page s ouvre a l infini Résolu/Fermé

Question

Bonjour, 
depuis hier quand j ouvre une page du style, ajout suppression, mes documents ... la page s ouvre a l infini et plus moyen de l arreter.

je suis obligé d eteindre le pc pour que ça s arrete!

je pense avoir chopé une de ses cochonneries 

quelqu un peut il m aider s il vous plait,

merci d avance



Configuration: Windows XP / Firefox 3.6.9

jacques.gache · Answer

bonjour, postes un zhpdiag pour voir si infections !!

Ouvre ce lien et télécharge ZHPDiag : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

cliques sur télécharger "celui de droite" 

ou directement ici: https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

et si problème : http://www.premiumorange.com/zeb-help-process/zhpdiag.html 

tu vas en bas de la page et tu télécharges le premier tu  et tu dézippes 
 

Enregistres le sur ton Bureau. 

Une fois le téléchargement achevé

pour XP, double-clique sur ZHPDiag 

pour Vista,et seven tu  fais un clic droit sur l'icône et exécute en tant qu'administrateur. 

N'oublies pas de cocher la case qui permet de mettre un raccourci sur le Bureau. 

/|\ l'outil a créé 2 icônes ZHPDiag et ZHPFix. 

Double cliques sur le raccourci ZHPDiag sur ton Bureau pour XP sinon clique droit et en tant que administrateur !! 

Clique sur le Tournevis puis sur Tous pour cocher toutes les cases des options. 

Cliques sur la loupe pour lancer l'analyse. 

Laisses l'outil travailler, il peut être assez long. 

A la fin de l'analyse,clique sur l'appareil photo et enregistre le rapport sur ton Bureau. 


Fermes ZHPDiag en fin d'analyse. 


Pour me le transmettre clique sur ce lien : 

http://www.cijoint.fr/index.php

Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\bureau\.ZHPDiag.txt

ou directement en choisissant bureau et  ZHPDiag.txt clique dessus 

Clique sur Ouvrir. 

Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt 

est ajouté dans la page. 

Copie ce lien dans ta réponse.

m11 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201009/cijURkc5WL.txt

m11 · Answer

======= RAPPORT D'AD-REMOVER 2.0.0.1,E | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 06/09/10 à 15:20
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [3]) -> Lancé à 19:45:57 le 12/09/2010, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86) 
mikavirg@MIKAVIRG-AHB1UF ( ) 
 
============== ACTION(S) ==============


0,Fichier supprimé: C:\Program Files\Mozilla FireFox\Components\AskSearch.js
0,Fichier supprimé: C:\Documents and Settings\mikavirg\Application Data\Mozilla\FireFox\Profiles\ynnigo7m.default\prefs.js.ask.bak
0,Fichier supprimé: C:\Documents and Settings\mikavirg\Application Data\Mozilla\FireFox\Profiles\ynnigo7m.default\searchplugins\ask.xml
0,Fichier supprimé: C:\Documents and Settings\mikavirg\Application Data\Mozilla\FireFox\Profiles\ynnigo7m.default\searchplugins\ask.uk.xml
0,Dossier supprimé: C:\Documents and Settings\mikavirg\Menu Démarrer\Programmes\Ask Search Assistant
0,Dossier supprimé: C:\Program Files\Ask Search Assistant
0,Dossier supprimé: C:\Documents and Settings\mikavirg\Local Settings\Application Data\Conduit
0,Dossier supprimé: C:\Program Files\Conduit

(!) -- Fichiers temporaires supprimés.


-- Fichier ouvert: C:\Documents and Settings\mikavirg\Application Data\Mozilla\FireFox\Profiles\ynnigo7m.default\Prefs.js --
Ligne supprimée: user_pref("extensions.snipit.askTbInstalled", true); 
Ligne supprimée: user_pref("extensions.snipit.chromeURL", "hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&... 
Ligne supprimée: user_pref("extensions.snipit.history_query", "caf=ASKURL=hxxp://www.ask.com/web?q=caf&qsrc=2871&o=10... 
-- Fichier Fermé --
 

1,Clé supprimée: HKLM\Software\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
1,Clé supprimée: HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
0,Clé supprimée: HKLM\Software\Conduit
0,Clé supprimée: HKCU\Software\AskSearchAsst
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Ask Search Assistant
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask.com Search Assistant


============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.9 (fr)] **

-- C:\Documents and Settings\mikavirg\Application Data\Mozilla\FireFox\Profiles\ynnigo7m.default\Prefs.js --
browser.download.dir, C:\Documents and Settings\mikavirg\Bureau
browser.search.defaultenginename, Winamp Search
browser.search.defaulturl, hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50-ff-shou...
browser.search.selectedEngine, Winamp Search
browser.startup.homepage, hxxp://www.google.com
browser.startup.homepage_override.mstone, rv:1.9.2.9
keyword.URL, hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50-ff-shoutcast-ab-en-us...

========================================

** Internet Explorer Version [8.0.6001.18702] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 0

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 8 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 19 Fichier(s)

C:\Ad-Report-CLEAN[3].txt - 12/09/2010 (1740 Octet(s)) 
C:\Ad-Report-SCAN[2].txt - 12/09/2010 (4568 Octet(s)) 

Fin à: 19:49:07, 12/09/2010 
 
============== E.O.F ==============

m11 · Answer

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4601

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/09/2010 21:29:46
mbam-log-2010-09-12 (21-29-46).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 229025
Temps écoulé: 50 minute(s), 11 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\ErrorRepairPro (Rogue.ErrorRepairProfessional) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Error Repair Professional (Rogue.ErrorRepairProfessional) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\mikavirg\Mes documents\Keygen\keygen.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Error Repair Professional\Error Repair Professional.lnk (Rogue.ErrorRepairProfessional) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Error Repair Professional\Uninstall Error Repair Professional.lnk (Rogue.ErrorRepairProfessional) -> Quarantined and deleted successfully.

m11 · Answer

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.5 ¤¤¤¤¤¤¤¤¤¤ User : mikavirg (Administrateurs) Update on 12/09/2010 by g3n-h@ckm@n ::::: 16.00 Start at: 08:09:20 | 13/09/2010 Processeur Intel Pentium III Xeon Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Enabled AV : AntiVir Desktop 9.0.1.32 [ (!) Disabled | Updated ] C:\ -> Disque fixe local | 232,88 Go (52,32 Go free) | NTFS D:\ -> Disque CD-ROM E:\ -> Disque CD-ROM Boot: Normal ¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer C:\WINDOWS\System32\smss.exe ---- 424 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ---- C:\WINDOWS\system32\csrss.exe ---- 5672 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\WINDOWS\system32\winlogon.exe ---- 2436 Ko ---- High ---- winlogon.exe ---- C:\WINDOWS\system32\services.exe ---- 4008 Ko ---- Normal ---- C:\WINDOWS\system32\services.exe ---- C:\WINDOWS\system32\lsass.exe ---- 2344 Ko ---- Normal ---- C:\WINDOWS\system32\lsass.exe ---- C:\WINDOWS\system32\Ati2evxx.exe ---- 3336 Ko ---- Normal ---- C:\WINDOWS\system32\Ati2evxx.exe ---- C:\WINDOWS\system32\svchost.exe ---- 5292 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k DcomLaunch ---- C:\WINDOWS\system32\svchost.exe ---- 4664 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k rpcss ---- C:\WINDOWS\System32\svchost.exe ---- 35260 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k netsvcs ---- C:\WINDOWS\system32\svchost.exe ---- 3380 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup ---- C:\WINDOWS\system32\Ati2evxx.exe ---- 4280 Ko ---- Normal ---- Ati2evxx.exe -Client ---- C:\WINDOWS\System32\svchost.exe ---- 5864 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k NetworkService ---- C:\WINDOWS\system32\svchost.exe ---- 9688 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\WINDOWS\Explorer.EXE ---- 31240 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- C:\WINDOWS\System32\brsvc01a.exe ---- 1304 Ko ---- Normal ---- C:\WINDOWS\System32\brsvc01a.exe ---- C:\WINDOWS\System32\brss01a.exe ---- 2052 Ko ---- Normal ---- brss01a.exe ---- C:\WINDOWS\system32\spoolsv.exe ---- 5640 Ko ---- Normal ---- C:\WINDOWS\system32\spoolsv.exe ---- C:\Program Files\Avira\AntiVir Desktop\sched.exe ---- 808 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\sched.exe" ---- C:\WINDOWS\System32\svchost.exe ---- 3796 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k LocalService ---- C:\Program Files\SimpleCenter\bin\win\sclauncher.exe ---- 1096 Ko ---- Normal ---- "C:\Program Files\SimpleCenter\bin\win\sclauncher.exe" ---- C:\WINDOWS\Mixer.exe ---- 4136 Ko ---- Normal ---- "C:\WINDOWS\Mixer.exe" /startup ---- C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe ---- 2012 Ko ---- Normal ---- "C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe" KMConfig.exe ---- C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMConfig.exe ---- 9488 Ko ---- Normal ---- KMConfig.exe ---- C:\WINDOWS\system32 undll32.exe ---- 3648 Ko ---- Normal ---- "C:\WINDOWS\system32 undll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent ---- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe ---- 1480 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min ---- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe ---- 3384 Ko ---- Normal ---- "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" ---- CyberLink C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe ---- 584 Ko ---- Normal ---- "C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe" /crashhandler ---- Google Inc C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMProcess.exe ---- 4856 Ko ---- Normal ---- "C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMProcess.exe" ---- C:\Program Files\Orange\Systray\SystrayApp.exe ---- 5660 Ko ---- Normal ---- "C:\Program Files\Orange\Systray\SystrayApp.exe" ---- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe ---- 4432 Ko ---- Normal ---- "C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe" -Embedding ---- C:\Program Files\a-squared Free\a2service.exe ---- 5956 Ko ---- Normal ---- "C:\Program Files\a-squared Free\a2service.exe" ---- Emsi Software GmbH C:\Program Files\Orange\Launcher\Launcher.exe ---- 28312 Ko ---- Normal ---- "C:\Program Files\Orange\Launcher\Launcher.exe" -appid connectivityapp ---- C:\Program Files\Canon\MyPrinter\BJMyPrt.exe ---- 2912 Ko ---- Normal ---- "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon ---- Canon Inc. C:\Program Files\Fichiers communs\Nokia\MPlatform\NokiaMServer.exe ---- 21076 Ko ---- Normal ---- "C:\Program Files\Fichiers communs\Nokia\MPlatform\NokiaMServer.exe" /watchfiles startup ---- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe ---- 2864 Ko ---- Normal ---- "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe" ---- Sun Microsystems, Inc. C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe ---- 15268 Ko ---- Normal ---- "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" ---- Logitech C:\Program Files\Orange\Deskboard\deskboard.exe ---- 16104 Ko ---- Normal ---- "C:\Program Files\Orange\Deskboard\deskboard.exe" ---- C:\Program Files\Orange\connectivity\connectivitymanager.exe ---- 7420 Ko ---- Normal ---- "C:\Program Files\Orange\connectivity\connectivitymanager.exe" ---- C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe ---- 19028 Ko ---- Normal ---- "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE ---- Logitech C:\Program Files\Microsoft ActiveSync\wcescomm.exe ---- 5124 Ko ---- Normal ---- "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" ---- Microsoft Corporation C:\WINDOWS\system32\ctfmon.exe ---- 3560 Ko ---- Normal ---- "C:\WINDOWS\system32\ctfmon.exe" ---- C:\Program Files\Messenger\msmsgs.exe ---- 2500 Ko ---- Normal ---- "C:\Program Files\Messenger\msmsgs.exe" /background ---- C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe ---- 12528 Ko ---- Normal ---- "C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe" ---- C:\PROGRA~1\MICROS~3 apimgr.exe ---- 5368 Ko ---- Normal ---- C:\PROGRA~1\MICROS~3 apimgr.exe -Embedding ---- Microsoft Corporation C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe ---- 107636 Ko ---- Normal ---- "C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" -tray ---- Nokia C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe ---- 6928 Ko ---- Normal ---- "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" ---- C:\Program Files\Avira\AntiVir Desktop\avguard.exe ---- 15328 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" ---- C:\WINDOWS\system32\svchost.exe ---- 3360 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k bthsvcs ---- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe ---- 2908 Ko ---- Normal ---- "C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe" ---- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ---- 2136 Ko ---- Normal ---- "C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE" ---- Canon Inc. C:\Program Files\Java\jre6\bin\jqs.exe ---- 1388 Ko ---- Idle ---- "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" ---- Sun Microsystems, Inc. C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe ---- 5924 Ko ---- Normal ---- "C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe" ---- Nero AG C:\WINDOWS\system32\IoctlSvc.exe ---- 1756 Ko ---- Normal ---- C:\WINDOWS\system32\IoctlSvc.exe ---- C:\Program Files\CyberLink\Shared Files\RichVideo.exe ---- 3044 Ko ---- Normal ---- "C:\Program Files\CyberLink\Shared Files\RichVideo.exe" ---- CyberLink C:\WINDOWS\System32\svchost.exe ---- 4288 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k imgsvc ---- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe ---- 4972 Ko ---- Normal ---- "C:\Program Files\PC Connectivity Solution\ServiceLayer.exe" ---- C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe ---- 2112 Ko ---- High ---- {8517E33D-5E6C-406F-95EC-E9FA6E756E06} ---- C:\WINDOWS\System32\alg.exe ---- 3672 Ko ---- Normal ---- C:\WINDOWS\System32\alg.exe ---- C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe ---- 2692 Ko ---- High ---- {B694210A-479A-44E5-8D01-531AC8DECD23} ---- C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe ---- 1740 Ko ---- Normal ---- OraConfigRecover.exe OrangeHSS ---- C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe ---- 3248 Ko ---- Normal ---- "C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe" -Embedding ---- C:\WINDOWS\System32\svchost.exe ---- 3548 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k HTTPFilter ---- C:\Program Files\Fichiers communs\Nokia\NoA okiaaserver.exe ---- 5756 Ko ---- Normal ---- "C:\Program Files\Fichiers communs\Nokia\NoA okiaaserver.exe" ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 5152 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe ---- 3912 Ko ---- High ---- {F8D63B49-97A2-4071-BBDD-4BBA6DB6EFC3} ---- C:\WINDOWS\system32\wscntfy.exe ---- 2564 Ko ---- Normal ---- C:\WINDOWS\system32\wscntfy.exe ---- C:\WINDOWS\system32\cmd.exe ---- 2836 Ko ---- Normal ---- C:\WINDOWS\system32\cmd.exe /K List'em.bat ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 6828 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- C:\Program Files\List_Kill'em\pv.exe ---- 2824 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ---- ¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤ [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe @ = NokiaOviSuite2 = C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] sclauncher = C:\Program Files\SimpleCenter\bin\win\sclauncher.exe C-Media Mixer = Mixer.exe /startup KMConfig = "C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe" KMConfig.exe NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup nwiz = nwiz.exe /install NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit CmPCIaudio = RunDll32 CMICNFG3.cpl,CMICtrlWnd BluetoothAuthenticationAgent = rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent avgnt = "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min RemoteControl = "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" LanguageShortcut = "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" UCam_Menu = "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0" UpdatePSTShortCut = "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" SystrayORAHSS = "C:\Program Files\Orange\Systray\SystrayApp.exe" ORAHSSSessionManager = C:\Program Files\Orange\SessionManager\SessionManager.exe CanonMyPrinter = C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon CanonSolutionMenu = C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" Adobe ARM = "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" KernelFaultCheck = %systemroot%\system32\dumprep 0 -k NokiaMServer = C:\Program Files\Fichiers communs\Nokia\MPlatform\NokiaMServer /watchfiles startup SunJavaUpdateSched = "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe" Launch LgDeviceAgent = "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe" Launch LCDMon = "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" Launch LGDCore = "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion unonce\PCCSReboot ¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] dontdisplaylastusername = 0 (0x0) legalnoticecaption = legalnoticetext = shutdownwithoutlogon = 1 (0x1) undockwithoutlogon = 1 (0x1) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun = 128 (0x80) NoDriveAutoRun = 128 (0x80) HonorAutoRunSetting = 1 (0x1) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveAutoRun = 128 (0x80) NoDriveTypeAutoRun = 128 (0x80) HonorAutoRunSetting = 1 (0x1) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] AutoRestartShell = 1 (0x1) DefaultDomainName = MIKAVIRG-AHB1UF DefaultUserName = mikavirg LegalNoticeCaption = LegalNoticeText = PowerdownAfterShutdown = 0 ReportBootOk = 1 Shell = explorer.exe ShutdownWithoutLogon = 0 System = Userinit = C:\WINDOWS\system32\userinit.exe, VmApplet = rundll32 shell32,Control_RunDLL "sysdm.cpl" SfcQuota = -1 (0xffffffff) allocatecdroms = 0 allocatedasd = 0 allocatefloppies = 0 cachedlogonscount = 10 forceunlocklogon = 0 (0x0) passwordexpirywarning = 14 (0xe) scremoveoption = 0 AllowMultipleTSSessions = 0 (0x0) UIHost = LogonUI.EXE LogonType = 1 (0x1) DebugServerCommand = no SFCDisable = 0 (0x0) WinStationsDisabled = 0 HibernationPreviouslyEnabled = 1 (0x1) ShowLogonOptions = 0 (0x0) AltDefaultUserName = mikavirg AltDefaultDomainName = MIKAVIRG-AHB1UF SfcScan = 0 (0x0) ChangePasswordUseKerberos = 1 (0x1) Background = 0 0 0 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\AtiExtEvent] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dimsntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wlballoon] ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} = ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\eMule\eMule.exe = C:\Program Files\eMule\eMule.exe:*:Enabled:eMule Plus C:\Program Files\Messenger\msmsgs.exe = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Nokia\Nokia Software Updater su_ui_client.exe = C:\Program Files\Nokia\Nokia Software Updater su_ui_client.exe:*:Enabled:Nokia Software Updater C:\Program Files\Fichiers communs\Nokia\Service Layer\A sl_host_process.exe = C:\Program Files\Fichiers communs\Nokia\Service Layer\A sl_host_process.exe:*:Enabled:Nokia Service Layer Host Process C:\Program Files\SimpleCenter\Home Media Server.exe = C:\Program Files\SimpleCenter\Home Media Server.exe:*:Enabled:Home Media Server %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\WINDOWS\system32\dpvsetup.exe = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test C:\Program Files\Reality Pump\World War III Black Gold\Setup.exe = C:\Program Files\Reality Pump\World War III Black Gold\Setup.exe:*:Enabled:Setup C:\Program Files\TVAnts\Tvants.exe = C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts C:\Program Files\play2p\play2p.exe = C:\Program Files\play2p\play2p.exe:*:Disabled:play2p C:\Program Files\SopCast\adv\SopAdver.exe = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver C:\Program Files\SopCast\SopCast.exe = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application C:\Program Files\Orange\Connectivity\ConnectivityManager.exe = C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Samsung\Samsung New PC Studio psasvr.exe = C:\Program Files\Samsung\Samsung New PC Studio psasvr.exe:*:Enabled:KTF MUSIC AoD Server C:\Program Files\Samsung\Samsung New PC Studio psvsvr.exe = C:\Program Files\Samsung\Samsung New PC Studio psvsvr.exe:*:Enabled:KTF MUSIC VoD Server C:\Program Files\ma-config.com\maconfservice.exe = C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice C:\Program Files\Internet Explorer\iexplore.exe = C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer C:\Program Files\Mozilla Firefox\firefox.exe = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger ¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8167C273-DF59-4416-B647-C8BB2C7EE83E}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{84CEDFFB-2061-4D35-9E03-E4A359014E0B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4d64f3ba-f112-4efe-a02e-96680859937c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5b7bf89d-d196-4c32-a303-a57b8ab7f18d}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{866D7D0E-D9CB-49B6-A103-E6FAEFD13969}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B5885D32-156B-49FF-BA57-1931B72A4CDD}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dd772a76-bef3-44d7-8b39-502c8504c1f1}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f15ee071-deb7-4cbb-951f-431c98338d8e}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}] ¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] ¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤ HKLM\SYSTEM\CCS\Services\Tcpip\..\{D144121B-C836-488E-86E5-8685F3C3C1BF}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{D144121B-C836-488E-86E5-8685F3C3C1BF}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{AFE5B887-D1D4-4145-B6D6-1DDF35DDD62F}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{D144121B-C836-488E-86E5-8685F3C3C1BF}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 ¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr Local Page = C:\WINDOWS\system32\blank.htm Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr Local Page = C:\WINDOWS\system32\blank.htm ¤¤¤¤¤ Proxy Internet Explorer [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] ProxyEnable = 0 (0x0) ProxyServer = ¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\apitrap.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ASSTE.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AVSTE.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Cleanup.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\cqw32.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\divx.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\divxdec.ax] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DJSMAR00.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DRMINST.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\enc98.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EncodeDivXExt.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\EncryptPatchVer.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\front.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\fullsoft.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\GBROWSER.DLL] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\htmlmarq.ocx] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\htmlmm.ocx] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\install.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ishscan.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ISSTE.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\javai.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\jvm.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\jvm_g.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\main123w.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mngreg32.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\msci_uno.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mscoree.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mscorsvr.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mscorwks.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\msjava.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\mso.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NAVOPTRF.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NeVideoFX.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NPMLIC.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NSWSTE.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\photohse.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\PMSTE.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ppw32hlp.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\printhse.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\prwin8.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ps80.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\psdmt.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\qfinder.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\qpw.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Salwrap.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\setup.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\setup32.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\sevinst.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\symlcnet.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options core_ebook.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\TFDTCTT8.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ua80.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\udtapi.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ums.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vb40032.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\vbe6.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\wpwin8.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\xlmlEN.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\xwsetup.EXE] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Your Image File Name Here without a path] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\_INSTPGM.EXE] ¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection] ¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !! ¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤ C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Canal IDE principal\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Canal IDE principal#1\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Canal IDE secondaire\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Canal IDE secondaire#1\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Intel(R) ICH8 2 port Serial ATA Storage Controller - 2825\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Intel(R) ICH8 4 port Serial ATA Storage Controller - 2820\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Intel(R) ICH9 Family 2 port Serial ATA Storage Controller 2 - 2926\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\My Drivers\DriverGenius\Backup\Driver Backup 3-2-2010-81227\Intel(R) ICH9R DO DH 4 port Serial ATA Storage Controller 1 - 2920\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\pilotes sauvegarde\Canal IDE principal\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\pilotes sauvegarde\Canal IDE principal#1\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\pilotes sauvegarde\Canal IDE secondaire\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\Documents and Settings\mikavirg\Mes documents\pilotes sauvegarde\Canal IDE secondaire#1\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\$NtServicePackUninstall$\atapi.sys : [MD5.cdfe4411a69c224bd1d11b2da92dac51] [SHA256.0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d] C:\WINDOWS\ServicePackFiles\i386\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\dllcache\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\drivers\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys : [MD5.cdfe4411a69c224bd1d11b2da92dac51] [SHA256.0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d] C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\atapi.sys : [MD5.cdfe4411a69c224bd1d11b2da92dac51] [SHA256.0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d] C:\WINDOWS\system32\ReinstallBackups\0022\DriverFiles\i386\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] C:\WINDOWS\system32\ReinstallBackups\0047\DriverFiles\i386\atapi.sys : [MD5.9f3a2f5aa6875c72bf062c712cfa2674] [SHA256.b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9] ¤¤¤¤¤ Reference Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 338c86357871c167a96ab976519bf59e Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤ Défragmenteur de disque Windows Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc. Rapport d'analyse 233 Go total, 52,32 Go libre (22%), 6% fragmenté (fragmentation du fichier 12%) Il ne vous est pas nécessaire de défragmenter ce volume. ¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤ ¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤ Present !! : C:\WINDOWS\Fonts\GRGAREF.TTF Present !! : C:\WINDOWS\inf t5java.inf Present !! : C:\WINDOWS\meta4.exe Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn Present !! : C:\WINDOWS\System32\dumphive.exe Present !! : C:\WINDOWS\System32\Process.exe Present !! : C:\WINDOWS\System32\SET16A.tmp Present !! : C:\WINDOWS\System32\SrchSTS.exe Present !! : C:\WINDOWS\System32 mp.reg Present !! : C:\WINDOWS\System32\VCCLSID.exe Present !! : C:\WINDOWS\System32\WS2Fix.exe Present !! : C:\Documents and Settings\mikavirg\Application Data\pcouffin.inf Present !! : C:\Documents and Settings\mikavirg\Application Data\pcouffin.log Present !! : C:\Documents and Settings\mikavirg\LOCAL Settings\Temp\NEventMessages.dll Present !! : C:\Documents and Settings\mikavirg\LOCAL Settings\Temp\NOSEventMessages.dll ¤¤¤¤¤¤¤¤¤¤ Keys : Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383} Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe" Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179} FEATURE_BROWSER_EMULATION | svchost : ==================================== ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-13 08:20:22 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys atapi.sys spfe.sys >>UNKNOWN [0x8AEA7938]<< kernel: MBR read successfully user & kernel MBR OK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify = 0 (0x0) FirewallDisableNotify = 0 (0x0) UpdatesDisableNotify = 0 (0x0) AntiVirusOverride = 0 (0x0) FirewallOverride = 0 (0x0) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ End of scan : 8:20:54,71

m11 · Answer

desolé je viens de rentrer du boulot ¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.5 ¤¤¤¤¤¤¤¤¤¤ User : mikavirg (Administrateurs) Update on 12/09/2010 by g3n-h@ckm@n ::::: 16.00 Start at: 19:30:11 | 13/09/2010 Processeur Intel Pentium III Xeon Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Enabled AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ] C:\ -> Disque fixe local | 232,88 Go (52,37 Go free) | NTFS D:\ -> Disque CD-ROM E:\ -> Disque CD-ROM ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko) C:\WINDOWS\System32\smss.exe ----440 Ko C:\WINDOWS\system32\csrss.exe ----5888 Ko C:\WINDOWS\system32\winlogon.exe ----2736 Ko C:\WINDOWS\system32\services.exe ----4068 Ko C:\WINDOWS\system32\lsass.exe ----1732 Ko C:\WINDOWS\system32\Ati2evxx.exe ----3336 Ko C:\WINDOWS\system32\svchost.exe ----5276 Ko C:\WINDOWS\system32\svchost.exe ----4740 Ko C:\WINDOWS\System32\svchost.exe ----36716 Ko C:\WINDOWS\system32\svchost.exe ----3396 Ko C:\WINDOWS\system32\Ati2evxx.exe ----4280 Ko C:\WINDOWS\System32\svchost.exe ----7720 Ko C:\WINDOWS\system32\svchost.exe ----10320 Ko C:\WINDOWS\Explorer.EXE ----55808 Ko C:\WINDOWS\System32\brsvc01a.exe ----1304 Ko C:\WINDOWS\System32\brss01a.exe ----2052 Ko C:\WINDOWS\system32\spoolsv.exe ----5672 Ko C:\Program Files\Avira\AntiVir Desktop\sched.exe ----848 Ko C:\WINDOWS\System32\svchost.exe ----3812 Ko C:\Program Files\SimpleCenter\bin\win\sclauncher.exe ----1096 Ko C:\WINDOWS\Mixer.exe ----4136 Ko C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe ----2012 Ko C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMConfig.exe ----9488 Ko C:\WINDOWS\system32 undll32.exe ----3684 Ko C:\Program Files\Avira\AntiVir Desktop\avgnt.exe ----1480 Ko C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe ----3380 Ko C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe ----584 Ko C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMProcess.exe ----4856 Ko C:\Program Files\Orange\Systray\SystrayApp.exe ----5672 Ko C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe ----4504 Ko C:\Program Files\a-squared Free\a2service.exe ----5956 Ko C:\Program Files\Orange\Launcher\Launcher.exe ----29712 Ko C:\Program Files\Canon\MyPrinter\BJMyPrt.exe ----2912 Ko C:\Program Files\Fichiers communs\Nokia\MPlatform\NokiaMServer.exe ----21088 Ko C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe ----2864 Ko C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe ----15268 Ko C:\Program Files\Orange\Deskboard\deskboard.exe ----16256 Ko C:\Program Files\Orange\connectivity\connectivitymanager.exe ----7428 Ko C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe ----19036 Ko C:\Program Files\Microsoft ActiveSync\wcescomm.exe ----5136 Ko C:\WINDOWS\system32\ctfmon.exe ----3576 Ko C:\Program Files\Messenger\msmsgs.exe ----2544 Ko C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe ----12592 Ko C:\PROGRA~1\MICROS~3 apimgr.exe ----5412 Ko C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe ----107664 Ko C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe ----7240 Ko C:\Program Files\Avira\AntiVir Desktop\avguard.exe ----16284 Ko C:\WINDOWS\system32\svchost.exe ----3376 Ko C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe ----2908 Ko C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ----2136 Ko C:\Program Files\Java\jre6\bin\jqs.exe ----1380 Ko C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe ----5916 Ko C:\WINDOWS\system32\IoctlSvc.exe ----1756 Ko C:\Program Files\CyberLink\Shared Files\RichVideo.exe ----3048 Ko C:\WINDOWS\System32\svchost.exe ----4396 Ko C:\Program Files\PC Connectivity Solution\ServiceLayer.exe ----4964 Ko C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe ----2112 Ko C:\WINDOWS\System32\alg.exe ----3656 Ko C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe ----2692 Ko C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe ----1740 Ko C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe ----3256 Ko C:\WINDOWS\System32\svchost.exe ----3564 Ko C:\Program Files\Fichiers communs\Nokia\NoA okiaaserver.exe ----5840 Ko C:\WINDOWS\system32\wbem\wmiprvse.exe ----5344 Ko C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe ----3912 Ko C:\Program Files\eMule\emule.exe ----49296 Ko C:\WINDOWS\system32\cmd.exe ----2960 Ko C:\WINDOWS\system32\wbem\wmiprvse.exe ----6908 Ko C:\Program Files\List_Kill'em\ERUNT.EXE ----4008 Ko C:\Program Files\List_Kill'em\pv.exe ----2820 Ko ¤¤¤¤¤¤¤¤¤¤ Files/folders : Quarantined & Deleted !! : C:\WINDOWS\Fonts\GRGAREF.TTF Quarantined & Deleted !! : C:\WINDOWS\inf t5java.inf Quarantined & Deleted !! : C:\WINDOWS\meta4.exe Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn Quarantined & Deleted !! : C:\WINDOWS\System32\dumphive.exe Quarantined & Deleted !! : C:\WINDOWS\System32\Process.exe Quarantined & Deleted !! : C:\WINDOWS\System32\SET16A.tmp Quarantined & Deleted !! : C:\WINDOWS\System32\SrchSTS.exe Quarantined & Deleted !! : C:\WINDOWS\System32 mp.reg Quarantined & Deleted !! : C:\WINDOWS\System32\VCCLSID.exe Quarantined & Deleted !! : C:\WINDOWS\System32\WS2Fix.exe Quarantined & Deleted !! : C:\Documents and Settings\mikavirg\Application Data\pcouffin.inf Quarantined & Deleted !! : C:\Documents and Settings\mikavirg\Application Data\pcouffin.log Quarantined & Deleted !! : C:\Documents and Settings\mikavirg\LOCAL Settings\Temp\Perflib_Perfdata_6a8.dat Quarantined & Deleted !! : C:\Documents and Settings\mikavirg\LOCAL Settings\Temp\NEventMessages.dll Quarantined & Deleted !! : C:\Documents and Settings\mikavirg\LOCAL Settings\Temp\NOSEventMessages.dll ¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤ 127.0.0.1 localhost ¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤ Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383} Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe" Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d} Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d} Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d} Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d} Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d} ¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr/?ocid=iehp Local Page = C:\WINDOWS\system32\blank.htm Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.google.com/?gws_rd=ssl Local Page = C:\WINDOWS\system32\blank.htm Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify = 0 (0x0) FirewallDisableNotify = 0 (0x0) UpdatesDisableNotify = 0 (0x0) AntiVirusOverride = 0 (0x0) FirewallOverride = 0 (0x0) FirstRunDisabled = 1 () ¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤ Ndisuio : Start = 3 EapHost : Start = 2 Ip6Fw : Start = 2 SharedAccess : Start = 2 wuauserv : Start = 2 wscsvc : Start = 2 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Disk Cleaned anti-ver blaster : OK Prefetch cleaned ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ FEATURE_BROWSER_EMULATION | svchost : ==================================== Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys atapi.sys spfe.sys >>UNKNOWN [0x8AEA7938]<< kernel: MBR read successfully user & kernel MBR OK ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

m11 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201009/cijANdpaLn.txt

m11 · Answer

ben pour l instant tout a l air d aller tres bien je n ai deja plus les pages qui s ouvrent tout le temps

m11 · Answer

Rapport de ZHPFix v1.12.3149 par Nicolas Coolman, Update du 11/09/2010
Fichier d'export Registre : 
Run by mikavirg at 15/09/2010 20:12:59
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
HKLM\Software\Totem  => Clé supprimée avec succès

========== Valeur(s) du Registre ==========
O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k  => Valeur supprimée avec succès
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) - (.not file.)  => Valeur absente

========== Fichier(s) ==========
c:\windows\system32\dumprep 0 -k  => Fichier supprimé au reboot

========== Etat des services ==========
FTRTSVC  => Service arrêté avec succès


========== Récapitulatif ==========
1 : Clé(s) du Registre
2 : Valeur(s) du Registre
1 : Fichier(s)
1 : Etat des services


End of the scan

m11 · Answer

QuickScan Beta 32-bit v0.9.9.38
-------------------------------
Scan date:  Wed Sep 15 20:18:41 2010
Machine ID: 2C1BE880



No infection found.
-------------------



Processes
---------
 IoctlSvc Application                    2556    C:\WINDOWS\system32\IoctlSvc.exe
a-squared                                1536    C:\Program Files\a-squared Free\a2service.exe
AntiVir Desktop                           412    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
AntiVir Desktop                          2184    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
AntiVir Desktop                          1740    C:\Program Files\Avira\AntiVir Desktop\sched.exe
ATI External Event Utility for Windows    960    C:\WINDOWS\system32\ati2evxx.exe
ATI External Event Utility for Windows   1252    C:\WINDOWS\system32\ati2evxx.exe
brother Industries Ltd brss01a.exe       1684    C:\WINDOWS\system32\brss01a.exe
brother Industries Ltd brsvc01a          1664    C:\WINDOWS\system32\brsvc01a.exe
Canon My Printer                         1036    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
CSS-Corporate                            3164    C:\Program Files\Orange\Connectivity\ConnectivityManager.exe
CSS-Corporate                            3172    C:\Program Files\Orange\Connectivity\corecom\CoreCom.exe
CSS-Corporate                             976    C:\Program Files\Orange\Connectivity\corecom\OraConfigRecover.exe
CSS-Corporate                            1112    C:\Program Files\Orange\Launcher\Launcher.exe
CSS-Corporate                            1000    C:\Program Files\Orange\Systray\SystrayApp.exe
CSS-Corporate                            1124    C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
CSS-Corporate                            1912    C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
Deskboard.exe                            3156    C:\Program Files\Orange\Deskboard\Deskboard.exe
DRIVER AUTORUN                            296    C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe
Firefox                                  4920    C:\Program Files\Mozilla Firefox\firefox.exe
Firefox                                  5964    C:\Program Files\Mozilla Firefox\plugin-container.exe
Google Update                            1888    C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
IJPLMSVC                                 2364    C:\Program Files\Canon\IJPLM\ijplmsvc.exe
Java(TM) Platform SE 6 U21               2384    C:\Program Files\Java\jre6\bin\jqs.exe
Java(TM) Platform SE Auto Updater 2 0    1448    C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
Keyboard And Mouse Processing             620    C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMProcess.exe
Logitech GamePanel Software              1360    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
Logitech GamePanel Software              1576    C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
Messenger                                1800    C:\Program Files\Messenger\msmsgs.exe
Microsoft ActiveSync                     1604    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
Microsoft ActiveSync                     2004    C:\PROGRA~1\MICROS~3apimgr.exe
Microsoft® Windows® Operating System      236    C:\WINDOWS\system32\alg.exe
Microsoft® Windows® Operating System      656    C:\WINDOWS\system32\csrss.exe
Microsoft® Windows® Operating System     1620    C:\WINDOWS\system32\ctfmon.exe
Microsoft® Windows® Operating System      744    C:\WINDOWS\system32\lsass.exe
Microsoft® Windows® Operating System     1692    C:\WINDOWS\system32\spoolsv.exe
Microsoft® Windows® Operating System     1060    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System      980    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     2212    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     2248    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1520    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     2684    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1392    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1196    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System      192    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1840    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1156    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     3496    C:\WINDOWS\system32\wbem\wmiprvse.exe
Mixer                                     280    C:\WINDOWS\mixer.exe
Nero BackItUp                            2400    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
Nero Home                                4256    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
Nero Home                                4200    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
Nokia M Platform                         1408    C:\Program Files\Fichiers communs\Nokia\MPlatform\NokiaMServer.exe
PC Connectivity Solution                 4072    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PC Connectivity Solution                 3828    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
PC Connectivity Solution                  536    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PC Connectivity Solution                 2596    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PowerDVD                                  420    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
RichVideo Module                         2584    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
RocketDock.exe                           2016    C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
SimpleCenter                              276    C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
Système d'exploitation Microsoft® Windo  1880    C:\WINDOWS\explorer.exe
Système d'exploitation Microsoft® Windo   404    C:\WINDOWS\system32undll32.exe
Système d'exploitation Microsoft® Windo   732    C:\WINDOWS\system32\services.exe
Système d'exploitation Microsoft® Windo   604    C:\WINDOWS\system32\smss.exe
Système d'exploitation Microsoft® Windo   688    C:\WINDOWS\system32\winlogon.exe
TeaTimer.exe                             1816    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
USB Keyboard And PS/2 Keyboard Driver     320    C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\KMConfig.exe


Network activity
----------------
Process firefox.exe (4920) connected on port 80 (HTTP) --> 91.103.142.129
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.49
Process firefox.exe (4920) connected on port 80 (HTTP) --> 72.14.235.148
Process firefox.exe (4920) connected on port 80 (HTTP) --> 92.123.5.115
Process firefox.exe (4920) connected on port 80 (HTTP) --> 209.85.227.101
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.49
Process firefox.exe (4920) connected on port 80 (HTTP) --> 66.249.92.148
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.49
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.49
Process firefox.exe (4920) connected on port 80 (HTTP) --> 209.85.227.113
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.49
Process firefox.exe (4920) connected on port 80 (HTTP) --> 217.89.107.50
Process firefox.exe (4920) connected on port 80 (HTTP) --> 94.127.72.70
Process firefox.exe (4920) connected on port 80 (HTTP) --> 217.89.107.50
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.32
Process firefox.exe (4920) connected on port 80 (HTTP) --> 94.127.72.70
Process firefox.exe (4920) connected on port 80 (HTTP) --> 91.103.142.129
Process firefox.exe (4920) connected on port 80 (HTTP) --> 217.89.107.50
Process firefox.exe (4920) connected on port 80 (HTTP) --> 217.89.107.50
Process firefox.exe (4920) connected on port 443 (HTTP over SSL) --> 209.85.227.139
Process firefox.exe (4920) connected on port 80 (HTTP) --> 217.89.107.50
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.32
Process firefox.exe (4920) connected on port 80 (HTTP) --> 72.14.235.148
Process firefox.exe (4920) connected on port 80 (HTTP) --> 217.89.107.50
Process firefox.exe (4920) connected on port 80 (HTTP) --> 62.41.63.49

Process svchost.exe (1060) listens on ports: 135 (RPC)
Process svchost.exe (1520) listens on ports: 2869 (SSDP event notification, UPNP)
Process rapimgr.exe (2004) listens on ports: 990 (FTP over SSL)


Autoruns and critical files
---------------------------
 Language Application                    C:\Program Files\CyberLink\PowerDVD\Language\Language.exe
Adobe Acrobat                            C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
Adobe Reader and Acrobat Manager         C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
AntiVir Desktop                          C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
Apple Software Update                    C:\Program Files\Apple Software Update\SoftwareUpdate.exe
ATI External Event Utility for Windows   C:\WINDOWS\system32\ati2evxx.dll
Canon My Printer                         C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
CNSLMAIN.EXE                             C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe
CSS-Corporate                            C:\Program Files\Orange\SessionManager\SessionManager.exe
CSS-Corporate                            C:\Program Files\Orange\Systray\SystrayApp.exe
DRIVER AUTORUN                           C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe
Google Update                            C:\Program Files\Google\Update\GoogleUpdate.exe
Google Updater                           C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Java(TM) Platform SE Auto Updater 2 0    C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
Logitech GamePanel Software              C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
Logitech GamePanel Software              C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
Logitech GamePanel Software              C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe
Messenger                                C:\Program Files\Messenger\msmsgs.exe
Microsoft ActiveSync                     C:\Program Files\Microsoft ActiveSync\wcescomm.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\bthprops.cpl
Microsoft® Windows® Operating System     C:\WINDOWS\system32\cryptnet.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\ctfmon.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\dimsntfy.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\WPDShServiceObj.dll
Mixer                                    C:\WINDOWS\mixer.exe
MUI StartMenu Application                C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
Nokia M Platform                         C:\Program Files\Fichiers communs\Nokia\MPlatform\NokiaMServer.exe
Nokia Ovi Suite 2                        C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
NVIDIA Compatible Windows 2000 Display   C:\WINDOWS\system32\NvCpl.dll
NVIDIA Media Center Library              C:\WINDOWS\system32\NvMcTray.dll
nwiz.exe                                 C:\WINDOWS\system32
wiz.exe
PowerDVD                                 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
RocketDock.exe                           C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
SimpleCenter                             C:\Program Files\SimpleCenter\bin\win\sclauncher.exe
StartMen Application                     C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\browseui.dll
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\crypt32.dll
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\cscdll.dll
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\LogonUI.EXE
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\sclgntfy.dll
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\shell32.dll
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\stobject.dll
Système d'exploitation Microsoft® Windo  c:\windows\system32\userinit.exe
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\wlnotify.dll
TeaTimer.exe                             C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
TransBar                                 C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
Windows® Internet Explorer               C:\WINDOWS\system32\webcheck.dll


Browser plugins
---------------
AcroIEHelperShim Library                 c:\program files\fichiers communs\adobe\acrobat\activex\acroiehelpershim.dll
Adobe Acrobat                            C:\Program Files\Internet Explorer\plugins
ppdf32.dll
Adobe Acrobat                            C:\Program Files\Mozilla Firefox\plugins
ppdf32.dll
Adobe® Flash® Player ActiveX             C:\WINDOWS\Downloaded Program Files\CONFLICT.1\FP_AX_CAB_INSTALLER.exe
Adobe® Flash® Player ActiveX             C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
BitDefender QuickScan                    C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
BitDefender QuickScan                    C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins
pqscan.dll
CANON iMAGE GATEWAY Album Plugin Utilit  C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
DivX Player Netscape Plugin              C:\Program Files\DivX\DivX Player
pDivxPlayerPlugin.dll
DivX Player Netscape Plugin              C:\Program Files\Mozilla Firefox\plugins
pDivxPlayerPlugin.dll
DivX Web Player                          C:\Program Files\DivX\DivX Web Player
pdivx32.dll
DivX Web Player                          C:\Program Files\Mozilla Firefox\plugins
pdivx32.dll
Foxit Reader Plugin for Mozilla          C:\Program Files\Mozilla Firefox\plugins
pFoxitReaderPlugin.dll
frozen.dll                               C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
Google Update                            C:\Program Files\Google\Update\1.2.183.29
pGoogleOneClick8.dll
Google Updater                           C:\Program Files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
googletoolbar-ff2.dll                    C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
googletoolbar-ff3.dll                    C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
googletoolbarloader.dll                  C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
GoogleToolbarNotifier                    c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
InstallShield Update Service             C:\WINDOWS\Downloaded Program Files\dwusplay.dll
InstallShield Update Service             C:\WINDOWS\Downloaded Program Files\dwusplay.exe
InstallShield Update Service             C:\WINDOWS\Downloaded Program Files\isusweb.dll
Java Deployment Toolkit 6.0.210.7        C:\Program Files\Mozilla Firefox\plugins
pdeployJava1.dll
Java(TM) Platform SE 6 U21               c:\program files\java\jre6\bin\jp2ssv.dll
Java(TM) Platform SE 6 U21               C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll
Java(TM) Platform SE 6 U21               c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
Ma-Config.com plugin                     C:\Program Files\ma-config.com
phardwaredetection.dll
Messenger                                C:\Program Files\Messenger\msmsgs.exe
Microsoft® Windows Live Login Helper     c:\program files\fichiers communs\microsoft shared\windows live\windowslivelogin.dll
Microsoft® Windows Media Player Firefox  C:\Program Files\Mozilla Firefox\plugins
p-mswmp.dll
Microsoft® Windows® Operating System     C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32svpsp.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\winrnr.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\wshbth.dll
Mozilla Default Plug-in                  C:\Program Files\Mozilla Firefox\plugins
pnul32.dll
nppdf32.FRA                              C:\Program Files\Internet Explorer\plugins
ppdf32.FRA
nppdf32.FRA                              C:\Program Files\Mozilla Firefox\plugins
ppdf32.FRA
NPSWF32.dll                              C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
Orange Installer Plugin                  C:\Documents and Settings\mikavirg\Application Data\Mozilla\Firefox\Profiles\ynnigo7m.default\extensions\{4D9AE42B-F4C0-40e6-AEDB-4EC6E42B77AF}\plugins
pOrangeInstaller.dll
searchpageurl.dll                        c:\program files\orange\searchurlhook\searchpageurl.dll
Silverlight Plug-In                      c:\Program Files\Microsoft Silverlight\4.0.50826.0
pctrl.dll
Système d'exploitation Microsoft® Windo  C:\WINDOWS\system32\mswsock.dll
Windows Genuine Advantage                C:\Program Files\Mozilla Firefox\plugins
pLegitCheckPlugin.dll
Windows Presentation Foundation          c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
Windows® Internet Explorer               C:\WINDOWS\system32\ieframe.dll
Yahoo! activeX Plug-in Bridge            C:\Program Files\Yahoo!\Common
pyaxmpb.dll


Missing files
-------------
File not found: C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
  --> HKLM\System\ControlSet001\services\avgio\"ImagePath"

File not found: C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
  --> HKLM\System\ControlSet001\services\avgntflt\"ImagePath"

File not found: C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
  --> HKLM\System\ControlSet001\services\AntiVirService\"ImagePath"

File not found: C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
  --> HKLM\System\ControlSet001\services\AntiVirScheduler\"ImagePath"

File not found: C:\Program Files\Veetle\VLCBroadcast
pvbp.dll
  --> HLKM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17\"Path"

File not found: C:\Program Files\Windows Live\Messenger\usnsvc.exe
  --> HKLM\System\ControlSet001\services\usnjsvc\"ImagePath"

File not found: C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  --> HKLM\System\ControlSet001\services\WLSetupSvc\"ImagePath"

File not found: C:\WINDOWS\System32\FTRTSVC.exe
  --> HKLM\System\ControlSet001\services\FTRTSVC\"ImagePath"

File not found: C:\WINDOWS\System32\appmgmts.dll
  --> HKLM\System\ControlSet001\services\AppMgmt\Parameters\"ServiceDll"

File not found: CMICNFG3.cpl
  --> HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"CmPCIaudio"


Scan
----


No file uploaded.

Scan finished - communication took 2 sec
Total traffic - 0.08 MB sent, 2.76 KB recvd
Scanned 1336 files and modules - 44 seconds

==============================================================================

m11 · Answer

[ Rapport ToolsCleaner version 2.3.1 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Program Files\List_Kill'em\mbr.exe: trouvé !
C:\Program Files\ZHPDiag\mbr.log: trouvé !
C:\Program Files\ZHPDiag\mbr.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\List_Kill'em\mbr.exe: supprimé !
C:\Program Files\ZHPDiag\mbr.log: supprimé !
C:\Program Files\ZHPDiag\mbr.exe: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

m11 · Answer

ok tout est fait merci a toi jacques.gache

m11 · Answer

voila c est fait!!

m11 · Answer

merci de ton aide    @+

Page s ouvre a l infini

14 réponses

Discussions similaires