PC infecté ?

Question

Bonjour, 

mon explorer n'arrete pas de se mettre en panne et est récupéré par windows 7.
c'est un aller et retour permanent.

merci de m'aider 



Configuration: Windows XP / Firefox 3.6.10

benurrr · Answer

salut

télécharge

https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

a l'installation vérifie que mise a jour et lancer programme et scan complet sont bien cocher

Une fois a jour, le programme va se lancer; clic sur l'onglet paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

A la fin du scan clique sur Afficher les résultats

Vérifier si tout est coché et clic Supprimer la sélection

S'il t'es demandé de redémarrer >>> clique sur "Yes"

Et tu poste le rapport générer

RobertS64 · Answer

Bonsoir et merci de m'aider...
Comme je le craignais, Malwarebytes n'a rien vu.C'est la 4 ème analyse que je fais . Il a trouvé la première fois une menace que j'ai  notée manuellement:

Hyjack.FolderOptions/Registry value/HKEY-CURRENT-USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
ofolderoptions

Sinon voici le post de Malwarebytes

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4786

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/10/2010 20:24:37
mbam-log-2010-10-12 (20-24-37).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Elément(s) analysé(s): 301735
Temps écoulé: 51 minute(s), 34 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

benurrr · Answer

DÉSACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRÉSENTS !!!!!(car il est détecte a tort comme infection)  

Télécharge ici :List_Kill'em de gen-hackman   

http://sd-4.archive-host.com/membres/up/829108531491024/Mes_Tools/List_Killem_Install.exe 


et enregistre le sur ton bureau 

 windows 7 => clic droit "exécuter en tant que administrateur 

sur le raccourci sur ton bureau pour lancer l'installation 

Laisse coché : 

  Exécuter List_Kill'em 

une fois terminée , clic sur "terminer" et le programme se lancera seul 

Il commencera par telecharger et installer ses mises à jour , puis te donnera son menu 

choisis l'option Search 

  laisse travailler l'outil 

il se peut qu'une boite de dialogue s'ouvre , dans ce cas clique sur "ok" ou "Agrée" 

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué. 

  Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED" 

------  NE LE POSTE PAS SUR LE FORUM------- 

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/ 

  Clique sur Parcourir et cherche le fichier C:\List'em.txt 

  Clique sur Ouvrir. 

 Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt 

est ajouté dans la page. 

  Copie ce lien dans ta réponse.

RobertS64 · Answer

voici le lien:

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.9 ¤¤¤¤¤¤¤¤¤¤

User : utilisateur (Administrateurs) 
Update on 09/10/2010 by g3n-h@ckm@n ::::: 15.30
Start at: 21:25:11 | 12/10/2010

Intel(R) Core(TM) i5 CPU       M 520  @ 2.40GHz
Microsoft Windows 7 Professionnel  (6.1.7600 64-bit) # 
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 455,7 Go (241,77 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM
 
Boot: Normal 

¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer


C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe ---- 1808 Ko ---- Normal ---- "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" ---- Avira GmbH
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe ---- 3816 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe" ---- ArcSoft, Inc.
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe ---- 756 Ko ---- Normal ---- "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" ---- Avira GmbH
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe ---- 7524 Ko ---- Normal ---- "C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe" ---- 
C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe ---- 4072 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe" ---- Intervideo, Inc.
C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe ---- 5428 Ko ---- Normal ---- "C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe" ---- Sony Corporation
C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe ---- 3636 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe" ---- Protexis Inc.
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe ---- 4608 Ko ---- Normal ---- "C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe" ---- ArcSoft, Inc.
C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe ---- 11036 Ko ---- Normal ---- "C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe" ---- Sony Corporation
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe ---- 12868 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe" ---- Sony Corporation
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe ---- 6968 Ko ---- Normal ---- "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe"  ---- Intel Corporation
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe ---- 12932 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe" ---- 
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe ---- 6364 Ko ---- Normal ---- "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe" ---- Intel Corporation
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe ---- 8540 Ko ---- Normal ---- "C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe" ---- Safer Networking Ltd.
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe ---- 2056 Ko ---- Normal ---- "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"  ---- Google Inc
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe ---- 5116 Ko ---- Normal ---- "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background ---- Microsoft Corporation
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe ---- 12712 Ko ---- Normal ---- "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun ---- DT Soft Ltd
C:\Windows\SysWOW64\DllHost.exe ---- 7224 Ko ---- Normal ---- C:\Windows\SysWOW64\DllHost.exe /Processid:{78FD0120-D39C-45D8-A9BE-2B802B3C23E5} ---- 
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe ---- 93576 Ko ---- Idle ---- "C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe"  ---- 
C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe ---- 13360 Ko ---- Normal ---- "C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe" ---- Sony Corporation
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- 10512 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"  ---- Adobe Systems, Incorporated
C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe ---- 6356 Ko ---- Normal ---- "C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe"  ---- Sony Corporation
C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe ---- 11328 Ko ---- Normal ---- "C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe"  ---- Sony Corporation
C:\Program Files (x86)\SONY\Marketing Tools\MarketingTools.exe ---- 3440 Ko ---- Normal ---- "C:\Program Files (x86)\SONY\Marketing Tools\MarketingTools.exe"  ---- 
C:\Program Files (x86)\Java\jre6\bin\jusched.exe ---- 11440 Ko ---- Normal ---- "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"  ---- Sun Microsystems, Inc.
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe ---- 3552 Ko ---- Normal ---- "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min ---- Avira GmbH
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe ---- 7032 Ko ---- Normal ---- "C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe"  ---- ArcSoft, Inc.
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac ---- 10212 Ko ---- Normal ---- ArcCon.ac 66260 0 ---- ArcSoft, Inc.
C:\Program Files (x86)\Mozilla Firefox\firefox.exe ---- 93912 Ko ---- Normal ---- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"  ---- Mozilla Corporation
C:\Program Files\Sony\VAIO Care\listener.exe ---- 4596 Ko ---- Normal ---- C:\Program Files\Sony\VAIO Care/listener.exe /silent /slot=0 ---- 
C:\Windows\SysWOW64\cmd.exe ---- 3896 Ko ---- Normal ---- C:\Windows\system32\cmd.exe  /K List'em.bat ---- 
C:\Program Files (x86)\List_Kill'em\pv.exe ---- 5864 Ko ---- Normal ---- pv  -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ---- 


¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
swg	=         	"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
msnmsgr	=         	"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
DAEMON Tools Lite	=         	"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
SpybotSD TeaTimer	=         	C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
Adobe Reader Speed Launcher	=         	"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
Adobe ARM	=         	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
ISBMgr.exe	=         	"C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" 
NortonOnlineBackupReminder	=         	"C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED 
PMBVolumeWatcher	=         	C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe 
MarketingTools	=         	C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe 
SunJavaUpdateSched	=         	"C:\Program Files (x86)\Java\jre6\bin\jusched.exe" 
QuickTime Task	=         	"C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime 
SearchSettings	=         	C:\Program Files (x86)\pdfforge Toolbar\SearchSettings.exe 
avgnt	=         	"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min 
ArcSoft Connection Service	=         	C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	=      	145 (0x91) 
NoFolderOptions	=      	0 (0x0) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoActiveDesktop	=      	1 (0x1) 
NoActiveDesktopChanges	=      	1 (0x1) 
ForceActiveDesktopOn	=      	0 (0x0) 
NoControlPanel	=      	0 (0x0) 
RestrictCPL	=      	0 (0x0) 
NoSetFolders	=      	0 (0x0) 
NoWinKeys	=      	0 (0x0) 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	=         	

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 Shell	=         	explorer.exe 
 Userinit	=         	C:\Windows\system32\userinit.exe, 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\VESWinlogon]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}]

¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤

[@	=         	]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]

¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤

HKLM\SYSTEM\CCS\Services\Tcpip\..\{BB8C9484-BDD0-485F-9085-847F9BF303D0}: DhcpNameServer=192.168.0.1 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E0AA6BE7-E4D6-4F14-89B4-4915F1966550}: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{BB8C9484-BDD0-485F-9085-847F9BF303D0}: DhcpNameServer=192.168.0.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E0AA6BE7-E4D6-4F14-89B4-4915F1966550}: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS2\Services\Tcpip\..\{BB8C9484-BDD0-485F-9085-847F9BF303D0}: DhcpNameServer=192.168.0.1 
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E0AA6BE7-E4D6-4F14-89B4-4915F1966550}: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 


¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	=         	C:\Windows\SysWOW64\blank.htm
Default_Search_URL	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	=         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://fr.ask.com/?o=14597&l=dis
Local Page	=         	C:\Windows\system32\blank.htm
Search Page	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

¤¤¤¤¤ Proxy Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable	=      	0 (0x0)


¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤
 

¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DllNXOptions]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IEInstal.exe]

¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection] 
KnownDllList	=         	nlhtml.dll

¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!  
 
¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤

[MD5.02062c0b390b7729edc9e69c680a6f3c] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys  
[MD5.02062c0b390b7729edc9e69c680a6f3c] - C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys  

¤¤¤¤¤ Reference 

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4   : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 338c86357871c167a96ab976519bf59e
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
 
¤¤¤¤¤¤¤¤¤¤ Explorer ¤¤¤¤¤¤¤¤¤¤
 
[MD5.ce44e970ac4b5348e624e28b47f893c4] - C:\Windows\explorer.exe  
[MD5.2626fc9755be22f805d3cfa0ce3ee727] - C:\Windows\System32\explorer.exe  
[MD5.2626fc9755be22f805d3cfa0ce3ee727] - C:\Windows\SysWOW64\explorer.exe  
[MD5.c235a51cb740e45ffa0ebfb9bafcda64] - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe  
[MD5.f170b4a061c9e026437b193b4d571799] - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe  
[MD5.9aaaec8dac27aa17b053e6352ad233ae] - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe  
[MD5.700073016dac1c3d2e7e2ce4223334b6] - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe  
[MD5.b8ec4bd49ce8f6fc457721bfc210b67f] - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe  
[MD5.15bc38a7492befe831966adb477cf76f] - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe  
[MD5.b95eeb0f4e5efbf1038a35b3351cf047] - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe  
[MD5.2626fc9755be22f805d3cfa0ce3ee727] - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe  
[MD5.9ff6c4c91a3711c0a3b18f87b08b518d] - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe  
[MD5.c76153c7eca00fa852bb0c193378f917] - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe  

¤¤¤¤¤¤¤¤¤¤ Winlogon ¤¤¤¤¤¤¤¤¤¤
 
[MD5.132328df455b0028f13bf0abee51a63a] - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe 
[MD5.da3e2a6fa9660cc75b471530ce88453a] - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe 
[MD5.a93d41a4d4b0d91c072d11dd8af266de] - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe 

¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤


¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
 
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e35736b4-9b51-11df-8951-506313e5aed9}\shell\autorun  
@	=         	Installer ou exécuter un programme depuis son support  
SetWorkingDirectoryFromTarget	=         	  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e35736b4-9b51-11df-8951-506313e5aed9}\shell\autorun\command  
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e35736b4-9b51-11df-8951-506313e5aed9}\shell\autorun\command  
@	=         	H:\autorun.exe  
 
¤¤¤¤¤¤¤¤¤¤ First Scan ¤¤¤¤¤¤¤¤¤¤
 
 

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤
 
[@	=         	]  
[HKEY_CURRENT_USER\software\3herosoft]  
[HKEY_CURRENT_USER\software\7-Zip]  
[HKEY_CURRENT_USER\software\Adobe]  
[HKEY_CURRENT_USER\software\Alps]  
[HKEY_CURRENT_USER\software\AppDataLow]  
[HKEY_CURRENT_USER\software\Apple Computer, Inc.]  
[HKEY_CURRENT_USER\software\ArcSoft]  
[HKEY_CURRENT_USER\software\ASIO]  
[HKEY_CURRENT_USER\software\Avira]  
[HKEY_CURRENT_USER\software\Axantum]  
[HKEY_CURRENT_USER\software\BitDefender]  
[HKEY_CURRENT_USER\software\Canon]  
[HKEY_CURRENT_USER\software\cbss]  
[HKEY_CURRENT_USER\software\CDDB]  
[HKEY_CURRENT_USER\software\Clients]  
[HKEY_CURRENT_USER\software\DAMN]  
[HKEY_CURRENT_USER\software\DirectShow]  
[HKEY_CURRENT_USER\software\DivXNetworks]  
[HKEY_CURRENT_USER\software\DT Soft]  
[HKEY_CURRENT_USER\software\FreeTime]  
[HKEY_CURRENT_USER\software\Gabest]  
[HKEY_CURRENT_USER\software\GNU]  
[HKEY_CURRENT_USER\software\Google]  
[HKEY_CURRENT_USER\software\Haali]  
[HKEY_CURRENT_USER\software\IM Providers]  
[HKEY_CURRENT_USER\software\ImTOO]  
[HKEY_CURRENT_USER\software\JavaSoft]  
[HKEY_CURRENT_USER\software\Local AppWizard-Generated Applications]  
[HKEY_CURRENT_USER\software\Macromedia]  
[HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware]  
[HKEY_CURRENT_USER\software\MediaNavigation]  
[HKEY_CURRENT_USER\software\Microsoft]  
[HKEY_CURRENT_USER\software\MozillaPlugins]  
[HKEY_CURRENT_USER\software\Nero]  
[HKEY_CURRENT_USER\software\Netscape]  
[HKEY_CURRENT_USER\software\NVIDIA Corporation]  
[HKEY_CURRENT_USER\software\ODBC]  
[HKEY_CURRENT_USER\software\Opera Software]  
[HKEY_CURRENT_USER\software\pdf-convert]  
[HKEY_CURRENT_USER\software\PDFCreator]  
[HKEY_CURRENT_USER\software\Pinnacle Systems]  
[HKEY_CURRENT_USER\software\Piriform]  
[HKEY_CURRENT_USER\software\Policies]  
[HKEY_CURRENT_USER\software\Realtek]  
[HKEY_CURRENT_USER\software\Red Giant Software]  
[HKEY_CURRENT_USER\software\Roxio]  
[HKEY_CURRENT_USER\software\Safer Networking Limited]  
[HKEY_CURRENT_USER\software\Search Settings]  
[HKEY_CURRENT_USER\software\Settings]  
[HKEY_CURRENT_USER\software\Show & Tell, Inc.]  
[HKEY_CURRENT_USER\software\Softonic]  
[HKEY_CURRENT_USER\software\Sonic]  
[HKEY_CURRENT_USER\software\Sony Corporation]  
[HKEY_CURRENT_USER\software\Sony Creative Software]  
[HKEY_CURRENT_USER\software\SpecItems]  
[HKEY_CURRENT_USER\software\Steinberg]  
[HKEY_CURRENT_USER\software\Steinberg Media Technologies GmbH]  
[HKEY_CURRENT_USER\software\Steinberg Media Techologies GmbH]  
[HKEY_CURRENT_USER\software\TC Works]  
[HKEY_CURRENT_USER\software\Trolltech]  
[HKEY_CURRENT_USER\software\VB and VBA Program Settings]  
[HKEY_CURRENT_USER\software\VOB]  
[HKEY_CURRENT_USER\software\Widcomm]  
[HKEY_CURRENT_USER\software\WinRAR]  
[HKEY_CURRENT_USER\software\WinRAR SFX]  
[HKEY_CURRENT_USER\software\Wow6432Node]  
[HKEY_CURRENT_USER\software\Classes]  

[HKEY_LOCAL_MACHINE\software\14919ea49a8f3b4aa3cf1058d9a64cec]  
[HKEY_LOCAL_MACHINE\software\7-Zip]  
[HKEY_LOCAL_MACHINE\software\Adobe]  
[HKEY_LOCAL_MACHINE\software\America Online]  
[HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.]  
[HKEY_LOCAL_MACHINE\software\Apple Inc.]  
[HKEY_LOCAL_MACHINE\software\Application Updater]  
[HKEY_LOCAL_MACHINE\software\ArcSoft]  
[HKEY_LOCAL_MACHINE\software\ASIO]  
[HKEY_LOCAL_MACHINE\software\Avidemux 2.5]  
[HKEY_LOCAL_MACHINE\software\Avira]  
[HKEY_LOCAL_MACHINE\software\AviSynth]  
[HKEY_LOCAL_MACHINE\software\Canon]  
[HKEY_LOCAL_MACHINE\software\CCleaner]  
[HKEY_LOCAL_MACHINE\software\CDDB]  
[HKEY_LOCAL_MACHINE\software\Conduit]  
[HKEY_LOCAL_MACHINE\software\Corel]  
[HKEY_LOCAL_MACHINE\software\DAMN]  
[HKEY_LOCAL_MACHINE\software\Debug]  
[HKEY_LOCAL_MACHINE\software\Digital River]  
[HKEY_LOCAL_MACHINE\software\DivX]  
[HKEY_LOCAL_MACHINE\software\DT Soft]  
[HKEY_LOCAL_MACHINE\software\FAST Multimedia]  
[HKEY_LOCAL_MACHINE\software\GNU]  
[HKEY_LOCAL_MACHINE\software\Google]  
[HKEY_LOCAL_MACHINE\software\GPL Ghostscript]  
[HKEY_LOCAL_MACHINE\software\HaaliMkx]  
[HKEY_LOCAL_MACHINE\software\HighCriteria]  
[HKEY_LOCAL_MACHINE\software\illiminable]  
[HKEY_LOCAL_MACHINE\software\Intel]  
[HKEY_LOCAL_MACHINE\software\JavaSoft]  
[HKEY_LOCAL_MACHINE\software\JreMetrics]  
[HKEY_LOCAL_MACHINE\software\Macromedia]  
[HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware]  
[HKEY_LOCAL_MACHINE\software\McAfeeInstaller]  
[HKEY_LOCAL_MACHINE\software\Microsoft]  
[HKEY_LOCAL_MACHINE\software\Mozilla]  
[HKEY_LOCAL_MACHINE\software\mozilla.org]  
[HKEY_LOCAL_MACHINE\software\MozillaPlugins]  
[HKEY_LOCAL_MACHINE\software\Nero]  
[HKEY_LOCAL_MACHINE\software\Netscape]  
[HKEY_LOCAL_MACHINE\software\ODBC]  
[HKEY_LOCAL_MACHINE\software\Opera Software]  
[HKEY_LOCAL_MACHINE\software\Panda Software]  
[HKEY_LOCAL_MACHINE\software\PDFCreator]  
[HKEY_LOCAL_MACHINE\software\pdfforge]  
[HKEY_LOCAL_MACHINE\software\Pegasus Imaging]  
[HKEY_LOCAL_MACHINE\software\PegasusImaging]  
[HKEY_LOCAL_MACHINE\software\Pinnacle Systems]  
[HKEY_LOCAL_MACHINE\software\Propellerhead Software]  
[HKEY_LOCAL_MACHINE\software\PSCONVDriver]  
[HKEY_LOCAL_MACHINE\software\Realtek]  
[HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.]  
[HKEY_LOCAL_MACHINE\software\Red Giant Software]  
[HKEY_LOCAL_MACHINE\software\Roxio]  
[HKEY_LOCAL_MACHINE\software\Safer Networking Limited]  
[HKEY_LOCAL_MACHINE\software\Search Settings]  
[HKEY_LOCAL_MACHINE\software\Softonic_France]  
[HKEY_LOCAL_MACHINE\software\Sony Corporation]  
[HKEY_LOCAL_MACHINE\software\Sony Creative Software]  
[HKEY_LOCAL_MACHINE\software\Sony Media Software]  
[HKEY_LOCAL_MACHINE\software\Steinberg]  
[HKEY_LOCAL_MACHINE\software\Universalis]  
[HKEY_LOCAL_MACHINE\software\VideoLAN]  
[HKEY_LOCAL_MACHINE\software\Volatile]  
[HKEY_LOCAL_MACHINE\software\VST]  
[HKEY_LOCAL_MACHINE\software\Waves]  
[HKEY_LOCAL_MACHINE\software\X-AVCSD]  
[HKEY_LOCAL_MACHINE\software\Classes]  
[HKEY_LOCAL_MACHINE\software\Clients]  
[HKEY_LOCAL_MACHINE\software\Policies]  
[HKEY_LOCAL_MACHINE\software\RegisteredApplications]  

¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤

Present !! : C:\ProgramData\.wtav  
Present !! : C:\ProgramData\imgpdf2.dll  
Present !! : C:\ProgramData\MusicStation.log  
Present !! : C:\ProgramData\MusicStation.xml  
Present !! : C:\ProgramData\.wtav  
Present !! : C:\ProgramData\imgpdf2.dll  
Present !! : C:\ProgramData\MusicStation.log  
Present !! : C:\ProgramData\MusicStation.xml  
Present !! : C:\ProgramData\.wtav  
Present !! : C:\ProgramData\imgpdf2.dll  
Present !! : C:\ProgramData\MusicStation.log  
Present !! : C:\ProgramData\MusicStation.xml  
Present !! : C:\ProgramData\.wtav  
Present !! : C:\ProgramData\imgpdf2.dll  
Present !! : C:\ProgramData\MusicStation.log  
Present !! : C:\ProgramData\MusicStation.xml  
Present !! : C:\Program Files (x86)\Mozilla FireFox\extensions\searchsettings@spigot.com  
Present !! : C:\Program Files (x86)\pdfforge Toolbar\SearchSettings.dll  
Present !! : C:\Windows\Fonts\img hearts.ttf  
Present !! : C:\Windows\Fonts\img travel.ttf  
Present !! : C:\Users\utilisateur\.COMMgr  
Present !! : C:\Users\utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run : SearchSettings  
Present !! : HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run : SearchSettings  
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {D4027C7F-154A-4066-A1AD-4243D8127440}  
Present !! : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks : {E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoFolderOptions  
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop  
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktopChanges  
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoSetFolders  
Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : RestrictCpl  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableRegistryTools  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableTaskMgr  
Present !! : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"  
Present !! : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"  
Present !! : "HKCU\Software\Search Settings"  
Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"  
Present !! : "HKLM\Software\Search Settings"  
Present !! : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Present !! : HKCU\Software\AppDataLow\Software\pdfforge  
Present !! : HKCU\Software\AppDataLow\Software\PriceGong  
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}  
Present !! : HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Present !! : HKLM\Software\Conduit  
Present !! : HKLM\Software\pdfforge  

FEATURE_BROWSER_EMULATION | svchost : 
====================================
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-12 21:32:31
Windows 6.1.7600  WOW64 FAT NTAPI

detected NTDLL code modification:
ZwEnumerateKey 0 != 47, ZwQueryKey 0 != 19, ZwOpenKey 0 != 15, ZwClose 0 != 12, ZwEnumerateValueKey 0 != 16, ZwQueryValueKey 0 != 20, ZwOpenFile 0 != 48, ZwQueryDirectoryFile 0 != 50, ZwQuerySystemInformation 0 != 51Initialization error


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: error reading MBR 

¤¤¤¤¤¤¤¤¤¤ Programs ¤¤¤¤¤¤¤¤¤¤

1.0.0.07310
3.1.0.09080
4.1.0.08270
1.4.0.0a-FRA
3herosoft Video Converter 3.5.4.0925
7-Zip 4.65
Adobe Flash Player 10 ActiveX 10.0.32.18
Adobe Flash Player 10 Plugin 10.1.85.3
Adobe Reader 9.2 - Français 9.2.0
Advertising Center 0.0.0.2
Apple Application Support 1.2.1
Apple Software Update 2.1.1.116
ArcSoft Magic-i Visual Effects 2 2.0.1.85
ArcSoft PhotoStudio 6 6.0.1.132
ArcSoft WebCam Companion 3 3.0.21.193
Avidemux 2.5 2.5.3.0
Avira AntiVir Premium 10.0.0.81
CCleaner 2.33
CD-LabelPrint
CamStudio 2.0 Fr
Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data
Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data
Canon MP Navigator EX 3.0
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Easy-PhotoPrint Pro
Canon Utilities My Printer
Canon Utilities Solution Menu
Convert PDF To Image
Corel WinDVD 10.0.5.109
DolbyFiles 2.0
Encyclopaedia Universalis 2010 2010.0.0.0
Enregistrement utilisateur de Canon MP990 series
Evernote 3.5.0.545
FormatFactory 2.45 2.45
Free PS Convert driver 8.15
Galerie de photos Windows Live 14.0.8081.709
Gestion de l?alimentation de VAIO 5.0.0.11300
Google Chrome 6.0.472.63
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer 1.0.0
Google Update Helper 1.2.183.23
ImTOO 3GP Video Converter 5.1.22.0305
Installation Windows Live 14.0.8089.726
Installation Windows Live 14.0.8089.0726
Intel(R) Turbo Boost Technology Driver 01.00.00.1030
Java(TM) 6 Update 16 6.0.160
Junk Mail filter update 14.0.8089.726
Knoll Light Factory EZ Studio
List_Kill'em
MSVCRT 14.0.1468.721
MSXML 4.0 SP2 (KB954430) 4.20.9870.0
MSXML 4.0 SP2 (KB973688) 4.20.9876.0
Magic Bullet Looks Studio
Malwarebytes' Anti-Malware
Media Gallery 1.1.0.10210
Media Gallery 1.1.0.10210
Microsoft Choice Guard 2.0.48.0
Microsoft Office Live Add-in 1.5 2.0.4024.1
Microsoft Office PowerPoint Viewer 2007 (French) 12.0.6425.1000
Microsoft Office Professional Edition 2003 11.0.5614.0
Microsoft Office Suite Activation Assistant 2.9
Microsoft SQL Server 2005 Compact Edition [ENU] 3.1.0000
Microsoft SQL Server Compact 3.5 SP1 English 3.5.5692.0
Microsoft Silverlight 4.0.50524.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable 8.0.59193
Microsoft Visual C++ 2005 Redistributable 8.0.56336
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 9.0.30729.4148
Microsoft Works 9.7.0621
Module de compatibilité pour Microsoft Office System 2007 12.0.6425.1000
Mozilla Firefox (3.6.10) 3.6.10 (fr)
MusicStation 2.0.0.1067
Nero ControlCenter 9.0.0.1
Nero Installer 4.4.9.0
Norton Online Backup 1.2.20.0
Opera 10.62 10.62
Outil de restauration de données VAIO 1.2.0.09150
Outil de téléchargement Windows Live 14.0.8014.1029
PDFCreator 1.0.1
PMB 5.0.00.10260
PMB VAIO Edition Guide 1.0.00.09250
PMB VAIO Edition Guide 1.0.00.09250
PMB VAIO Edition plug-in (Click to Disc) 3.0.01.11230
PMB VAIO Edition plug-in (Click to Disc) 3.0.01.11230
PMB VAIO Edition plug-in (VAIO Image Optimizer) 1.0.00.10150
PMB VAIO Edition plug-in (VAIO Image Optimizer) 1.0.00.10150
PMB VAIO Edition plug-in (VAIO Movie Story) 2.0.01.12010
PMB VAIO Edition plug-in (VAIO Movie Story) 2.0.01.12010
Panda ActiveScan 2.0 01.04.01.0000
Paramètres de contrôle du contenu VAIO 2.4.1.09180
Paramètres des fonctions d'origine VAIO 2.0.0.07010
Pinnacle Studio 14 14.0.0.7255
Pinnacle Studio Ultimate Collection Plugins 14.0.0.7255
Prise en charge du transfert VAIO 1.1.0.10200
QuickTime 7.66.71.0
Realtek High Definition Audio Driver 6.0.1.5964
Red Giant ToonIt Studio
Roxio Central Audio 3.8.0
Roxio Central Copy 3.8.0
Roxio Central Core 3.8.0
Roxio Central Data 3.8.0
Roxio Central Tools 3.8.0
Roxio Easy Media Creator 10 LJ 10.3
Roxio Easy Media Creator Home 10.3.183
Setting Utility Series 5.1.0.11200
Softonic_France Toolbar 5.7.2.2
Sony Home Network Library 2.0.1.10160
Sony Home Network Library 2.0.1.10160
Sound Forge Pro 10.0 10.0.368
Spybot - Search & Destroy 1.6.2
Steinberg Cubase 5 5.1.0
Steinberg Drum Loop Expansion 01 1.0.0.1
Steinberg Groove Agent ONE Content 1.0.0.003
Steinberg HALionOne 1.1.0.457
Steinberg HALionOne Additional Content Set 01 1.0.0.001
Steinberg HALionOne Expression Set 1.0.1.0
Steinberg HALionOne GM Drum Set 1.0.1.457
Steinberg HALionOne GM Set 1.0.1.457
Steinberg HALionOne Pro Set 1.0.1.457
Steinberg HALionOne Studio Drum Set 1.0.1.457
Steinberg HALionOne Studio Set 1.0.1.457
Steinberg LoopMash Content 1.0.0.005
Steinberg REVerence Content 01 1.0.0.006
TC.Works.Native.Bundle.v3.0.VST.WinAll-cRime
Trapcode 3DStroke Studio
Trapcode Particular Studio
Trapcode Shine Studio
UseNeXT
VAIO Care 5.0.4.11200
VAIO Content Metadata Intelligent Analyzing Manager 3.6.0.09250
VAIO Content Metadata Intelligent Analyzing Manager 3.6.0.09250
VAIO Content Metadata Intelligent Analyzing Manager 3.6.0.09250
VAIO Content Metadata Intelligent Analyzing Manager 3.6.0.09250
VAIO Content Metadata Intelligent Network Service Manager 3.6.0.09080
VAIO Content Metadata Intelligent Network Service Manager 3.6.0.09080
VAIO Content Metadata Intelligent Network Service Manager 3.6.0.09080
VAIO Content Metadata Manager Settings 3.6.0.09240
VAIO Content Metadata Manager Settings 3.6.0.09240
VAIO Content Metadata XML Interface Library 3.6.0.09080
VAIO Content Metadata XML Interface Library 3.6.0.09080
VAIO Content Metadata XML Interface Library 3.6.0.09080
VAIO Content Monitoring Settings 2.4.1.09180
VAIO Control Center 4.1.0.10160
VAIO DVD Menu Data 2.0.00.10130
VAIO Data Restore Tool 1.2.0.09150
VAIO Entertainment Platform 3.6.0.09150
VAIO Entertainment Platform 3.6.0.09150
VAIO Event Service 5.1.0.11300
VAIO Gate 1.2.0.09240
VAIO Gate Default 1.0.0.10290
VAIO Hardware Diagnostics 3.9.1
VAIO Marketing Tools
VAIO Media plus 2.0.1.10160
VAIO Media plus Opening Movie 1.2.0.09100
VAIO Movie Story Template Data 2.0.00.09240
VAIO Movie Story Template Data 2.0.00.09240
VAIO Original Function Settings 2.0.0.07010
VAIO Personalization Manager 2.0.0.06220
VAIO Personalization Manager 2.0.0.06220
VAIO Personalization Manager 2.0.0.06220
VAIO Premium Partners 1.0
VAIO Smart Network 3.1.0.11250
VAIO Update 5 5.0.0.10300
VAIO Wallpaper Contents 2.0.0.06010
VAIO Window Organizer 2.0.0.08280
VAIO screensaver 1.0.0.0
VLC media player 1.1.4 1.1.4
Waves Mercury Bundle 5.0
Windows Live Call 14.0.8064.0206
Windows Live Communications Platform 14.0.8064.206
Windows Live FolderShare 14.0.8089.726
Windows Live Mail 14.0.8089.0726
Windows Live Messenger 14.0.8089.0726
Windows Live Writer 14.0.8089.0726
Windows Media Player Firefox Plugin 1.0.0.8
pdfforge Toolbar v1.1.2 1.1.2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:35:12,93

benurrr · Answer

Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau. 
mais cette fois-ci : 

choisis l'option CLEAN 

laisse travailler l'outil. 

en fin de scan la fenêtre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau

RobertS64 · Answer

rien ne se passe....
Que dois-je faire?

S'agit il du fichier "more"?

benurrr · Answer

windows 7 => clic droit "exécuter en tant que administrateur

gen-hackman · Answer

salut Benurr explorer est patché......  

le bon est celui-ci il me semble : 9aaaec8dac27aa17b053e6352ad233ae 

¤¤¤¤¤¤?G3?-?@¢??@?(TM)©®?¤¤¤¤¤&#164

RobertS64 · Answer

à part la fenètre SEARCH, CLEAN etc..il n'y a rien d'autre..
Tout à l'heure, il y avait une fenetre avec la progression du scan....

benurrr · Answer

"pour le clean de list_kill'em s'il ne fonctionne pas :
executer clic droit en tant qu'administrateur :
C:\Program Files (X86)\List_kill'em\del_reg " 

j'attends un message de gen-hackman le concepteur du tool 

a toute suite 
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C.., 
Mais C.. de penser que ­tu es libre...Merci a australe13

RobertS64 · Answer

le CLEAN s'est bien effectué... mais le problème de mise en carafe de "explorer" puis de sa récupération par Windows 7 tourne en séquence ininterrompue sans arrêt...

benurrr · Answer

poste le rapport Kill'em.txt qui se trouve sur ton bureau

* Démarrer une invite de commandes en mode administrateur de la façon suivante: 
      Cliquez sur Démarrer/(Tous les)Programmes/Accessoires puis cliquez droit sur Invite de commandes. Choisissez Exécuter en tant qu'Administrateur. 

    * Dans la fenêtre noire qui s'ouvre, copiez-collez la commande suivante puis appuyez sur la touche Entrée. 

          sfc /verifyonly 

    * L'analyse du système se lance et peut durer plus ou moins longtemps en fonction de la puissance de votre ordinateur. 


      Vous pouvez suivre la progression de la tâche en surveillant le % d'avancement affiché. 
    * Lorsque la vérification se termine, le verdict tombe: 

un message va s'inscrire note le  
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C.., 
Mais C.. de penser que ­tu es libre...Merci a australe13

RobertS64 · Answer

voici le rapport kill'em:

¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.9 ¤¤¤¤¤¤¤¤¤¤ 
 
User : utilisateur (Administrateurs) 
Update on 09/10/2010 by g3n-h@ckm@n ::::: 15.30
Start at: 23:42:53 | 12/10/2010

Intel(R) Core(TM) i5 CPU       M 520  @ 2.40GHz
Microsoft Windows 7 Professionnel  (6.1.7600 64-bit) # 
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 455,7 Go (241,33 Go free) | NTFS
D:\ -> Disque amovible
E:\ -> Disque amovible
F:\ -> Disque CD-ROM
H:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\ProgramData\.wtav 
Quarantined & Deleted !! : C:\ProgramData\imgpdf2.dll 
Quarantined & Deleted !! : C:\ProgramData\MusicStation.log 
Quarantined & Deleted !! : C:\ProgramData\MusicStation.xml 
Quarantined & Deleted !! : C:\Windows\Fonts\img hearts.ttf 
Quarantined & Deleted !! : C:\Windows\Fonts\img travel.ttf 
 
Quarantined & Deleted !! : C:\Users\utilisateur\.COMMgr 
Quarantined & Deleted !! : C:\Users\utilisateur\AppData\Local\GDIPFONTCACHEV1.DAT 
Quarantined & Deleted !! : C:\Users\utilisateur\LOCAL Settings\Temp\catchme.dll 
 
¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1       localhost   

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run : SearchSettings  
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {D4027C7F-154A-4066-A1AD-4243D8127440}  
Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks : {E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoFolderOptions  
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktop  
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoActiveDesktopChanges  
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : NoSetFolders  
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer : RestrictCpl  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableRegistryTools  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableTaskMgr  
Deleted : "HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings"  
Deleted : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"  
Deleted : "HKCU\Software\Search Settings"  
Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}"  
Deleted : "HKLM\Software\Search Settings"  
Deleted : HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}  
Deleted : HKCU\Software\AppDataLow\Software\pdfforge  
Deleted : HKCU\Software\AppDataLow\Software\PriceGong  
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}  
Deleted : HKLM\Software\Conduit  
Deleted : HKLM\Software\pdfforge  

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.msn.com/fr-fr/?ocid=iehp
Local Page	=         	C:\WINDOWS\system32\blank.htm
Default_Search_URL	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL	=         	https://www.msn.com/fr-fr/?ocid=iehp
Search Page	=         	https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	=         	https://www.google.com/?gws_rd=ssl
Local Page	=         	C:\WINDOWS\system32\blank.htm
Search Page	=         	http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] 
FirstRunDisabled	=      	1 () 
AntiVirusDisableNotify	=      	0 (0x0) 
FirewallDisableNotify	=      	0 (0x0) 
UpdatesDisableNotify	=      	0 (0x0) 
AntiVirusOverride	=      	0 (0x0) 
FirewallOverride	=      	0 (0x0) 
 
¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Wlansvc : Start = 2   
 SharedAccess : Start = 2   
 windefend : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK 
Prefetch cleaned 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ 

FEATURE_BROWSER_EMULATION | svchost : 
====================================
 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: error reading MBR 
 
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

RobertS64 · Answer

l'analyse ne se lance pas aprés verfonly..
Des lignes de textes apparaissent et je dois taper quelque chose aprés:

c:\users\utilisateur

benurrr · Answer

oui sa sfc /verifyonly  fait un copier coller
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C.., 
Mais C.. de penser que ­tu es libre...Merci a australe13

RobertS64 · Answer

Voici le rapport de verify only qui indique des violations d'intégrité 2010-08-27 13:20:06, Info CBS Starting TrustedInstaller initialization. 2010-08-27 13:20:06, Info CBS Loaded Servicing Stack v6.1.7600.16385 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\cbscore.dll 2010-08-27 13:20:07, Info CSI 00000001@2010/8/27:11:20:07.838 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feecd2e9a1 @0x7feed598755 @0x7feed562ac7 @0xff37e94c @0xff37d769 @0xff37daff) 2010-08-27 13:20:07, Info CSI 00000002@2010/8/27:11:20:07.843 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feecd2e9a1 @0x7feed5e500e @0x7feed5b1504 @0x7feed562b9d @0xff37e94c @0xff37d769) 2010-08-27 13:20:07, Info CSI 00000003@2010/8/27:11:20:07.846 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feecd2e9a1 @0x7feed728728 @0x7feed728856 @0xff37e444 @0xff37d7ae @0xff37daff) 2010-08-27 13:20:07, Info CBS Ending TrustedInstaller initialization. 2010-08-27 13:20:07, Info CBS Starting the TrustedInstaller main loop. 2010-08-27 13:20:07, Info CBS TrustedInstaller service starts successfully. 2010-08-27 13:20:07, Info CBS SQM: Initializing online with Windows opt-in: False 2010-08-27 13:20:07, Info CBS SQM: Cleaning up report files older than 10 days. 2010-08-27 13:20:07, Info CBS SQM: Requesting upload of all unsent reports. 2010-08-27 13:20:07, Info CBS SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x80004005 - E_FAIL] 2010-08-27 13:20:07, Info CBS SQM: Failed to start standard sample upload. [HRESULT = 0x80004005 - E_FAIL] 2010-08-27 13:20:07, Info CBS SQM: Queued 0 file(s) for upload with pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6 2010-08-27 13:20:07, Info CBS SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x80004005 - E_FAIL] 2010-08-27 13:20:07, Info CBS No startup processing required, TrustedInstaller service was not set as autostart, or else a reboot is still pending. 2010-08-27 13:20:07, Info CBS NonStart: Checking to ensure startup processing was not required. 2010-08-27 13:20:07, Info CSI 00000004 IAdvancedInstallerAwareStore_ResolvePendingTransactions (call 1) (flags = 00000004, progress = NULL, phase = 0, pdwDisposition = @0x195f910 2010-08-27 13:20:07, Info CSI 00000005 Creating NT transaction (seq 1), objectname [6]"(null)" 2010-08-27 13:20:07, Info CSI 00000006 Created NT transaction (seq 1) result 0x00000000, handle @0x1f0 2010-08-27 13:20:07, Info CSI 00000007@2010/8/27:11:20:07.968 CSI perf trace: CSIPERF:TXCOMMIT;742 2010-08-27 13:20:07, Info CBS NonStart: Success, startup processing not required as expected. 2010-08-27 13:20:07, Info CBS Startup processing thread terminated normally 2010-08-27 13:20:07, Info CSI 00000008 CSI Store 1739568 (0x00000000001a8b30) initialized 2010-08-27 13:20:07, Info CBS Session: 30098905_3459428009 initialized by client WindowsUpdateAgent. 2010-08-27 13:20:08, Info CBS Mismatch between open element and close element [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS Failed to get next element [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS Invalid enum string [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS unexpected string [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS Failed to get next package root element [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS failed to process package [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS Wrong package format [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS Invalid xml format [HRESULT = 0x800f080d - CBS_E_MANIFEST_INVALID_ITEM] 2010-08-27 13:20:08, Info CBS Manifest parsing error at line: 1, context:

benurrr · Answer

Si une violation d'intégrité a été révélée par la vérification, il va falloir maintenant réparer.

Pour cela:

    * Démarrez de nouveau une invite de commandes en mode Administrateur (Cliquez sur Démarrer/(Tous les)Programmes/Accessoires puis cliquez droit sur Invite de commandes. Choisissez Exécuter en tant qu'Administrateur).
    * Copiez-collez cette fois, dans la fenêtre de commandes, la commande suivante:

          sfc /scannow

    * Une nouvelle analyse va débuter qui sera plus longue que la vérification. Donc, patientez!
    * A la fin, Windows vous dit s'il a pu réparer ou pas et vous demande de redémarrer le PC pour achever la réparation.

RobertS64 · Answer

tout a l'air de marcher....sauf que je n'ai pu coller le rapport CBS.log qui a l'air gigantesque...

faut il utiliser Ccleaner pour analyser le registre pour finir ?

En tous les cas merci beaucoup vraiment et pour l'attitude et pour la compétence

benurrr · Answer

mon explorer n'arrete pas de se mettre en panne et est récupéré par windows 7.
c'est un aller et retour permanent.  et sa c'est bon ?

RobertS64 · Answer

merci encore............tput a l'air de bien aller

benurrr · Answer

Télécharge DelFix sur ton bureau.

http://sd-1.archive-host.com/membres/up/17959594961240255/DelFix.exe

3.1 - Option Recherche

Téléchargez DelFix sur votre bureau.
Lancez le, tapez 1 et validez en appuyant sur [Entrée]
Patientez quelques secondes puis copiez/collez le contenu du rapport qui s'ouvrira sur le forum qui vous prend en charge.

Note : Le rapport est sauvegardé sous C:\DelFixSearch.txt

-------------------------

3.2 - Option Suppression

Téléchargez DelFix sur votre bureau
Lancez le, tapez 2 et validez en appuyant sur [Entrée]
Patientez quelques secondes puis copiez/collez le contenu du rapport qui s'ouvrira sur le forum qui vous prend en charge.

Note : Le rapport est sauvegardé sous C:\DelFixSuppr.txt

PC infecté ?

21 réponses

Newsletters