   [495616]
[MD5.8E884B0A19679340BFFF5C157075D6B5] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe   [53248]
[MD5.8387F133A6EDB0B97C41CB55CEDBA041] - (.Lavasoft - Ad-Aware Tray Application.) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe   [864624]
[MD5.B60DDDD2D63CE41CB8C487FCFBB6419E] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe   [638816]
[MD5.7EE856AB0E8D63B4D180CE580E14A376] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [548352]


---\ Plugins de navigateurs Opera/Firefox(P1/P2)
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\iTunes\Mozilla Plugins
pitunes.dll
P2 - FPN: [HKLM] [@garmin.com/GpsControl] - (.GARMIN Corp. - Garmin Communicator Plug-In 2.8.3.0.) -- C:\Program Files\Garmin GPS Plugin
pGarmin.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.50826.0.) -- C:\Program Files\Microsoft Silverlight\4.0.50826.0
pctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (.not file.)
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=8] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.2.183.23
pGoogleOneClick8.dll


---\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"


---\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp


---\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/toolbar/ie8/sidebar.html


---\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (8.00.6001.18939 (longhorn_ie8_gdr.100616-1700)) -- C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} . (.Pas de propriétaire - Pas de description.) (No version) -- C:\Program Files\Orange\Connexion Internet Orange\SearchURLHook\SearchPageURL.dll


---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} . (.Microsoft Corporation - Search Helper for Internet Explorer.) -- C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IE Developer Toolbar BHO - {CC7E636D-39AA-49b6-B511-65413DA137A1} . (.Microsoft Corporation - Internet Explorer Developer Toolbar.) -- C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} . (.Pas de propriétaire - Pas de description.) -- (.not file.)


---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} . (.Hewlett-Packard Company - hp view toolbar.) -- c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} . (.Pas de propriétaire - Pas de description.) --  (.not file.)
O3 - Toolbar: barre d'outils Orange - {D3028143-6145-4318-99D3-3EDCE54A95A9} . (.Orange - IE Toolbar Container.) -- C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll
O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} . (.Pas de propriétaire - Pas de description.) --  (.not file.)
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (.Pas de propriétaire - Pas de description.) --  (.not file.)


---\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [hpsysdrv] . (.Hewlett-Packard Company - hpsysdrv.) -- c:\windows\system\hpsysdrv.exe 
O4 - HKLM\..\Run: [HPHmon06] . (.Hewlett-Packard - HPHmon06.) -- C:\WINDOWS\system32\hphmon06.exe 
O4 - HKLM\..\Run: [KBD] . (.Hewlett-Packard Company - KBD EXE.) -- C:\HP\KBD\KBD.exe 
O4 - HKLM\..\Run: [Recguard] . (.Pas de propriétaire - Recguard Application.) -- C:\WINDOWS\SMINST\RECGUARD.exe 
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll 
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe 
O4 - HKLM\..\Run: [SiS Windows KeyHook] . (.Silicon Integrated Systems Corporation - SiS Compatible Super VGA Keyboard Daemon.) -- C:\WINDOWS\system32\keyhook.exe 
O4 - HKLM\..\Run: [AGRSMMSG] . (.Agere Systems - SoftModem Messaging Applet.) -- C:\Windows\AGRSMMSG.exe 
O4 - HKLM\..\Run: [PS2] . (.Hewlett-Packard Company - PS2 EXE.) -- C:\WINDOWS\system32\ps2.exe 
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] . (.THOMSON Telecom Belgium - SpeedTouch Statistics.) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe 
O4 - HKLM\..\Run: [UMonit] . (.Pas de propriétaire - UMonit MFC Application.) -- C:\WINDOWS\system32\UMonit.exe 
O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] . (.Sony Corporation - Content Transfer Walkman Detector.) -- C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe 
O4 - HKLM\..\Run: [AppleSyncNotifier] . (.Apple Inc. - AppleSyncNotifier.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe 
O4 - HKLM\..\Run: [avgnt] . (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe 
O4 - HKLM\..\Run: [ORAHSSSessionManager] . (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\SessionManager\SessionManager.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe 
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [orangeinside] . (.Orange - Executable Orange Inside.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe 
O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe 
O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [orangeinside] . (.Orange - Executable Orange Inside.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe 


---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: ajouter cette page à vos favoris Orange - (.not file.) - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\cce11E.html
O8 - Extra context menu item: orange.fr . (.Pas de propriétaire - Pas de description.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\src\orange_html\orange.html
O8 - Extra context menu item: traduire la page - (.not file.) - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\cce11C.html
O8 - Extra context menu item: traduire le texte sélectionné - (.not file.) - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\cce11D.html
O8 - Extra context menu item: _orange.fr . (.Pas de propriétaire - Pas de description.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\src\orange_html\orange.html


---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.not file.) - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} . (.Microsoft Corporation - Internet Explorer Developer Toolbar.) -- C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} . (.not file.) - (.not file.)


---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files\Bonjour\mdnsNSP.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\WINDOWS\system32\wshbth.dll


---\ Piratage de l'Option 'Rétablir les paramètres Web' (O14)
O14 - IERESET.INF: START_PAGE_URL=START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome


---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5A779DC0-837B-4590-AC42-C7C0847478C5} (OrangeInstaller_ModuleIE Control) - http://logicielsgratuits.orange.fr/download_service/Install/OrangeInstaller.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} () - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab


---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{03D5B8EA-18B5-4ABE-AFD8-66E9B081FDDE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{03D5B8EA-18B5-4ABE-AFD8-66E9B081FDDE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{03D5B8EA-18B5-4ABE-AFD8-66E9B081FDDE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1


---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\System32\dimsntfy.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\System32\igfxsrvc.dll


---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll


---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll


---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) . (.Avira GmbH - Antivirus Scheduler.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) . (.Avira GmbH - Antivirus On-Access Service.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device (Apple Mobile Device) . (.Apple Inc. - Apple Mobile Device Service.) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) . (.France Telecom SA - Orange Connection Kit.) - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lavasoft Ad-Aware Service (Lavasoft Ad-Aware Service) . (.Lavasoft - Ad-Aware Service Application.) - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 61.72.) - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 (Pml Driver HPZ12) . (.HP - PML Driver.) - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) . (.Sunbelt Software - Sunbelt Firewall Service.) - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe


---\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) -  (.not file.)


---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\User_Feed_Synchronization-{C4CA4977-2455-4245-971A-D452668B9EB6}.job


---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\binegutils.dll
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\msnetmtg.inf
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\msmsgs.inf
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\wmp11.inf
O40 - ASIC: Fax - {8b15971b-5355-4c82-8c07-7e181ea07608} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\fxsocm.inf
O40 - ASIC: Adobe Flash Player 9 ActiveX - {D27CDB6E-AE6D-11cf-96B8-444553540000} . (.Adobe Systems, Inc. - Adobe Flash Player 10.0 r45.) -- C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx


---\ Pilotes lancés au démarrage (O41)
O41 - Driver: Avg Anti-Rootkit Clean Driver (AvgArCln) . (.GRISOFT, s.r.o. - AVG7 Clean Driver.) - C:\Windows\system32\DRIVERS\AvgArCln.sys
O41 - Driver: avgio (avgio) . (.Avira GmbH - Avira AntiVir Support for Minifilter.) - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
O41 - Driver: avipbb (avipbb) . (.Avira GmbH - Avira Driver for RootKit Detection.) - C:\Windows\system32\DRIVERS\avipbb.sys
O41 - Driver: FNETDEVI (FNETDEVI) . (.FNet Co., Ltd. - FNETDEVI.SYS.) - C:\WINDOWS\system32\drivers\FNETDEVI.sys
O41 - Driver: Firewall Driver (fwdrv) . (.Sunbelt Software - Sunbelt Personal Firewall FWDRV.) - C:\WINDOWS\system32\drivers\fwdrv.sys
O41 - Driver: Kerio HIPS Driver (khips) . (.Sunbelt Software - Sunbelt Personal Firewall Host Intrusion Pr.) - C:\WINDOWS\system32\drivers\khips.sys
O41 - Driver: (SiSkp) . (.Silicon Integrated Systems Corporation - SiS VGA Driver Manager.) - C:\Windows\system32\DRIVERS\srvkp.sys
O41 - Driver: ssmdrv (ssmdrv) . (.Avira GmbH - AVIRA SnapShot Driver.) - C:\Windows\system32\DRIVERS\ssmdrv.sys


---\ Logiciels installés (O42)
O42 - Logiciel: Ad-Aware - (.Lavasoft.) [HKLM] -- Ad-Aware
O42 - Logiciel: Ad-Aware - (.Lavasoft.) [HKLM] -- {DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Flash Player 9 ActiveX - (.Adobe Systems.) [HKLM] -- ShockwaveFlash
O42 - Logiciel: Adobe Reader 9.3.4 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A93000000001}
O42 - Logiciel: Agere Systems PCI Soft Modem - (.Pas de propriétaire.) [HKLM] -- Agere Systems Soft Modem
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM] -- {3FA365DF-2D68-45ED-8F83-8C8A33E65143}
O42 - Logiciel: Apple Mobile Device Support - (.Apple Inc..) [HKLM] -- {AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM] -- {6956856F-B6B3-4BE0-BA0B-8F495BE32033}
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
O42 - Logiciel: Avira AntiVir Personal - Free Antivirus - (.Avira GmbH.) [HKLM] -- Avira AntiVir Desktop
O42 - Logiciel: Bonjour - (.Apple Inc..) [HKLM] -- {07287123-B8AC-41CE-8346-3D777245C35B}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: Connexion Internet Orange - (.Pas de propriétaire.) [HKLM] -- {ORAHSS}.UninstallSuite
O42 - Logiciel: Content Transfer - (.Sony Corporation.) [HKLM] -- {CFADE4AF-C0CF-4A04-A776-741318F1658F}
O42 - Logiciel: Creative WebCam NX Driver (1.02.01.0827) - (.Pas de propriétaire.) [HKLM] -- Creative PD1110
O42 - Logiciel: EVEREST Home Edition v2.20 - (.Lavalys Inc.) [HKLM] -- EVEREST Home Edition_is1
O42 - Logiciel: FAT32 Format - (.Pas de propriétaire.) [HKLM] -- FAT32 Format
O42 - Logiciel: Free Mp3 Wma Converter V 1.81 - (.Pas de propriétaire.) [HKLM] -- Free Mp3 Wma Converter_is1
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {1EE04769-91C4-4A06-92B7-FCAFE6BABDD9}
O42 - Logiciel: Garmin Communicator Plugin - (.Garmin Ltd or its subsidiaries.) [HKLM] -- {03737893-5BEE-4C78-9C58-3AE7F172BBBE}
O42 - Logiciel: Garmin USB Drivers - (.Garmin Ltd or its subsidiaries.) [HKLM] -- {65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}
O42 - Logiciel: Genesys USB Mass Storage Device - (.Genesys Logic.) [HKLM] -- {959B7F35-2819-40C5-A0CD-3C53B5FCC935}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: HP Customer Participation Program 7.0 - (.HP.) [HKLM] -- HPExtendedCapabilities
O42 - Logiciel: HP Deskjet Preloaded Printer Drivers - (.Hewlett-Packard Company.) [HKLM] -- {F419D20A-7719-4639-8E30-C073A040D878}
O42 - Logiciel: HP Image Zone 4.2 - (.HP.) [HKLM] -- HP Photo & Imaging
O42 - Logiciel: HP Image Zone Plus 4.2 - (.HP.) [HKLM] -- {5E1494D4-3562-4FFB-B35C-600F80F6934C}
O42 - Logiciel: HP Imaging Device Functions 7.0 - (.HP.) [HKLM] -- HP Imaging Device Functions
O42 - Logiciel: HP PSC & OfficeJet 4.0 - (.HP.) [HKLM] -- {A1062847-0846-427A-92A1-BB8251A91E91}
O42 - Logiciel: HP Photosmart Essential - (.HP.) [HKLM] -- {6994491D-D491-48F1-AE1F-E179C1FFFC2F}
O42 - Logiciel: HP Photosmart, Officejet and Deskjet 7.0.A - (.HP.) [HKLM] -- {BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}
O42 - Logiciel: HP Software Update - (.Hewlett-Packard.) [HKLM] -- {457791C5-D702-4143-A7B2-2744BE9573F2}
O42 - Logiciel: HP Solution Center 7.0 - (.HP.) [HKLM] -- HP Solution Center & Imaging Support Tools
O42 - Logiciel: HPIZ402 - (.Hewlett-Packard.) [HKLM] -- {8D9768AE-DE42-4A04-A461-2361A58C384D}
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5
O42 - Logiciel: Hotfix for Windows XP (KB976002-v5) - (.Microsoft Corporation.) [HKLM] -- KB976002-v5
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {133742BA-6F46-4D3E-85AF-78631D9AD8B8}
O42 - Logiciel: InterVideo WinDVD Creator 2 - (.InterVideo Inc..) [HKLM] -- {2FCE4FC5-6930-40E7-A4F1-F862207424EF}
O42 - Logiciel: InterVideo WinDVD Player - (.InterVideo Inc..) [HKLM] -- {91810AFC-A4F8-4EBA-A5AA-B198BBC81144}
O42 - Logiciel: Internet Explorer Developer Toolbar - (.Microsoft.) [HKLM] -- {E7081891-BC7F-43F9-9CE6-B5DD2F497156}
O42 - Logiciel: Java(TM) 6 Update 15 - (.Sun Microsystems, Inc..) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216011FF}
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {8E5233E1-7495-44FB-8DEB-4BE906D59619}
O42 - Logiciel: K-Lite Codec Pack 4.4.2 (Full) - (.Pas de propriétaire.) [HKLM] -- KLiteCodecPack_is1
O42 - Logiciel: KBD - (.Pas de propriétaire.) [HKLM] -- KBD
O42 - Logiciel: Lecteur Windows Media 11 - (.Pas de propriétaire.) [HKLM] -- Windows Media Player
O42 - Logiciel: Logiciel d'archivage WinRAR - (.Pas de propriétaire.) [HKLM] -- WinRAR archiver
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
O42 - Logiciel: MSXML 4.0 SP2 (KB936181) - (.Microsoft Corporation.) [HKLM] -- {C04E32E0-0416-434D-AFB9-6969D703A9EF}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Media Manager for WALKMAN 1.2 - (.Sony.) [HKLM] -- {5A6ED905-D19D-4954-8499-0DAF386460F7}
O42 - Logiciel: Micro Application - 9 Dictionnaires Utiles - (.Pas de propriétaire.) [HKLM] -- {B410328C-0E8C-4DD2-9DB4-DE7766D0DFE0}
O42 - Logiciel: Microsoft .NET Framework 1.1 - (.Microsoft.) [HKLM] -- {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
O42 - Logiciel: Microsoft .NET Framework 1.1 - (.Pas de propriétaire.) [HKLM] -- Microsoft .NET Framework 1.1  (1033)
O42 - Logiciel: Microsoft .NET Framework 1.1 French Language Pack - (.Microsoft.) [HKLM] -- {9A394342-4A68-4EBA-85A6-55B559F4E700}
O42 - Logiciel: Microsoft .NET Framework 1.1 Security Update (KB979906) - (.Pas de propriétaire.) [HKLM] -- M979906
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA - (.Microsoft Corporation.) [HKLM] -- {0BD83598-C2EF-3343-847B-7D2E84599128}
O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack SP1 - fra - (.Microsoft Corporation.) [HKLM] -- {3E31821C-7917-367E-938E-E65FC413EA31}
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
O42 - Logiciel: Microsoft Compression Client Pack 1.0 for Windows XP - (.Microsoft Corporation.) [HKLM] -- MSCompPackV1
O42 - Logiciel: Microsoft Internationalized Domain Names Mitigation APIs - (.Microsoft Corporation.) [HKLM] -- IDNMitigationAPIs
O42 - Logiciel: Microsoft National Language Support Downlevel APIs - (.Microsoft Corporation.) [HKLM] -- NLSDownlevelMapping
O42 - Logiciel: Microsoft Office 2000 Premium - (.Microsoft Corporation.) [HKLM] -- {0000040C-78E1-11D2-B60F-006097C998E7}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Search Enhancement Pack - (.Microsoft Corporation.) [HKLM] -- {4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Microsoft Sync Framework Runtime Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {8A74E887-8F0F-4017-AF53-CBA42211AAA5}
O42 - Logiciel: Microsoft Sync Framework Services Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0 - (.Microsoft Corporation.) [HKLM] -- Wudf01000
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 - (.Microsoft Corporation.) [HKLM] -- {770657D0-A123-3C07-8E44-1C83EC895118}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}
O42 - Logiciel: Microsoft Visual J# .NET Redistributable Package 1.1 - (.Microsoft.) [HKLM] -- {1A655D51-1423-48A3-B748-8F5A0BE294C8}
O42 - Logiciel: MobileMe Control Panel - (.Apple Inc..) [HKLM] -- {3AC54383-31D1-4907-961B-B12CBB1D0AE8}
O42 - Logiciel: Module linguistique Microsoft .NET Framework 3.5 SP1- fra - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 Language Pack SP1 - fra
O42 - Logiciel: NVIDIA Drivers - (.Pas de propriétaire.) [HKLM] -- NVIDIA Drivers
O42 - Logiciel: Norton Internet Security - (.Symantec Corporation.) [HKLM] -- {F396D99B-1FA8-4ED1-A006-B7A5972E06E2}
O42 - Logiciel: OCR Software by I.R.I.S 7.0 - (.HP.) [HKLM] -- HPOCR
O42 - Logiciel: Orange Inside - (.Orange.) [HKCU] -- Orange Inside
O42 - Logiciel: Orange Installeur version 1.0.0.0 - (.Orange.) [HKLM] -- {D13FE823-C575-4451-AC37-E645A67AA581}_1.0.0.0
O42 - Logiciel: Outil de téléchargement Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}
O42 - Logiciel: PC-Doctor pour Windows - (.Pas de propriétaire.) [HKLM] -- {1F7CCFA3-D926-4882-B2A5-A0217ED25597}
O42 - Logiciel: PS2 - (.Pas de propriétaire.) [HKLM] -- PS2
O42 - Logiciel: Photo et imagerie HP 3.5 - HP Devices - (.HP.) [HKLM] -- {15B9DC72-73F9-4d99-9E28-848D66DA8D99}
O42 - Logiciel: Photosmart 320,370,7400,8100,8400 Series (fra) - (.HP.) [HKLM] -- {AAC4FC36-8F89-4587-8DD3-EBC57C83374D}
O42 - Logiciel: Python 2.2 combined Win32 extensions - (.Pas de propriétaire.) [HKLM] -- Python 2.2 combined Win32 extensions
O42 - Logiciel: Python 2.2.1 - (.PythonLabs at Zope Corporation.) [HKLM] -- Python 2.2.1
O42 - Logiciel: Quick Zip 4.60.019 - (.Joseph Leung.) [HKLM] -- Quick Zip_is1
O42 - Logiciel: QuickTime - (.Apple Inc..) [HKLM] -- {1451DE6B-ABE1-4F62-BE9A-B363A17588A2}
O42 - Logiciel: Rainlendar2 (remove only) - (.Pas de propriétaire.) [HKLM] -- Rainlendar2
O42 - Logiciel: Search Settings 1.2.2 - (.Spigot, Inc..) [HKLM] -- {0B1AAC97-8563-41D9-AE47-58E6A222F0E1}
O42 - Logiciel: Segoe UI - (.Microsoft Corp.) [HKLM] -- {A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
O42 - Logiciel: SiS VGA Utilities - (.Pas de propriétaire.) [HKLM] -- SiS VGA Driver
O42 - Logiciel: Sonic RecordNow! - (.Hewlett-Packard.) [HKLM] -- {9541FED0-327F-4DF0-8B96-EF57EF622F19}
O42 - Logiciel: SpeedTouch USB Software - (.Pas de propriétaire.) [HKLM] -- {D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}
O42 - Logiciel: Sunbelt Personal Firewall - (.Sunbelt Software.) [HKLM] -- {BFD080F6-3BF0-40E1-9507-9CA969C35870}
O42 - Logiciel: Update for Microsoft .NET Framework 3.5 SP1 (KB963707) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707
O42 - Logiciel: VLC media player 0.9.8a - (.VideoLAN Team.) [HKLM] -- VLC media player
O42 - Logiciel: Visual C++ 2008 x86 Runtime - (v9.0.30729) - (.Microsoft Corporation.) [HKLM] -- {F333A33D-125C-32A2-8DCE-5C5D14231E27}
O42 - Logiciel: Visual C++ 2008 x86 Runtime - v9.0.30729.01 - (.Microsoft Corporation.) [HKLM] -- {F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01
O42 - Logiciel: Windows Genuine Advantage Validation Tool (KB892130) - (.Microsoft Corporation.) [HKLM] -- KB892130
O42 - Logiciel: Windows Internet Explorer 7 - (.Microsoft Corporation.) [HKLM] -- ie7
O42 - Logiciel: Windows Internet Explorer 8 - (.Microsoft Corporation.) [HKLM] -- ie8
O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {B3B487E7-6171-4376-9074-B28082CEB504}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3175E049-F9A9-4A3D-8F19-AC9FB04514D1}
O42 - Logiciel: Windows Live Contrôle parental - (.Microsoft Corporation.) [HKLM] -- {9FF9FDF7-F84A-4F99-B4BB-066B6F95F33D}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {5DD76286-9BE7-4894-A990-E905E91AC818}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {445B183D-F4F1-45C8-B9DB-F11355CA657B}
O42 - Logiciel: Windows Live Toolbar - (.Microsoft Corporation.) [HKLM] -- {9D6524E6-15CF-4852-BF70-04FE973A3DE1}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {4634B21A-CC07-4396-890C-2B8168661FEA}
O42 - Logiciel: Windows Media Format 11 runtime - (.Microsoft Corporation.) [HKLM] -- WMFDist11
O42 - Logiciel: Windows Media Format 11 runtime - (.Pas de propriétaire.) [HKLM] -- Windows Media Format Runtime
O42 - Logiciel: Windows Media Player 11 - (.Microsoft Corporation.) [HKLM] -- wmp11
O42 - Logiciel: Windows XP Service Pack 3 - (.Microsoft Corporation.) [HKLM] -- Windows XP Service
O42 - Logiciel: XML Paper Specification Shared Components Language Pack 1.0 - (.Microsoft Corporation.) [HKLM] -- XPSEPSCLP
O42 - Logiciel: barre d'outils Orange - (.France Telecom SA.) [HKLM] -- OrangeToolbarFR
O42 - Logiciel: getPlus(R) for Adobe - (.NOS Microsystems Ltd..) [HKLM] -- {CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
O42 - Logiciel: iPod Video Converter 3.80 - (.iPodRobot.com @ VOW Software Co, Ltd..) [HKLM] -- iPod Video Converter
O42 - Logiciel: iTunes - (.Apple Inc..) [HKLM] -- {A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}

---\ HKCU & HKLM Software Keys
[HKCU\Software\AC3filter]
[HKCU\Software\AVS4YOU]
[HKCU\Software\Adobe]
[HKCU\Software\Alcatel]
[HKCU\Software\AppDataLow]
[HKCU\Software\Apple Computer, Inc.]
[HKCU\Software\Apple Inc.]
[HKCU\Software\Audacity]
[HKCU\Software\Avg]
[HKCU\Software\Avira]
[HKCU\Software\CDDB]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\Conduit]
[HKCU\Software\Creative Tech]
[HKCU\Software\Cygnus Solutions]
[HKCU\Software\DivXNetworks]
[HKCU\Software\Eraser]
[HKCU\Software\GNU]
[HKCU\Software\GSpot Appliance Corp]
[HKCU\Software\Gabest]
[HKCU\Software\GetData]
[HKCU\Software\Google]
[HKCU\Software\Haali]
[HKCU\Software\Hewlett-Packard]
[HKCU\Software\HookNetwork]
[HKCU\Software\IE]
[HKCU\Software\IM Providers]
[HKCU\Software\Illustrate]
[HKCU\Software\Intel]
[HKCU\Software\InterVideo]
[HKCU\Software\JEDI-VCL]
[HKCU\Software\JavaSoft]
[HKCU\Software\LAventure]
[HKCU\Software\Lake]
[HKCU\Software\Lavalys]
[HKCU\Software\Lavasoft]
[HKCU\Software\Leadertech]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MediaInfo]
[HKCU\Software\Mininova]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Netscape]
[HKCU\Software\Novell]
[HKCU\Software\ODBC]
[HKCU\Software\ORL]
[HKCU\Software\Opendisc]
[HKCU\Software\OrangeInside]
[HKCU\Software\OrangeInstaller]
[HKCU\Software\Orange]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\Quickzip]
[HKCU\Software\SPAMfighter]
[HKCU\Software\SampleView]
[HKCU\Software\Serenescreen]
[HKCU\Software\SoftPerfect]
[HKCU\Software\Sonic]
[HKCU\Software\Sony Corporation]
[HKCU\Software\Sony Creative Software]
[HKCU\Software\SpoonInstall]
[HKCU\Software\Sunbelt Software]
[HKCU\Software\Symantec]
[HKCU\Software\Trolltech]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\VOWSoft]
[HKCU\Software\VirginMega]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Windows Live Writer]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\Yahoo]
[HKCU\Software\eBay]
[HKCU\Software\keyhole.com]
[HKLM\Software\AVG]
[HKLM\Software\AVS4YOU]
[HKLM\Software\Adobe]
[HKLM\Software\Agere]
[HKLM\Software\Alcatel]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\Avance]
[HKLM\Software\AviSynth]
[HKLM\Software\Avira]
[HKLM\Software\BrowserChoice]
[HKLM\Software\C07ft5Y]
[HKLM\Software\CDDB]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Codec Tweak Tool]
[HKLM\Software\Conduit]
[HKLM\Software\Creative Tech]
[HKLM\Software\Cygnus Solutions]
[HKLM\Software\DivXNetworks]
[HKLM\Software\FNET]
[HKLM\Software\FRANCE TELECOM]
[HKLM\Software\FreeCDRIP]
[HKLM\Software\GEAR Software]
[HKLM\Software\GNU]
[HKLM\Software\Gabest]
[HKLM\Software\Garmin]
[HKLM\Software\Gemplus]
[HKLM\Software\Genesys Logic]
[HKLM\Software\Google]
[HKLM\Software\Grisoft]
[HKLM\Software\HP]
[HKLM\Software\HaaliMkx]
[HKLM\Software\Hewlett-Packard]
[HKLM\Software\HighCriteria]
[HKLM\Software\ICE]
[HKLM\Software\INTEL]
[HKLM\Software\InstallShield]
[HKLM\Software\InterVideo]
[HKLM\Software\JavaRa]
[HKLM\Software\JavaSoft]
[HKLM\Software\KLCodecPack]
[HKLM\Software\Kantaris]
[HKLM\Software\LEAD Technologies, Inc.]
[HKLM\Software\Lake]
[HKLM\Software\Lavasoft]
[HKLM\Software\Licenses]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\Micro Application]
[HKLM\Software\MicroVision]
[HKLM\Software\MimarSinan]
[HKLM\Software\Mininova]
[HKLM\Software\Motive]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\NOS]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Nelco]
[HKLM\Software\Novell]
[HKLM\Software\ODBC]
[HKLM\Software\Orange]
[HKLM\Software\PC-Doctor]
[HKLM\Software\Policies]
[HKLM\Software\Program Groups]
[HKLM\Software\Python]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\S3R521]
[HKLM\Software\S3]
[HKLM\Software\SECURITOO]
[HKLM\Software\SPAMfighter]
[HKLM\Software\Safer Networking Limited]
[HKLM\Software\Schlumberger]
[HKLM\Software\Secure]
[HKLM\Software\SiS]
[HKLM\Software\Sonic]
[HKLM\Software\Sony Corporation]
[HKLM\Software\Sony Creative Software]
[HKLM\Software\Sunbelt Software]
[HKLM\Software\SymNRT]
[HKLM\Software\Symantec]
[HKLM\Software\Uniblue]
[HKLM\Software\VideoLAN]
[HKLM\Software\Wilson WindowWare]
[HKLM\Software\WinRAR]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\Windows]
[HKLM\Software\X-AVCSD]
[HKLM\Software\Yahoo]
[HKLM\Software\ZSMC]
[HKLM\Software\mozilla.org]


---\ Contenu des dossiers ProgramFiles/ProgramData (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\a-squared Free
O43 - CFD:Common File Directory ----D- C:\Program Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Apple Software Update
O43 - CFD:Common File Directory ----D- C:\Program Files\Avira
O43 - CFD:Common File Directory ----D- C:\Program Files\AviSynth 2.5
O43 - CFD:Common File Directory ----D- C:\Program Files\AVS4YOU
O43 - CFD:Common File Directory ----D- C:\Program Files\Bonjour
O43 - CFD:Common File Directory ----D- C:\Program Files\CCleaner
O43 - CFD:Common File Directory ----D- C:\Program Files\Conduit
O43 - CFD:Common File Directory ----D- C:\Program Files\Creative
O43 - CFD:Common File Directory ----D- C:\Program Files\DIFX
O43 - CFD:Common File Directory ----D- C:\Program Files\Easy Internet signup
O43 - CFD:Common File Directory ----D- C:\Program Files\FAT32 Format
O43 - CFD:Common File Directory ----D- C:\Program Files\Fat32Format
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\Free Audio Pack
O43 - CFD:Common File Directory ----D- C:\Program Files\Garmin
O43 - CFD:Common File Directory ----D- C:\Program Files\Garmin GPS Plugin
O43 - CFD:Common File Directory ----D- C:\Program Files\Google
O43 - CFD:Common File Directory ----D- C:\Program Files\Help and Support Additions
O43 - CFD:Common File Directory ----D- C:\Program Files\Hewlett-Packard
O43 - CFD:Common File Directory ----D- C:\Program Files\HP
O43 - CFD:Common File Directory ----D- C:\Program Files\Illustrate
O43 - CFD:Common File Directory --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\InterVideo
O43 - CFD:Common File Directory ----D- C:\Program Files\IObit
O43 - CFD:Common File Directory ----D- C:\Program Files\iPod
O43 - CFD:Common File Directory ----D- C:\Program Files\iPodRobot
O43 - CFD:Common File Directory ----D- C:\Program Files\iTunes
O43 - CFD:Common File Directory ----D- C:\Program Files\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Java(2)
O43 - CFD:Common File Directory ----D- C:\Program Files\K-Lite Codec Pack
O43 - CFD:Common File Directory ----D- C:\Program Files\Lavalys
O43 - CFD:Common File Directory ----D- C:\Program Files\Lavasoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD:Common File Directory ----D- C:\Program Files\Micro Application
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\microsoft frontpage
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Sync Framework
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Visual Studio
O43 - CFD:Common File Directory ----D- C:\Program Files\Movie Maker
O43 - CFD:Common File Directory ----D- C:\Program Files\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD:Common File Directory ----D- C:\Program Files\MSXML 4.0
O43 - CFD:Common File Directory ----D- C:\Program Files\NetMeeting
O43 - CFD:Common File Directory ----D- C:\Program Files\NOS
O43 - CFD:Common File Directory ----D- C:\Program Files\Orange
O43 - CFD:Common File Directory ----D- C:\Program Files\Outlook Express
O43 - CFD:Common File Directory ---AD- C:\Program Files\PC-Doctor for Windows
O43 - CFD:Common File Directory ----D- C:\Program Files\QuickTime
O43 - CFD:Common File Directory ----D- C:\Program Files\QuickZip4
O43 - CFD:Common File Directory ----D- C:\Program Files\Rainlendar2
O43 - CFD:Common File Directory ----D- C:\Program Files\Reference Assemblies
O43 - CFD:Common File Directory ----D- C:\Program Files\Services en ligne
O43 - CFD:Common File Directory ----D- C:\Program Files\SiS VGA Utilities V3.59e
O43 - CFD:Common File Directory ----D- C:\Program Files\Sonic
O43 - CFD:Common File Directory ----D- C:\Program Files\Sonic RecordNow!
O43 - CFD:Common File Directory ----D- C:\Program Files\Sony
O43 - CFD:Common File Directory ----D- C:\Program Files\Sunbelt Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Thomson
O43 - CFD:Common File Directory ----D- C:\Program Files\TomTom DesktopSuite
O43 - CFD:Common File Directory ----D- C:\Program Files\Trend Micro
O43 - CFD:Common File Directory ----D- C:\Program Files\Uniblue
O43 - CFD:Common File Directory --H-D- C:\Program Files\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files\VideoLAN
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Connect 2
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows NT
O43 - CFD:Common File Directory --H-D- C:\Program Files\WindowsUpdate
O43 - CFD:Common File Directory ----D- C:\Program Files\WinRAR
O43 - CFD:Common File Directory ----D- C:\Program Files\xerox
O43 - CFD:Common File Directory ----D- C:\Program Files\ZHPDiag
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Apple
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\AVSMedia
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\BitDefender
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Designer
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\France Telecom
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Hewlett-Packard
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\HP
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\InstallShield
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\MSSoap
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\ODBC
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\PC Tools
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Services
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Sony Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\SpeechEngines
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\SureThing Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\System
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Windows Live
O43 - CFD:Common File Directory -SH-D- C:\Program Files\Fichiers Communs\WindowsLiveInstaller


---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 09:15:00 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\SchedLgU.Txt   [32010]
O44 - LFC:[MD5.C7DD7D9739785BD3A6B8499EEC1DEE7E] - 05/09/2010 - 08:29:25 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys   [38224]
O44 - LFC:[MD5.67B48A903430C6D4FB58CBACA1866601] - 05/09/2010 - 08:29:22 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbam.sys   [20952]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 08:17:13 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\WindowsUpdate.log   [1246370]
O44 - LFC:[MD5.67F1C8C98C2148BAF4ED68ED5117CA9D] - 05/09/2010 - 08:15:55 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32
vapps.xml   [4452]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/09/2010 - 08:15:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\0.log   [0]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 08:15:19 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\wiadebug.log   [159]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 08:15:18 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\sti.log   [608]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 08:15:15 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\wiaservc.log   [50]
O44 - LFC:[MD5.6A2CB42966136854F4464516FBB4AE72] - 05/09/2010 - 08:15:03 -S-A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\bootstat.dat   [2048]
O44 - LFC:[MD5.C7F870B067A40E9AF203228853D23C73] - 05/09/2010 - 08:14:55 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\aaw7boot.log   [90205]
O44 - LFC:[MD5.000471E081715A81805584AF2FCF8A0E] - 05/09/2010 - 08:14:01 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\bthservsdp.dat   [3308]
O44 - LFC:[MD5.ADEFE7A022D977E431C17B46153707D2] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\FaxSetup.log   [61594]
O44 - LFC:[MD5.09724E220EEAB5395A4D8844C7463C79] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB981332-IE8.log   [7217]
O44 - LFC:[MD5.B953EB23165846090766FF9CA956073E] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\comsetup.log   [20422]
O44 - LFC:[MD5.C88D66ADEB230FD54D947B756C45F36C] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\iis6.log   [9634]
O44 - LFC:[MD5.39B3F72C9EEEE6AE609638B651CEDADA] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\imsins.log   [1355]
O44 - LFC:[MD5.EF62BD3FE5CB279D85DDB2736E6C921B] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\msgsocm.log   [3030]
O44 - LFC:[MD5.011D503AB844C213491083444AA50FEA] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS
tdtcsetup.log   [12362]
O44 - LFC:[MD5.50FB9C9E9EB994284AC3DC982EA14AF8] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ocgen.log   [29560]
O44 - LFC:[MD5.31D3985B5BA22E48F6EC8D67AE5AE24B] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ocmsn.log   [3420]
O44 - LFC:[MD5.61CABABC79465081062CD9BD2D16B91E] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setupapi.log   [14964]
O44 - LFC:[MD5.F869CB40C5679555D2DEE4BBA2D10B09] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS	soc.log   [23590]
O44 - LFC:[MD5.5DDBD7D9BC420CF34BCBF2B18699BFE8] - 05/09/2010 - 08:05:16 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB976662-IE8.log   [8115]
O44 - LFC:[MD5.26146A18C026D9F44BB44822E2BFEF07] - 05/09/2010 - 08:05:16 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\imsins.BAK   [1355]
O44 - LFC:[MD5.722F2988A014341A454FDAEDA02F8A8C] - 05/09/2010 - 08:05:15 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\updspapi.log   [43257]
O44 - LFC:[MD5.C4B8DC578E4D69F8F7B093E4087F8460] - 05/09/2010 - 08:05:08 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB971961-IE8.log   [7864]
O44 - LFC:[MD5.A6E2514716EC28AD305F35D921153495] - 05/09/2010 - 08:03:01 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\wpa.dbl   [1158]
O44 - LFC:[MD5.6C67AC9BE6D413F6EABE66AFB1DAB355] - 05/09/2010 - 06:17:04 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\spupdsvc.log   [7525]
O44 - LFC:[MD5.6828009A50744E5FA9EF26C7D95B53FB] - 05/09/2010 - 06:14:49 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ie8_main.log   [42880]
O44 - LFC:[MD5.1DCC9CFE391B87FE1F99026C9CC03865] - 05/09/2010 - 06:14:45 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB2183461-IE8.log   [166858]
O44 - LFC:[MD5.E508F8C5D893547CFF5BCAFFEB878BDF] - 05/09/2010 - 06:14:09 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB982664-IE8.log   [159863]
O44 - LFC:[MD5.F711748CA7CB773198A2126A705B634B] - 05/09/2010 - 06:13:57 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB982381-IE8.log   [181668]
O44 - LFC:[MD5.7C536719CB6155EBB082238D090804AA] - 05/09/2010 - 06:12:51 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ie8.log   [176548]
O44 - LFC:[MD5.7301F1916E680D330326AE01802CC2DA] - 05/09/2010 - 05:47:47 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB2183461-IE7.log   [73492]
O44 - LFC:[MD5.D3E15965DE089FBA16F2E82A0D9DCAF5] - 05/09/2010 - 05:47:14 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB981349.log   [12176]
O44 - LFC:[MD5.CB446351EC02416C2795145EC3D8D8F5] - 05/09/2010 - 05:47:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB971961.log   [8171]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/09/2010 - 05:47:05 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setupact.log   [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/09/2010 - 05:47:05 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setuperr.log   [0]
O44 - LFC:[MD5.408A6EAADFF48AC9D5F1F587A1CC15FA] - 31/08/2010 - 15:49:09 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\FNTCACHE.DAT   [152384]
O44 - LFC:[MD5.2C46310AC8198036C99E7DA2F652E6F9] - 31/08/2010 - 15:45:02 ---A- . (.Pas de propri

Utilisateur anonyme · Answer

Salut 

* Bienvenue sur CCM !
* N'ouvre pas d'autres sujets pour le même problème >>  sur ce forum ou sur un autre  
* Ensemble nous allons essayer de régler ton problème .


1)Rapport de ZHPDiag >> incomplet

poste un nouveau rapport ZHPDiag
*   Héberge le rapport sur ce site,   
 >> Cijoint.fr  
*  puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.  


* Pour t aider ,pour heberger le rapport   
*  rends toi sur Cijoint.fr      
*  clic sur Parcourir      
*  trouve >> le rapport que tu viens d'enregistrer qui doit par exemple être sur ton bureau      
*  et valide en cliquant sur >> Cliquez ici pour déposer le Fichier     
*  un lien de ce genre http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt te sera généré,       
*  il te suffit de le poster ici  pour que je puisse voir le rapport  


a premiére vue

2) * Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX)

* Ad-Remover  permet d'éliminer proprement les publiciels vérolés, « adware » en anglais. 
 * Affichant de la publicité en échange d'un service gratuit, 
 * certains d'entre eux contiennent des logiciels espions violant votre vie privée numérique tout en modifiant le comportement de ton système.

   ICI  >>AD-Remover

/!\ Déconnecte-toi d'internet et ferme toutes applications en cours /!\

*  Double-clique sur l'icône Ad-remover située sur ton Bureau.
* Sur la page, clique sur le bouton « Nettoyer »
* Confirme l'opération
*  Poste le rapport qui apparaît à la fin.
* (Le rapport est sauvegardé aussi sous C:\Ad-report.)
* (CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)





       
                
            Membre Contributeur sécurité CCM
            Windows Vista // Windows XP

lilou4515 · Answer

Bonjour

voici le premier résultat.

http://www.cijoint.fr/cjlink.php?file=cj201009/cijROgGphF.txt 

je continue la suite 

a+

lilou4515 · Answer

voici le rapport complémentaire de ad remover



======= RAPPORT D'AD-REMOVER 2.0.0.1,E | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 03/09/10 à 23:00
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 14:01:05 le 05/09/2010, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86) 
HP_Propriétaire@NOM-641695C7437 ( ) 
 
============== ACTION(S) ==============


0,Dossier supprimé: C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Conduit
0,Dossier supprimé: C:\Program Files\Conduit
3,Fichier supprimé: C:\WINDOWS\Installer\76a694.msi  

(!) -- Fichiers temporaires supprimés.


1,Clé supprimée: HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
0,Clé supprimée: HKLM\Software\Classes\SearchSettings.BHO
0,Clé supprimée: HKLM\Software\Classes\SearchSettings.BHO.1
0,Clé supprimée: HKLM\Software\Conduit
0,Clé supprimée: HKCU\Software\Conduit
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}

0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}


============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [Impossible d'obtenir la version] **

========================================

** Internet Explorer Version [8.0.6001.18702] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 4 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 12 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 05/09/2010 (1469 Octet(s)) 

Fin à: 14:09:51, 05/09/2010 
 
============== E.O.F ============== 



merci d'avance pour la suite

Utilisateur anonyme · Answer

Salut lilou4515 1) -+-+-+-+-> ZHPFix <-+-+-+-+- * ferme toutes les applications ouvertes. * Copies tout le texte présent en gras dans l'encadré ci-dessous *( tu le selectionnes avec ta souris >> Clique droit dessus et choisis "copier" ou fait Ctrl+C ) O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (.Pas de propriétaire - Pas de description.) -- (.not file.) OPT:O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe OPT:O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe OPT:OPT:O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe OPT:O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O42 - Logiciel: Search Settings 1.2.2 - (.Spigot, Inc..) [HKLM] -- {0B1AAC97-8563-41D9-AE47-58E6A222F0E1} [HKCU\Software\Conduit] [HKCU\Software\Mininova] [HKLM\Software\BrowserChoice] O43 - CFD:Common File Directory ----D- C:\Program Files\Conduit O53 - SMSR:HKLM\...\startupreg\swg [Key] . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe * Double Clique sur l'icone ZhpFix du bureau pour le lancer . * Windows7/Vista >> Fais un clic-droit sur le raccourci de ZHPFix et choisis "Exécuter en temps qu'administrateur" * Une fois l'outil ZHPFix ouvert , * clique sur le bouton [ H ] ( "coller les lignes Helper" ) . * Dans l'encadré principal * tu verras donc les lignes que tu as copié précédemment apparaitre . * Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre. * cliques >> OK puis * Clques sur >>Tous * Pour finir clique sur >> Nettoyer . * colle le rapport obtenu . ( ce rapport est sauvegardé dans ce dossier C:\Program files\ZHPDiag\ZHPFixReport.txt ) 2) /!\ Il faut IMPERATIVEMENT désactiver tous tes logiciels de protection pour utiliser ce programme/!\ * Télécharge GMER Rootkit Scanner : * GMER est l'un des meilleurs scanneurs rootkits actuels. * Il est capable de détecter la casi totalité des rootkits. ICI >> gmer * Ferme également toutes les applications actives dont ton navigateur. * Clique sur le bouton "Download EXE" * Sauvegarde-le sur ton Bureau. * Double-clique sur l'exécutable téléchargé . * Utilisateurs de Windows Vista / Windows7 tu fais un clic droit sur l'icône et exécute en tant qu'administrateur.. * Dans l'onglet "Rootkit", clique sur "SCAN" puis patiente... * A la fin, clique sur "SAVE" et enregistre le rapport sur ton Bureau. * Héberge le rapport de Gmer sur ce site, cijoint.fr * Copie/colle les liens générés ici * Pour t aider * rends toi sur http://www.cijoint.fr * clic sur Parcourir * trouve >> le rapport que tu viens d'enregistrer qui doit par exemple être sur ton bureau * et valide en cliquant sur >> Cliquez ici pour déposer le Fichier * un lien de ce genre http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt te sera généré, Si GMER plante, il faut savoir que certains logiciels peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement * Télécharge Defogger (de jpshortstuff) sur ton Bureau ICI >> Defogger (de jpshortstuff) * Lance le * Pour Windows Vista et Windows 7, * faire un clic droit et >> Exécuter en tant qu'administrateur. * Une fenêtre apparait : clique sur "Disable" * Fais redémarrer l'ordinateur si l'outil te le demande * Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable" * puis réessaye Gmer : 3)/!\ Réactives tous tes logiciels de protection /!\ 4)* J ai vu que tu as Malwarebytes * Lances--> Malwarebytes (MBAM) * Fais une mise a jour <== à faire * Puis vas dans l'onglet "Recherche", coche >> Exécuter un examen complet * puis "Rechercher" * Sélectionnes tes disques durs" puis clique sur "Lancer l'examen" * A la fin du scan, clique sur Afficher les résultats puis sur Enregistrer le rapport *Si MalwareBytes' détecte des infections, clique sur ==>Afficher les résultats, puis sur ==>Supprimer la sélection * S'il t' es demandé de redémarrer, clique sur "oui " * aprés la suppression(s) de ou des infections trouvées --> poste le rapport ici Membre Contributeur sécurité CCM Windows Vista // Windows XP

lilou4515 · Answer

voici le rapport:

O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (.Pas de propriétaire - Pas de description.) -- (.not file.) 
OPT:O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe 
OPT:O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 
OPT:OPT:O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe 
OPT:O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe 
O42 - Logiciel: Search Settings 1.2.2 - (.Spigot, Inc..) [HKLM] -- {0B1AAC97-8563-41D9-AE47-58E6A222F0E1} 
[HKCU\Software\Conduit] 
[HKCU\Software\Mininova] 
[HKLM\Software\BrowserChoice] 
O43 - CFD:Common File Directory ----D- C:\Program Files\Conduit 
O53 - SMSR:HKLM\...\startupreg\swg [Key] . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

lilou4515 · Answer

pour la phase 2 :

il faut que je désactive antivir ad aware et ccleaner ?

A+

lilou4515 · Answer

ainsi que mon pare feu ??

A+

Utilisateur anonyme · Answer

Salut

ce n est pas le rapport de ZHPDiag que tu m'as posté ,mais un copié/collé des lignes à fixer

refais en lisant bien !!!

lilou4515 · Answer

Je pense avoir enfin réussi:
Rapport de ZHPDiag v1.26.582 par Nicolas Coolman, Update du 03/09/2010
Run by HP_Propriétaire at 05/09/2010 18:35:33
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\ Web Browser
MSIE: Internet Explorer v8.0.6001.18702

---\ System Information
Platform : Microsoft Windows XP (5.1.2600) Service Pack 3
Processor: x86 Family 15 Model 12 Stepping 0, AuthenticAMD
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1023 MB (44% free)
System drive C: has 36 GB (25%) free of 144 GB

---\ Logged in mode
Computer Name: NOM-641695C7437
User Name: HP_Propriétaire
All Users Names: SUPPORT_fddfa904, SUPPORT_388945a0, HP_Propriétaire, HelpAssistant, ASPNET, Administrateur, 
Unselected Option:  O1,O45,O61,O65,O82
Logged in as Administrator

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 36 Go of 144 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 58 Go of 153 Go)
E:\ Hard drive, Flash drive, Thumb drive (Free 1 Go of 5 Go)
F:\ CD-ROM drive (Free 0 Go of 1 Go)
G:\ CD-ROM drive (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
J:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
K:\ Floppy drive, Flash card reader, USB Key (Not Inserted)


---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: OK


---\ Processus lancés
[MD5.279764BFCE70AF320AA48E9C4A4B4721] - (.Lavasoft - Ad-Aware Service Application.) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe   [1355928]
[MD5.9015BC03F62940527EC92D45EE89E46F] - (.Avira GmbH - Antivirus Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe   [108289]
[MD5.B8720A787C1223492E6F319465E996CE] - (.Avira GmbH - Antivirus On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe   [185089]
[MD5.557F35D1CA42AEA14A6690E21887A31F] - (.Apple Inc. - Apple Mobile Device Service.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe   [144712]
[MD5.3F56903E124E820AEECE6D471583C6C1] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe   [238888]
[MD5.B0C9FFF54F16DF2012F53A34736A0975] - (.France Telecom SA - Orange Connection Kit.) -- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe   [69632]
[MD5.67CF1F160CE06E45793EFB6D2FA41E16] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 61.72.) -- C:\WINDOWS\system32
vsvc32.exe   [114755]
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe   [135664]
[MD5.7234E4B852F8FA0C48FF0E4FD7394490] - (.Sunbelt Software - Sunbelt Firewall Service.) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe   [1234480]
[MD5.A464B1F7249B9893AB3F08CDA55F18E5] - (.Sunbelt Software - Sunbelt Firewall GUI.) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe   [1967664]
[MD5.06A1ECB63DF139EC639E084D4AB3C9D7] - (.Hewlett-Packard Company - hpsysdrv.) -- C:\windows\system\hpsysdrv.exe   [52736]
[MD5.A6FD829F428F6445B8F72FF725438590] - (.Hewlett-Packard - HPHmon06.) -- C:\WINDOWS\system32\hphmon06.exe   [659456]
[MD5.4A95F15B706B8FD9EC8715B6401EAB7B] - (.Hewlett-Packard Company - KBD EXE.) -- C:\HP\KBD\KBD.EXE   [61440]
[MD5.ECDCFBEA4CAEAF2DD5E9D0092396DFC1] - (.Silicon Integrated Systems Corporation - SiS Compatible Super VGA Keyboard Daemon.) -- C:\WINDOWS\system32\keyhook.exe   [249856]
[MD5.E7BE65BF79906AEBC698E077D53F6A1C] - (.Agere Systems - SoftModem Messaging Applet.) -- C:\WINDOWS\AGRSMMSG.exe   [88363]
[MD5.D40191AA225638AB20E59524CDD74030] - (.THOMSON Telecom Belgium - SpeedTouch Statistics.) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe   [866816]
[MD5.C52E2D526A576D0917A8829D325DDE86] - (.Pas de propriétaire - UMonit MFC Application.) -- C:\WINDOWS\system32\UMonit.exe   [200704]
[MD5.C5F49EEBA10F86A5AF1C2D7B126A90FF] - (.Sony Corporation - Content Transfer Walkman Detector.) -- C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe   [423200]
[MD5.29680A793F690EEF4AAA68479D2A6DF8] - (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe   [209153]
[MD5.E00765FD4417D4C60325BD49279D5C62] - (.Orange - Executable Orange Inside.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe   [812032]
[MD5.72DE9723E5203A5C5D284C6D001A1D14] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe   [717552]
[MD5.527F995C40417C0F4EBB74ACA98F915A] - (.France Telecom SA - Orange Connection Kit.) -- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe   [90112]
[MD5.ABC9091B6D438381DBACFD1A82E0C0EA] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe   [282624]
[MD5.682DB04704A74F228A080B31003B6FC6] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe   [974848]
[MD5.CAF2CCB6E9F5FDBE99EE8904EB9DC506] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe   [495616]
[MD5.8E884B0A19679340BFFF5C157075D6B5] - (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe   [53248]
[MD5.8387F133A6EDB0B97C41CB55CEDBA041] - (.Lavasoft - Ad-Aware Tray Application.) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe   [864624]
[MD5.B60DDDD2D63CE41CB8C487FCFBB6419E] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe   [638816]
[MD5.C78A7317A8554F4369DA522E0DCF87D6] - (.Nicolas Coolman - Nettoyeur de rapport ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPFix.exe   [472576]
[MD5.7EE856AB0E8D63B4D180CE580E14A376] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [548352]


---\ Plugins de navigateurs Opera/Firefox(P1/P2)
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\iTunes\Mozilla Plugins
pitunes.dll
P2 - FPN: [HKLM] [@garmin.com/GpsControl] - (.GARMIN Corp. - Garmin Communicator Plug-In 2.8.3.0.) -- C:\Program Files\Garmin GPS Plugin
pGarmin.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.50826.0.) -- C:\Program Files\Microsoft Silverlight\4.0.50826.0
pctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (.not file.)
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=8] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.2.183.23
pGoogleOneClick8.dll


---\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"


---\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr


---\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk


---\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (8.00.6001.18939 (longhorn_ie8_gdr.100616-1700)) -- C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} . (.Pas de propriétaire - Pas de description.) (No version) -- C:\Program Files\Orange\Connexion Internet Orange\SearchURLHook\SearchPageURL.dll


---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} . (.Microsoft Corporation - Search Helper for Internet Explorer.) -- C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} . (.Pas de propriétaire - Pas de description.) -- (.not file.)


---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} . (.Hewlett-Packard Company - hp view toolbar.) -- c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} . (.Pas de propriétaire - Pas de description.) --  (.not file.)
O3 - Toolbar: barre d'outils Orange - {D3028143-6145-4318-99D3-3EDCE54A95A9} . (.Orange - IE Toolbar Container.) -- C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll
O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} . (.Pas de propriétaire - Pas de description.) --  (.not file.)


---\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [hpsysdrv] . (.Hewlett-Packard Company - hpsysdrv.) -- c:\windows\system\hpsysdrv.exe 
O4 - HKLM\..\Run: [HPHmon06] . (.Hewlett-Packard - HPHmon06.) -- C:\WINDOWS\system32\hphmon06.exe 
O4 - HKLM\..\Run: [KBD] . (.Hewlett-Packard Company - KBD EXE.) -- C:\HP\KBD\KBD.exe 
O4 - HKLM\..\Run: [Recguard] . (.Pas de propriétaire - Recguard Application.) -- C:\WINDOWS\SMINST\RECGUARD.exe 
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll 
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe 
O4 - HKLM\..\Run: [SiS Windows KeyHook] . (.Silicon Integrated Systems Corporation - SiS Compatible Super VGA Keyboard Daemon.) -- C:\WINDOWS\system32\keyhook.exe 
O4 - HKLM\..\Run: [AGRSMMSG] . (.Agere Systems - SoftModem Messaging Applet.) -- C:\Windows\AGRSMMSG.exe 
O4 - HKLM\..\Run: [PS2] . (.Hewlett-Packard Company - PS2 EXE.) -- C:\WINDOWS\system32\ps2.exe 
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] . (.THOMSON Telecom Belgium - SpeedTouch Statistics.) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe 
O4 - HKLM\..\Run: [UMonit] . (.Pas de propriétaire - UMonit MFC Application.) -- C:\WINDOWS\system32\UMonit.exe 
O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] . (.Sony Corporation - Content Transfer Walkman Detector.) -- C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe 
O4 - HKLM\..\Run: [AppleSyncNotifier] . (.Apple Inc. - AppleSyncNotifier.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe 
O4 - HKLM\..\Run: [avgnt] . (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
O4 - HKLM\..\Run: [ORAHSSSessionManager] . (.France Telecom SA - Orange Connection Kit.) -- C:\Program Files\Orange\Connexion Internet Orange\SessionManager\SessionManager.exe 
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe 
O4 - HKCU\..\Run: [orangeinside] . (.Orange - Executable Orange Inside.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe 
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe 
O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [orangeinside] . (.Orange - Executable Orange Inside.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe 
O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe 


---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: ajouter cette page à vos favoris Orange - (.not file.) - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\cce11E.html
O8 - Extra context menu item: orange.fr . (.Pas de propriétaire - Pas de description.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\src\orange_html\orange.html
O8 - Extra context menu item: traduire la page - (.not file.) - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\cce11C.html
O8 - Extra context menu item: traduire le texte sélectionné - (.not file.) - C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\cce11D.html
O8 - Extra context menu item: _orange.fr . (.Pas de propriétaire - Pas de description.) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\src\orange_html\orange.html


---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.not file.) - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} . (.not file.) - (.not file.)


---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files\Bonjour\mdnsNSP.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\WINDOWS\system32\wshbth.dll


---\ Piratage de l'Option 'Rétablir les paramètres Web' (O14)
O14 - IERESET.INF: START_PAGE_URL=START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome


---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5A779DC0-837B-4590-AC42-C7C0847478C5} (OrangeInstaller_ModuleIE Control) - http://logicielsgratuits.orange.fr/download_service/Install/OrangeInstaller.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} () - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab


---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{03D5B8EA-18B5-4ABE-AFD8-66E9B081FDDE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{03D5B8EA-18B5-4ABE-AFD8-66E9B081FDDE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{03D5B8EA-18B5-4ABE-AFD8-66E9B081FDDE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1


---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\System32\dimsntfy.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\System32\igfxsrvc.dll


---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll


---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll


---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) . (.Avira GmbH - Antivirus Scheduler.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) . (.Avira GmbH - Antivirus On-Access Service.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device (Apple Mobile Device) . (.Apple Inc. - Apple Mobile Device Service.) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) . (.France Telecom SA - Orange Connection Kit.) - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lavasoft Ad-Aware Service (Lavasoft Ad-Aware Service) . (.Lavasoft - Ad-Aware Service Application.) - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 61.72.) - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 (Pml Driver HPZ12) . (.HP - PML Driver.) - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) . (.Sunbelt Software - Sunbelt Firewall Service.) - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe


---\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) -  (.not file.)


---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\User_Feed_Synchronization-{C4CA4977-2455-4245-971A-D452668B9EB6}.job


---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\binegutils.dll
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\msnetmtg.inf
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\msmsgs.inf
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\wmp11.inf
O40 - ASIC: Fax - {8b15971b-5355-4c82-8c07-7e181ea07608} . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\fxsocm.inf
O40 - ASIC: Adobe Flash Player 9 ActiveX - {D27CDB6E-AE6D-11cf-96B8-444553540000} . (.Adobe Systems, Inc. - Adobe Flash Player 10.0 r45.) -- C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx


---\ Pilotes lancés au démarrage (O41)
O41 - Driver: Avg Anti-Rootkit Clean Driver (AvgArCln) . (.GRISOFT, s.r.o. - AVG7 Clean Driver.) - C:\Windows\system32\DRIVERS\AvgArCln.sys
O41 - Driver: avgio (avgio) . (.Avira GmbH - Avira AntiVir Support for Minifilter.) - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
O41 - Driver: avipbb (avipbb) . (.Avira GmbH - Avira Driver for RootKit Detection.) - C:\Windows\system32\DRIVERS\avipbb.sys
O41 - Driver: FNETDEVI (FNETDEVI) . (.FNet Co., Ltd. - FNETDEVI.SYS.) - C:\WINDOWS\system32\drivers\FNETDEVI.sys
O41 - Driver: Firewall Driver (fwdrv) . (.Sunbelt Software - Sunbelt Personal Firewall FWDRV.) - C:\WINDOWS\system32\drivers\fwdrv.sys
O41 - Driver: Kerio HIPS Driver (khips) . (.Sunbelt Software - Sunbelt Personal Firewall Host Intrusion Pr.) - C:\WINDOWS\system32\drivers\khips.sys
O41 - Driver: (SiSkp) . (.Silicon Integrated Systems Corporation - SiS VGA Driver Manager.) - C:\Windows\system32\DRIVERS\srvkp.sys
O41 - Driver: ssmdrv (ssmdrv) . (.Avira GmbH - AVIRA SnapShot Driver.) - C:\Windows\system32\DRIVERS\ssmdrv.sys


---\ Logiciels installés (O42)
O42 - Logiciel: Ad-Aware - (.Lavasoft.) [HKLM] -- Ad-Aware
O42 - Logiciel: Ad-Aware - (.Lavasoft.) [HKLM] -- {DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Flash Player 9 ActiveX - (.Adobe Systems.) [HKLM] -- ShockwaveFlash
O42 - Logiciel: Adobe Reader 9.3.4 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A93000000001}
O42 - Logiciel: Agere Systems PCI Soft Modem - (.Pas de propriétaire.) [HKLM] -- Agere Systems Soft Modem
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM] -- {3FA365DF-2D68-45ED-8F83-8C8A33E65143}
O42 - Logiciel: Apple Mobile Device Support - (.Apple Inc..) [HKLM] -- {AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM] -- {6956856F-B6B3-4BE0-BA0B-8F495BE32033}
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
O42 - Logiciel: Avira AntiVir Personal - Free Antivirus - (.Avira GmbH.) [HKLM] -- Avira AntiVir Desktop
O42 - Logiciel: Bonjour - (.Apple Inc..) [HKLM] -- {07287123-B8AC-41CE-8346-3D777245C35B}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: Connexion Internet Orange - (.Pas de propriétaire.) [HKLM] -- {ORAHSS}.UninstallSuite
O42 - Logiciel: Content Transfer - (.Sony Corporation.) [HKLM] -- {CFADE4AF-C0CF-4A04-A776-741318F1658F}
O42 - Logiciel: Creative WebCam NX Driver (1.02.01.0827) - (.Pas de propriétaire.) [HKLM] -- Creative PD1110
O42 - Logiciel: EVEREST Home Edition v2.20 - (.Lavalys Inc.) [HKLM] -- EVEREST Home Edition_is1
O42 - Logiciel: FAT32 Format - (.Pas de propriétaire.) [HKLM] -- FAT32 Format
O42 - Logiciel: Free Mp3 Wma Converter V 1.81 - (.Pas de propriétaire.) [HKLM] -- Free Mp3 Wma Converter_is1
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {1EE04769-91C4-4A06-92B7-FCAFE6BABDD9}
O42 - Logiciel: Garmin Communicator Plugin - (.Garmin Ltd or its subsidiaries.) [HKLM] -- {03737893-5BEE-4C78-9C58-3AE7F172BBBE}
O42 - Logiciel: Garmin USB Drivers - (.Garmin Ltd or its subsidiaries.) [HKLM] -- {65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}
O42 - Logiciel: Genesys USB Mass Storage Device - (.Genesys Logic.) [HKLM] -- {959B7F35-2819-40C5-A0CD-3C53B5FCC935}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: HP Customer Participation Program 7.0 - (.HP.) [HKLM] -- HPExtendedCapabilities
O42 - Logiciel: HP Deskjet Preloaded Printer Drivers - (.Hewlett-Packard Company.) [HKLM] -- {F419D20A-7719-4639-8E30-C073A040D878}
O42 - Logiciel: HP Image Zone 4.2 - (.HP.) [HKLM] -- HP Photo & Imaging
O42 - Logiciel: HP Image Zone Plus 4.2 - (.HP.) [HKLM] -- {5E1494D4-3562-4FFB-B35C-600F80F6934C}
O42 - Logiciel: HP Imaging Device Functions 7.0 - (.HP.) [HKLM] -- HP Imaging Device Functions
O42 - Logiciel: HP PSC & OfficeJet 4.0 - (.HP.) [HKLM] -- {A1062847-0846-427A-92A1-BB8251A91E91}
O42 - Logiciel: HP Photosmart Essential - (.HP.) [HKLM] -- {6994491D-D491-48F1-AE1F-E179C1FFFC2F}
O42 - Logiciel: HP Photosmart, Officejet and Deskjet 7.0.A - (.HP.) [HKLM] -- {BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}
O42 - Logiciel: HP Software Update - (.Hewlett-Packard.) [HKLM] -- {457791C5-D702-4143-A7B2-2744BE9573F2}
O42 - Logiciel: HP Solution Center 7.0 - (.HP.) [HKLM] -- HP Solution Center & Imaging Support Tools
O42 - Logiciel: HPIZ402 - (.Hewlett-Packard.) [HKLM] -- {8D9768AE-DE42-4A04-A461-2361A58C384D}
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5
O42 - Logiciel: Hotfix for Windows XP (KB976002-v5) - (.Microsoft Corporation.) [HKLM] -- KB976002-v5
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {133742BA-6F46-4D3E-85AF-78631D9AD8B8}
O42 - Logiciel: InterVideo WinDVD Creator 2 - (.InterVideo Inc..) [HKLM] -- {2FCE4FC5-6930-40E7-A4F1-F862207424EF}
O42 - Logiciel: InterVideo WinDVD Player - (.InterVideo Inc..) [HKLM] -- {91810AFC-A4F8-4EBA-A5AA-B198BBC81144}
O42 - Logiciel: Java(TM) 6 Update 15 - (.Sun Microsystems, Inc..) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216011FF}
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {8E5233E1-7495-44FB-8DEB-4BE906D59619}
O42 - Logiciel: K-Lite Codec Pack 4.4.2 (Full) - (.Pas de propriétaire.) [HKLM] -- KLiteCodecPack_is1
O42 - Logiciel: KBD - (.Pas de propriétaire.) [HKLM] -- KBD
O42 - Logiciel: Lecteur Windows Media 11 - (.Pas de propriétaire.) [HKLM] -- Windows Media Player
O42 - Logiciel: Logiciel d'archivage WinRAR - (.Pas de propriétaire.) [HKLM] -- WinRAR archiver
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
O42 - Logiciel: MSXML 4.0 SP2 (KB936181) - (.Microsoft Corporation.) [HKLM] -- {C04E32E0-0416-434D-AFB9-6969D703A9EF}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Media Manager for WALKMAN 1.2 - (.Sony.) [HKLM] -- {5A6ED905-D19D-4954-8499-0DAF386460F7}
O42 - Logiciel: Micro Application - 9 Dictionnaires Utiles - (.Pas de propriétaire.) [HKLM] -- {B410328C-0E8C-4DD2-9DB4-DE7766D0DFE0}
O42 - Logiciel: Microsoft .NET Framework 1.1 - (.Microsoft.) [HKLM] -- {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
O42 - Logiciel: Microsoft .NET Framework 1.1 - (.Pas de propriétaire.) [HKLM] -- Microsoft .NET Framework 1.1  (1033)
O42 - Logiciel: Microsoft .NET Framework 1.1 French Language Pack - (.Microsoft.) [HKLM] -- {9A394342-4A68-4EBA-85A6-55B559F4E700}
O42 - Logiciel: Microsoft .NET Framework 1.1 Security Update (KB979906) - (.Pas de propriétaire.) [HKLM] -- M979906
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA - (.Microsoft Corporation.) [HKLM] -- {0BD83598-C2EF-3343-847B-7D2E84599128}
O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack SP1 - fra - (.Microsoft Corporation.) [HKLM] -- {3E31821C-7917-367E-938E-E65FC413EA31}
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
O42 - Logiciel: Microsoft Compression Client Pack 1.0 for Windows XP - (.Microsoft Corporation.) [HKLM] -- MSCompPackV1
O42 - Logiciel: Microsoft Internationalized Domain Names Mitigation APIs - (.Microsoft Corporation.) [HKLM] -- IDNMitigationAPIs
O42 - Logiciel: Microsoft National Language Support Downlevel APIs - (.Microsoft Corporation.) [HKLM] -- NLSDownlevelMapping
O42 - Logiciel: Microsoft Office 2000 Premium - (.Microsoft Corporation.) [HKLM] -- {0000040C-78E1-11D2-B60F-006097C998E7}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Search Enhancement Pack - (.Microsoft Corporation.) [HKLM] -- {4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Microsoft Sync Framework Runtime Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {8A74E887-8F0F-4017-AF53-CBA42211AAA5}
O42 - Logiciel: Microsoft Sync Framework Services Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0 - (.Microsoft Corporation.) [HKLM] -- Wudf01000
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 - (.Microsoft Corporation.) [HKLM] -- {770657D0-A123-3C07-8E44-1C83EC895118}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}
O42 - Logiciel: Microsoft Visual J# .NET Redistributable Package 1.1 - (.Microsoft.) [HKLM] -- {1A655D51-1423-48A3-B748-8F5A0BE294C8}
O42 - Logiciel: MobileMe Control Panel - (.Apple Inc..) [HKLM] -- {3AC54383-31D1-4907-961B-B12CBB1D0AE8}
O42 - Logiciel: Module linguistique Microsoft .NET Framework 3.5 SP1- fra - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 Language Pack SP1 - fra
O42 - Logiciel: NVIDIA Drivers - (.Pas de propriétaire.) [HKLM] -- NVIDIA Drivers
O42 - Logiciel: Norton Internet Security - (.Symantec Corporation.) [HKLM] -- {F396D99B-1FA8-4ED1-A006-B7A5972E06E2}
O42 - Logiciel: OCR Software by I.R.I.S 7.0 - (.HP.) [HKLM] -- HPOCR
O42 - Logiciel: Orange Inside - (.Orange.) [HKCU] -- Orange Inside
O42 - Logiciel: Orange Installeur version 1.0.0.0 - (.Orange.) [HKLM] -- {D13FE823-C575-4451-AC37-E645A67AA581}_1.0.0.0
O42 - Logiciel: Outil de téléchargement Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}
O42 - Logiciel: PC-Doctor pour Windows - (.Pas de propriétaire.) [HKLM] -- {1F7CCFA3-D926-4882-B2A5-A0217ED25597}
O42 - Logiciel: PS2 - (.Pas de propriétaire.) [HKLM] -- PS2
O42 - Logiciel: Photo et imagerie HP 3.5 - HP Devices - (.HP.) [HKLM] -- {15B9DC72-73F9-4d99-9E28-848D66DA8D99}
O42 - Logiciel: Photosmart 320,370,7400,8100,8400 Series (fra) - (.HP.) [HKLM] -- {AAC4FC36-8F89-4587-8DD3-EBC57C83374D}
O42 - Logiciel: Python 2.2 combined Win32 extensions - (.Pas de propriétaire.) [HKLM] -- Python 2.2 combined Win32 extensions
O42 - Logiciel: Python 2.2.1 - (.PythonLabs at Zope Corporation.) [HKLM] -- Python 2.2.1
O42 - Logiciel: Quick Zip 4.60.019 - (.Joseph Leung.) [HKLM] -- Quick Zip_is1
O42 - Logiciel: QuickTime - (.Apple Inc..) [HKLM] -- {1451DE6B-ABE1-4F62-BE9A-B363A17588A2}
O42 - Logiciel: Rainlendar2 (remove only) - (.Pas de propriétaire.) [HKLM] -- Rainlendar2
O42 - Logiciel: Segoe UI - (.Microsoft Corp.) [HKLM] -- {A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
O42 - Logiciel: SiS VGA Utilities - (.Pas de propriétaire.) [HKLM] -- SiS VGA Driver
O42 - Logiciel: Sonic RecordNow! - (.Hewlett-Packard.) [HKLM] -- {9541FED0-327F-4DF0-8B96-EF57EF622F19}
O42 - Logiciel: SpeedTouch USB Software - (.Pas de propriétaire.) [HKLM] -- {D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}
O42 - Logiciel: Sunbelt Personal Firewall - (.Sunbelt Software.) [HKLM] -- {BFD080F6-3BF0-40E1-9507-9CA969C35870}
O42 - Logiciel: Update for Microsoft .NET Framework 3.5 SP1 (KB963707) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707
O42 - Logiciel: VLC media player 0.9.8a - (.VideoLAN Team.) [HKLM] -- VLC media player
O42 - Logiciel: Visual C++ 2008 x86 Runtime - (v9.0.30729) - (.Microsoft Corporation.) [HKLM] -- {F333A33D-125C-32A2-8DCE-5C5D14231E27}
O42 - Logiciel: Visual C++ 2008 x86 Runtime - v9.0.30729.01 - (.Microsoft Corporation.) [HKLM] -- {F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01
O42 - Logiciel: Windows Genuine Advantage Validation Tool (KB892130) - (.Microsoft Corporation.) [HKLM] -- KB892130
O42 - Logiciel: Windows Internet Explorer 7 - (.Microsoft Corporation.) [HKLM] -- ie7
O42 - Logiciel: Windows Internet Explorer 8 - (.Microsoft Corporation.) [HKLM] -- ie8
O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {B3B487E7-6171-4376-9074-B28082CEB504}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3175E049-F9A9-4A3D-8F19-AC9FB04514D1}
O42 - Logiciel: Windows Live Contrôle parental - (.Microsoft Corporation.) [HKLM] -- {9FF9FDF7-F84A-4F99-B4BB-066B6F95F33D}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {5DD76286-9BE7-4894-A990-E905E91AC818}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {445B183D-F4F1-45C8-B9DB-F11355CA657B}
O42 - Logiciel: Windows Live Toolbar - (.Microsoft Corporation.) [HKLM] -- {9D6524E6-15CF-4852-BF70-04FE973A3DE1}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {4634B21A-CC07-4396-890C-2B8168661FEA}
O42 - Logiciel: Windows Media Format 11 runtime - (.Microsoft Corporation.) [HKLM] -- WMFDist11
O42 - Logiciel: Windows Media Format 11 runtime - (.Pas de propriétaire.) [HKLM] -- Windows Media Format Runtime
O42 - Logiciel: Windows Media Player 11 - (.Microsoft Corporation.) [HKLM] -- wmp11
O42 - Logiciel: Windows XP Service Pack 3 - (.Microsoft Corporation.) [HKLM] -- Windows XP Service
O42 - Logiciel: XML Paper Specification Shared Components Language Pack 1.0 - (.Microsoft Corporation.) [HKLM] -- XPSEPSCLP
O42 - Logiciel: barre d'outils Orange - (.France Telecom SA.) [HKLM] -- OrangeToolbarFR
O42 - Logiciel: getPlus(R) for Adobe - (.NOS Microsystems Ltd..) [HKLM] -- {CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
O42 - Logiciel: iPod Video Converter 3.80 - (.iPodRobot.com @ VOW Software Co, Ltd..) [HKLM] -- iPod Video Converter
O42 - Logiciel: iTunes - (.Apple Inc..) [HKLM] -- {A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}

---\ HKCU & HKLM Software Keys
[HKCU\Software\AC3filter]
[HKCU\Software\AVS4YOU]
[HKCU\Software\Ad-Remover]
[HKCU\Software\Adobe]
[HKCU\Software\Alcatel]
[HKCU\Software\AppDataLow]
[HKCU\Software\Apple Computer, Inc.]
[HKCU\Software\Apple Inc.]
[HKCU\Software\Audacity]
[HKCU\Software\Avg]
[HKCU\Software\Avira]
[HKCU\Software\CDDB]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\Creative Tech]
[HKCU\Software\Cygnus Solutions]
[HKCU\Software\DivXNetworks]
[HKCU\Software\Eraser]
[HKCU\Software\GNU]
[HKCU\Software\GSpot Appliance Corp]
[HKCU\Software\Gabest]
[HKCU\Software\GetData]
[HKCU\Software\Google]
[HKCU\Software\Haali]
[HKCU\Software\Hewlett-Packard]
[HKCU\Software\HookNetwork]
[HKCU\Software\IE]
[HKCU\Software\IM Providers]
[HKCU\Software\Illustrate]
[HKCU\Software\Intel]
[HKCU\Software\InterVideo]
[HKCU\Software\JEDI-VCL]
[HKCU\Software\JavaSoft]
[HKCU\Software\LAventure]
[HKCU\Software\Lake]
[HKCU\Software\Lavalys]
[HKCU\Software\Lavasoft]
[HKCU\Software\Leadertech]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MediaInfo]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Netscape]
[HKCU\Software\Novell]
[HKCU\Software\ODBC]
[HKCU\Software\ORL]
[HKCU\Software\Opendisc]
[HKCU\Software\OrangeInside]
[HKCU\Software\OrangeInstaller]
[HKCU\Software\Orange]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\Quickzip]
[HKCU\Software\SPAMfighter]
[HKCU\Software\SampleView]
[HKCU\Software\Serenescreen]
[HKCU\Software\SoftPerfect]
[HKCU\Software\Sonic]
[HKCU\Software\Sony Corporation]
[HKCU\Software\Sony Creative Software]
[HKCU\Software\SpoonInstall]
[HKCU\Software\Sunbelt Software]
[HKCU\Software\Symantec]
[HKCU\Software\Trolltech]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\VOWSoft]
[HKCU\Software\VirginMega]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Windows Live Writer]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\Yahoo]
[HKCU\Software\eBay]
[HKCU\Software\keyhole.com]
[HKLM\Software\AVG]
[HKLM\Software\AVS4YOU]
[HKLM\Software\Adobe]
[HKLM\Software\Agere]
[HKLM\Software\Alcatel]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\Avance]
[HKLM\Software\AviSynth]
[HKLM\Software\Avira]
[HKLM\Software\C07ft5Y]
[HKLM\Software\CDDB]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Codec Tweak Tool]
[HKLM\Software\Creative Tech]
[HKLM\Software\Cygnus Solutions]
[HKLM\Software\DivXNetworks]
[HKLM\Software\FNET]
[HKLM\Software\FRANCE TELECOM]
[HKLM\Software\FreeCDRIP]
[HKLM\Software\GEAR Software]
[HKLM\Software\GNU]
[HKLM\Software\Gabest]
[HKLM\Software\Garmin]
[HKLM\Software\Gemplus]
[HKLM\Software\Genesys Logic]
[HKLM\Software\Google]
[HKLM\Software\Grisoft]
[HKLM\Software\HP]
[HKLM\Software\HaaliMkx]
[HKLM\Software\Hewlett-Packard]
[HKLM\Software\HighCriteria]
[HKLM\Software\ICE]
[HKLM\Software\INTEL]
[HKLM\Software\InstallShield]
[HKLM\Software\InterVideo]
[HKLM\Software\JavaRa]
[HKLM\Software\JavaSoft]
[HKLM\Software\KLCodecPack]
[HKLM\Software\Kantaris]
[HKLM\Software\LEAD Technologies, Inc.]
[HKLM\Software\Lake]
[HKLM\Software\Lavasoft]
[HKLM\Software\Licenses]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\Micro Application]
[HKLM\Software\MicroVision]
[HKLM\Software\MimarSinan]
[HKLM\Software\Mininova]
[HKLM\Software\Motive]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\NOS]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Nelco]
[HKLM\Software\Novell]
[HKLM\Software\ODBC]
[HKLM\Software\Orange]
[HKLM\Software\PC-Doctor]
[HKLM\Software\Policies]
[HKLM\Software\Program Groups]
[HKLM\Software\Python]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\S3R521]
[HKLM\Software\S3]
[HKLM\Software\SECURITOO]
[HKLM\Software\SPAMfighter]
[HKLM\Software\Safer Networking Limited]
[HKLM\Software\Schlumberger]
[HKLM\Software\Secure]
[HKLM\Software\SiS]
[HKLM\Software\Sonic]
[HKLM\Software\Sony Corporation]
[HKLM\Software\Sony Creative Software]
[HKLM\Software\Sunbelt Software]
[HKLM\Software\SymNRT]
[HKLM\Software\Symantec]
[HKLM\Software\Uniblue]
[HKLM\Software\VideoLAN]
[HKLM\Software\Wilson WindowWare]
[HKLM\Software\WinRAR]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\Windows]
[HKLM\Software\X-AVCSD]
[HKLM\Software\Yahoo]
[HKLM\Software\ZSMC]
[HKLM\Software\mozilla.org]


---\ Contenu des dossiers ProgramFiles/ProgramData (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\a-squared Free
O43 - CFD:Common File Directory ----D- C:\Program Files\Ad-Remover
O43 - CFD:Common File Directory ----D- C:\Program Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Apple Software Update
O43 - CFD:Common File Directory ----D- C:\Program Files\Avira
O43 - CFD:Common File Directory ----D- C:\Program Files\AviSynth 2.5
O43 - CFD:Common File Directory ----D- C:\Program Files\AVS4YOU
O43 - CFD:Common File Directory ----D- C:\Program Files\Bonjour
O43 - CFD:Common File Directory ----D- C:\Program Files\CCleaner
O43 - CFD:Common File Directory ----D- C:\Program Files\Creative
O43 - CFD:Common File Directory ----D- C:\Program Files\DIFX
O43 - CFD:Common File Directory ----D- C:\Program Files\Easy Internet signup
O43 - CFD:Common File Directory ----D- C:\Program Files\FAT32 Format
O43 - CFD:Common File Directory ----D- C:\Program Files\Fat32Format
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\Free Audio Pack
O43 - CFD:Common File Directory ----D- C:\Program Files\Garmin
O43 - CFD:Common File Directory ----D- C:\Program Files\Garmin GPS Plugin
O43 - CFD:Common File Directory ----D- C:\Program Files\Google
O43 - CFD:Common File Directory ----D- C:\Program Files\Help and Support Additions
O43 - CFD:Common File Directory ----D- C:\Program Files\Hewlett-Packard
O43 - CFD:Common File Directory ----D- C:\Program Files\HP
O43 - CFD:Common File Directory ----D- C:\Program Files\Illustrate
O43 - CFD:Common File Directory --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\InterVideo
O43 - CFD:Common File Directory ----D- C:\Program Files\IObit
O43 - CFD:Common File Directory ----D- C:\Program Files\iPod
O43 - CFD:Common File Directory ----D- C:\Program Files\iPodRobot
O43 - CFD:Common File Directory ----D- C:\Program Files\iTunes
O43 - CFD:Common File Directory ----D- C:\Program Files\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Java(2)
O43 - CFD:Common File Directory ----D- C:\Program Files\K-Lite Codec Pack
O43 - CFD:Common File Directory ----D- C:\Program Files\Lavalys
O43 - CFD:Common File Directory ----D- C:\Program Files\Lavasoft
O43 - CFD:Common File Directory ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD:Common File Directory ----D- C:\Program Files\Micro Application
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft
O43 - CFD:Common File Directory ----D- C:\Program Files\microsoft frontpage
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Sync Framework
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Visual Studio
O43 - CFD:Common File Directory ----D- C:\Program Files\Movie Maker
O43 - CFD:Common File Directory ----D- C:\Program Files\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD:Common File Directory ----D- C:\Program Files\MSXML 4.0
O43 - CFD:Common File Directory ----D- C:\Program Files\NetMeeting
O43 - CFD:Common File Directory ----D- C:\Program Files\NOS
O43 - CFD:Common File Directory ----D- C:\Program Files\Orange
O43 - CFD:Common File Directory ----D- C:\Program Files\Outlook Express
O43 - CFD:Common File Directory ---AD- C:\Program Files\PC-Doctor for Windows
O43 - CFD:Common File Directory ----D- C:\Program Files\QuickTime
O43 - CFD:Common File Directory ----D- C:\Program Files\QuickZip4
O43 - CFD:Common File Directory ----D- C:\Program Files\Rainlendar2
O43 - CFD:Common File Directory ----D- C:\Program Files\Reference Assemblies
O43 - CFD:Common File Directory ----D- C:\Program Files\Services en ligne
O43 - CFD:Common File Directory ----D- C:\Program Files\SiS VGA Utilities V3.59e
O43 - CFD:Common File Directory ----D- C:\Program Files\Sonic
O43 - CFD:Common File Directory ----D- C:\Program Files\Sonic RecordNow!
O43 - CFD:Common File Directory ----D- C:\Program Files\Sony
O43 - CFD:Common File Directory ----D- C:\Program Files\Sunbelt Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Thomson
O43 - CFD:Common File Directory ----D- C:\Program Files\TomTom DesktopSuite
O43 - CFD:Common File Directory ----D- C:\Program Files\Trend Micro
O43 - CFD:Common File Directory ----D- C:\Program Files\Uniblue
O43 - CFD:Common File Directory --H-D- C:\Program Files\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files\VideoLAN
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Connect 2
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows NT
O43 - CFD:Common File Directory --H-D- C:\Program Files\WindowsUpdate
O43 - CFD:Common File Directory ----D- C:\Program Files\WinRAR
O43 - CFD:Common File Directory ----D- C:\Program Files\xerox
O43 - CFD:Common File Directory ----D- C:\Program Files\ZHPDiag
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Apple
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\AVSMedia
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\BitDefender
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Designer
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\France Telecom
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Hewlett-Packard
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\HP
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\InstallShield
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Java
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\MSSoap
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\ODBC
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\PC Tools
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Services
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Sony Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\SpeechEngines
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\SureThing Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\System
O43 - CFD:Common File Directory ----D- C:\Program Files\Fichiers Communs\Windows Live
O43 - CFD:Common File Directory -SH-D- C:\Program Files\Fichiers Communs\WindowsLiveInstaller


---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 17:32:31 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\WindowsUpdate.log   [1259436]
O44 - LFC:[MD5.67F1C8C98C2148BAF4ED68ED5117CA9D] - 05/09/2010 - 13:57:51 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32
vapps.xml   [4452]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/09/2010 - 13:57:25 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\0.log   [0]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 13:57:21 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\wiadebug.log   [159]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 13:57:21 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\sti.log   [627]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 13:57:17 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\wiaservc.log   [50]
O44 - LFC:[MD5.6A2CB42966136854F4464516FBB4AE72] - 05/09/2010 - 13:57:05 -S-A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\bootstat.dat   [2048]
O44 - LFC:[MD5.F4D843B0957A0EACCEA30F723F173611] - 05/09/2010 - 13:56:58 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\aaw7boot.log   [90653]
O44 - LFC:[MD5.00000000000000000000000000000000] - 05/09/2010 - 13:55:59 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\SchedLgU.Txt   [32076]
O44 - LFC:[MD5.873EA3362AA6AC9B704F6C27D2CC7445] - 05/09/2010 - 13:55:58 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\bthservsdp.dat   [12]
O44 - LFC:[MD5.9BA0F076623E0606E74D179BF6244932] - 05/09/2010 - 13:34:10 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\ZHPExportRegistry-05-09-2010-14-34-10.txt   [41298]
O44 - LFC:[MD5.129AF27B6B4AABB6338E934FB1F7C552] - 05/09/2010 - 13:27:45 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setupact.log   [75]
O44 - LFC:[MD5.67DCC536C5D3EB9208578FE60143D423] - 05/09/2010 - 13:27:45 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setupapi.log   [19240]
O44 - LFC:[MD5.CB5829F9B073B0A58FBE4308A4705181] - 05/09/2010 - 13:09:53 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Ad-Report-CLEAN[1].txt   [2813]
O44 - LFC:[MD5.C7DD7D9739785BD3A6B8499EEC1DEE7E] - 05/09/2010 - 08:29:25 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys   [38224]
O44 - LFC:[MD5.67B48A903430C6D4FB58CBACA1866601] - 05/09/2010 - 08:29:22 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbam.sys   [20952]
O44 - LFC:[MD5.ADEFE7A022D977E431C17B46153707D2] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\FaxSetup.log   [61594]
O44 - LFC:[MD5.09724E220EEAB5395A4D8844C7463C79] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB981332-IE8.log   [7217]
O44 - LFC:[MD5.B953EB23165846090766FF9CA956073E] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\comsetup.log   [20422]
O44 - LFC:[MD5.C88D66ADEB230FD54D947B756C45F36C] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\iis6.log   [9634]
O44 - LFC:[MD5.39B3F72C9EEEE6AE609638B651CEDADA] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\imsins.log   [1355]
O44 - LFC:[MD5.EF62BD3FE5CB279D85DDB2736E6C921B] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\msgsocm.log   [3030]
O44 - LFC:[MD5.011D503AB844C213491083444AA50FEA] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS
tdtcsetup.log   [12362]
O44 - LFC:[MD5.50FB9C9E9EB994284AC3DC982EA14AF8] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ocgen.log   [29560]
O44 - LFC:[MD5.31D3985B5BA22E48F6EC8D67AE5AE24B] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ocmsn.log   [3420]
O44 - LFC:[MD5.F869CB40C5679555D2DEE4BBA2D10B09] - 05/09/2010 - 08:05:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS	soc.log   [23590]
O44 - LFC:[MD5.5DDBD7D9BC420CF34BCBF2B18699BFE8] - 05/09/2010 - 08:05:16 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB976662-IE8.log   [8115]
O44 - LFC:[MD5.26146A18C026D9F44BB44822E2BFEF07] - 05/09/2010 - 08:05:16 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\imsins.BAK   [1355]
O44 - LFC:[MD5.722F2988A014341A454FDAEDA02F8A8C] - 05/09/2010 - 08:05:15 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\updspapi.log   [43257]
O44 - LFC:[MD5.C4B8DC578E4D69F8F7B093E4087F8460] - 05/09/2010 - 08:05:08 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB971961-IE8.log   [7864]
O44 - LFC:[MD5.A6E2514716EC28AD305F35D921153495] - 05/09/2010 - 08:03:01 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\wpa.dbl   [1158]
O44 - LFC:[MD5.6C67AC9BE6D413F6EABE66AFB1DAB355] - 05/09/2010 - 06:17:04 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\spupdsvc.log   [7525]
O44 - LFC:[MD5.6828009A50744E5FA9EF26C7D95B53FB] - 05/09/2010 - 06:14:49 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ie8_main.log   [42880]
O44 - LFC:[MD5.1DCC9CFE391B87FE1F99026C9CC03865] - 05/09/2010 - 06:14:45 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB2183461-IE8.log   [166858]
O44 - LFC:[MD5.E508F8C5D893547CFF5BCAFFEB878BDF] - 05/09/2010 - 06:14:09 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB982664-IE8.log   [159863]
O44 - LFC:[MD5.F711748CA7CB773198A2126A705B634B] - 05/09/2010 - 06:13:57 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB982381-IE8.log   [181668]
O44 - LFC:[MD5.7C536719CB6155EBB082238D090804AA] - 05/09/2010 - 06:12:51 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\ie8.log   [176548]
O44 - LFC:[MD5.7301F1916E680D330326AE01802CC2DA] - 05/09/2010 - 05:47:47 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB2183461-IE7.log   [73492]
O44 - LFC:[MD5.D3E15965DE089FBA16F2E82A0D9DCAF5] - 05/09/2010 - 05:47:14 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB981349.log   [12176]
O44 - LFC:[MD5.CB446351EC02416C2795145EC3D8D8F5] - 05/09/2010 - 05:47:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\KB971961.log   [8171]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/09/2010 - 05:47:05 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setuperr.log   [0]
O44 - LFC:[MD5.408A6EAADFF48AC9D5F1F587A1CC15FA] - 31/08/2010 - 15:49:09 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\FNTCACHE.DAT   [152384]
O44 - LFC:[MD5.2C46310AC8198036C99E7DA2F652E6F9] - 31/08/2010 - 15:45:02 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\PerfStringBackup.INI   [1088680]
O44 - LFC:[MD5.93308D18DBAD016209C00274611BD6E9] - 31/08/2010 - 15:45:02 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\perfc009.dat   [73000]
O44 - LFC:[MD5.FC1431D53644777EF267CA5C0A62EF2A] - 31/08/2010 - 15:45:02 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\perfc00C.dat   [87108]
O44 - LFC:[MD5.DCAD67E15F103147C0AEFC56CD166913] - 31/08/2010 - 15:45:02 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\perfh009.dat   [444118]
O44 - LFC:[MD5.5D0890ED95B8209A55475AD099D366A6] - 31/08/2010 - 15:45:02 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\perfh00C.dat   [514548]


---\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll


---\ Export de clé d'application autorisée (ECAA) (O47)
O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessm

Utilisateur anonyme · Answer

Salut     

non c'est pas ce qui t était demandé et en plus ce rapport est incomplet     

lis bien ce qui suit étape par étape     

 -+-+-+-+-> ZHPFix <-+-+-+-+-        


1) * ferme toutes les applications ouvertes.       
      
2)* Copies  tout le texte présent en gras dans l'encadré ci-dessous         
*( tu le selectionnes avec ta souris >> Clique droit dessus et choisis "copier" ou fait Ctrl+C )       


        
 O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (.Pas de propriétaire - Pas de description.) --  (.not file.)           
 OPT:O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe           
 OPT:O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe           
 OPT:OPT:O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe           
 OPT:O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe           
O42 - Logiciel: Search Settings 1.2.2 - (.Spigot, Inc..) [HKLM] -- {0B1AAC97-8563-41D9-AE47-58E6A222F0E1}           
 [HKCU\Software\Conduit]           
 [HKCU\Software\Mininova]           
 [HKLM\Software\BrowserChoice]           
 O43 - CFD:Common File Directory ----D- C:\Program Files\Conduit           
 O53 - SMSR:HKLM\...\startupreg\swg  [Key] . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe           


        


3) * Double Clique sur l'icone ZhpFix du bureau pour le lancer .       

4)* Une fois l'outil ZHPFix ouvert ,          

5)* clique sur le bouton [ H ] cliques pour voir ==> Image ( "coller les lignes Helper" ) .         

6)* Dans l'encadré principal          

7)* tu verras donc les lignes que tu as copié précédemment apparaitre  .         

8) * Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.          

9) * cliques >> OK puis        

10) * Cliques sur >>Tous        

11) * Pour finir clique sur >> Nettoyer .         
* colle le rapport obtenu .          
( ce rapport est sauvegardé dans ce dossier C:\Program files\ZHPDiag\ZHPFixReport.txt )          


                 
                     
            Membre Contributeur sécurité CCM     
            Windows Vista // Windows XP

lilou4515 · Answer

voila je suis dur pour comprendre mais je pense que la c'est ok:

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-4104955527-856496882-2249289308-1007\Software\Microsoft\Windows\CurrentVersion\Run]
"orangeinside"="C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe"
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

lilou4515 · Answer

salut

est ce que c'est ça?


Rapport de ZHPFix v1.12.3143 par Nicolas Coolman, Update du 01/09/2010
Fichier d'export Registre : 
Run by HP_Propriétaire at 06/09/2010 17:19:18
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
HKCU\Software\Conduit  => Clé absente
HKCU\Software\Mininova  => Clé absente
HKLM\Software\BrowserChoice  => Clé absente
O53 - SMSR:HKLM\...\startupreg\swg [Key] . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe  => Clé absente

========== Valeur(s) du Registre ==========
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (.Pas de propriétaire - Pas de description.) -- (.not file.)  => Valeur absente
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe  => Valeur absente
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe  => Valeur absente
O4 - HKUS\S-1-5-21-4104955527-856496882-2249289308-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe  => Valeur supprimée avec succès

========== Dossier(s) ==========
C:\Program Files\Conduit  => Dossier absent

========== Fichier(s) ==========
c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe  => Supprimé et mis en quarantaine

========== Logiciel(s) ==========
O42 - Logiciel: Search Settings 1.2.2 - (.Spigot, Inc..) [HKLM] -- {0B1AAC97-8563-41D9-AE47-58E6A222F0E1}  => Logiciel déjà supprimé

========== Autre ==========
OPT:O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe  => Format Non supporté


========== Récapitulatif ==========
4 : Clé(s) du Registre
4 : Valeur(s) du Registre
1 : Dossier(s)
1 : Fichier(s)
1 : Logiciel(s)
1 : Autre


End of the scan

Utilisateur anonyme · Answer

Salut  


ok maintenant tu as reussie

fais ce qui suit

1) /!\ Il faut IMPERATIVEMENT désactiver tous tes logiciels de protection pour utiliser ce programme/!\  

* Télécharge GMER Rootkit Scanner  :   

* GMER est  l'un des meilleurs scanneurs rootkits actuels.  
* Il est capable de détecter la casi totalité des rootkits.  

  ICI  >>  gmer   
   
*  Ferme également toutes les applications actives dont ton navigateur.   
*  Clique sur le bouton "Download EXE"   
*  Sauvegarde-le sur ton Bureau.   
*  Double-clique sur l'exécutable téléchargé .   
*  Utilisateurs de Windows Vista / Windows7 tu fais un clic droit sur l'icône  et exécute en tant qu'administrateur..   
* Dans l'onglet "Rootkit", clique sur "SCAN" puis patiente...  
* A la fin, clique sur "SAVE" et enregistre le rapport sur ton Bureau.  
* Héberge le rapport de Gmer  sur ce site,  
cijoint.fr  
* Copie/colle les liens générés ici  


* Pour t aider  
* rends toi sur http://www.cijoint.fr     
* clic sur Parcourir     
* trouve >> le rapport que tu viens d'enregistrer qui doit par exemple être sur ton bureau     
* et valide en cliquant sur >> Cliquez ici pour déposer le Fichier    
* un lien de ce genre http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt te sera généré,    


Si GMER  plante, il faut savoir que certains logiciels peuvent gêner les outils de désinfection.    
Utilise Defogger pour les désactiver temporairement    



* Télécharge Defogger (de jpshortstuff) sur ton Bureau  
   ICI  >> Defogger (de jpshortstuff)  
* Lance le  
* Pour Windows Vista et Windows 7,   
*  faire un clic droit et >>  Exécuter en tant qu'administrateur.   
* Une fenêtre apparait : clique sur "Disable"  
* Fais redémarrer l'ordinateur si l'outil te le demande  
* Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"  

* puis réessaye Gmer :  



2)/!\  Réactives  tous tes logiciels de protection /!\   



3)* J ai vu que tu as Malwarebytes    

* Lances--> Malwarebytes (MBAM)    
* Fais une  mise a jour       <== à faire  
* Puis vas dans l'onglet "Recherche", coche >> Exécuter un examen complet      
* puis "Rechercher"      
*  Sélectionnes tes disques durs" puis clique sur "Lancer l'examen"      
*  A la fin du scan, clique sur Afficher les résultats puis sur Enregistrer le rapport      
*Si MalwareBytes'  détecte des infections, clique sur ==>Afficher les résultats, puis sur ==>Supprimer la sélection      
* S'il t' es demandé de redémarrer, clique sur "oui "      
*  aprés la suppression(s) de ou des infections trouvées --> poste le rapport ici      




     
                
            Membre Contributeur sécurité CCM
            Windows Vista // Windows XP

lilou4515 · Answer

salut 
je le poste comme ça car, si je veux le poster part le lien ci joint.fr il me dit qu'il n'y a pas de fichier.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-07 17:52:04
Windows 5.1.2600 Service Pack 3
Running: yxh755it.exe; Driver: C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\pwloifow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwClose [0xF5492F80]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwCreateFile [0xF5492552]
SSDT            F7B72286                                                                                                                                       ZwCreateKey
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwCreateProcess [0xF5491A1A]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwCreateProcessEx [0xF5491910]
SSDT            F7B7227C                                                                                                                                       ZwCreateThread
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwDeleteFile [0xF5493034]
SSDT            F7B7228B                                                                                                                                       ZwDeleteKey
SSDT            F7B72295                                                                                                                                       ZwDeleteValueKey
SSDT            \SystemRoot\system32\drivers\khips.sys (Sunbelt Personal Firewall Host Intrusion Prevention Driver/Sunbelt Software)                           ZwLoadDriver [0xF52EFF64]
SSDT            F7B7229A                                                                                                                                       ZwLoadKey
SSDT            \SystemRoot\system32\drivers\khips.sys (Sunbelt Personal Firewall Host Intrusion Prevention Driver/Sunbelt Software)                           ZwMapViewOfSection [0xF52F024A]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwOpenFile [0xF5492906]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwOpenKey [0xF548EB78]
SSDT            F7B72268                                                                                                                                       ZwOpenProcess
SSDT            F7B7226D                                                                                                                                       ZwOpenThread
SSDT            F7B722A4                                                                                                                                       ZwReplaceKey
SSDT            F7B7229F                                                                                                                                       ZwRestoreKey
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwResumeThread [0xF54920DC]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwSetInformationFile [0xF5492CE0]
SSDT            F7B72290                                                                                                                                       ZwSetValueKey
SSDT            F7B72277                                                                                                                                       ZwTerminateProcess
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwWriteFile [0xF5492BB2]

---- Kernel code sections - GMER 1.0.15 ----

PAGENDSM        NDIS.sys!NdisMIndicateStatus                                                                                                                   F72139EF 6 Bytes  JMP F5486C5E \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
init            C:\WINDOWS\system32\drivers\ALCXSENS.SYS                                                                                                       entry point in "init" section [0xF68D1510]
init            C:\WINDOWS\system32\drivers\FNETDEVI.SYS                                                                                                       entry point in "init" section [0xF79B6000]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualProtectEx                                                             7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualProtect                                                               7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!WriteProcessMemory                                                           7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessW                                                               7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessA                                                               7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualAlloc                                                                 7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualAllocEx                                                               7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateRemoteThread                                                           7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateThread                                                                 7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessInternalW                                                       7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessInternalA                                                       7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!WinExec                                                                      7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!SetThreadContext                                                             7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] USER32.dll!SetWindowsHookExW                                                              7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] USER32.dll!SetWindowsHookExA                                                              7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] WS2_32.dll!socket                                                                         719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] WS2_32.dll!bind                                                                           719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] WS2_32.dll!connect                                                                        719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 000301A8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00030090 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!WriteProcessMemory                                            7C802213 5 Bytes  JMP 00030694 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 000302C0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00030234 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualAlloc                                                  7C809AF1 5 Bytes  JMP 00030004 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualAllocEx                                                7C809B12 5 Bytes  JMP 0003011C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateRemoteThread                                            7C8104CC 5 Bytes  JMP 000304F0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateThread                                                  7C8106D7 5 Bytes  JMP 0003057C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessInternalW                                        7C8197B0 5 Bytes  JMP 000303D8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessInternalA                                        7C81D54E 5 Bytes  JMP 0003034C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00030464 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!SetThreadContext                                              7C863C09 5 Bytes  JMP 00030608 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] USER32.dll!SetWindowsHookExW                                               7E3A820F 5 Bytes  JMP 000307AC 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] USER32.dll!SetWindowsHookExA                                               7E3B1211 5 Bytes  JMP 00030720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WS2_32.dll!socket                                                          719F4211 5 Bytes  JMP 000308C4 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WS2_32.dll!bind                                                            719F4480 5 Bytes  JMP 00030838 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WS2_32.dll!connect                                                         719F4A07 5 Bytes  JMP 00030950 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetConnectA                                               404BDEAE 5 Bytes  JMP 00030F54 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetConnectW                                               404BF862 5 Bytes  JMP 00030FE0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenA                                                  404CD690 5 Bytes  JMP 00030D24 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenW                                                  404CDB09 5 Bytes  JMP 00030DB0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenUrlA                                               404CF3A4 5 Bytes  JMP 00030E3C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenUrlW                                               40516DDF 5 Bytes  JMP 00030EC8 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[428] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[428] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualProtectEx                                                                               7C801A61 5 Bytes  JMP 001601A8 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualProtect                                                                                 7C801AD4 5 Bytes  JMP 00160090 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!WriteProcessMemory                                                                             7C802213 5 Bytes  JMP 00160694 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessW                                                                                 7C802336 5 Bytes  JMP 001602C0 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessA                                                                                 7C80236B 5 Bytes  JMP 00160234 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualAlloc                                                                                   7C809AF1 5 Bytes  JMP 00160004 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualAllocEx                                                                                 7C809B12 5 Bytes  JMP 0016011C 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateRemoteThread                                                                             7C8104CC 5 Bytes  JMP 001604F0 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateThread                                                                                   7C8106D7 5 Bytes  JMP 0016057C 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessInternalW                                                                         7C8197B0 5 Bytes  JMP 001603D8 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessInternalA                                                                         7C81D54E 5 Bytes  JMP 0016034C 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!WinExec                                                                                        7C86250D 5 Bytes  JMP 00160464 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!SetThreadContext                                                                               7C863C09 5 Bytes  JMP 00160608 
.text           C:\WINDOWS\system32\csrss.exe[608] USER32.dll!SetWindowsHookExW                                                                                7E3A820F 5 Bytes  JMP 001607AC 
.text           C:\WINDOWS\system32\csrss.exe[608] USER32.dll!SetWindowsHookExA                                                                                7E3B1211 5 Bytes  JMP 00160720 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000701A8 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00070090 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00070694 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000702C0 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00070234 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00070004 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0007011C 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000704F0 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0007057C 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000703D8 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0007034C 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00070464 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00070608 
.text           C:\WINDOWS\system32\winlogon.exe[632] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000707AC 
.text           C:\WINDOWS\system32\winlogon.exe[632] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00070720 
.text           C:\WINDOWS\system32\winlogon.exe[632] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000708C4 
.text           C:\WINDOWS\system32\winlogon.exe[632] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00070838 
.text           C:\WINDOWS\system32\winlogon.exe[632] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00070950 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\services.exe[676] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\services.exe[676] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\services.exe[676] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000708C4 
.text           C:\WINDOWS\system32\services.exe[676] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00070838 
.text           C:\WINDOWS\system32\services.exe[676] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00070950 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualProtectEx                                                                               7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualProtect                                                                                 7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!WriteProcessMemory                                                                             7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessW                                                                                 7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessA                                                                                 7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualAlloc                                                                                   7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualAllocEx                                                                                 7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateRemoteThread                                                                             7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateThread                                                                                   7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessInternalW                                                                         7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessInternalA                                                                         7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!WinExec                                                                                        7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!SetThreadContext                                                                               7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\lsass.exe[688] USER32.dll!SetWindowsHookExW                                                                                7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\lsass.exe[688] USER32.dll!SetWindowsHookExA                                                                                7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!socket                                                                                           719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!bind                                                                                             719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!connect                                                                                          719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!socket                                                                                         719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!bind                                                                                           719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!connect                                                                                        719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!socket                                                                                         719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!bind                                                                                           719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!connect                                                                                        719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\System32\svchost.exe[976] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\System32\svchost.exe[976] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\System32\svchost.exe[976] WS2_32.dll!socket                                                                                         719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\System32\svchost.exe[976] WS2_32.dll!bind                                                                                           719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\System32\svchost.exe[976] WS2_32.dll!connect                                                                                        719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetConnectA                                                                              404BDEAE 5 Bytes  JMP 00080F54 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetConnectW                                                                              404BF862 5 Bytes  JMP 00080FE0 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenA                                                                                 404CD690 5 Bytes  JMP 00080D24 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenW                                                                                 404CDB09 5 Bytes  JMP 00080DB0 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenUrlA                                                                              404CF3A4 5 Bytes  JMP 00080E3C 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenUrlW                                                                              40516DDF 5 Bytes  JMP 00080EC8 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1008] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1008] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualProtectEx                                            7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualProtect                                              7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!WriteProcessMemory                                          7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessW                                              7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessA                                              7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualAlloc                                                7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualAllocEx                                              7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateRemoteThread                                          7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateThread                                                7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessInternalW                                      7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessInternalA                                      7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!WinExec                                                     7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!SetThreadContext                                            7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] USER32.dll!SetWindowsHookExW                                             7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] USER32.dll!SetWindowsHookExA                                             7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] WS2_32.dll!socket                                                        719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] WS2_32.dll!bind                                                          719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] WS2_32.dll!connect                                                       719F4A07 5 Bytes  JMP 00130950 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualProtectEx                                                                                    7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualProtect                                                                                      7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!WriteProcessMemory                                                                                  7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessW                                                                                      7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessA                                                                                      7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualAlloc                                                                                        7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualAllocEx                                                                                      7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateRemoteThread                                                                                  7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateThread                                                                                        7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessInternalW                                                                              7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessInternalA                                                                              7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!WinExec                                                                                             7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!SetThreadContext                                                                                    7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\Explorer.EXE[1340] USER32.dll!SetWindowsHookExW                                                                                     7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\Explorer.EXE[1340] USER32.dll!SetWindowsHookExA                                                                                     7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetConnectA                                                                                     404BDEAE 5 Bytes  JMP 00080F54 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetConnectW                                                                                     404BF862 5 Bytes  JMP 00080FE0 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenA                                                                                        404CD690 5 Bytes  JMP 00080D24 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenW                                                                                        404CDB09 5 Bytes  JMP 00080DB0 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenUrlA                                                                                     404CF3A4 5 Bytes  JMP 00080E3C 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenUrlW                                                                                     40516DDF 5 Bytes  JMP 00080EC8 
.text           C:\WINDOWS\Explorer.EXE[1340] WS2_32.dll!socket                                                                                                719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\Explorer.EXE[1340] WS2_32.dll!bind                                                                                                  719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\Explorer.EXE[1340] WS2_32.dll!connect                                                                                               719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1356] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1356] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00080950 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualProtectEx                                                            7C801A61 5 Bytes  JMP 001401A8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualProtect                                                              7C801AD4 5 Bytes  JMP 00140090 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!WriteProcessMemory                                                          7C802213 5 Bytes  JMP 00140694 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessW                                                              7C802336 5 Bytes  JMP 001402C0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessA                                                              7C80236B 5 Bytes  JMP 00140234 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualAlloc                                                                7C809AF1 5 Bytes  JMP 00140004 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualAllocEx                                                              7C809B12 5 Bytes  JMP 0014011C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateRemoteThread                                                          7C8104CC 5 Bytes  JMP 001404F0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateThread                                                                7C8106D7 5 Bytes  JMP 0014057C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessInternalW                                                      7C8197B0 5 Bytes  JMP 001403D8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessInternalA                                                      7C81D54E 5 Bytes  JMP 0014034C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!WinExec                                                                     7C86250D 5 Bytes  JMP 00140464 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!SetThreadContext                                                            7C863C09 5 Bytes  JMP 00140608 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!DialogBoxParamW                                                               7E3A47AB 5 Bytes  JMP 40D85501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!SetWindowsHookExW                                                             7E3A820F 5 Bytes  JMP 40E59AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!CallNextHookEx                                                                7E3AB3C6 5 Bytes  JMP 40E4D135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!CreateWindowExW                                                               7E3AD0A3 5 Bytes  JMP 40E5DB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!UnhookWindowsHookEx                                                           7E3AD5F3 5 Bytes  JMP 40DC4666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!SetWindowsHookExA                                                             7E3B1211 5 Bytes  JMP 00140720 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!DialogBoxIndirectParamW                                                       7E3B2072 5 Bytes  JMP 40F54B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!MessageBoxIndirectA                                                           7E3BA082 5 Bytes  JMP 40F54AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text

Utilisateur anonyme · Answer

Salut

le rapport est incomplet poste le en plusieurs fois >>mais il me le faut en entier

lilou4515 · Answer

ok ça marche


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-07 17:52:04
Windows 5.1.2600 Service Pack 3
Running: yxh755it.exe; Driver: C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\pwloifow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwClose [0xF5492F80]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwCreateFile [0xF5492552]
SSDT            F7B72286                                                                                                                                       ZwCreateKey
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwCreateProcess [0xF5491A1A]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwCreateProcessEx [0xF5491910]
SSDT            F7B7227C                                                                                                                                       ZwCreateThread
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwDeleteFile [0xF5493034]
SSDT            F7B7228B                                                                                                                                       ZwDeleteKey
SSDT            F7B72295                                                                                                                                       ZwDeleteValueKey
SSDT            \SystemRoot\system32\drivers\khips.sys (Sunbelt Personal Firewall Host Intrusion Prevention Driver/Sunbelt Software)                           ZwLoadDriver [0xF52EFF64]
SSDT            F7B7229A                                                                                                                                       ZwLoadKey
SSDT            \SystemRoot\system32\drivers\khips.sys (Sunbelt Personal Firewall Host Intrusion Prevention Driver/Sunbelt Software)                           ZwMapViewOfSection [0xF52F024A]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwOpenFile [0xF5492906]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwOpenKey [0xF548EB78]
SSDT            F7B72268                                                                                                                                       ZwOpenProcess
SSDT            F7B7226D                                                                                                                                       ZwOpenThread
SSDT            F7B722A4                                                                                                                                       ZwReplaceKey
SSDT            F7B7229F                                                                                                                                       ZwRestoreKey
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwResumeThread [0xF54920DC]
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwSetInformationFile [0xF5492CE0]
SSDT            F7B72290                                                                                                                                       ZwSetValueKey
SSDT            F7B72277                                                                                                                                       ZwTerminateProcess
SSDT            \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)                                                      ZwWriteFile [0xF5492BB2]

---- Kernel code sections - GMER 1.0.15 ----

PAGENDSM        NDIS.sys!NdisMIndicateStatus                                                                                                                   F72139EF 6 Bytes  JMP F5486C5E \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
init            C:\WINDOWS\system32\drivers\ALCXSENS.SYS                                                                                                       entry point in "init" section [0xF68D1510]
init            C:\WINDOWS\system32\drivers\FNETDEVI.SYS                                                                                                       entry point in "init" section [0xF79B6000]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualProtectEx                                                             7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualProtect                                                               7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!WriteProcessMemory                                                           7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessW                                                               7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessA                                                               7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualAlloc                                                                 7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!VirtualAllocEx                                                               7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateRemoteThread                                                           7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateThread                                                                 7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessInternalW                                                       7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!CreateProcessInternalA                                                       7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!WinExec                                                                      7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] kernel32.dll!SetThreadContext                                                             7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] USER32.dll!SetWindowsHookExW                                                              7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] USER32.dll!SetWindowsHookExA                                                              7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] WS2_32.dll!socket                                                                         719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] WS2_32.dll!bind                                                                           719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Google\Update\GoogleUpdate.exe[188] WS2_32.dll!connect                                                                        719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 000301A8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00030090 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!WriteProcessMemory                                            7C802213 5 Bytes  JMP 00030694 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 000302C0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00030234 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualAlloc                                                  7C809AF1 5 Bytes  JMP 00030004 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!VirtualAllocEx                                                7C809B12 5 Bytes  JMP 0003011C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateRemoteThread                                            7C8104CC 5 Bytes  JMP 000304F0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateThread                                                  7C8106D7 5 Bytes  JMP 0003057C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessInternalW                                        7C8197B0 5 Bytes  JMP 000303D8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!CreateProcessInternalA                                        7C81D54E 5 Bytes  JMP 0003034C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00030464 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] kernel32.dll!SetThreadContext                                              7C863C09 5 Bytes  JMP 00030608 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] USER32.dll!SetWindowsHookExW                                               7E3A820F 5 Bytes  JMP 000307AC 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] USER32.dll!SetWindowsHookExA                                               7E3B1211 5 Bytes  JMP 00030720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WS2_32.dll!socket                                                          719F4211 5 Bytes  JMP 000308C4 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WS2_32.dll!bind                                                            719F4480 5 Bytes  JMP 00030838 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WS2_32.dll!connect                                                         719F4A07 5 Bytes  JMP 00030950 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetConnectA                                               404BDEAE 5 Bytes  JMP 00030F54 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetConnectW                                               404BF862 5 Bytes  JMP 00030FE0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenA                                                  404CD690 5 Bytes  JMP 00030D24 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenW                                                  404CDB09 5 Bytes  JMP 00030DB0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenUrlA                                               404CF3A4 5 Bytes  JMP 00030E3C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[256] WININET.dll!InternetOpenUrlW                                               40516DDF 5 Bytes  JMP 00030EC8 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[428] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[428] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[428] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualProtectEx                                                                               7C801A61 5 Bytes  JMP 001601A8 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualProtect                                                                                 7C801AD4 5 Bytes  JMP 00160090 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!WriteProcessMemory                                                                             7C802213 5 Bytes  JMP 00160694 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessW                                                                                 7C802336 5 Bytes  JMP 001602C0 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessA                                                                                 7C80236B 5 Bytes  JMP 00160234 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualAlloc                                                                                   7C809AF1 5 Bytes  JMP 00160004 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!VirtualAllocEx                                                                                 7C809B12 5 Bytes  JMP 0016011C 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateRemoteThread                                                                             7C8104CC 5 Bytes  JMP 001604F0 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateThread                                                                                   7C8106D7 5 Bytes  JMP 0016057C 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessInternalW                                                                         7C8197B0 5 Bytes  JMP 001603D8 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!CreateProcessInternalA                                                                         7C81D54E 5 Bytes  JMP 0016034C 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!WinExec                                                                                        7C86250D 5 Bytes  JMP 00160464 
.text           C:\WINDOWS\system32\csrss.exe[608] KERNEL32.dll!SetThreadContext                                                                               7C863C09 5 Bytes  JMP 00160608 
.text           C:\WINDOWS\system32\csrss.exe[608] USER32.dll!SetWindowsHookExW                                                                                7E3A820F 5 Bytes  JMP 001607AC 
.text           C:\WINDOWS\system32\csrss.exe[608] USER32.dll!SetWindowsHookExA                                                                                7E3B1211 5 Bytes  JMP 00160720 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000701A8 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00070090 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00070694 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000702C0 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00070234 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00070004 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0007011C 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000704F0 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0007057C 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000703D8 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0007034C 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00070464 
.text           C:\WINDOWS\system32\winlogon.exe[632] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00070608 
.text           C:\WINDOWS\system32\winlogon.exe[632] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000707AC 
.text           C:\WINDOWS\system32\winlogon.exe[632] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00070720 
.text           C:\WINDOWS\system32\winlogon.exe[632] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000708C4 
.text           C:\WINDOWS\system32\winlogon.exe[632] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00070838 
.text           C:\WINDOWS\system32\winlogon.exe[632] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00070950 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\services.exe[676] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\services.exe[676] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\services.exe[676] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\services.exe[676] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000708C4 
.text           C:\WINDOWS\system32\services.exe[676] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00070838 
.text           C:\WINDOWS\system32\services.exe[676] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00070950 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualProtectEx                                                                               7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualProtect                                                                                 7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!WriteProcessMemory                                                                             7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessW                                                                                 7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessA                                                                                 7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualAlloc                                                                                   7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!VirtualAllocEx                                                                                 7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateRemoteThread                                                                             7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateThread                                                                                   7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessInternalW                                                                         7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!CreateProcessInternalA                                                                         7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!WinExec                                                                                        7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\lsass.exe[688] kernel32.dll!SetThreadContext                                                                               7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\lsass.exe[688] USER32.dll!SetWindowsHookExW                                                                                7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\lsass.exe[688] USER32.dll!SetWindowsHookExA                                                                                7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!socket                                                                                           719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!bind                                                                                             719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\lsass.exe[688] WS2_32.dll!connect                                                                                          719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[852] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!socket                                                                                         719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!bind                                                                                           719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!connect                                                                                        719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!socket                                                                                         719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!bind                                                                                           719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!connect                                                                                        719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\System32\svchost.exe[976] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\System32\svchost.exe[976] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\System32\svchost.exe[976] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\System32\svchost.exe[976] WS2_32.dll!socket                                                                                         719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\System32\svchost.exe[976] WS2_32.dll!bind                                                                                           719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\System32\svchost.exe[976] WS2_32.dll!connect                                                                                        719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetConnectA                                                                              404BDEAE 5 Bytes  JMP 00080F54 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetConnectW                                                                              404BF862 5 Bytes  JMP 00080FE0 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenA                                                                                 404CD690 5 Bytes  JMP 00080D24 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenW                                                                                 404CDB09 5 Bytes  JMP 00080DB0 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenUrlA                                                                              404CF3A4 5 Bytes  JMP 00080E3C 
.text           C:\WINDOWS\System32\svchost.exe[976] WININET.dll!InternetOpenUrlW                                                                              40516DDF 5 Bytes  JMP 00080EC8 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1008] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1008] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualProtectEx                                            7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualProtect                                              7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!WriteProcessMemory                                          7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessW                                              7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessA                                              7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualAlloc                                                7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!VirtualAllocEx                                              7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateRemoteThread                                          7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateThread                                                7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessInternalW                                      7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!CreateProcessInternalA                                      7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!WinExec                                                     7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] kernel32.dll!SetThreadContext                                            7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] USER32.dll!SetWindowsHookExW                                             7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] USER32.dll!SetWindowsHookExA                                             7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] WS2_32.dll!socket                                                        719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] WS2_32.dll!bind                                                          719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1160] WS2_32.dll!connect                                                       719F4A07 5 Bytes

lilou4515 · Answer

.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualProtectEx                                                                                    7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualProtect                                                                                      7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!WriteProcessMemory                                                                                  7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessW                                                                                      7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessA                                                                                      7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualAlloc                                                                                        7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!VirtualAllocEx                                                                                      7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateRemoteThread                                                                                  7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateThread                                                                                        7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessInternalW                                                                              7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!CreateProcessInternalA                                                                              7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!WinExec                                                                                             7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\Explorer.EXE[1340] kernel32.dll!SetThreadContext                                                                                    7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\Explorer.EXE[1340] USER32.dll!SetWindowsHookExW                                                                                     7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\Explorer.EXE[1340] USER32.dll!SetWindowsHookExA                                                                                     7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetConnectA                                                                                     404BDEAE 5 Bytes  JMP 00080F54 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetConnectW                                                                                     404BF862 5 Bytes  JMP 00080FE0 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenA                                                                                        404CD690 5 Bytes  JMP 00080D24 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenW                                                                                        404CDB09 5 Bytes  JMP 00080DB0 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenUrlA                                                                                     404CF3A4 5 Bytes  JMP 00080E3C 
.text           C:\WINDOWS\Explorer.EXE[1340] WININET.dll!InternetOpenUrlW                                                                                     40516DDF 5 Bytes  JMP 00080EC8 
.text           C:\WINDOWS\Explorer.EXE[1340] WS2_32.dll!socket                                                                                                719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\Explorer.EXE[1340] WS2_32.dll!bind                                                                                                  719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\Explorer.EXE[1340] WS2_32.dll!connect                                                                                               719F4A07 5 Bytes  JMP 00080950 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1356] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1356] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00080950 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualProtectEx                                                            7C801A61 5 Bytes  JMP 001401A8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualProtect                                                              7C801AD4 5 Bytes  JMP 00140090 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!WriteProcessMemory                                                          7C802213 5 Bytes  JMP 00140694 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessW                                                              7C802336 5 Bytes  JMP 001402C0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessA                                                              7C80236B 5 Bytes  JMP 00140234 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualAlloc                                                                7C809AF1 5 Bytes  JMP 00140004 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!VirtualAllocEx                                                              7C809B12 5 Bytes  JMP 0014011C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateRemoteThread                                                          7C8104CC 5 Bytes  JMP 001404F0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateThread                                                                7C8106D7 5 Bytes  JMP 0014057C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessInternalW                                                      7C8197B0 5 Bytes  JMP 001403D8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!CreateProcessInternalA                                                      7C81D54E 5 Bytes  JMP 0014034C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!WinExec                                                                     7C86250D 5 Bytes  JMP 00140464 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] kernel32.dll!SetThreadContext                                                            7C863C09 5 Bytes  JMP 00140608 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!DialogBoxParamW                                                               7E3A47AB 5 Bytes  JMP 40D85501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!SetWindowsHookExW                                                             7E3A820F 5 Bytes  JMP 40E59AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!CallNextHookEx                                                                7E3AB3C6 5 Bytes  JMP 40E4D135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!CreateWindowExW                                                               7E3AD0A3 5 Bytes  JMP 40E5DB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!UnhookWindowsHookEx                                                           7E3AD5F3 5 Bytes  JMP 40DC4666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!SetWindowsHookExA                                                             7E3B1211 5 Bytes  JMP 00140720 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!DialogBoxIndirectParamW                                                       7E3B2072 5 Bytes  JMP 40F54B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!MessageBoxIndirectA                                                           7E3BA082 5 Bytes  JMP 40F54AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!DialogBoxParamA                                                               7E3BB144 5 Bytes  JMP 40F54B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!MessageBoxExW                                                                 7E3D0838 5 Bytes  JMP 40F54972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!MessageBoxExA                                                                 7E3D085C 5 Bytes  JMP 40F549D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!DialogBoxIndirectParamA                                                       7E3D6D7D 5 Bytes  JMP 40F54BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] USER32.dll!MessageBoxIndirectW                                                           7E3E64D5 5 Bytes  JMP 40F54A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] ole32.dll!CoCreateInstance                                                               774C057E 5 Bytes  JMP 40E5DB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] ole32.dll!OleLoadFromStream                                                              774E9C85 5 Bytes  JMP 40F54EF0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] WININET.dll!InternetConnectA                                                             404BDEAE 5 Bytes  JMP 00140F54 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] WININET.dll!InternetConnectW                                                             404BF862 5 Bytes  JMP 00140FE0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] WININET.dll!InternetOpenA                                                                404CD690 5 Bytes  JMP 00140D24 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] WININET.dll!InternetOpenW                                                                404CDB09 5 Bytes  JMP 00140DB0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] WININET.dll!InternetOpenUrlA                                                             404CF3A4 5 Bytes  JMP 00140E3C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] WININET.dll!InternetOpenUrlW                                                             40516DDF 5 Bytes  JMP 00140EC8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] ws2_32.dll!socket                                                                        719F4211 5 Bytes  JMP 001408C4 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] ws2_32.dll!bind                                                                          719F4480 5 Bytes  JMP 00140838 
.text           C:\Program Files\Internet Explorer\iexplore.exe[1448] ws2_32.dll!connect                                                                       719F4A07 5 Bytes  JMP 00140950 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\spoolsv.exe[1504] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00080950 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!VirtualProtectEx                                                           7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!VirtualProtect                                                             7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!WriteProcessMemory                                                         7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!CreateProcessW                                                             7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!CreateProcessA                                                             7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!VirtualAlloc                                                               7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!VirtualAllocEx                                                             7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!CreateRemoteThread                                                         7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!CreateThread                                                               7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!CreateProcessInternalW                                                     7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!CreateProcessInternalA                                                     7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!WinExec                                                                    7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] kernel32.dll!SetThreadContext                                                           7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] USER32.dll!SetWindowsHookExW                                                            7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] USER32.dll!SetWindowsHookExA                                                            7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] WS2_32.dll!socket                                                                       719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] WS2_32.dll!bind                                                                         719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Avira\AntiVir Desktop\sched.exe[1556] WS2_32.dll!connect                                                                      719F4A07 5 Bytes

lilou4515 · Answer

.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1600] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1600] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetConnectA                                                                             404BDEAE 5 Bytes  JMP 00080F54 
.text           C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetConnectW                                                                             404BF862 5 Bytes  JMP 00080FE0 
.text           C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenA                                                                                404CD690 5 Bytes  JMP 00080D24 
.text           C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenW                                                                                404CDB09 5 Bytes  JMP 00080DB0 
.text           C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenUrlA                                                                             404CF3A4 5 Bytes  JMP 00080E3C 
.text           C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenUrlW                                                                             40516DDF 5 Bytes  JMP 00080EC8 
.text           C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00080950 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!VirtualProtectEx                                                         7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!VirtualProtect                                                           7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!WriteProcessMemory                                                       7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!CreateProcessW                                                           7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!CreateProcessA                                                           7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!VirtualAlloc                                                             7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!VirtualAllocEx                                                           7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!CreateRemoteThread                                                       7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!CreateThread                                                             7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!CreateProcessInternalW                                                   7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!CreateProcessInternalA                                                   7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!WinExec                                                                  7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] kernel32.dll!SetThreadContext                                                         7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] USER32.dll!SetWindowsHookExW                                                          7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] USER32.dll!SetWindowsHookExA                                                          7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] WS2_32.dll!socket                                                                     719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] WS2_32.dll!bind                                                                       719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1656] WS2_32.dll!connect                                                                    719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!VirtualProtectEx             7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!VirtualProtect               7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!WriteProcessMemory           7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!CreateProcessW               7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!CreateProcessA               7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!VirtualAlloc                 7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!VirtualAllocEx               7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!CreateRemoteThread           7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!CreateThread                 7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!CreateProcessInternalW       7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!CreateProcessInternalA       7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!WinExec                      7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] kernel32.dll!SetThreadContext             7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] WS2_32.dll!socket                         719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] WS2_32.dll!bind                           719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] WS2_32.dll!connect                        719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] USER32.dll!SetWindowsHookExW              7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1668] USER32.dll!SetWindowsHookExA              7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!VirtualProtectEx                                                                 7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!VirtualProtect                                                                   7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!WriteProcessMemory                                                               7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!CreateProcessW                                                                   7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!CreateProcessA                                                                   7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!VirtualAlloc                                                                     7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!VirtualAllocEx                                                                   7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!CreateRemoteThread                                                               7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!CreateThread                                                                     7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!CreateProcessInternalW                                                           7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!CreateProcessInternalA                                                           7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!WinExec                                                                          7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] kernel32.dll!SetThreadContext                                                                 7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] WS2_32.dll!socket                                                                             719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] WS2_32.dll!bind                                                                               719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] WS2_32.dll!connect                                                                            719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] USER32.dll!SetWindowsHookExW                                                                  7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Bonjour\mDNSResponder.exe[1680] USER32.dll!SetWindowsHookExA                                                                  7E3B1211 5 Bytes  JMP 00130720 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\svchost.exe[1712] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\svchost.exe[1712] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\svchost.exe[1712] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\svchost.exe[1712] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000708C4 
.text           C:\WINDOWS\system32\svchost.exe[1712] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00070838 
.text           C:\WINDOWS\system32\svchost.exe[1712] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00070950 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!VirtualProtectEx                                   7C801A61 5 Bytes  JMP 001301A8 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!VirtualProtect                                     7C801AD4 5 Bytes  JMP 00130090 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!WriteProcessMemory                                 7C802213 5 Bytes  JMP 00130694 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!CreateProcessW                                     7C802336 5 Bytes  JMP 001302C0 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!CreateProcessA                                     7C80236B 5 Bytes  JMP 00130234 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!VirtualAlloc                                       7C809AF1 5 Bytes  JMP 00130004 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!VirtualAllocEx                                     7C809B12 5 Bytes  JMP 0013011C 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!CreateRemoteThread                                 7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!CreateThread                                       7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!CreateProcessInternalW                             7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!CreateProcessInternalA                             7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!WinExec                                            7C86250D 5 Bytes  JMP 00130464 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] kernel32.dll!SetThreadContext                                   7C863C09 5 Bytes  JMP 00130608 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] USER32.dll!SetWindowsHookExW                                    7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] USER32.dll!SetWindowsHookExA                                    7E3B1211 5 Bytes  JMP 00130720 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] WS2_32.dll!socket                                               719F4211 5 Bytes  JMP 001308C4 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] WS2_32.dll!bind                                                 719F4480 5 Bytes  JMP 00130838 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[1784] WS2_32.dll!connect                                              719F4A07 5 Bytes  JMP 00130950 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!VirtualProtectEx                                              7C801A61 5 Bytes  JMP 001401A8 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!VirtualProtect                                                7C801AD4 5 Bytes  JMP 00140090 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!WriteProcessMemory                                            7C802213 5 Bytes  JMP 00140694 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!CreateProcessW                                                7C802336 5 Bytes  JMP 001402C0 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!CreateProcessA                                                7C80236B 5 Bytes  JMP 00140234 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!VirtualAlloc                                                  7C809AF1 5 Bytes  JMP 00140004 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!VirtualAllocEx                                                7C809B12 5 Bytes  JMP 0014011C 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!CreateRemoteThread                                            7C8104CC 5 Bytes  JMP 001404F0 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!CreateThread                                                  7C8106D7 5 Bytes  JMP 0014057C 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!CreateProcessInternalW                                        7C8197B0 5 Bytes  JMP 001403D8 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!CreateProcessInternalA                                        7C81D54E 5 Bytes  JMP 0014034C 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!WinExec                                                       7C86250D 5 Bytes  JMP 00140464 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] kernel32.dll!SetThreadContext                                              7C863C09 5 Bytes  JMP 00140608 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] USER32.dll!SetWindowsHookExW                                               7E3A820F 5 Bytes  JMP 001407AC 
.text           C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe[1844] USER32.dll!SetWindowsHookExA                                               7E3B1211 5 Bytes  JMP 00140720 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 001301A8 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00130090 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00130694 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 001302C0 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00130234 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00130004 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0013011C 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00130464 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00130608 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00130720 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] WS2_32.dll!socket                                                                                        719F4211 5 Bytes  JMP 000708C4 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] WS2_32.dll!bind                                                                                          719F4480 5 Bytes  JMP 00070838 
.text           C:\WINDOWS\system32
vsvc32.exe[1952] WS2_32.dll!connect                                                                                       719F4A07 5 Bytes  JMP 00070950

lilou4515 · Answer

.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!VirtualProtectEx                                     7C801A61 5 Bytes  JMP 000701A8 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!VirtualProtect                                       7C801AD4 5 Bytes  JMP 00070090 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!WriteProcessMemory                                   7C802213 5 Bytes  JMP 00070694 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!CreateProcessW                                       7C802336 5 Bytes  JMP 000702C0 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!CreateProcessA                                       7C80236B 5 Bytes  JMP 00070234 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!VirtualAlloc                                         7C809AF1 5 Bytes  JMP 00070004 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!VirtualAllocEx                                       7C809B12 5 Bytes  JMP 0007011C 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!CreateRemoteThread                                   7C8104CC 5 Bytes  JMP 000704F0 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!CreateThread                                         7C8106D7 5 Bytes  JMP 0007057C 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!CreateProcessInternalW                               7C8197B0 5 Bytes  JMP 000703D8 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!CreateProcessInternalA                               7C81D54E 5 Bytes  JMP 0007034C 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!WinExec                                              7C86250D 5 Bytes  JMP 00070464 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] kernel32.dll!SetThreadContext                                     7C863C09 5 Bytes  JMP 00070608 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] USER32.dll!SetWindowsHookExW                                      7E3A820F 5 Bytes  JMP 000707AC 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] USER32.dll!SetWindowsHookExA                                      7E3B1211 5 Bytes  JMP 00070720 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] WS2_32.dll!socket                                                 719F4211 5 Bytes  JMP 000708C4 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] WS2_32.dll!bind                                                   719F4480 5 Bytes  JMP 00070838 
.text           C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2036] WS2_32.dll!connect                                                719F4A07 5 Bytes  JMP 00070950 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!VirtualProtectEx                                                                                7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!VirtualProtect                                                                                  7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!WriteProcessMemory                                                                              7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateProcessW                                                                                  7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateProcessA                                                                                  7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!VirtualAlloc                                                                                    7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!VirtualAllocEx                                                                                  7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateRemoteThread                                                                              7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateThread                                                                                    7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateProcessInternalW                                                                          7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateProcessInternalA                                                                          7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!WinExec                                                                                         7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!SetThreadContext                                                                                7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\System32\alg.exe[2320] USER32.dll!SetWindowsHookExW                                                                                 7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\System32\alg.exe[2320] USER32.dll!SetWindowsHookExA                                                                                 7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\System32\alg.exe[2320] WS2_32.dll!socket                                                                                            719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\System32\alg.exe[2320] WS2_32.dll!bind                                                                                              719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\System32\alg.exe[2320] WS2_32.dll!connect                                                                                           719F4A07 5 Bytes  JMP 00080950 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!VirtualProtectEx                                                            7C801A61 5 Bytes  JMP 001401A8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!VirtualProtect                                                              7C801AD4 5 Bytes  JMP 00140090 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!WriteProcessMemory                                                          7C802213 5 Bytes  JMP 00140694 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!CreateProcessW                                                              7C802336 5 Bytes  JMP 001402C0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!CreateProcessA                                                              7C80236B 5 Bytes  JMP 00140234 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!VirtualAlloc                                                                7C809AF1 5 Bytes  JMP 00140004 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!VirtualAllocEx                                                              7C809B12 5 Bytes  JMP 0014011C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!CreateRemoteThread                                                          7C8104CC 5 Bytes  JMP 001404F0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!CreateThread                                                                7C8106D7 5 Bytes  JMP 0014057C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!CreateProcessInternalW                                                      7C8197B0 5 Bytes  JMP 001403D8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!CreateProcessInternalA                                                      7C81D54E 5 Bytes  JMP 0014034C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!WinExec                                                                     7C86250D 5 Bytes  JMP 00140464 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] kernel32.dll!SetThreadContext                                                            7C863C09 5 Bytes  JMP 00140608 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!DialogBoxParamW                                                               7E3A47AB 5 Bytes  JMP 40D85501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!SetWindowsHookExW                                                             7E3A820F 5 Bytes  JMP 001407AC 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!CreateWindowExW                                                               7E3AD0A3 5 Bytes  JMP 40E5DB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!SetWindowsHookExA                                                             7E3B1211 5 Bytes  JMP 00140720 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!DialogBoxIndirectParamW                                                       7E3B2072 5 Bytes  JMP 40F54B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!MessageBoxIndirectA                                                           7E3BA082 5 Bytes  JMP 40F54AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!DialogBoxParamA                                                               7E3BB144 5 Bytes  JMP 40F54B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!MessageBoxExW                                                                 7E3D0838 5 Bytes  JMP 40F54972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!MessageBoxExA                                                                 7E3D085C 5 Bytes  JMP 40F549D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!DialogBoxIndirectParamA                                                       7E3D6D7D 5 Bytes  JMP 40F54BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] USER32.dll!MessageBoxIndirectW                                                           7E3E64D5 5 Bytes  JMP 40F54A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] WININET.dll!InternetConnectA                                                             404BDEAE 5 Bytes  JMP 00140F54 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] WININET.dll!InternetConnectW                                                             404BF862 5 Bytes  JMP 00140FE0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] WININET.dll!InternetOpenA                                                                404CD690 5 Bytes  JMP 00140D24 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] WININET.dll!InternetOpenW                                                                404CDB09 5 Bytes  JMP 00140DB0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] WININET.dll!InternetOpenUrlA                                                             404CF3A4 5 Bytes  JMP 00140E3C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] WININET.dll!InternetOpenUrlW                                                             40516DDF 5 Bytes  JMP 00140EC8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] ws2_32.dll!socket                                                                        719F4211 5 Bytes  JMP 001408C4 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] ws2_32.dll!bind                                                                          719F4480 5 Bytes  JMP 00140838 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2680] ws2_32.dll!connect                                                                       719F4A07 5 Bytes  JMP 00140950 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!VirtualProtectEx                                            7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!VirtualProtect                                              7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!WriteProcessMemory                                          7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!CreateProcessW                                              7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!CreateProcessA                                              7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!VirtualAlloc                                                7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!VirtualAllocEx                                              7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!CreateRemoteThread                                          7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!CreateThread                                                7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!CreateProcessInternalW                                      7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!CreateProcessInternalA                                      7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!WinExec                                                     7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] kernel32.dll!SetThreadContext                                            7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] USER32.dll!SetWindowsHookExW                                             7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] USER32.dll!SetWindowsHookExA                                             7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] WS2_32.dll!socket                                                        719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] WS2_32.dll!bind                                                          719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2752] WS2_32.dll!connect                                                       719F4A07 5 Bytes  JMP 00130950 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 001301A8 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00130090 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00130694 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 001302C0 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00130234 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00130004 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0013011C 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00130464 
.text           C:\windows\system\hpsysdrv.exe[2920] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00130608 
.text           C:\windows\system\hpsysdrv.exe[2920] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\windows\system\hpsysdrv.exe[2920] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00130720 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!VirtualProtectEx                                                                           7C801A61 5 Bytes  JMP 001301A8 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!VirtualProtect                                                                             7C801AD4 5 Bytes  JMP 00130090 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!WriteProcessMemory                                                                         7C802213 5 Bytes  JMP 00130694 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!CreateProcessW                                                                             7C802336 5 Bytes  JMP 001302C0 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!CreateProcessA                                                                             7C80236B 5 Bytes  JMP 00130234 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!VirtualAlloc                                                                               7C809AF1 5 Bytes  JMP 00130004 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!VirtualAllocEx                                                                             7C809B12 5 Bytes  JMP 0013011C 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!CreateRemoteThread                                                                         7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!CreateThread                                                                               7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!CreateProcessInternalW                                                                     7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!CreateProcessInternalA                                                                     7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!WinExec                                                                                    7C86250D 5 Bytes  JMP 00130464 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] kernel32.dll!SetThreadContext                                                                           7C863C09 5 Bytes  JMP 00130608 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] WS2_32.dll!socket                                                                                       719F4211 5 Bytes  JMP 001308C4 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] WS2_32.dll!bind                                                                                         719F4480 5 Bytes  JMP 00130838 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] WS2_32.dll!connect                                                                                      719F4A07 5 Bytes  JMP 00130950 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] USER32.dll!SetWindowsHookExW                                                                            7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\WINDOWS\system32\hphmon06.exe[2928] USER32.dll!SetWindowsHookExA                                                                            7E3B1211 5 Bytes  JMP 00130720 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!VirtualProtectEx                                                                                          7C801A61 5 Bytes  JMP 001301A8 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!VirtualProtect                                                                                            7C801AD4 5 Bytes  JMP 00130090 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!WriteProcessMemory                                                                                        7C802213 5 Bytes  JMP 00130694 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!CreateProcessW                                                                                            7C802336 5 Bytes  JMP 001302C0 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!CreateProcessA                                                                                            7C80236B 5 Bytes  JMP 00130234 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!VirtualAlloc                                                                                              7C809AF1 5 Bytes  JMP 00130004 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!VirtualAllocEx                                                                                            7C809B12 5 Bytes  JMP 0013011C 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!CreateRemoteThread                                                                                        7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!CreateThread                                                                                              7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!CreateProcessInternalW                                                                                    7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!CreateProcessInternalA                                                                                    7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!WinExec                                                                                                   7C86250D 5 Bytes  JMP 00130464 
.text           C:\HP\KBD\KBD.EXE[2936] kernel32.dll!SetThreadContext                                                                                          7C863C09 5 Bytes  JMP 00130608 
.text           C:\HP\KBD\KBD.EXE[2936] USER32.dll!SetWindowsHookExW                                                                                           7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\HP\KBD\KBD.EXE[2936] USER32.dll!SetWindowsHookExA                                                                                           7E3B1211 5 Bytes  JMP 00130720 
.text           C:\HP\KBD\KBD.EXE[2936] WININET.dll!InternetConnectA                                                                                           404BDEAE 5 Bytes  JMP 00130F54 
.text           C:\HP\KBD\KBD.EXE[2936] WININET.dll!InternetConnectW                                                                                           404BF862 5 Bytes  JMP 00130FE0 
.text           C:\HP\KBD\KBD.EXE[2936] WININET.dll!InternetOpenA                                                                                              404CD690 5 Bytes  JMP 00130D24 
.text           C:\HP\KBD\KBD.EXE[2936] WININET.dll!InternetOpenW                                                                                              404CDB09 5 Bytes  JMP 00130DB0 
.text           C:\HP\KBD\KBD.EXE[2936] WININET.dll!InternetOpenUrlA                                                                                           404CF3A4 5 Bytes  JMP 00130E3C 
.text           C:\HP\KBD\KBD.EXE[2936] WININET.dll!InternetOpenUrlW                                                                                           40516DDF 5 Bytes  JMP 00130EC8 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 001301A8 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00130090 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00130694 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 001302C0 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00130234 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00130004 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0013011C 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00130464 
.text           C:\WINDOWS\system32\keyhook.exe[2996] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00130608 
.text           C:\WINDOWS\system32\keyhook.exe[2996] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\WINDOWS\system32\keyhook.exe[2996] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00130720 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!VirtualProtectEx                                                                                    7C801A61 5 Bytes  JMP 001301A8 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!VirtualProtect                                                                                      7C801AD4 5 Bytes  JMP 00130090 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!WriteProcessMemory                                                                                  7C802213 5 Bytes  JMP 00130694 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!CreateProcessW                                                                                      7C802336 5 Bytes  JMP 001302C0 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!CreateProcessA                                                                                      7C80236B 5 Bytes  JMP 00130234 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!VirtualAlloc                                                                                        7C809AF1 5 Bytes  JMP 00130004 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!VirtualAllocEx                                                                                      7C809B12 5 Bytes  JMP 0013011C 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!CreateRemoteThread                                                                                  7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!CreateThread                                                                                        7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!CreateProcessInternalW                                                                              7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!CreateProcessInternalA                                                                              7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!WinExec                                                                                             7C86250D 5 Bytes  JMP 00130464 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] kernel32.dll!SetThreadContext                                                                                    7C863C09 5 Bytes  JMP 00130608 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] USER32.dll!SetWindowsHookExW                                                                                     7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\WINDOWS\AGRSMMSG.exe[3008] USER32.dll!SetWindowsHookExA                                                                                     7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!VirtualProtectEx                                                       7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!VirtualProtect                                                         7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!WriteProcessMemory                                                     7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!CreateProcessW                                                         7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!CreateProcessA                                                         7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!VirtualAlloc                                                           7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!VirtualAllocEx                                                         7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!CreateRemoteThread                                                     7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!CreateThread                                                           7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!CreateProcessInternalW                                                 7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!CreateProcessInternalA                                                 7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!WinExec                                                                7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] kernel32.dll!SetThreadContext                                                       7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] USER32.dll!SetWindowsHookExW                                                        7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe[3064] USER32.dll!SetWindowsHookExA                                                        7E3B1211 5 Bytes  JMP 00130720 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 001301A8 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00130090 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00130694 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 001302C0 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00130234 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00130004 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0013011C 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00130464 
.text           C:\WINDOWS\system32\UMonit.exe[3072] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00130608 
.text           C:\WINDOWS\system32\UMonit.exe[3072] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\WINDOWS\system32\UMonit.exe[3072] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!VirtualProtectEx                                       7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!VirtualProtect                                         7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!WriteProcessMemory                                     7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!CreateProcessW                                         7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!CreateProcessA                                         7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!VirtualAlloc                                           7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!VirtualAllocEx                                         7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!CreateRemoteThread                                     7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!CreateThread                                           7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!CreateProcessInternalW                                 7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!CreateProcessInternalA                                 7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!WinExec                                                7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] kernel32.dll!SetThreadContext                                       7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] USER32.dll!SetWindowsHookExW                                        7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[3080] USER32.dll!SetWindowsHookExA                                        7E3B1211 5 Bytes  JMP 00130720

lilou4515 · Answer

.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!VirtualProtectEx                                                           7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!VirtualProtect                                                             7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!WriteProcessMemory                                                         7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!CreateProcessW                                                             7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!CreateProcessA                                                             7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!VirtualAlloc                                                               7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!VirtualAllocEx                                                             7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!CreateRemoteThread                                                         7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!CreateThread                                                               7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!CreateProcessInternalW                                                     7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!CreateProcessInternalA                                                     7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!WinExec                                                                    7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] kernel32.dll!SetThreadContext                                                           7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] USER32.dll!SetWindowsHookExW                                                            7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] USER32.dll!SetWindowsHookExA                                                            7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] WININET.dll!InternetConnectA                                                            404BDEAE 5 Bytes  JMP 00070F54 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] WININET.dll!InternetConnectW                                                            404BF862 5 Bytes  JMP 00070FE0 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] WININET.dll!InternetOpenA                                                               404CD690 5 Bytes  JMP 00070D24 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] WININET.dll!InternetOpenW                                                               404CDB09 5 Bytes  JMP 00070DB0 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] WININET.dll!InternetOpenUrlA                                                            404CF3A4 5 Bytes  JMP 00070E3C 
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3100] WININET.dll!InternetOpenUrlW                                                            40516DDF 5 Bytes  JMP 00070EC8 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!VirtualProtectEx                                                                           7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!VirtualProtect                                                                             7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!WriteProcessMemory                                                                         7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!CreateProcessW                                                                             7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!CreateProcessA                                                                             7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!VirtualAlloc                                                                               7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!VirtualAllocEx                                                                             7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!CreateRemoteThread                                                                         7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!CreateThread                                                                               7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!CreateProcessInternalW                                                                     7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!CreateProcessInternalA                                                                     7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!WinExec                                                                                    7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\rundll32.exe[3108] kernel32.dll!SetThreadContext                                                                           7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\rundll32.exe[3108] USER32.dll!SetWindowsHookExW                                                                            7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\rundll32.exe[3108] USER32.dll!SetWindowsHookExA                                                                            7E3B1211 5 Bytes  JMP 00080720 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!VirtualProtectEx                                    7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!VirtualProtect                                      7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!WriteProcessMemory                                  7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!CreateProcessW                                      7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!CreateProcessA                                      7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!VirtualAlloc                                        7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!VirtualAllocEx                                      7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!CreateRemoteThread                                  7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!CreateThread                                        7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!CreateProcessInternalW                              7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!CreateProcessInternalA                              7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!WinExec                                             7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] kernel32.dll!SetThreadContext                                    7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] USER32.dll!SetWindowsHookExW                                     7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] USER32.dll!SetWindowsHookExA                                     7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WININET.dll!InternetConnectA                                     404BDEAE 5 Bytes  JMP 00130F54 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WININET.dll!InternetConnectW                                     404BF862 5 Bytes  JMP 00130FE0 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WININET.dll!InternetOpenA                                        404CD690 5 Bytes  JMP 00130D24 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WININET.dll!InternetOpenW                                        404CDB09 5 Bytes  JMP 00130DB0 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WININET.dll!InternetOpenUrlA                                     404CF3A4 5 Bytes  JMP 00130E3C 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WININET.dll!InternetOpenUrlW                                     40516DDF 5 Bytes  JMP 00130EC8 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WS2_32.dll!socket                                                719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WS2_32.dll!bind                                                  719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe[3160] WS2_32.dll!connect                                               719F4A07 5 Bytes  JMP 00130950 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!VirtualProtectEx        7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!VirtualProtect          7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!WriteProcessMemory      7C802213 5 Bytes  JMP 00130694 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!CreateProcessW          7C802336 5 Bytes  JMP 001302C0 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!CreateProcessA          7C80236B 5 Bytes  JMP 00130234 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!VirtualAlloc            7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!VirtualAllocEx          7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!CreateRemoteThread      7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!CreateThread            7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!CreateProcessInternalW  7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!CreateProcessInternalA  7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!WinExec                 7C86250D 5 Bytes  JMP 00130464 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] kernel32.dll!SetThreadContext        7C863C09 5 Bytes  JMP 00130608 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] WS2_32.dll!socket                    719F4211 5 Bytes  JMP 001308C4 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] WS2_32.dll!bind                      719F4480 5 Bytes  JMP 00130838 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] WS2_32.dll!connect                   719F4A07 5 Bytes  JMP 00130950 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] USER32.dll!SetWindowsHookExW         7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe[3196] USER32.dll!SetWindowsHookExA         7E3B1211 5 Bytes  JMP 00130720 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!VirtualProtectEx                                                                             7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!VirtualProtect                                                                               7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!WriteProcessMemory                                                                           7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!CreateProcessW                                                                               7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!CreateProcessA                                                                               7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!VirtualAlloc                                                                                 7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!VirtualAllocEx                                                                               7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!CreateRemoteThread                                                                           7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!CreateThread                                                                                 7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!CreateProcessInternalW                                                                       7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!CreateProcessInternalA                                                                       7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!WinExec                                                                                      7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] kernel32.dll!SetThreadContext                                                                             7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] USER32.dll!SetWindowsHookExW                                                                              7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\ctfmon.exe[3208] USER32.dll!SetWindowsHookExA                                                                              7E3B1211 5 Bytes  JMP 00080720 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!VirtualProtectEx                           7C801A61 5 Bytes  JMP 001301A8 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!VirtualProtect                             7C801AD4 5 Bytes  JMP 00130090 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!WriteProcessMemory                         7C802213 5 Bytes  JMP 00130694 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!CreateProcessW                             7C802336 5 Bytes  JMP 001302C0 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!CreateProcessA                             7C80236B 5 Bytes  JMP 00130234 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!VirtualAlloc                               7C809AF1 5 Bytes  JMP 00130004 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!VirtualAllocEx                             7C809B12 5 Bytes  JMP 0013011C 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!CreateRemoteThread                         7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!CreateThread                               7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!CreateProcessInternalW                     7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!CreateProcessInternalA                     7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!WinExec                                    7C86250D 5 Bytes  JMP 00130464 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] kernel32.dll!SetThreadContext                           7C863C09 5 Bytes  JMP 00130608 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] USER32.dll!SetWindowsHookExW                            7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe[3316] USER32.dll!SetWindowsHookExA                            7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!VirtualProtectEx                                                        7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!VirtualProtect                                                          7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!WriteProcessMemory                                                      7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!CreateProcessW                                                          7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!CreateProcessA                                                          7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!VirtualAlloc                                                            7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!VirtualAllocEx                                                          7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!CreateRemoteThread                                                      7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!CreateThread                                                            7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!CreateProcessInternalW                                                  7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!CreateProcessInternalA                                                  7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!WinExec                                                                 7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] kernel32.dll!SetThreadContext                                                        7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] USER32.dll!SetWindowsHookExW                                                         7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] USER32.dll!SetWindowsHookExA                                                         7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] WININET.dll!InternetConnectA                                                         404BDEAE 5 Bytes  JMP 00130F54 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] WININET.dll!InternetConnectW                                                         404BF862 5 Bytes  JMP 00130FE0 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] WININET.dll!InternetOpenA                                                            404CD690 5 Bytes  JMP 00130D24 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] WININET.dll!InternetOpenW                                                            404CDB09 5 Bytes  JMP 00130DB0 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] WININET.dll!InternetOpenUrlA                                                         404CF3A4 5 Bytes  JMP 00130E3C 
.text           C:\Program Files\Avira\AntiVir Desktop\avcenter.exe[3388] WININET.dll!InternetOpenUrlW                                                         40516DDF 5 Bytes  JMP 00130EC8 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!VirtualProtectEx                                   7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!VirtualProtect                                     7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!WriteProcessMemory                                 7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!CreateProcessW                                     7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!CreateProcessA                                     7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!VirtualAlloc                                       7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!VirtualAllocEx                                     7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!CreateRemoteThread                                 7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!CreateThread                                       7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!CreateProcessInternalW                             7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!CreateProcessInternalA                             7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!WinExec                                            7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] kernel32.dll!SetThreadContext                                   7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] USER32.dll!SetWindowsHookExW                                    7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Orange\Connexion Internet Orange\systray\systrayapp.exe[3436] USER32.dll!SetWindowsHookExA                                    7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!VirtualProtectEx                     7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!VirtualProtect                       7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!WriteProcessMemory                   7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!CreateProcessW                       7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!CreateProcessA                       7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!VirtualAlloc                         7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!VirtualAllocEx                       7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!CreateRemoteThread                   7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!CreateThread                         7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!CreateProcessInternalW               7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!CreateProcessInternalA               7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!WinExec                              7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] kernel32.dll!SetThreadContext                     7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] USER32.dll!SetWindowsHookExW                      7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] USER32.dll!SetWindowsHookExA                      7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] WS2_32.dll!socket                                 719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] WS2_32.dll!bind                                   719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\connectivitymanager.exe[3452] WS2_32.dll!connect                                719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!VirtualProtectEx                         7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!VirtualProtect                           7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!WriteProcessMemory                       7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!CreateProcessW                           7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!CreateProcessA                           7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!VirtualAlloc                             7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!VirtualAllocEx                           7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!CreateRemoteThread                       7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!CreateThread                             7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!CreateProcessInternalW                   7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!CreateProcessInternalA                   7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!WinExec                                  7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] kernel32.dll!SetThreadContext                         7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] USER32.dll!SetWindowsHookExW                          7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] USER32.dll!SetWindowsHookExA                          7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WS2_32.dll!socket                                     719F4211 5 Bytes  JMP 001308C4 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WS2_32.dll!bind                                       719F4480 5 Bytes  JMP 00130838 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WS2_32.dll!connect                                    719F4A07 5 Bytes  JMP 00130950 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WININET.dll!InternetConnectA                          404BDEAE 5 Bytes  JMP 00130F54 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WININET.dll!InternetConnectW                          404BF862 5 Bytes  JMP 00130FE0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WININET.dll!InternetOpenA                             404CD690 5 Bytes  JMP 00130D24 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WININET.dll!InternetOpenW                             404CDB09 5 Bytes  JMP 00130DB0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WININET.dll!InternetOpenUrlA                          404CF3A4 5 Bytes  JMP 00130E3C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\CoreCom.exe[3508] WININET.dll!InternetOpenUrlW                          40516DDF 5 Bytes  JMP 00130EC8

lilou4515 · Answer

.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!VirtualProtectEx                                                                            7C801A61 5 Bytes  JMP 000701A8 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!VirtualProtect                                                                              7C801AD4 5 Bytes  JMP 00070090 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!WriteProcessMemory                                                                          7C802213 5 Bytes  JMP 00070694 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!CreateProcessW                                                                              7C802336 5 Bytes  JMP 000702C0 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!CreateProcessA                                                                              7C80236B 5 Bytes  JMP 00070234 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!VirtualAlloc                                                                                7C809AF1 5 Bytes  JMP 00070004 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!VirtualAllocEx                                                                              7C809B12 5 Bytes  JMP 0007011C 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!CreateRemoteThread                                                                          7C8104CC 5 Bytes  JMP 000704F0 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!CreateThread                                                                                7C8106D7 5 Bytes  JMP 0007057C 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!CreateProcessInternalW                                                                      7C8197B0 5 Bytes  JMP 000703D8 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!CreateProcessInternalA                                                                      7C81D54E 5 Bytes  JMP 0007034C 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!WinExec                                                                                     7C86250D 5 Bytes  JMP 00070464 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] kernel32.dll!SetThreadContext                                                                            7C863C09 5 Bytes  JMP 00070608 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] USER32.dll!SetWindowsHookExW                                                                             7E3A820F 5 Bytes  JMP 000707AC 
.text           C:\WINDOWS\system32\wscntfy.exe[3592] USER32.dll!SetWindowsHookExA                                                                             7E3B1211 5 Bytes  JMP 00070720 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!VirtualProtectEx                7C801A61 5 Bytes  JMP 001301A8 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!VirtualProtect                  7C801AD4 5 Bytes  JMP 00130090 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!WriteProcessMemory              7C802213 5 Bytes  JMP 00130694 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!CreateProcessW                  7C802336 5 Bytes  JMP 001302C0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!CreateProcessA                  7C80236B 5 Bytes  JMP 00130234 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!VirtualAlloc                    7C809AF1 5 Bytes  JMP 00130004 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!VirtualAllocEx                  7C809B12 5 Bytes  JMP 0013011C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!CreateRemoteThread              7C8104CC 5 Bytes  JMP 001304F0 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!CreateThread                    7C8106D7 5 Bytes  JMP 0013057C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!CreateProcessInternalW          7C8197B0 5 Bytes  JMP 001303D8 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!CreateProcessInternalA          7C81D54E 5 Bytes  JMP 0013034C 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!WinExec                         7C86250D 5 Bytes  JMP 00130464 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] kernel32.dll!SetThreadContext                7C863C09 5 Bytes  JMP 00130608 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] USER32.dll!SetWindowsHookExW                 7E3A820F 5 Bytes  JMP 001307AC 
.text           C:\Program Files\Orange\Connexion Internet Orange\connectivity\CoreCom\OraConfigRecover.exe[3652] USER32.dll!SetWindowsHookExA                 7E3B1211 5 Bytes  JMP 00130720 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!VirtualProtectEx                                                            7C801A61 5 Bytes  JMP 001401A8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!VirtualProtect                                                              7C801AD4 5 Bytes  JMP 00140090 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!WriteProcessMemory                                                          7C802213 5 Bytes  JMP 00140694 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!CreateProcessW                                                              7C802336 5 Bytes  JMP 001402C0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!CreateProcessA                                                              7C80236B 5 Bytes  JMP 00140234 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!VirtualAlloc                                                                7C809AF1 5 Bytes  JMP 00140004 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!VirtualAllocEx                                                              7C809B12 5 Bytes  JMP 0014011C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!CreateRemoteThread                                                          7C8104CC 5 Bytes  JMP 001404F0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!CreateThread                                                                7C8106D7 5 Bytes  JMP 0014057C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!CreateProcessInternalW                                                      7C8197B0 5 Bytes  JMP 001403D8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!CreateProcessInternalA                                                      7C81D54E 5 Bytes  JMP 0014034C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!WinExec                                                                     7C86250D 5 Bytes  JMP 00140464 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] kernel32.dll!SetThreadContext                                                            7C863C09 5 Bytes  JMP 00140608 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxParamW                                                               7E3A47AB 5 Bytes  JMP 40D85501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!SetWindowsHookExW                                                             7E3A820F 5 Bytes  JMP 40E59AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!CallNextHookEx                                                                7E3AB3C6 5 Bytes  JMP 40E4D135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!CreateWindowExW                                                               7E3AD0A3 5 Bytes  JMP 40E5DB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!UnhookWindowsHookEx                                                           7E3AD5F3 5 Bytes  JMP 40DC4666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!SetWindowsHookExA                                                             7E3B1211 5 Bytes  JMP 00140720 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxIndirectParamW                                                       7E3B2072 5 Bytes  JMP 40F54B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxIndirectA                                                           7E3BA082 5 Bytes  JMP 40F54AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxParamA                                                               7E3BB144 5 Bytes  JMP 40F54B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxExW                                                                 7E3D0838 5 Bytes  JMP 40F54972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxExA                                                                 7E3D085C 5 Bytes  JMP 40F549D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!DialogBoxIndirectParamA                                                       7E3D6D7D 5 Bytes  JMP 40F54BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] USER32.dll!MessageBoxIndirectW                                                           7E3E64D5 5 Bytes  JMP 40F54A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] ole32.dll!CoCreateInstance                                                               774C057E 5 Bytes  JMP 40E5DB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] ole32.dll!OleLoadFromStream                                                              774E9C85 5 Bytes  JMP 40F54EF0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] WININET.dll!InternetConnectA                                                             404BDEAE 5 Bytes  JMP 00140F54 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] WININET.dll!InternetConnectW                                                             404BF862 5 Bytes  JMP 00140FE0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] WININET.dll!InternetOpenA                                                                404CD690 5 Bytes  JMP 00140D24 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] WININET.dll!InternetOpenW                                                                404CDB09 5 Bytes  JMP 00140DB0 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] WININET.dll!InternetOpenUrlA                                                             404CF3A4 5 Bytes  JMP 00140E3C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] WININET.dll!InternetOpenUrlW                                                             40516DDF 5 Bytes  JMP 00140EC8 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] ws2_32.dll!socket                                                                        719F4211 5 Bytes  JMP 001408C4 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] ws2_32.dll!bind                                                                          719F4480 5 Bytes  JMP 00140838 
.text           C:\Program Files\Internet Explorer\iexplore.exe[3692] ws2_32.dll!connect                                                                       719F4A07 5 Bytes  JMP 00140950 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!VirtualProtectEx                                                                      7C801A61 5 Bytes  JMP 000801A8 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!VirtualProtect                                                                        7C801AD4 5 Bytes  JMP 00080090 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!WriteProcessMemory                                                                    7C802213 5 Bytes  JMP 00080694 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!CreateProcessW                                                                        7C802336 5 Bytes  JMP 000802C0 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!CreateProcessA                                                                        7C80236B 5 Bytes  JMP 00080234 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!VirtualAlloc                                                                          7C809AF1 5 Bytes  JMP 00080004 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!VirtualAllocEx                                                                        7C809B12 5 Bytes  JMP 0008011C 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!CreateRemoteThread                                                                    7C8104CC 5 Bytes  JMP 000804F0 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!CreateThread                                                                          7C8106D7 5 Bytes  JMP 0008057C 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!CreateProcessInternalW                                                                7C8197B0 5 Bytes  JMP 000803D8 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!CreateProcessInternalA                                                                7C81D54E 5 Bytes  JMP 0008034C 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!WinExec                                                                               7C86250D 5 Bytes  JMP 00080464 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] kernel32.dll!SetThreadContext                                                                      7C863C09 5 Bytes  JMP 00080608 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] USER32.dll!SetWindowsHookExW                                                                       7E3A820F 5 Bytes  JMP 000807AC 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] USER32.dll!SetWindowsHookExA                                                                       7E3B1211 5 Bytes  JMP 00080720 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] WS2_32.dll!socket                                                                                  719F4211 5 Bytes  JMP 000808C4 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] WS2_32.dll!bind                                                                                    719F4480 5 Bytes  JMP 00080838 
.text           C:\WINDOWS\system32\wbem\wmiprvse.exe[3792] WS2_32.dll!connect                                                                                 719F4A07 5 Bytes  JMP 00080950 

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \SystemRoot\system32\DRIVERS	cpip.sys[NDIS.SYS!NdisCloseAdapter]                                                                              [F5486B06] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS	cpip.sys[NDIS.SYS!NdisOpenAdapter]                                                                               [F5486B26] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS	cpip.sys[NDIS.SYS!NdisRegisterProtocol]                                                                          [F5486B60] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]                                                                       [F5486B86] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]                                                                         [F5486B60] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter]                                                                              [F5486B26] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter]                                                                             [F5486B06] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisClCloseCall]                                                                             [F54875D8] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisClMakeCall]                                                                              [F5487540] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCoDeleteVc]                                                                              [F548749E] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCoCreateVc]                                                                              [F54873BA] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCloseAdapter]                                                                            [F5486B06] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisOpenAdapter]                                                                             [F5486B26] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisClOpenAddressFamily]                                                                     [F5487B14] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisClCloseAddressFamily]                                                                    [F5487D3C] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCoSendPackets]                                                                           [F5487286] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol]                                                                      [F5486B86] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol]                                                                        [F5486B60] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS
disuio.sys[NDIS.SYS!NdisRegisterProtocol]                                                                        [F5486B60] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS
disuio.sys[NDIS.SYS!NdisDeregisterProtocol]                                                                      [F5486B86] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS
disuio.sys[NDIS.SYS!NdisCloseAdapter]                                                                            [F5486B06] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
IAT             \SystemRoot\system32\DRIVERS
disuio.sys[NDIS.SYS!NdisOpenAdapter]                                                                             [F5486B26] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Internet Explorer\iexplore.exe[1448] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]                            [009E1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT             C:\Program Files\Internet Explorer\iexplore.exe[3692] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]                            [009E1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                       fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                      fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                      fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                                    fwdrv.sys (Sunbelt Personal Firewall FWDRV/Sunbelt Software)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                       fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001b1d10324d                                                                    
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001b1d10324d@001fcc81b8ed                                                       0x8A 0xEB 0x02 0xA0 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001b1d10324d@001fe482ed4e                                                       0x7B 0xF5 0x74 0x1A ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001b1d10324d@0017d5c4dd39                                                       0x67 0x91 0x96 0x11 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001b1d10324d@0023d601f33d                                                       0xE4 0xF6 0x13 0x29 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001b1d10324d (not active ControlSet)                                                
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001b1d10324d@001fcc81b8ed                                                           0x8A 0xEB 0x02 0xA0 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001b1d10324d@001fe482ed4e                                                           0x7B 0xF5 0x74 0x1A ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001b1d10324d@0017d5c4dd39                                                           0x67 0x91 0x96 0x11 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001b1d10324d@0023d601f33d                                                           0xE4 0xF6 0x13 0x29 ...

---- EOF - GMER 1.0.15 ----


voila je pense que tu as tout 

a tout à l 'heure

Utilisateur anonyme · Answer

Re

déja demandé !!

*  vu que tu as Malwarebytes  

* Lances--> Malwarebytes (MBAM)  
* Fais une  mise a jour       <== à faire
* Puis vas dans l'onglet "Recherche", coche >> Exécuter un examen complet    
* puis "Rechercher"    
*  Sélectionnes tes disques durs" puis clique sur "Lancer l'examen"    
*  A la fin du scan, clique sur Afficher les résultats puis sur Enregistrer le rapport    
*Si MalwareBytes'  détecte des infections, clique sur ==>Afficher les résultats, puis sur ==>Supprimer la sélection    
* S'il t' es demandé de redémarrer, clique sur "oui "    
*  aprés la suppression(s) de ou des infections trouvées --> poste le rapport ici

lilou4515 · Answer

voici le rapport malwarebytes:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4562

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07/09/2010 20:38:02
mbam-log-2010-09-07 (20-38-02).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 250017
Temps écoulé: 1 heure(s), 51 minute(s), 43 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

Salut

1) tu as Ccleaner

* Lances CCleaner.
* Ensuite, clique sur Options ==> Avancé et décoche la case
* Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 24 heures
* Clique sur l'onglet ==> Nettoyeur puis sur ==>Lancer le Nettoyage.
* Ensuite clique sur l'icone==> Registre , à droite, clique sur ==>Chercher des erreurs" puis sur "Réparer les erreurs sélectionnées.
* Accepte la sauvegarde, de la BDR (base de registre )qu'il propose
* Je te conseille de le repasser au moins deux fois,(ou + jusqu'à qu'il ne trouve plus d'erreurs.)



2) Télécharge OTL (de OldTimer) sur ton Bureau. 

 >> OTL (de OldTimer)  

*  Utilisateurs Windows  XP => double clique >>sur OTL.exe  
* Utilisateurs Windows  Vista / windows 7  => clic droit "executer en tant que en tant qu'administrateur "sur OTL.exe pour le lancer.  

coches les cases lop & purity check ainsi que en haut Tous les Utilisateurs et minimal output

Copies et colles le contenue de cette citation dans la partie inférieure d'OTL sous >> Personalisation :



netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT



* Cliques sur l'icône "Analyse" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).
* Copie et colle le contenu de OTL.Txt dans ta prochaine réponse

*   Héberge le rapport >> OTL.Txt sur ce site,   
 >> Cijoint.fr  
*  puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.  

* Pour t aider ,pour heberger le rapport   
*  rends toi sur Cijoint.fr      
*  clic sur Parcourir      
*  trouve >> le rapport que tu viens d'enregistrer qui doit par exemple être sur ton bureau      
*  et valide en cliquant sur >> Cliquez ici pour déposer le Fichier     
*  un lien de ce genre http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt te sera généré,       
*  il te suffit de le poster ici  pour que je puisse voir le rapport  

fais aprés de même avec le rapport >> Extras.Txt

lilou4515 · Answer

salut
voici d'abort le estras.txt:
http://www.cijoint.fr/cjlink.php?file=cj201009/cijIojXMSR.txt

lilou4515 · Answer

et le deuxième: OTL logfile created on: 08/09/2010 18:26:37 - Run 1 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\HP_Propriétaire\Bureau Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 1 023,00 Mb Total Physical Memory | 561,00 Mb Available Physical Memory | 55,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 76,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 143,81 Gb Total Space | 36,56 Gb Free Space | 25,42% Space Free | Partition Type: NTFS Drive D: | 152,66 Gb Total Space | 57,72 Gb Free Space | 37,81% Space Free | Partition Type: NTFS Drive E: | 5,22 Gb Total Space | 1,42 Gb Free Space | 27,09% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: NOM-641695C7437 Current User Name: HP_Propriétaire Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010/09/08 18:24:39 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Propriétaire\Bureau\OTL.exe PRC - [2010/02/24 11:05:20 | 000,812,032 | ---- | M] (Orange) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe PRC - [2009/08/24 13:23:02 | 000,282,624 | ---- | M] (France Telecom SA) -- C:\Program Files\Orange\Connexion Internet Orange\Systray\SystrayApp.exe PRC - [2009/08/24 13:22:44 | 000,717,552 | ---- | M] (France Telecom SA) -- C:\Program Files\Orange\Connexion Internet Orange\Launcher\Launcher.exe PRC - [2009/08/24 13:22:34 | 000,069,632 | ---- | M] (France Telecom SA) -- C:\Program Files\Fichiers communs\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe PRC - [2009/08/24 13:22:30 | 000,053,248 | ---- | M] (France Telecom SA) -- C:\Program Files\Orange\Connexion Internet Orange\Connectivity\Corecom\OraConfigRecover.exe PRC - [2009/08/24 13:22:28 | 000,495,616 | ---- | M] (France Telecom SA) -- C:\Program Files\Orange\Connexion Internet Orange\Connectivity\Corecom\CoreCom.exe PRC - [2009/08/24 13:22:26 | 000,974,848 | ---- | M] (France Telecom SA) -- C:\Program Files\Orange\Connexion Internet Orange\Connectivity\ConnectivityManager.exe PRC - [2009/08/24 13:22:26 | 000,090,112 | ---- | M] (France Telecom SA) -- C:\Program Files\Fichiers communs\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe PRC - [2009/07/21 14:33:58 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009/07/09 12:22:18 | 000,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe PRC - [2009/05/13 16:47:40 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2009/03/02 13:08:11 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2008/07/24 06:58:17 | 000,200,704 | R--- | M] () -- C:\WINDOWS\system32\UMonit.exe PRC - [2008/07/11 17:51:32 | 000,423,200 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe PRC - [2008/04/14 04:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/04/26 11:21:28 | 001,967,664 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe PRC - [2007/04/26 11:21:28 | 001,234,480 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe PRC - [2004/05/20 10:47:18 | 000,249,856 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\system32\Keyhook.exe PRC - [2004/01/26 11:38:38 | 000,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010/09/08 18:24:39 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Propriétaire\Bureau\OTL.exe MOD - [2008/04/14 04:32:02 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt) SRV - [2009/08/24 13:22:34 | 000,069,632 | ---- | M] (France Telecom SA) [Auto | Running] -- C:\Program Files\Fichiers communs\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe -- (FTRTSVC) SRV - [2009/07/21 14:33:58 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009/07/09 12:22:18 | 000,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort) SRV - [2009/05/13 16:47:40 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2009/03/03 14:53:08 | 000,033,176 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R) SRV - [2007/04/26 11:21:28 | 001,234,480 | ---- | M] (Sunbelt Software) [Auto | Running] -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe -- (SPF4) SRV - [2006/03/03 21:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys -- (Lavasoft Kernexplorer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\catchme.sys -- (catchme) DRV - [2010/07/01 11:58:57 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd) DRV - [2009/12/10 20:06:01 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009/08/05 23:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2009/05/11 10:11:52 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009/03/30 10:32:47 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2009/02/13 12:34:33 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008/12/15 10:53:46 | 000,019,572 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\FNETDEVI.SYS -- (FNETDEVI) DRV - [2007/04/26 11:21:34 | 000,072,624 | ---- | M] (Sunbelt Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\khips.sys -- (khips) DRV - [2007/04/26 11:21:30 | 000,302,000 | ---- | M] (Sunbelt Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fwdrv.sys -- (fwdrv) DRV - [2007/01/31 15:33:46 | 000,005,632 | ---- | M] (GRISOFT, s.r.o.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\avgarkt.sys -- (AVG Anti-Rootkit) DRV - [2007/01/18 14:00:28 | 000,003,968 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AvgArCln.sys -- (AvgArCln) DRV - [2006/03/01 19:53:54 | 000,032,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\pcandis5.sys -- (PCANDIS5) DRV - [2004/07/19 18:33:14 | 000,218,112 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315) DRV - [2004/07/17 05:20:34 | 000,012,160 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp) DRV - [2004/07/02 00:12:00 | 002,459,840 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers v4_mini.sys -- (nv) DRV - [2004/06/29 18:07:18 | 001,268,204 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2004/06/15 06:08:20 | 000,626,220 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2003/12/12 07:54:14 | 000,391,424 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS) DRV - [2003/12/08 11:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) DRV - [2003/12/08 11:53:46 | 000,070,688 | ---- | M] (THOMSON) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl) DRV - [2003/09/23 11:38:34 | 000,034,688 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pcampr5.sys -- (PCAMPR5) DRV - [2003/09/19 01:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc) DRV - [2003/09/10 23:36:54 | 000,021,060 | ---- | M] (InterVideo, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iviaspi.sys -- (Iviaspi) DRV - [2003/07/18 17:58:20 | 000,036,992 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys -- (SISAGP) DRV - [2003/07/11 23:28:56 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC) DRV - [2003/07/02 12:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1) DRV - [2003/05/14 04:57:02 | 000,090,357 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\P1110Vid.sys -- (P1110VID) DRV - [2002/10/04 18:04:10 | 000,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139) DRV - [2001/06/04 15:00:00 | 000,014,112 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.01net.com/http://www.01men.com/ [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = https://www.msn.com/fr-fr?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr IE - HKCU\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\Connexion Internet Orange\SearchURLHook\SearchPageURL.dll () IE - HKCU\..\URLSearchHook: {AEEC3B59-CA98-4EBA-A140-57B94E283583} - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2009/02/15 23:14:41 | 000,291,983 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10053 more lines... O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - No CLSID value found. O3 - HKLM\..\Toolbar: ({EA551C00-2AE5-11d3-8592-00A0C98E9EA4}) - - C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll (Orange) O3 - HKLM\..\Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKLM\..\Toolbar: (Vue HP) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company) O3 - HKLM\..\Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found. O3 - HKLM\..\Toolbar: (barre d'outils Orange) - {D3028143-6145-4318-99D3-3EDCE54A95A9} - C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll (Orange) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (Vue HP) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company) O3 - HKCU\..\Toolbar\WebBrowser: (Vue HP) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company) O3 - HKCU\..\Toolbar\WebBrowser: (barre d'outils Orange) - {D3028143-6145-4318-99D3-3EDCE54A95A9} - C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll (Orange) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation) O4 - HKLM..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\Connexion Internet Orange\SessionManager\SessionManager.exe (France Telecom SA) O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe () O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation) O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium) O4 - HKLM..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe () O4 - HKLM..\Run: [VTTimer] File not found O4 - HKCU..\Run: [orangeinside] C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe (Orange) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 145 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0 O8 - Extra context menu item: _orange.fr - C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\src\orange_html\orange.html () O8 - Extra context menu item: orange.fr - C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\src\orange_html\orange.html () O9 - Extra Button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Key error. File not found O9 - Extra 'Tools' menuitem : &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - Reg Error: Key error. File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKCU\..Trusted Domains: orange.fr ([logicielsgratuits] http in Trusted sites) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool) O16 - DPF: {5A779DC0-837B-4590-AC42-C7C0847478C5} http://logicielsgratuits.orange.fr/download_service/Install/OrangeInstaller.cab (OrangeInstaller_ModuleIE Control) O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab (UnoCtrl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab (EPUImageControl Class) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab (Reg Error: Key error.) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O24 - Desktop Components:0 (Ma page d'accueil) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/01/01 15:06:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009/11/25 09:00:24 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009/11/25 09:00:24 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2001/07/27 22:07:38 | 000,000,000 | -HS- | M] () - E:\AUTOEXEC.BAT -- [ FAT32 ] O32 - AutoRun File - [2009/11/25 08:00:26 | 000,000,000 | RHSD | M] - E:\autorun.inf -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (C:\WINDOWS\45059515.exe \??\C:\WINDOWS\45059515.dat) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found MsConfig - StartUpReg: [b]BluetoothAuthenticationAgent[/b] - hkey= - key= - File not found MsConfig - StartUpReg: [b]Google Quick Search Box[/b] - hkey= - key= - C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe File not found MsConfig - StartUpReg: [b]msnmsgr[/b] - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe File not found MsConfig - StartUpReg: [b]ORAHSSSessionManager[/b] - hkey= - key= - C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe File not found MsConfig - StartUpReg: [b]Rainlendar2[/b] - hkey= - key= - C:\Program Files\Rainlendar2\Rainlendar2.exe () MsConfig - StartUpReg: [b]SunJavaUpdateSched[/b] - hkey= - key= - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Rendu VML (Vector Graphics Rendering) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Liaison de données Dynamic HTML pour Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Création avancée ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes Java DirectAnimation ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {9A394342-4A68-4EBA-85A6-55B559F4E700} - .NET Framework ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Planificateur de tâches ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player 9 ActiveX ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32 undll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler) Drivers32: msacm.alf2cd - C:\WINDOWS\System32\alf2cd.acm (NCT Company) Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/ Drivers32: msacm.scg726 - C:\WINDOWS\System32\Scg726.acm (SHARP Corporation) Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32 ssoft32.acm (DSP GROUP, INC.) Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.) Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.DIVX - C:\WINDOWS\System32\divx.dll (DivX, Inc.) Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept) Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll () Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\PROGRA~1\SPlayer\ir50_32.dll File not found Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.) Drivers32: vidc.mp42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation) Drivers32: vidc.mp43 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation) Drivers32: vidc.mpg4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation) Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll () Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org) CREATERESTOREPOINT Restore point Set: OTL Restore Point (17465059307421696) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010/09/08 18:24:23 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP_Propriétaire\Bureau\OTL.exe [2010/09/08 16:35:12 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HP_Propriétaire\Recent [2010/09/05 14:01:02 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Remover [2010/09/05 11:49:05 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPDiag [2010/09/05 09:29:25 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/09/05 09:29:22 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/09/05 09:29:22 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/09/03 16:59:26 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010/09/08 18:25:00 | 000,000,452 | -H-- | M] () -- C:\WINDOWS asks\User_Feed_Synchronization-{C4CA4977-2455-4245-971A-D452668B9EB6}.job [2010/09/08 18:24:39 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Propriétaire\Bureau\OTL.exe [2010/09/08 16:36:50 | 000,000,310 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Mes documents\cc_20100908_163647.reg [2010/09/08 16:36:36 | 013,893,632 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\NTUSER.DAT [2010/09/08 16:36:29 | 000,034,826 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Mes documents\cc_20100908_163623.reg [2010/09/08 16:28:38 | 000,004,452 | ---- | M] () -- C:\WINDOWS\System32 vapps.xml [2010/09/08 16:28:36 | 000,000,188 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT [2010/09/08 16:28:08 | 000,001,050 | ---- | M] () -- C:\WINDOWS asks\GoogleUpdateTaskMachineCore.job [2010/09/08 16:28:05 | 000,000,006 | -H-- | M] () -- C:\WINDOWS asks\SA.DAT [2010/09/08 16:28:00 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys [2010/09/08 16:28:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/09/07 21:24:31 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat [2010/09/07 20:15:00 | 000,001,054 | ---- | M] () -- C:\WINDOWS asks\GoogleUpdateTaskMachineUA.job [2010/09/07 18:50:06 | 000,159,744 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/09/07 16:34:56 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe [2010/09/07 13:36:07 | 000,000,492 | ---- | M] () -- C:\WINDOWS asks\Ad-Aware Update (Weekly).job [2010/09/07 12:07:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS asks\AppleSoftwareUpdate.job [2010/09/05 14:01:03 | 000,001,565 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Bureau\AD-R.lnk [2010/09/05 11:49:06 | 000,000,677 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk [2010/09/05 11:49:06 | 000,000,672 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk [2010/09/05 09:29:28 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk [2010/09/05 09:03:01 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/09/05 07:16:28 | 000,000,826 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\Microsoft\Internet Explorer\Quick Launch\Démarrer Internet Explorer.lnk [2010/08/31 20:44:15 | 006,960,090 | -H-- | M] () -- C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\IconCache.db [2010/08/31 19:12:02 | 000,000,693 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Bureau\CCleaner.lnk [2010/08/31 17:13:03 | 000,001,740 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 9.lnk [2010/08/31 16:49:09 | 000,152,384 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010/08/31 16:45:02 | 001,088,680 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/08/31 16:45:02 | 000,514,548 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat [2010/08/31 16:45:02 | 000,444,118 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/08/31 16:45:02 | 000,087,108 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat [2010/08/31 16:45:02 | 000,073,000 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010/09/08 16:36:49 | 000,000,310 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Mes documents\cc_20100908_163647.reg [2010/09/08 16:36:26 | 000,034,826 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Mes documents\cc_20100908_163623.reg [2010/09/07 16:34:51 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Bureau\yxh755it.exe [2010/09/05 14:01:03 | 000,001,565 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Bureau\AD-R.lnk [2010/09/05 11:49:06 | 000,000,677 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk [2010/09/05 11:49:06 | 000,000,672 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk [2010/09/05 09:29:28 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk [2010/09/05 07:16:28 | 000,000,826 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\Microsoft\Internet Explorer\Quick Launch\Démarrer Internet Explorer.lnk [2009/12/09 10:36:57 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2009/06/02 22:18:31 | 000,001,968 | ---- | C] () -- C:\WINDOWS\Media9Ut.INI [2009/05/27 17:47:51 | 000,001,257 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\QuickZip45.ini [2009/04/24 18:48:13 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\AVSMediaPlayer.m3u [2009/04/24 10:59:33 | 000,394,240 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll [2009/01/13 19:03:21 | 000,000,040 | ---- | C] () -- C:\WINDOWS\NAVIGMA.INI [2008/12/31 16:48:07 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2008/12/31 16:48:06 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2008/12/31 16:48:02 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008/12/31 16:48:02 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008/12/31 16:48:01 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008/12/31 16:47:58 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008/12/31 16:47:58 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008/12/31 07:17:33 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll [2008/12/15 14:36:05 | 000,000,039 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2008/12/10 19:11:51 | 000,001,372 | R--- | C] () -- C:\WINDOWS\System32\IconCfg0.ini [2008/12/10 18:00:40 | 000,176,128 | R--- | C] () -- C:\WINDOWS\System32\ustor.dll [2008/09/17 14:38:43 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll [2008/09/16 21:19:30 | 000,000,379 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008/09/16 21:15:46 | 000,159,744 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/09/16 20:20:22 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2008/09/16 20:13:33 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\fusioncache.dat [2004/06/29 06:58:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2004/01/02 06:59:41 | 000,100,530 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini [2004/01/02 06:59:40 | 000,105,873 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini [2004/01/01 22:54:04 | 000,000,640 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2004/01/01 22:23:43 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/01/01 18:58:48 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll [2004/01/01 18:58:22 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll [2004/01/01 18:58:22 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll [2004/01/01 18:53:37 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll [2004/01/01 18:52:25 | 000,023,967 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2004/01/01 18:51:52 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2004/01/01 18:36:08 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2004/01/01 18:36:08 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2004/01/01 18:36:07 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2004/01/01 18:36:07 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2004/01/01 18:36:07 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2004/01/01 18:36:07 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2004/01/01 16:41:05 | 000,002,546 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log [2004/01/01 16:35:12 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2004/01/01 15:57:07 | 000,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll [2004/01/01 15:57:07 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll [2004/01/01 15:09:25 | 000,000,851 | ---- | C] () -- C:\WINDOWS\orun32.ini [2003/03/06 23:53:18 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\hpnvr82.dll [2001/07/07 03:00:00 | 000,003,279 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI [1999/01/22 21:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >[/color] [2010/02/02 21:58:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe [2009/04/18 18:19:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple [2009/08/01 15:45:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer [2009/11/29 13:57:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg8 [2009/11/29 14:34:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avira [2009/04/24 10:31:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVS4YOU [2009/04/18 18:15:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations [2010/07/30 09:46:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Google [2008/09/17 14:44:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard [2008/09/17 15:02:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HP [2009/10/03 08:27:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterVideo [2010/05/07 09:22:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Lavasoft [2008/09/16 20:01:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/06/04 11:57:27 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft [2004/01/01 18:57:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Motive [2009/08/01 15:46:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NOS [2009/05/27 18:24:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data View_Profiles [2008/09/16 21:03:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime [2004/01/01 15:11:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SBSI [2009/04/18 18:27:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony [2010/07/25 08:47:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SPAMfighter [2010/05/02 20:06:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2009/11/28 16:29:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2009/04/25 15:47:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VOWSoft [2008/09/16 20:47:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage [2009/02/06 22:26:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLInstaller [2009/09/30 17:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009/04/24 09:24:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color] [2009/02/04 15:56:14 | 000,075,112 | ---- | M] (GEAR Software, Inc.) -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\DifXInstall32.exe [2009/12/08 13:17:40 | 000,079,144 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe [2010/05/25 06:55:34 | 000,501,872 | ---- | M] (Google Inc.) -- C:\Documents and Settings\All Users\Application Data\Google\Google Toolbar\Update\gtb25.tmp.exe [2010/01/03 12:05:09 | 005,061,520 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe [color=#A23BEC]< %APPDATA%\*. >[/color] [2009/12/08 21:11:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\AccurateRip [2010/06/03 15:43:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Adobe [2008/09/17 16:46:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM [2009/09/30 17:56:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Apple Computer [2009/12/08 21:31:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\AVS4YOU [2010/09/07 18:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\dvdcss [2009/05/31 13:41:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Google [2008/11/05 09:59:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Help [2008/09/17 19:02:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\HP [2009/04/11 22:12:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Identities [2008/12/16 21:01:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Intervideo [2008/11/15 04:47:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Leadertech [2008/09/16 19:26:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Macromedia [2008/09/16 20:01:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Malwarebytes [2010/03/22 20:05:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Media Player Classic [2009/12/09 15:28:46 | 000,000,000 | --SD | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Microsoft [2008/09/16 21:14:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Microsoft Web Folders [2008/09/17 19:02:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Motive [2009/09/26 08:13:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla [2010/03/21 19:48:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\MSNInstaller [2009/06/01 17:30:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\OpenOffice.org [2010/06/20 08:07:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange [2004/01/01 19:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\SampleView [2008/11/15 04:47:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Sonic [2009/04/18 18:27:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Sony [2009/04/18 18:30:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Sony Corporation [2010/07/25 08:47:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\SPAMfighter [2009/12/09 07:58:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\SPlayer [2004/01/01 16:07:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Sun [2010/07/24 17:19:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Uniblue [2010/03/11 22:25:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc [2008/12/21 07:04:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc(2) [2009/04/25 19:52:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Windows Live Writer [2010/07/11 21:57:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\WinRAR [2009/06/16 18:36:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Propriétaire\Application Data\Yahoo! [color=#A23BEC]< %APPDATA%\*.exe /s >[/color] [2010/06/20 08:07:13 | 000,155,834 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\uninstall.exe [2009/11/13 15:03:38 | 000,152,576 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\install\Launch.exe [2010/02/24 11:05:20 | 000,201,216 | ---- | M] () -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\install\Uninstall.exe [2010/02/24 11:05:20 | 000,812,032 | ---- | M] (Orange) -- C:\Documents and Settings\HP_Propriétaire\Application Data\Orange\OrangeInside\one\OrangeInside.exe [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color] [2010/06/24 14:25:22 | 000,184,320 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\WINDOWS\system32\iepeers.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color] [2004/01/01 15:58:34 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2004/01/01 15:58:34 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2004/01/01 15:58:34 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2E0A12A9 @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 @Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6 < End of report >

Utilisateur anonyme · Answer

Salut Comment va ton PC ?? Tes protections >> Sunbelt Personal Firewall 4 + Avira AntiVir Personal Largement suffisant >> tu l as en payant >> Lavasoft Ad-Aware de trop sur ton PC à Désinstaller également 1)tu as encore du Norton sur ton PC à désinstaller ainsi * Télécharge et exécute l'outil de désinstallation Norton * ICI >> outil de désinstallation Norton * Choisis >> * J'utilise Windows Vista/XP/2000. * Cliques sur >> TÉLÉCHARGER sur la même ligne ensuite 2) * Télécharge JavaRa.zip (de Paul ' McLain et Fred de Vries) sur ton Bureau. ICI >> JavaRa * Décompresse le fichier sur le Bureau (Clic droit > Extraire tout). * Double-clique sur le répertoire JavaRa. * Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher). * Choisis Français puis clique sur Select. * Clique sur >> Recherche de mises à jour. * Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher. * Autorise le processus à se connecter s'il le demande, clique sur Installer et suis les instructions d'installation qui prennent quelques minutes. * L'installation est terminée, reviens à l'écran de JavaRa * clique sur >> Effacer les anciennes versions. * Clique sur Oui pour confirmer. * Laisse travailler et clique ensuite sur OK, * puis une deuxième fois sur OK. * Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse. * Ferme l'application. Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log. 3) * Vaccines tes Amovibles * Desactive ton antivirus le temps de la manip * Telecharge et install UsbFix (de El Desaparecido et C_XX ) ICI >> UsbFix (de El Desaparecido et C_XX ) * Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectées sans les ouvrir * Double clique sur le raccourci UsbFix présent sur ton bureau . * Choisis l'option >> Vacciner * Laisse travailler l'outil. * Ensuite poste le rapport UsbFix.txt qui apparaîtra * Réactive ton antivirus 4) Essayes et installes ce navigateur *>> Mozilla Firefox >> Mozilla Firefox * Sécurise le navigateur Firefox(Utilise le en Priorité) avec AdBlock Plus >> Securiser Firefox * tu rajouteras aussi WOT il permet d'identifier aisément les sites dangereux dans les résultats de recherche et dans Firefox,explorer et Google Chrome >> WOT 5) Telecharges Starter * Starter est un logiciel permettant de visualiser et de gérer les programmes qui se chargent automatiquement au lancement de Windows . ICI >> Starter * désactives les applications inutiles au démarrage autres que tes protections,applications windows et pilotes 6) * Installe ce Soft qui te tiendra au courant des mises à jour de tes Logiciels installés * Télécharge Update Checker * logiciel permet de trouver la liste des logiciels installés sur ton PC ainsi que leurs versions actuelles, et en comparant cette liste avec la base des données du serveur. * il peut dire quel logiciel n'est pas à jour, et il te propose également de le télécharger ICI >> Update Checker * Installe le avec les paramètres par défaut en cliquant chaque fois sur Suivant. * Une fois installé, patiente quelques secondes et tu verras apparaître une icône verte dans ta barre des tâches te signalant qu'il y a des mises à jour disponibles. * Double-cliques sur l'icône pour être redirigé sur le site de téléchargement des mises à jour. * Un conseil : n'installe pas les BETA qui sont listées en dessous.>> Beta Updates Detected * Tu installes les mises à jour Fais tout ceci et seulement aprés , 7)poste moi un dernier Log ZHPDiag * Héberge le rapport sur ce site, >> Cijoint.fr * puis copie/colle le lien fourni dans ta prochaine réponse sur le forum. * Pour t aider ,pour heberger le rapport * rends toi sur Cijoint.fr * clic sur Parcourir * trouve >> le rapport que tu viens d'enregistrer qui doit par exemple être sur ton bureau * et valide en cliquant sur >> Cliquez ici pour déposer le Fichier * un lien de ce genre http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt te sera généré, * il te suffit de le poster ici pour que je puisse voir le rapport 8) Malwarebytes tu le Conserveras pour analyses Complémentaires et à jour Analyses 1 fois/Semaine

lilou4515 · Answer

salut 

Le PC se comporte bien mieux.
Pour les protection ok je suis ton conseil et pour Lavasoft Ad-Aware je l'ai désinstallé.
Quand je veux utiliser l'outil de désinstallation Norton  il m'affiche ce message d'erreur.
une autre instance de symNRT ou un autre outil de réception symantec est en cours d'éxécution. Veuillez fermer cette application et essayer à nouveau d'éxécuter symNRT.
J'ai effecté la manip après redémarrage et toujours pareil.
As tu une solution?
Sinon, je continue la suite des manip
a+

lilou4515 · Answer

salut 

c 'est bon j'ai réussi et je continue la suite 

a+

Utilisateur anonyme · Answer

Salut

trés bien 

@+

lilou4515 · Answer

salut 

le rapport java 

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Fri Sep 10 17:26:18 2010

Found and removed: C:\Documents and Settings\HP_Propriétaire\Application Data\Sun\Java\jre1.6.0_11

Found and removed: C:\Documents and Settings\HP_Propriétaire\Application Data\Sun\Java\jre1.6.0_13

Found and removed: C:\Documents and Settings\HP_Propriétaire\Application Data\Sun\Java\jre1.6.0_15

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_11

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: Software\Classes\JavaPlugin.160_11

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACB9B14518A96D117A58000B0D410203

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

------------------------------------

Finished reporting.



a+

lilou4515 · Answer

re 

pour usbfix

il m'affiche aucun rapport.

est ce normal?

A+

Utilisateur anonyme · Answer

Re

avec UsbFix,normalement oui >>  tu as vacciné !!!

continue la suite et reviens

lilou4515 · Answer

Salut 

* Sécurise le navigateur Firefox(Utilise le en Priorité) avec AdBlock Plus 


je n'arrive pas a installer adblock plus

as tu un conseil ?

Merci d'avance

Utilisateur anonyme · Answer

Salut

Pour >> adblock plus tu essaieras plus tard en le désinstallant et aprés un redémarrage de Firefox et une nouvelle tentative d installation 

fais la suite 

@+

lilou4515 · Answer

Bonjour 

pour starter:

il me reste très peu de chose. j'espère que je n'ai pas fait de bêtise.

je vais essayé de faire à nouveau adblock

a+

lilou4515 · Answer

salut 

pour checker les sites de téléchargement sont fiable ? 

je fais la suite

Utilisateur anonyme · Answer

Re

pour checker les sites de téléchargement sont fiable ?
 oui !!

fai la suite si plus de soucis

lilou4515 · Answer

re 

voici le rapport ZHPDiag

http://www.cijoint.fr/cjlink.php?file=cj201009/cijNMCoiVn.txt 

a+

Utilisateur anonyme · Answer

Salut

rien dans le log ZHPDiag quelques lignes superflues

donc



1) * Télécharges ToolsCleaner de A.Rothstein 
.pour enlever les programmes utilisés pendant la procédure. 

ICI >> ToolsCleaner 

. Enregistres ToolsCleaner2.exe sur le Bureau. 
. Double-cliquer dessus, puis cliquer sur >> Recherche 
 ==> Le programme va chercher les utilitaires installé 
.Il se peut que la fenêtre devienne blanche pendant le scan, c'est normal ! 
. Lorsque la recherche est terminée ToolsCleaner affiche une liste des différents outils trouvés, 
. cliques sur ==> Suppression afin de les supprimer. 
. et ensuite cliques ==> vidage Corbeille 
. Fermes le programme en cliquant sur "Quitter ". 
. Postes le rapport qui se trouve ici >>> C:\TCleaner.txt 
. tu termines en faisant un clic droit sur ToolsCleaner et tu le supprimes 


ensuite,si plus de soucis  

Fais ceci >>  

2) * désactive la  Restauration de ton système : 

* sert à supprimer les infections qui se trouvent dans la restauration du système. 
* Cliques sur démarrer. 
* Clic droit sur "Poste de travail" puis choisir "Propriétés". 
* Sélectionnes l'onglet "Restauration du système". 
* Coches ==>Désactiver la Restauration du système sur tous les lecteurs  ou Désactiver la Restauration du système puis appliquer. 
* OK==> Redémarres ton PC 

ensuite 

3) * Puis retournes sur ==>Poste de travail ==> Propriétés  
* décoches cette fois ==>Désactiver la Restauration du système sur tous les lecteurs  ou Désactiver la Restauration du système ==>appliquer ==> puis ok. 

aprés  

4) * Création du point de restauration : 

* vas dans le Menu Démarrer puis dans Programmes, 
* Accessoires et enfin dans Outils système, 
* Choisis Restauration du système, 
* Sélectionnes==> Créer un point de restauration, 
* Cliques sur Suivant, 
* Entres un nom pour le point de restauration : ce nom assez simple pour que tu le retrouves 
* Cliques ==>Créer et le point de restauration se créé automatiquement 


reviens me confirmer 


            
                
            Membre Contributeur sécurité CCM
            Windows Vista // Windows XP

lilou4515 · Answer

salut 

avec tools cleaner théoriquement je ne devrais plus avoir tous les logitiels que l'on a téléchargé sur le bureau?

Sinon il me reste semble t il que l'opération 4 Création du point de restauration 

a+

Utilisateur anonyme · Answer

Re

ok fais et reviens pour les derniers conseils

lilou4515 · Answer

salut 

Tout les icones de logiciels sont toujours sur mon bureau. Est ce normal ?
 
j'ai créé un point de restauration pour continuer je fais démarrage?

A+

Utilisateur anonyme · Answer

Salut

as-tu bien passé ToolsCleaner car je n ai pas eu de rapport

Fais un clic droit sur ToolsCleaner et tu le supprimes

essayes celui-çi


* Télécharge  Supress'tools (de NicoVA) :  
*  Utilitaire pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques  :   

 ICI >>Supress'tools (de NicoVA)  

    * Enregistre le fichier sur le Bureau.  
    * Double-cliquez sur Supresstools.exe pour l'exécuter   
     *(si vous êtes sous Windows Vista et Windows 7,   
    * fais un clic-droit sur le fichier Supresstools.exe et >> exécutez-le en tant qu'administrateur.)  
    * Clique sur Recherche, puis Suppression pour finaliser.  
    * Un rapport sera généré (il est également enregistré à la racine du disque dur : C:\Report.txt)   
    * poste le Rapport  



            
                
            Membre Contributeur sécurité CCM
            Windows Vista // Windows XP

lilou4515 · Answer

Salut 

depuis que j'ai firefox je n'arrive pas a enregistrer sur mon bureau .

il enregistre directement le logiciel sur mes documents et de ce fait je n'ai pas le rapport est ce normale . c'est ce qui s'est passé pour tools.

je fais un essai

a+

lilou4515 · Answer

re 

voici le rapport


Rapport Supress'tools
Supress'tools a été éxécuté le 12/09/2010 à 09 : 54
Par HP_Propriétaire
Système d'exploitation : WIN_XP / X86 / Service Pack 3
Mode | Recherche | 

¤¤¤¤¤¤¤ C:\ ¤¤¤¤¤¤¤

Ad-Report-CLEAN[1].txt trouvé !

¤¤¤¤¤¤¤ C:\Documents and Settings\HP_Propriétaire\Bureau\ ¤¤¤¤¤¤¤

OTL.exe Trouvé !
OTL.Txt Trouvé !
ZHPDiag.txt Trouvé !
ZHPFixReport.txt Trouvé !
OTL.Txt Trouvé !
Extras.Txt Trouvé !
OTL.exe Trouvé !
OTL.Txt Trouvé !
OTL.exe Trouvé !

¤¤¤¤¤¤¤ C:\Documents and Settings\HP_Propriétaire\Mes documents\Téléchargements\ ¤¤¤¤¤¤¤


¤¤¤¤¤¤¤ C:\WINDOWS\ ¤¤¤¤¤¤¤


¤¤¤¤¤¤¤ C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ ¤¤¤¤¤¤¤


¤¤¤¤¤¤¤ C:\Program Files\ ¤¤¤¤¤¤¤

trend micro\ trouvé !

¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch\ ¤¤¤¤¤¤¤


¤¤¤¤¤¤¤ Registre ¤¤¤¤¤¤¤

HKEY_CURRENT_USER\Software\Ad-Remover Trouvé!

¤¤¤¤¤¤¤ Demande d'upload ¤¤¤¤¤¤¤ 


((((((((((((((( EOF )))))))))))))))

Utilisateur anonyme · Answer

Re   

Relances la recherche  avec >> Supress'tools ensuite fais suppression   

ensuite pour Firefox tu dis   

depuis que j'ai firefox je n'arrive pas a enregistrer sur mon bureau   

* Lances Firefox >> cliques outils   
* dans la fenêtre  
* Options > onglet général    
* cliques sur le bouton >> toujours demander ou enregistrer les fichiers   
* refermes la fenêtre  
@+   
               
                   
            Membre Contributeur sécurité CCM   
            Windows Vista // Windows XP

lilou4515 · Answer

re 


pour l'enregistrement sur mon bureau c'est bon avec firefox.

suite à l'opération de suppress'tools il me reste encore ceci sur mon bureau:

ZHPDiag
ZHPFix
AD-R
yxh755it
rap
Norton_remov

dois je les supprimer manuellement

a+

Utilisateur anonyme · Answer

Re

ok

pour ces deux ZHPDiag et ZHPFix pour les supprimer ,comme c est mis réguliérement à jour
désinstalles via ajouter et supprimer des programmes >> ZHPDiag  les deux icônes disparaitront

pour les autres supprimes les manuellement 

ensuite cliques sur Démarrer >> poste de travail>> disque local >< supprimes les dossiers si présent 

ensuite

1)* régle de sécurité :on réfléchit puis on clique et pas l'inverse
* Les fichiers/programmes c'est comme les bonbons, quand ça vient d'un inconnu, on n'accepte pas


2)*  Fais régulièrement une sauvegarde de tes documents importants sur un support externe (disque dur externe, CD/DVD réinscriptible...)
* Dans ce sujet, nous avons pu désinfecter ton ordinateur, mais ce n'est pas toujours le cas. 
* Certaines infections cryptent les documents et demandent une rançon pour les récupérer, 
* d'autres les modifient pour diffuser des infections, obligeant donc à les effacer... 
* Il faut donc toujours avoir une sauvegarde saine de tes documents, sinon tu risques de les perdre.

3)* un peu de lecture
Tu prendras le temps de lire
 Synthèse du Projet Antimalwares 
 Projet Antimalwares  

et pour terminer


* Tu peux mettre ton problème résolu !!
>> Résolu


            
                
            Membre Contributeur sécurité CCM
            Windows Vista // Windows XP

lilou4515 · Answer

re

ok je vais suivre tes conseils.

j'ai crée un point de restauration avec son nom 

Petite question:

 cela sert à quoi ? Ou puis je le retrouver? 


 et il me reste apparemment  une autre étape car je me retrouve avec une page ou il est noté:

pour effectuer une autre tâche , cliquer sur démarrage 

ou dois je tout simplement  fermer

je voulais te remercier pour tous ces bons conseils te souhaitant un bon dimanche.

a+

Utilisateur anonyme · Answer

Salut  lilou4515 



j'ai crée un point de restauration avec son nom
Petite question:
cela sert à quoi ?


Le point de restauration sert à remettre le PC en l'état où il était au jour du point de restauration en cas de problème.


Ou puis je le retrouver? 

lecture >> Points de restauration


pour la fenêtre je ne sais laquelle tu parles ,fermes la


si plus de soucis

* Tu peux mettre ton problème résolu !!
>> Résolu


Bon dimanche

Pc hyper lent souris incontrolable - Page 3

Newsletters