Connection internet très lente

======= RAPPORT D'AD-REMOVER 2.0.0.1,E | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 06/09/10 à 15:20
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 07:21:12 le 15/09/2010, Mode normal

Microsoft Windows 7 Édition Familiale Premium (X64)
jc&tayo@JC-TAYO-PC (Packard Bell EasyNote LJ73)

============== ACTION(S) ==============


0,Dossier supprimé: C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
0,Dossier supprimé: C:\Program Files (x86)\Ask.com
3,Fichier supprimé: C:\Windows\Installer\b4aea.msi
3,Fichier supprimé: C:\Windows\Installer\bd9d3.msi
3,Fichier supprimé: C:\Windows\Installer\bd9d9.msi
3,Fichier supprimé: C:\Windows\Installer\bd9df.msi
3,Fichier supprimé: C:\Windows\Installer\bd9e5.msi
3,Fichier supprimé: C:\Windows\Installer\bd9eb.msi
3,Fichier supprimé: C:\Windows\Installer\bd9f1.msi
3,Fichier supprimé: C:\Windows\Installer\bda09.msi
3,Fichier supprimé: C:\Windows\Installer\bda0f.msi
3,Fichier supprimé: C:\Windows\Installer\bda15.msi
3,Fichier supprimé: C:\Windows\Installer\bda1b.msi
3,Fichier supprimé: C:\Windows\Installer\bda21.msi
3,Fichier supprimé: C:\Windows\Installer\bda27.msi

(!) -- Fichiers temporaires supprimés.


1,Clé supprimée: HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
1,Clé supprimée: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
1,Clé supprimée: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
0,Clé supprimée: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
0,Clé supprimée: HKCU\Software\Ask.com
0,Clé supprimée: HKCU\Software\AppDataLow\AskToolbarInfo
0,Clé supprimée: HKCU\Software\AppDataLow\Software\AskToolbar
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}


============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.9 (fr)] **

-- C:\Users\jc&tayo\AppData\Roaming\Mozilla\FireFox\Profiles\mqynjrz5.default\Prefs.js --
browser.download.lastDir, C:\\Users\\jc&tayo\\Documents
browser.search.selectedEngine, Yahoo
browser.startup.homepage_override.mstone, rv:1.9.2.9

========================================

** Internet Explorer Version [8.0.7600.16385] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\SysWOW64\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 23 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 15/09/2010 (4898 Octet(s))
C:\Ad-Report-SCAN[1].txt - 15/09/2010 (5018 Octet(s))

Fin à: 07:22:16, 15/09/2010

============== E.O.F ==============

Salut,

Voila déjà un peu de ménage.

En attendant la suite ;-)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4618

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15/09/2010 10:57:34
mbam-log-2010-09-15 (10-57-34).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 246034
Temps écoulé: 1 heure(s), 9 minute(s), 45 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\jc&tayo\Downloads\TuneUp.2010.Fr+Keygen\Keymaker-CORE - TuneUp Utilities 2010 v9.0.2020.2 Incl.[BoDiE2003]\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
D:\video\utorrent\TuneUp.2010.Fr+Keygen\Keymaker-CORE - TuneUp Utilities 2010 v9.0.2020.2 Incl.[BoDiE2003]\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

Ok,

Ad-Remover avait fait le travail en profondeur.

Concernant les fichiers mis en quarantaine par Malwarebytes, à toi de voir si tu veux restaurer la quarantaine. Vu la teneur de ces fichiers, je ne peux pas te conseiller...

J'attends donc le rapport ZHPDiag

et voici le dernier rapport
Rapport de ZHPDiag v1.26.63 par Nicolas Coolman, Update du 14/09/2010
Run by jc&tayo at 15/09/2010 11:07:35
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\\ Web Browser
MSIE: Internet Explorer v8.0.7600.16385
MFIE: Mozilla Firefox (3.6.9)

---\\ System Information
Platform : Windows 7 Home Premium (6.1.7600)
Processor: AMD64 Family 16 Model 6 Stepping 2, AuthenticAMD
Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2812 MB (63% free)
System drive C: has 78 GB (66%) free of 117 GB

---\\ Logged in mode
Computer Name: JC-TAYO-PC
User Name: jc&tayo
All Users Names: jc&tayo, HomeGroupUser$, Administrateur,
Unselected Option: O1,O45,O61,O62,O65,O82
Logged in as Administrator

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 78 Go of 117 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 80 Go of 141 Go)
E:\ CD-ROM drive (Not Inserted)


---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableTaskMgr: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableRegistryTools: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] NoDispScrSavPage: OK


---\\ Processus lancés
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408]
[MD5.9ECBFD27FCC8E1D6CDD9D407A12E23F4] - (.NewTech Infosystems, Inc. - Packard Bell MyBackup.) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [262912]
[MD5.5D70631ED11867458E3D69A24C22DC64] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe [1157128]
[MD5.0E7C460A63E43D9A76E91430B50F254C] - (.Suyin - Video Web Camera.) -- C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe [1507448]
[MD5.28FD28A29C637C9AFEFE0A26E27C6DFE] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432]
[MD5.86805548E45DA1668A7035966C64FC3E] - (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe [344736]
[MD5.EC5C9D43D80D56C0C18D6328E536468C] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [554496]


---\\ Pages de recherche de Mozilla Firefox (M1)
M1 - SPR:Search Page Redirection - C:\Program Files (x86)\Mozilla FireFox\extensions\linkfilter@kaspersky.ru


---\\ Programmes d'extension pour Mozilla Firefox (M2)
M2 - MFEP: prefs.js [jc&tayo - mqynjrz5.default\{635abd67-4fe9-1b23-4f01-e679fa7484c1}] [yahoo.ytff] Yahoo! Toolbar 1.5.4.20081105 (.Yahoo!.)
M2 - MFEP: prefs.js [jc&tayo - mqynjrz5.default\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}] [adblockplus] Adblock Plus 1.2.2 (.Wladimir Palant.)


---\\ Plugins de navigateurs Opera/Firefox(P1/P2)
P2 - FPN:Firefox Plugin Navigator . (.mozilla.org - Default Plug-in.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npnul32.dll
P2 - FPN:Firefox Plugin Navigator . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape "9.3.4".) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\nppdf32.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin2.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin3.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin4.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin5.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin6.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npqtplugin7.dll
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.50826.0.) -- C:\Program Files (x86)\Microsoft Silverlight\4.0.50826.0\npctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8081.0709] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=8] - (.Google Inc. - Google Update.) -- C:\Program Files (x86)\Google\Update\1.2.183.13\npGoogleOneClick8.dll


---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe


---\\ Pages de démarrage d'Internet Explorer (R0)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr


---\\ Pages de recherche d'Internet Explorer (R1)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local


---\\ Internet Explorer URLSearchHook (R3)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (8.00.7600.16385 (win7_rtm.090713-1255)) -- C:\Windows\SysWOW64\ieframe.dll


---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} . (.WestByte - IE 4.x-6.x BHO for Internet Download Accele.) -- C:\PROGRA~2\IDA\idaiehlp.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} . (.Kaspersky Lab ZAO - IE Virtual Keyboard.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\ievkbd.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} . (.Google Inc. - Partner application.) -- C:\ProgramData\Partner\Partner.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} . (.Kaspersky Lab ZAO - WebToolBar component.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\klwtbbho.dll


---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: IDA Bar - {C70E30C7-140A-4166-A2E8-43557E62B41A} . (.WestByte Software - IDABar.) -- C:\Program Files (x86)\IDA\idabar.dll


---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [BackupManagerTray] . (.NewTech Infosystems, Inc. - Packard Bell MyBackup.) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
O4 - HKLM\..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [LManager] . (.Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4618

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15/09/2010 10:57:34
mbam-log-2010-09-15 (10-57-34).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 246034
Temps écoulé: 1 heure(s), 9 minute(s), 45 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\jc&tayo\Downloads\TuneUp.2010.Fr+Keygen\Keymaker-CORE - TuneUp Utilities 2010 v9.0.2020.2 Incl.[BoDiE2003]\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
D:\video\utorrent\TuneUp.2010.Fr+Keygen\Keymaker-CORE - TuneUp Utilities 2010 v9.0.2020.2 Incl.[BoDiE2003]\keygen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [VideoWebCamera] . (.Suyin - Video Web Camera.) -- C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe
O4 - HKLM\..\Run: [RemoteControl8] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] . (.CyberLink Corp. - PowerDVD Language Application.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Run: [AVP] . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Internet Download Accelerator] . (.WestByte - Internet Download Accelerator.) -- C:\Program Files (x86)\IDA\ida.exe
O4 - HKLM\..\Wow6432Node\Run: [BackupManagerTray] . (.NewTech Infosystems, Inc. - Packard Bell MyBackup.) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Wow6432Node\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Wow6432Node\Run: [VideoWebCamera] . (.Suyin - Video Web Camera.) -- C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe
O4 - HKLM\..\Wow6432Node\Run: [RemoteControl8] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Wow6432Node\Run: [PDVD8LanguageShortcut] . (.CyberLink Corp. - PowerDVD Language Application.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Wow6432Node\Run: [AVP] . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
O4 - HKLM\..\Wow6432Node\Run: [Malwarebytes Anti-Malware (reboot)] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-2935667259-1908577066-2125779557-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-21-2935667259-1908577066-2125779557-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-2935667259-1908577066-2125779557-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-2935667259-1908577066-2125779557-1000\..\Run: [Internet Download Accelerator] . (.WestByte - Internet Download Accelerator.) -- C:\Program Files (x86)\IDA\ida.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)


---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Download ALL with IDA . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\IDA\idaieall.htm
O8 - Extra context menu item: Download with IDA . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\IDA\idaie.htm
O8 - Extra context menu item: Google Sidewiki... . (.Google Inc. - Google Toolbar for Internet Explorer.) -- C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll


---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\kbrd.ico
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (.Pas de propriétaire - Pas de description.) -- C:\PROGRA~2\MICROS~1\Office12\REFBARH.ICO
O9 - Extra button: &Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} . (.WestByte - Internet Download Accelerator.) -- C:\Program Files (x86)\IDA\ida.exe
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\logo.ico


---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32\napinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files (x86)\Bonjour\mdnsNSP.dll


---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B925DDF-5FBB-4DD4-87FA-1942590BE2E8}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{5B925DDF-5FBB-4DD4-87FA-1942590BE2E8}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{5B925DDF-5FBB-4DD4-87FA-1942590BE2E8}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1


---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.


---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (AMD External Events Utility) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\atiesrxx.exe
O23 - Service: Apple Mobile Device (Apple Mobile Device) . (.Apple Inc. - Apple Mobile Device Service.) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus Service (AVP) . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Acer ePower Service (ePowerSvc) . (.Acer Incorporated - ePowerSvc.) - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
O23 - Service: GRegService (Greg_Service) . (.Acer Incorporated - Global Registration Service.) - C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: NTI IScheduleSvc (NTI IScheduleSvc) . (.NewTech Infosystems, Inc. - Backup Manager Module.) - C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
O23 - Service: Oberon Media Game Console service (OberonGameConsoleService) . (.Pas de propriétaire - OberonGameConsoleService.) - C:\Program Files (x86)\Packard Bell GameZone\GameConsole\OberonGameConsoleService.exe
O23 - Service: C:\Windows\system32\samsrv.dll (SamSs) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\lsass.exe
O23 - Service: C:\Windows\system32\spoolsv.exe (Spooler) . (.Pas de propriétaire - Pas de description.) - C:\Windows\System32\spoolsv.exe
O23 - Service: C:\Windows\system32\sppsvc.exe (sppsvc) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\sppsvc.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) . (.TuneUp Software - TuneUp Utilities Service.) - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
O23 - Service: Updater Service (Updater Service) . (.Acer - Acer Update Service.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe


---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) - (.not file.)


---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job


---\\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Microsoft Windows - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Pas de propriétaire - Pas de description.) -- "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11CF-96B8-444553540000} . (.Adobe Systems, Inc. - Adobe Flash Player 10.0 r32.) -- C:\Windows\SysWow64\Macromed\Flash\Flash10c.ocx


---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (blbdrive) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\blbdrive.sys
O41 - Driver: Pilote de CD-ROM (cdrom) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\drivers\discache.sys
O41 - Driver: kl2 (kl2) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\kl2.sys
O41 - Driver: Kaspersky Lab Driver (KLIF) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\klif.sys
O41 - Driver: Kaspersky Anti-Virus NDIS 6 Filter (KLIM6) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\klim6.sys
O41 - Driver: Microsoft System Management BIOS Driver (mssmbios) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\mssmbios.sys
O41 - Driver: NetBIOS Interface (NetBIOS) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\netbios.sys
O41 - Driver: C:\Windows\system32\drivers\netbt.sys (NetBT) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\netbt.sys
O41 - Driver: C:\Windows\system32\drivers\nsiproxy.sys (nsiproxy) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\drivers\nsiproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\rdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\drivers\rdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\drivers\rdprefmp.sys
O41 - Driver: Terminal Device Driver (TermDD) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: Virtual WiFi Filter Driver (vwififlt) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\vwififlt.sys
O41 - Driver: WFP Lightweight Filter (WfpLwf) . (.Pas de propriétaire - Pas de description.) - C:\Windows\system32\DRIVERS\wfplwf.sys


---\\ Logiciels installés (O42)
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
O42 - Logiciel: AMD USB Filter Driver - (.Advanced Micro Devices, Inc..) [HKLM] -- {82809116-D1EE-443C-AE31-F19E709DDF7A}
O42 - Logiciel: Acrobat.com - (.Adobe Systems Incorporated.) [HKLM] -- {287ECFA4-719A-2143-A09B-D6A12DE54E40}
O42 - Logiciel: Adobe AIR - (.Adobe Systems Inc..) [HKLM] -- Adobe AIR
O42 - Logiciel: Adobe AIR - (.Adobe Systems Inc..) [HKLM] -- {A2BCA9F1-566C-4805-97D1-7FDC93386723}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Photoshop Elements 7.0 - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Photoshop Elements 7
O42 - Logiciel: Adobe Photoshop Elements 7.0 - (.Adobe Systems Incorporated.) [HKLM] -- {5511C07D-A83C-45AD-92B6-42DF99729A3C}
O42 - Logiciel: Adobe Photoshop Elements 7.0 - (.Adobe Systems Incorporated.) [HKLM] -- {CB6075D9-F912-40AE-BEA6-E590DA24F16B}
O42 - Logiciel: Adobe Reader 9.3.4 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A93000000001}
O42 - Logiciel: Advertising Center - (.Nero AG.) [HKLM] -- {b2ec4a38-b545-4a00-8214-13fe0e915e6d}
O42 - Logiciel: Alice Greenfingers - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}
O42 - Logiciel: Amazonia - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM] -- {DAEAFD68-BB4A-4507-A241-C8804D2EA66D}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM] -- {C41300B9-185D-475E-BFEC-39EF732F19B1}
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
O42 - Logiciel: Backup Manager Basic - (.NewTech Infosystems.) [HKLM] -- {72B776E5-4530-4C4B-9453-751DF87D9D93}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: Catalyst Control Center - Branding - (.ATI.) [HKLM] -- {8B999A44-8314-493B-877E-A1DA5B54D9B8}
O42 - Logiciel: Chicken Invaders 2 - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}
O42 - Logiciel: CyberLink PowerDVD 8 - (.CyberLink Corp..) [HKLM] -- InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}
O42 - Logiciel: CyberLink PowerDVD 8 - (.CyberLink Corp..) [HKLM] -- {2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}
O42 - Logiciel: Dairy Dash - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}
O42 - Logiciel: Dream Day First Home - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}
O42 - Logiciel: Farm Frenzy 2 - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}
O42 - Logiciel: First Class Flurry - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {B131E59D-202C-43C6-84C9-68F0C37541F1}
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {18455581-E099-4BA8-BC6B-F34B2F06600C}
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Granny In Paradise - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}
O42 - Logiciel: Heroes of Hellas - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}
O42 - Logiciel: Identity Card - (.Packard Bell.) [HKLM] -- Identity Card
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {46ABBC54-1872-4AA3-95E2-F2C063A63F31}
O42 - Logiciel: Internet Download Accelerator version 5.6 - (.WestByte.) [HKLM] -- Internet Download Accelerator_is1
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {E2DFE069-083E-4631-9B6C-43C48E991DE5}
O42 - Logiciel: Kaspersky Anti-Virus 2011 - (.Kaspersky Lab.) [HKLM] -- InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}
O42 - Logiciel: Kaspersky Anti-Virus 2011 - (.Kaspersky Lab.) [HKLM] -- {66F1F013-008F-4875-B283-5A814B820347}
O42 - Logiciel: Launch Manager - (.Packard Bell.) [HKLM] -- LManager
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Merriam Websters Spell Jam - (.Oberon Media.) [HKLM] -- {82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}
O42 - Logiciel: Metaboli - (.Packard Bell.) [HKLM] -- Metaboli
O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0015-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0016-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0018-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0019-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001A-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001B-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-002A-040C-1000-0000000FF1CE}_OMUI.fr-fr_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0044-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-006E-040C-0000-0000000FF1CE}_OMUI.fr-fr_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-00A1-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-00BA-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0100-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0101-040C-0000-0000000FF1CE}_OMUI.fr-fr_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office Access MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0015-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Excel MUI (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0016-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Excel MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0016-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Groove MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-00BA-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Home and Student 2007 - (.Microsoft Corporation.) [HKLM] -- HOMESTUDENTR
O42 - Logiciel: Microsoft Office Home and Student 2007 - (.Microsoft Corporation.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office InfoPath MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0044-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Language Pack 2007 - French/Français - (.Microsoft Corporation.) [HKLM] -- OMUI.fr-fr
O42 - Logiciel: Microsoft Office O MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0100-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office OneNote MUI (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-00A1-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office OneNote MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-00A1-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Outlook MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001A-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office PowerPoint MUI (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0018-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office PowerPoint MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0018-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office PowerPoint Viewer 2007 (French) - (.Microsoft Corporation.) [HKLM] -- {95120000-00AF-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Arabic) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0401-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Dutch) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0413-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (German) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0407-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Spanish) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0C0A-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-002C-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-002C-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0401-0000-0000000FF1CE}_OMUI.fr-fr_{14809F99-C601-4D4A-9391-F1E8FAA964C5}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0407-0000-0000000FF1CE}_OMUI.fr-fr_{A0516415-ED61-419A-981D-93596DA74165}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0413-0000-0000000FF1CE}_OMUI.fr-fr_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
O42 - Logiciel: Microsoft Office Publisher MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0019-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0017-040C-0000-0000000FF1CE}_OMUI.fr-fr_{CCDA3DD6-E33D-4D75-B7C9-FF585580CE83}
O42 - Logiciel: Microsoft Office SharePoint Designer MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0017-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Shared MUI (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-006E-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Shared MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-006E-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Shared Setup Metadata MUI (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0115-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Suite Activation Assistant - (.Microsoft Corporation.) [HKLM] -- {E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}
O42 - Logiciel: Microsoft Office Word MUI (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001B-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Word MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001B-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office X MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0101-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {837b34e3-7c30-493c-8f6a-2b0f04e2912c}
O42 - Logiciel: Microsoft Works - (.Microsoft Corporation.) [HKLM] -- {0214A441-A4AB-43A8-8DEF-2F73C5364673}
O42 - Logiciel: Module de compatibilité pour Microsoft Office System 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0020-040C-0000-0000000FF1CE}
O42 - Logiciel: Mozilla Firefox (3.6.9) - (.Mozilla.) [HKLM] -- Mozilla Firefox (3.6.9)
O42 - Logiciel: Nero 9 Essentials - (.Nero AG.) [HKLM] -- {5d3f2e4c-cf1a-4558-b6ea-039aafb15a10}
O42 - Logiciel: Nero ControlCenter - (.Nero AG.) [HKLM] -- {bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}
O42 - Logiciel: Nero ControlCenter - (.Nero AG.) [HKLM] -- {f4041dce-3fe1-4e18-8a9e-9de65231ee36}
O42 - Logiciel: Nero DiscSpeed - (.Nero AG.) [HKLM] -- {869200db-287a-4dc0-b02b-2b6787fbcd4c}
O42 - Logiciel: Nero DiscSpeed Help - (.Nero AG.) [HKLM] -- {cc019e3f-59d2-4486-8d4b-878105b62a71}
O42 - Logiciel: Nero DriveSpeed - (.Nero AG.) [HKLM] -- {33cf58f5-48d8-4575-83d6-96f574e4d83a}
O42 - Logiciel: Nero DriveSpeed Help - (.Nero AG.) [HKLM] -- {e5c7d048-f9b4-4219-b323-8bdb01a2563d}
O42 - Logiciel: Nero Express Help - (.Nero AG.) [HKLM] -- {83202942-84b3-4c50-8622-b8c0aa2d2885}
O42 - Logiciel: Nero InfoTool - (.Nero AG.) [HKLM] -- {fbcdfd61-7dcf-4e71-9226-873ba0053139}
O42 - Logiciel: Nero InfoTool Help - (.Nero AG.) [HKLM] -- {20400dbd-e6db-45b8-9b6b-1dd7033818ec}
O42 - Logiciel: Nero Installer - (.Nero AG.) [HKLM] -- {e8a80433-302b-4ff1-815d-fcc8eac482ff}
O42 - Logiciel: Nero Online Upgrade - (.Nero AG.) [HKLM] -- {dba84796-8503-4ff0-af57-1747dd9a166d}
O42 - Logiciel: Nero StartSmart - (.Nero AG.) [HKLM] -- {7748ac8c-18e3-43bb-959b-088faea16fb2}
O42 - Logiciel: Nero StartSmart Help - (.Nero AG.) [HKLM] -- {2348b586-c9ae-46ce-936c-a68e9426e214}
O42 - Logiciel: Nero StartSmart OEM - (.Nero AG.) [HKLM] -- {4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}
O42 - Logiciel: NeroExpress - (.Nero AG.) [HKLM] -- {595a3116-40bb-4e0f-a2e8-d7951da56270}
O42 - Logiciel: Norton Online Backup - (.Symantec.) [HKLM] -- {C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}
O42 - Logiciel: Outil de téléchargement Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}
O42 - Logiciel: Packard Bell GameZone Console - (.Oberon Media, Inc..) [HKLM] -- {117E3AE2-10D1-41C1-9FA6-F4C382F767A8}_is1
O42 - Logiciel: Packard Bell InfoCentre - (.Packard Bell.) [HKLM] -- Packard Bell InfoCentre
O42 - Logiciel: Packard Bell MyBackup - (.NewTech Infosystems.) [HKLM] -- InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}
O42 - Logiciel: Packard Bell Power Management - (.Packard Bell.) [HKLM] -- {3DB0448D-AD82-4923-B305-D001E521A964}
O42 - Logiciel: Packard Bell Recovery Management - (.Packard Bell.) [HKLM] -- {7F811A54-5A09-4579-90E1-C93498E230D9}
O42 - Logiciel: Packard Bell Registration - (.Packard Bell.) [HKLM] -- Packard Bell Registration
O42 - Logiciel: Packard Bell ScreenSaver - (.Packard Bell Incorporated.) [HKLM] -- Packard Bell Screensaver
O42 - Logiciel: Packard Bell Updater - (.Packard Bell.) [HKLM] -- {EE171732-BEB4-4576-887D-CB62727F01CA}
O42 - Logiciel: QuickTime - (.Apple Inc..) [HKLM] -- {EB900AF8-CC61-4E15-871B-98D1EA3E8025}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: Realtek USB 2.0 Card Reader - (.Realtek Semiconductor Corp..) [HKLM] -- {96AE7E41-E34E-47D0-AC07-1091A8127911}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2277947) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{5857EE21-03D0-482E-9620-5A30B314A2AE}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB969559) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB976321) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7F207DCA-3399-40CB-A968-6E5991B1421A}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB982312) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{B0EC5722-241F-4CDA-83B4-AA5846B6F9F4}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB982331) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E8766951-2B6C-4022-86E8-80D2D1762B76}
O42 - Logiciel: Security Update for Microsoft Office Excel 2007 (KB982308) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C3F9A0DC-A5D1-4BB6-870E-2953E5A2487B}
O42 - Logiciel: Security Update for Microsoft Office InfoPath 2007 (KB979441) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
O42 - Logiciel: Security Update for Microsoft Office PowerPoint 2007 (KB982158) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{F5B70033-E79C-4569-90BF-BC9B4E4F3F46}
O42 - Logiciel: Security Update for Microsoft Office Visio Viewer 2007 (KB973709) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
O42 - Logiciel: Security Update for Microsoft Office Word 2007 (KB2251419) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7E9103DA-253F-41FF-9E83-7C83806C77DA}
O42 - Logiciel: Security Update for Microsoft Office system 2007 (972581) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}
O42 - Logiciel: Security Update for Microsoft Office system 2007 (KB974234) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{FCD742B9-7A55-44BC-A776-F795F21FEDDC}
O42 - Logiciel: TuneUp Utilities - (.TuneUp Software.) [HKLM] -- TuneUp Utilities
O42 - Logiciel: Update for 2007 Microsoft Office System (KB967642) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
O42 - Logiciel: Update for Microsoft Office 2007 Help for Common Features (KB963673) - (.Microsoft.) [HKLM] -- {90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}
O42 - Logiciel: Update for Microsoft Office Excel 2007 Help (KB963678) - (.Microsoft.) [HKLM] -- {90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}
O42 - Logiciel: Update for Microsoft Office OneNote 2007 (KB980729) - (.Microsoft.) [HKLM] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{329050A9-EF80-40F9-B633-74508F54C1FF}
O42 - Logiciel: Update for Microsoft Office OneNote 2007 Help (KB963670) - (.Microsoft.) [HKLM] -- {90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}
O42 - Logiciel: Update for Microsoft Office Powerpoint 2007 Help (KB963669) - (.Microsoft.) [HKLM] -- {90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}
O42 - Logiciel: Update for Microsoft Office Script Editor Help (KB963671) - (.Microsoft.) [HKLM] -- {90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
O42 - Logiciel: Update for Microsoft Office Word 2007 Help (KB963665) - (.Microsoft.) [HKLM] -- {90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}
O42 - Logiciel: VLC media player 1.1.4 - (.VideoLAN.) [HKLM] -- VLC media player
O42 - Logiciel: Video Web Camera - (.SuYin.) [HKLM] -- {6D9021DC-CF1B-4148-8C80-6D8E8A8A33EB}
O42 - Logiciel: Welcome Center - (.Packard Bell.) [HKLM] -- Packard Bell Welcome Center
O42 - Logiciel: WinRAR archiver - (.Pas de propriétaire.) [HKLM] -- WinRAR archiver
O42 - Logiciel: WinSCP 4.2.8 - (.Martin Prikryl.) [HKLM] -- winscp3_is1
O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3B4E636E-9D65-4D67-BA61-189800823F52}
O42 - Logiciel: Windows Live FolderShare - (.Microsoft Corporation.) [HKLM] -- {2075CB0A-D26F-4DAA-B424-5079296B43BA}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {5DD76286-9BE7-4894-A990-E905E91AC818}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {770F1BEC-2871-4E70-B837-FB8525FFA3B1}
O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {53B20C18-D8D4-4588-8737-9BBFE303C354}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {4634B21A-CC07-4396-890C-2B8168661FEA}
O42 - Logiciel: eBay Worldwide - (.OEM.) [HKLM] -- {E0B19DF7-B1C7-4937-82C4-0E4B1E346965}
O42 - Logiciel: eMule - (.Pas de propriétaire.) [HKLM] -- eMule
O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}
O42 - Logiciel: µTorrent - (.Pas de propriétaire.) [HKLM] -- uTorrent

---\\ HKCU & HKLM Software Keys
[HKCU\Software\2vg]
[HKCU\Software\ATI]
[HKCU\Software\Acer]
[HKCU\Software\Ad-Remover]
[HKCU\Software\Adobe]
[HKCU\Software\Altaruine]
[HKCU\Software\AppDataLow\Software\Google]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\Apple Computer, Inc.]
[HKCU\Software\Apple Inc.]
[HKCU\Software\BitTorrent]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\Compal]
[HKCU\Software\Cyberlink]
[HKCU\Software\EldoS]
[HKCU\Software\Google]
[HKCU\Software\IM Providers]
[HKCU\Software\KasperskyLab]
[HKCU\Software\Lake]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\Martin Prikryl]
[HKCU\Software\Netscape]
[HKCU\Software\Norton]
[HKCU\Software\OEM]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\Suyin]
[HKCU\Software\Synaptics]
[HKCU\Software\TuneUp]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Wow6432Node]
[HKCU\Software\eMule]
[HKCU\Software\toolband]
[HKLM\Software\ATI Technologies]
[HKLM\Software\ATI]
[HKLM\Software\Adobe]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\Audible]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Compal]
[HKLM\Software\CyberLink]
[HKLM\Software\Digital River]
[HKLM\Software\Google]
[HKLM\Software\Intel]
[HKLM\Software\KasperskyLab]
[HKLM\Software\Lake]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\Martin Prikryl]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\Nero]
[HKLM\Software\NewTech Infosystems]
[HKLM\Software\ODBC]
[HKLM\Software\OEM]
[HKLM\Software\Oberon Media]
[HKLM\Software\Packard Bell]
[HKLM\Software\Policies]
[HKLM\Software\Realtek Semiconductor Corp.]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\Sonic]
[HKLM\Software\SuYin]
[HKLM\Software\SymNRT]
[HKLM\Software\Symantec]
[HKLM\Software\TuneUp]
[HKLM\Software\VideoLAN]
[HKLM\Software\WinRAR]
[HKLM\Software\Yahoo]
[HKLM\Software\mozilla.org]


---\\ Contenu des dossiers ProgramFiles/ProgramData (O43)
O43 - CFD:Common File Directory ----D- C:\Program Files\ATI
O43 - CFD:Common File Directory ----D- C:\Program Files\Bonjour
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files
O43 - CFD:Common File Directory ----D- C:\Program Files\DIFX
O43 - CFD:Common File Directory ----D- C:\Program Files\DVD Maker
O43 - CFD:Common File Directory -SH-D- C:\Program Files\Fichiers communs
O43 - CFD:Common File Directory ----D- C:\Program Files\Google
O43 - CFD:Common File Directory ----D- C:\Program Files\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files\iPod
O43 - CFD:Common File Directory ----D- C:\Program Files\iTunes
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Games
O43 - CFD:Common File Directory ----D- C:\Program Files\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files\Packard Bell
O43 - CFD:Common File Directory ----D- C:\Program Files\PB Accessory Store
O43 - CFD:Common File Directory ----D- C:\Program Files\Realtek
O43 - CFD:Common File Directory ----D- C:\Program Files\Reference Assemblies
O43 - CFD:Common File Directory ----D- C:\Program Files\Synaptics
O43 - CFD:Common File Directory --H-D- C:\Program Files\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Defender
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Journal
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Mail
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows NT
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Portable Devices
O43 - CFD:Common File Directory ----D- C:\Program Files\Windows Sidebar
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Apple
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Services
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\System
O43 - CFD:Common File Directory ----D- C:\ProgramData\Adobe
O43 - CFD:Common File Directory ----D- C:\ProgramData\Apple
O43 - CFD:Common File Directory ----D- C:\ProgramData\Apple Computer
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Application Data
O43 - CFD:Common File Directory ----D- C:\ProgramData\ATI
O43 - CFD:Common File Directory ----D- C:\ProgramData\BackupManager
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Bureau
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Desktop
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Documents
O43 - CFD:Common File Directory ----D- C:\ProgramData\eMule
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Favoris
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Favorites
O43 - CFD:Common File Directory ----D- C:\ProgramData\Google
O43 - CFD:Common File Directory ----D- C:\ProgramData\Kaspersky Lab
O43 - CFD:Common File Directory ----D- C:\ProgramData\Kaspersky Lab Setup Files
O43 - CFD:Common File Directory ----D- C:\ProgramData\Malwarebytes
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Menu Démarrer
O43 - CFD:Common File Directory -S--D- C:\ProgramData\Microsoft
O43 - CFD:Common File Directory ----D- C:\ProgramData\Microsoft Help
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Modèles
O43 - CFD:Common File Directory ----D- C:\ProgramData\Nero
O43 - CFD:Common File Directory ----D- C:\ProgramData\Norton
O43 - CFD:Common File Directory ----D- C:\ProgramData\NortonInstaller
O43 - CFD:Common File Directory ----D- C:\ProgramData\OEM
O43 - CFD:Common File Directory ----D- C:\ProgramData\Packard Bell
O43 - CFD:Common File Directory ----D- C:\ProgramData\Partner
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Start Menu
O43 - CFD:Common File Directory ----D- C:\ProgramData\Temp
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\Templates
O43 - CFD:Common File Directory ----D- C:\ProgramData\TuneUp Software
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Apple
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\Services
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD:Common File Directory ----D- C:\Program Files\Common Files\System
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Ad-Remover
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\AMD
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Apple Software Update
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\ATI Technologies
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Bonjour
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\CCleaner
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Common Files
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\CyberLink
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\eMule
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Google
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\IDA
O43 - CFD:Common File Directory --H-D- C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Internet Explorer
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\iTunes
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Kaspersky Lab
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Launch Manager
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Malwarebytes' Anti-Malware
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft Office
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft Office Suite Activation Assistant
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft Silverlight
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft Visual Studio 8
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft Works
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Microsoft.NET
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Mozilla Firefox
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\MSBuild
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\MSXML 4.0
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Nero
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\NewTech Infosystems
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\OEM
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Packard Bell
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Packard Bell GameZone
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\QuickTime
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Realtek
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Reference Assemblies
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Symantec
O43 - CFD:Common File Directory --H-D- C:\Program Files (x86)\Temp
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\TuneUp Utilities 2010
O43 - CFD:Common File Directory --H-D- C:\Program Files (x86)\Uninstall Information
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\uTorrent
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\VideoLAN
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\VideoWebCamera
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Defender
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Live
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Live SkyDrive
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Mail
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Media Player
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows NT
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Portable Devices
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Windows Sidebar
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\WinRAR
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\WinSCP
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\ZHPDiag
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Common Files\Adobe
O43 - CFD:Common File Directory ----D- C:\Program Files (x86)\Common Files\Ado

après avoir lancer mbr.exe j'obtien ceci
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

Rapport de ZHPFix v1.12.3151 par Nicolas Coolman, Update du 14/09/2010
Fichier d'export Registre :
Run by jc&tayo at 15/09/2010 13:31:15
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} . (.Google Inc. - Partner application.) -- C:\ProgramData\Partner\Partner.dll => Clé supprimée avec succès
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}] => Clé supprimée avec succès
[HKCR\CLSID\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}] => Clé supprimée avec succès

========== Fichier(s) ==========
c:\programdata\partner\partner.dll => Fichier supprimé au reboot


========== Récapitulatif ==========
3 : Clé(s) du Registre
1 : Fichier(s)


End of the scan

voila alors pour mon problème de lenteur sa dois faire une quinzaine de jours mais j'ai observer que mon processeur tourner a 100% a chaque fois que sa bloqué

http://www.cijoint.fr/cjlink.php?file=cj201009/cij7hMxbRB.txt

MD5 : c75a3a99ecabbc0eacae46188466e513
SHA1 : 8c398e8c98525077e1c28013a1c3b9c44f825123
SHA256: 4e2cab0dc0caca037c8c08c116cfa03fdf08e085778e383bc50403831c17805e
ssdeep: 768:HEHFCb+tWBliB6JkL1bJVdnztT1YoMQpIWLkbCsn4:H8Fi+IKB9bVd84cCs4
File size : 34624 bytes
First seen: 2010-09-15 12:20:27
Last seen : 2010-09-15 12:20:27
Magic: PE32+ executable for MS Windows (native) Mono/.Net assembly
TrID:
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: TuneUp Software
copyright....: Copyright (c) 2003-2010 TuneUp Software GmbH
product......: TuneUp Utilities
description..: TuneUp Registry Optimization Boot Application
original name: n/a
internal name: n/a
file version.: 9.0.4600.5
comments.....: TuneUp Registry Optimization Boot Application
signers......: TuneUp Software
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 3:15 PM 8/27/2010
verified.....: -
PEiD: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x3468
timedatestamp....: 0x4C77BA87 (Fri Aug 27 13:15:51 2010)
machinetype......: 0x8664

[[ 5 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x4E24, 0x5000, 6.0, e97f346e28064e90cd93c220b833c12f
.data, 0x6000, 0x81C, 0x200, 0.4, ae2f0f42c0aad71caf8744c88e203ca0
.pdata, 0x7000, 0x2DC, 0x400, 3.22, 72f838f2632930cd2bd2b21503eae24d
.rsrc, 0x8000, 0x1408, 0x1600, 3.17, a6a594ef12bc56fc454c4c5ca2af4532
.reloc, 0xA000, 0x90, 0x200, 0.84, 3a9a161d8945af1efb9172e6a0882fd2

[[ 1 import(s) ]]
ntdll.dll: NtQueryKey, NtEnumerateValueKey, NtEnumerateKey, NtQuerySystemTime, memmove, NtOpenKey, NtSaveKey, NtTerminateProcess, NtUnloadKey, RtlInitUnicodeString, NtDeleteValueKey, NtShutdownSystem, NtLoadKey, NtQueryInformationFile, NtWaitForSingleObject, RtlFreeUnicodeString, wcsstr, NtCreateFile, NtClose, RtlAdjustPrivilege, NtDeleteFile, NtFlushBuffersFile, NtReplaceKey, NtQueryValueKey, NtSetValueKey, NtDeleteKey, NtInitializeRegistry, NtOpenFile, NtWriteFile, _vsnwprintf, RtlTimeToTimeFields, wcschr, RtlInitAnsiString, RtlUnicodeStringToOemString, RtlFindMessage, NtDisplayString, RtlOemStringToUnicodeString, RtlFreeOemString, NtQueryDefaultUILanguage, NtTerminateThread, NtQueryInformationThread, NtAlertThread, NtDelayExecution, NtCreateEvent, RtlCreateUserThread, RtlCreateHeap, RtlFreeHeap, RtlDestroyHeap, RtlAllocateHeap, towupper, RtlEqualUnicodeString, RtlNormalizeProcessParams, RtlUnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, memset, __C_specific_handler

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

MD5 : c9b83fc8fe5f38583ed7551410cd681e
SHA1 : efecff2349a1c433852002344f6d9491eff8744b
SHA256: 8bf979ccb79e737c7f7d3b4e57af5a5c02441eaad26a52a52b1c7b445df6c5ca
ssdeep: 384:WIbnN5m0xHDh40FH8yx12ZBzs6w0oyj3LotewoBVJwhOxes0T/oYYJLO5bCw1bO6:5N5Dpr
WfmyjBmuKT/ELkbCsbr
File size : 25920 bytes
First seen: 2010-09-15 12:27:40
Last seen : 2010-09-15 12:27:40
TrID:
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: TuneUp Software
copyright....: Copyright (c) 2003-2010 TuneUp Software GmbH
product......: TuneUp Utilities
description..: TuneUp WinLogon Extension
original name: n/a
internal name: n/a
file version.: 9.0.4600.5
comments.....: n/a
signers......: TuneUp Software
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 3:10 PM 8/27/2010
verified.....: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x11B0
timedatestamp....: 0x4C77B961 (Fri Aug 27 13:10:57 2010)
machinetype......: 0x8664 (AMD64)

[[ 6 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x2B8B, 0x2C00, 5.90, f0eb812de1e4787a7126a6237b4af2d9
.rdata, 0x4000, 0x1219, 0x1400, 4.24, 2f8cbc3d6c7f2ce5d807d1c4b1dad349
.data, 0x6000, 0x70, 0x200, 0.27, 56b241b53cec0d3779f8b5fec93d2bc0
.pdata, 0x7000, 0x2B8, 0x400, 3.00, 0a96037bbfe4eb8bd6ab750b9046af97
.rsrc, 0x8000, 0x358, 0x400, 2.88, df2b6229465e318f55fe3627aae1cdf3
.reloc, 0x9000, 0x24, 0x200, 0.13, 6836b60e2f58ad3ce953e6bbea7e6dc6

[[ 5 import(s) ]]
dbghelp.dll: ImageDirectoryEntryToData
SHLWAPI.dll: -, -, SHRegGetValueW
KERNEL32.dll: ExpandEnvironmentStringsW, VirtualQuery, SetFileAttributesW, LoadResource, LoadLibraryExW, IsBadReadPtr, SizeofResource, FlushInstructionCache, VirtualProtect, LocalFree, DeleteFileW, CloseHandle, lstrcmpiW, LocalAlloc, FindClose, GetLastError, GetModuleFileNameW, CopyFileW, GetSystemDirectoryW, GetCurrentThread, GetModuleHandleExW, GetCurrentProcess, MoveFileExW, FindFirstFileW, GetTempFileNameW, DisableThreadLibraryCalls, GetProcAddress, SetLastError, LoadLibraryW, FreeLibrary, FindResourceW
USER32.dll: GetSystemMetrics
ADVAPI32.dll: GetSecurityDescriptorDacl, RegSetValueExW, AdjustTokenPrivileges, RegEnumKeyExW, GetLengthSid, SetEntriesInAclW, GetSecurityDescriptorOwner, SetSecurityDescriptorOwner, AllocateAndInitializeSid, RegDeleteValueW, RegGetKeySecurity, ImpersonateSelf, LookupPrivilegeValueW, SetSecurityDescriptorDacl, RegDeleteKeyW, InitializeSecurityDescriptor, RegCreateKeyExW, AccessCheck, MapGenericMask, OpenThreadToken, OpenProcessToken, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, FreeSid, RegSetKeySecurity, RevertToSelf

[[ 4 export(s) ]]
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

MD5 : 69c23e4661787bb83355bf1e63179d63
SHA1 : c972b7d3e85089d740d6a89250ee9fce9f54fd80
SHA256: 32eb73cb51f27d2d48e22fe4b6cb49b3b86d1d4a121c464eb2d12cab1f62d66d
ssdeep: 384:VjosuMbNTVTmExYFO82xGjn/kYJLO5bCw1c:GsuOhEb2kjn/JLkbCsc
File size : 21312 bytes
First seen: 2010-09-05 09:18:02
Last seen : 2010-09-15 12:35:25
TrID:
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
sigcheck:
publisher....: TuneUp Software
copyright....: Copyright (c) 2003-2010 TuneUp Software GmbH
product......: TuneUp Utilities
description..: TuneUp WinLogon Extension
original name: n/a
internal name: n/a
file version.: 9.0.4600.5
comments.....: n/a
signers......: TuneUp Software
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 3:10 PM 8/27/2010
verified.....: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x11B0
timedatestamp....: 0x4C77B95D (Fri Aug 27 13:10:53 2010)
machinetype......: 0x14c (I386)

[[ 5 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x2067, 0x2200, 6.04, 94b39727c3fd827e6b4e14d0447aeb38
.rdata, 0x4000, 0xCAA, 0xE00, 4.49, 51aca71459e657d29d922e6a82f5d22c
.data, 0x5000, 0x3C, 0x200, 0.20, 56fff7d98a83378eeb46e40cfa6a915c
.rsrc, 0x6000, 0x358, 0x400, 2.88, 91411544f583e11dfd71b58d614b64c0
.reloc, 0x7000, 0x34A, 0x400, 5.08, b5d165d5bdaed67e6bcb2ac8c02af5a4

[[ 5 import(s) ]]
dbghelp.dll: ImageDirectoryEntryToData
SHLWAPI.dll: -, -, SHRegGetValueW
KERNEL32.dll: CopyFileW, VirtualQuery, FindResourceW, SetFileAttributesW, LoadResource, FlushInstructionCache, VirtualProtect, IsBadReadPtr, LoadLibraryExW, InterlockedDecrement, InterlockedIncrement, DeleteFileW, GetSystemDirectoryW, GetTempFileNameW, MoveFileExW, ExpandEnvironmentStringsW, GetModuleHandleExW, GetLastError, GetModuleFileNameW, GetCurrentThread, LocalAlloc, LocalFree, GetCurrentProcess, CloseHandle, FindFirstFileW, FindClose, lstrcmpiW, SetLastError, DisableThreadLibraryCalls, LoadLibraryW, GetProcAddress, FreeLibrary, SizeofResource
USER32.dll: GetSystemMetrics
ADVAPI32.dll: RegCreateKeyExW, RegDeleteValueW, RegSetValueExW, AllocateAndInitializeSid, GetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, RegSetKeySecurity, GetSecurityDescriptorOwner, GetLengthSid, ImpersonateSelf, OpenThreadToken, MapGenericMask, AccessCheck, RevertToSelf, RegGetKeySecurity, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, SetSecurityDescriptorDacl, SetEntriesInAclW, FreeSid

[[ 4 export(s) ]]
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

Additional information
Show all
MD5 : 22cc85000a9f558447d2a8470a7168ec
SHA1 : 1236a4a338ccc7e8f89e70f60fee200f529b8a76
SHA256: 698a90ddd5d08079c6e763224cabaf8a7532067f11000a518c74756bf94bb288
ssdeep: 768:FemksCLrJSNCvG/5RQubIe3AFbyT9EpgoTB9LkbCs4:Femks2wBBy7eEyqgGB9cCs4
File size : 36160 bytes
First seen: 2010-09-15 12:37:31
Last seen : 2010-09-15 12:37:31
TrID:
Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: TuneUp Software
copyright....: Copyright (c) 2003-2010 TuneUp Software GmbH
product......: TuneUp Utilities
description..: TuneUp Theme Extension
original name: n/a
internal name: n/a
file version.: 9.0.4600.5
comments.....: n/a
signers......: TuneUp Software
VeriSign Class 3 Code Signing 2009-2 CA
Class 3 Public Primary Certification Authority
signing date.: 3:10 PM 8/27/2010
verified.....: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x1A50
timedatestamp....: 0x4C77B959 (Fri Aug 27 13:10:49 2010)
machinetype......: 0x8664 (AMD64)

[[ 6 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x41DE, 0x4200, 6.03, 3416ff0fa223df6ab8eddf80825cfe87
.rdata, 0x6000, 0x1DD7, 0x1E00, 4.51, caf990645b5027d2e0cd63701d2e4940
.data, 0x8000, 0x21F8, 0x200, 0.80, a8f4b678d32c6d47e986d01ba2d921ff
.pdata, 0xB000, 0x480, 0x600, 3.43, 0430a6f2f4f867c71f52e3909a5672af
.rsrc, 0xC000, 0x820, 0xA00, 2.73, 99d612f2e6ed7740f446a0bf33b4bf1b
.reloc, 0xD000, 0xA0, 0x200, 0.72, f28b41dfd6631802b013ad14bad72c5c

[[ 5 import(s) ]]
dbghelp.dll: ImageDirectoryEntryToData
ntdll.dll: RtlNtStatusToDosError, RtlCreateUserThread, NtQueueApcThread
KERNEL32.dll: LoadLibraryW, ReadFile, FlushInstructionCache, GetFileSizeEx, GetProcAddress, VirtualProtect, FreeLibrary, LoadLibraryExW, WaitForSingleObject, SetEvent, GetTickCount, CreateRemoteThread, OpenProcess, VirtualFreeEx, SetFilePointerEx, Sleep, FormatMessageW, ExitThread, lstrlenW, FreeLibraryAndExitThread, lstrcmpiA, VirtualAllocEx, Process32FirstW, ProcessIdToSessionId, IsWow64Process, CreateEventW, Module32FirstW, Process32NextW, CreateToolhelp32Snapshot, Module32NextW, GetCurrentProcessId, WriteProcessMemory, ResumeThread, GetCurrentProcess, lstrcmpA, CloseHandle, ReleaseMutex, DisableThreadLibraryCalls, SetLastError, OpenMutexW, SearchPathW, ExpandEnvironmentStringsW, SetFileAttributesW, LocalFree, DeleteFileW, lstrcmpiW, LocalAlloc, FindClose, GetLastError, GetModuleFileNameW, GetVersionExW, CopyFileW, GetSystemDirectoryW, GetModuleHandleExW, MoveFileExW, FindFirstFileW, CreateMutexW, GetTempFileNameW, TerminateThread
USER32.dll: LoadStringW, MessageBoxW, GetSystemMetrics
ADVAPI32.dll: AdjustTokenPrivileges, ControlService, QueryServiceStatusEx, SetServiceStatus, ChangeServiceConfigW, RegisterServiceCtrlHandlerExW, OpenServiceW, OpenSCManagerW, DeleteService, OpenProcessToken, CloseServiceHandle, CreateServiceW, CryptVerifySignatureW, RegSetValueExW, RegCloseKey, RegEnumKeyExW, RegOpenKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, CheckTokenMembership, FreeSid, SetEntriesInAclW, AllocateAndInitializeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, LookupPrivilegeValueW, ChangeServiceConfig2W, StartServiceW, QueryServiceStatus, RegQueryValueExW

[[ 6 export(s) ]]
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, ServiceMain, ServiceRunCmd

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

Bonjour,

En complément à mon message ci-dessus :

Vu la modification ou l'installation d'extensions sur TuneUp le 27.08, je me demande s'il n'y aurait pas une certaine incompatibilité entre TuneUp ou certains de ses composants et Windows 7 64 bits.

Regarde sur le lien suivant, il n'est pas proposé au téléchargement pour Windows 7 64 bits et il y a un avis intéressant d'un internaute que je recopie ci-après :

https://www.clubic.com/telecharger-fiche14995-tuneup-utilities.html

"Un bug récent - version 9.0.4400.17
La nouvelle mise à jour 9.0.4500.28 affole le Centre de Maintenance sur windows 7 64 bits. Le module TuneUpUtilitiesService64.exe version 9.0.4500.28 provoque une erreur entraînant l'arrêt de tuneup, même sans lancer le logiciel ; et la mêmme erreur se répète 8 fois en 6 heures, d'où fichier d'erreur de plus de 6 Mo, provoquant un ralentissement ... abherrant pour un logiciel censé accélerer le système !
Absence de réponse du Service Technique en vacances !! "

@+

salut j'ai fait un teste de connexion j'ai obtenu les résultats suivant
débit en réception: 21.84 Mbps
débit en émission 842 Kbps
ping 55
en ce qui concerne TuneUp utility je vais surement l'effacer si c'est sa qui fait ralentir mon pc

Le débit en réception est très correct.

Je pense aussi que c'est TuneUp Utilities qui ralenti ton PC d'autant que la date correspond avec le début des problèmes.

Quand tu l'auras désinstallé si tout revient à la normale on pourra finaliser et nettoyer les outils qui ont servi à supprimer l'infection et purger la restauration système.

Je te donnerais la procédure.

@+

j'ai désinstaller tuneup sa va déja mieux peu tu me donner la procedure pour nettoyer comme tu me la dit plus haut merci

ayez tout est fait merci encore pour ton aide