Virus causant divers problèmes sur mon PC...
Résolu
Bonjour, je reçois plusieurs virus par jour que je met en quarantaine ou que je supprime. Très souvent au démarrage il revienne même après avoir coché la case "répéter cette action sans demander pour ce type de virus."!
Je sollicite votre aide une seconde fois pendant que mon pc n'est pas encore complètement foutu...
Mes problèmes:
-Étant administrateur je n'ai pas accès au panneau de configuration car je ne suis pas administrateur O_o' !
-Divers problème apparaissent de temps en temps tel que : le PC ne sais plus avec quel logiciel ouvrir un fichier donc l'extension est ... (pour tout les type de fichier) au redémarrage ça re-fonctionne -_-'
-Les antivirus que "Avira AntiVir Personal" supprime revienne après redémarrage...
-Firefox ne me connecte plus automatiquement même après suppressions des cookies etc... et activation de l'option pour loger automatiquement sur les sites....
Constatations bisares a mes yeux:
-Je ne lag pas pour autant...
-Pas de problèmes d'extinction s du PC toute seule etc...
-Pas de problème perte de compte ou autres...
Je suis ouvert à tour!
Merci, Bye
Je sollicite votre aide une seconde fois pendant que mon pc n'est pas encore complètement foutu...
Mes problèmes:
-Étant administrateur je n'ai pas accès au panneau de configuration car je ne suis pas administrateur O_o' !
-Divers problème apparaissent de temps en temps tel que : le PC ne sais plus avec quel logiciel ouvrir un fichier donc l'extension est ... (pour tout les type de fichier) au redémarrage ça re-fonctionne -_-'
-Les antivirus que "Avira AntiVir Personal" supprime revienne après redémarrage...
-Firefox ne me connecte plus automatiquement même après suppressions des cookies etc... et activation de l'option pour loger automatiquement sur les sites....
Constatations bisares a mes yeux:
-Je ne lag pas pour autant...
-Pas de problèmes d'extinction s du PC toute seule etc...
-Pas de problème perte de compte ou autres...
Je suis ouvert à tour!
Merci, Bye
95 réponses
Résumé de la discussion
Le fil décrit des infections sur Windows Vista qui reviennent au démarrage malgré la quarantaine, des difficultés d’accès au panneau de configuration en tant qu’administrateur et des problèmes d’ouverture des fichiers liés aux extensions. Des éléments de réponse préconisent des outils de nettoyage spécialisés tels que ComboFix (renommer l’exécutable et désactiver la protection en temps réel), Defogger et TDSSKiller, puis Ad-Remover. Des analyses de fichiers via VirusTotal et les rapports générés par les outils, tels que OTL et Combofix, servent à confirmer les menaces et orienter les étapes suivantes du nettoyage. En cas de difficultés persistantes, certaines réponses encouragent la désactivation temporaire d’outils de virtualisation ou d’émulation (Daemon Tools) qui peuvent gêner les outils de désinfection.
-
salut il ne faut pas poster plusieurs fois pour un meme sujet
Télécharge ici :OTL
▶ enregistre le sur ton Bureau.
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur OTL.exe pour le lancer.
▶ Coche les 2 cases Lop et Purity
▶ Coche la case devant tous les utilisateurs
▶ règle age du fichier sur "60 jours"
▶ dans la moitié gauche , mets tout sur "tous"
ne modifie pas ceci :
"fichiers créés" et "fichiers Modifiés"
▶Clic sur Analyse.
A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).
Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)
▶▶▶ NE LE POSTE PAS SUR LE FORUM
Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/
▶ Clique sur Parcourir et cherche le fichier ci-dessus.
▶ Clique sur Ouvrir.
▶ Clique sur "Cliquez ici pour déposer le fichier".
juste au niveau du bouton , en fin de chargement du fichier , Un lien de cette forme apparaitra :
http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt
▶ Copie ce lien dans ta réponse.
▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.
-
▶ Télécharge TDSSKiller
▶ Lance le ( Utilisateurs de vista/Seven -> Clic droit puis " Exécuter en tant que........... " )
L'outil va télécharger automatiquement la dernière version de TDSSKiller puis lancera une analyse.
Patiente pendant le scan. A la fin de l'analyse, appuies sur une touche. Un rapport va s'ouvrir.
▶ Copie/Colle son contenu dans ta prochaine réponse.
Note : Le rapport se trouve également sous C:\tdsskiller.txt. -
/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\
__________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================
▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur
Telecharge ici : Combofix
Avant d'utiliser ComboFix :
Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :
▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau
▶ Lance le
Une fenêtre apparait : clique sur "Disable"
▶ Fais redémarrer l'ordinateur si l'outil te le demande
Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"
_________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur combofix renommé
▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!
▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
-
▶ Télécharge ici : Ad-remover sur ton bureau :
▶ Déconnecte toi et ferme toutes applications en cours !
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
▶ sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .
▶ clique le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
▶ Au menu principal choisis "option Nettoyer" et tape sur [entrée] .
▶ Laisse travailler l'outil et ne touche à rien ...
▶ Poste le rapport qui apparait à la fin , sur le forum ...
( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )
▶ Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
-
salut
Fais analyser le(s) fichier(s) suivants sur Virustotal :
Virus Total
* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :
c:\windows\System32\shsvcs.dll
* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse. -
ok on a repondu en meme temps quand tu as mis le rapport du coup ca a altéré les choses lol
Fais analyser le(s) fichier(s) suivants sur Virustotal :
Virus Total
* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :
c:\users\Arthur\AppData\Roaming\Keylog_blackshades_fud.exe
c:\users\Arthur\AppData\Roaming\cyclops public hack.exe
* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse.
¤¤¤¤¤¤?G3?-?@¢??@?(TM)©®?¤¤¤¤¤¤ -
Merci je fait ça mais, jen e voyait pas mon autre poste suote a une erreur qui me redirigeait^^
Merci. -
Voici le fichier OTL.txt http://www.cijoint.fr/cjlink.php?file=cj201010/cij9Vn4WoP.txt
Merci encore -
Euh il a fait l'analyse en 1 minute seulement et a la fin il n y avait apparement aucune infection et le fichier texte que vous voulez est vide...
-
Bisard a la fin du scan il n y avais rien dans le fichier texte mais la il y a quelque chose^^
2010/10/18 18:08:02.0978 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/18 18:08:02.0979 ================================================================================
2010/10/18 18:08:02.0979 SystemInfo:
2010/10/18 18:08:02.0979
2010/10/18 18:08:02.0979 OS Version: 6.0.6001 ServicePack: 1.0
2010/10/18 18:08:02.0979 Product type: Workstation
2010/10/18 18:08:02.0979 ComputerName: PCSUPERPUISSANT
2010/10/18 18:08:02.0979 UserName: Arthur
2010/10/18 18:08:02.0979 Windows directory: C:\Windows
2010/10/18 18:08:02.0979 System windows directory: C:\Windows
2010/10/18 18:08:02.0979 Processor architecture: Intel x86
2010/10/18 18:08:02.0979 Number of processors: 4
2010/10/18 18:08:02.0979 Page size: 0x1000
2010/10/18 18:08:02.0979 Boot type: Normal boot
2010/10/18 18:08:02.0979 ================================================================================
2010/10/18 18:08:03.0470 Initialize success
2010/10/18 18:08:21.0152 ================================================================================
2010/10/18 18:08:21.0152 Scan started
2010/10/18 18:08:21.0152 Mode: Manual;
2010/10/18 18:08:21.0153 ================================================================================
2010/10/18 18:08:23.0440 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2010/10/18 18:08:23.0572 adfs (6d7f09cd92a9fef3a8efce66231fdd79) C:\Windows\system32\drivers\adfs.sys
2010/10/18 18:08:23.0704 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2010/10/18 18:08:23.0735 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2010/10/18 18:08:23.0832 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2010/10/18 18:08:23.0866 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2010/10/18 18:08:24.0016 AFD (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2010/10/18 18:08:24.0202 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2010/10/18 18:08:24.0276 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2010/10/18 18:08:24.0332 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2010/10/18 18:08:24.0424 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2010/10/18 18:08:24.0485 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2010/10/18 18:08:24.0590 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2010/10/18 18:08:24.0652 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2010/10/18 18:08:24.0792 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2010/10/18 18:08:24.0841 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2010/10/18 18:08:25.0119 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/10/18 18:08:25.0244 atapi (4f4fcb8b6ea06784fb6d475b7ec7300f) C:\Windows\system32\drivers\atapi.sys
2010/10/18 18:08:25.0340 avgio (f1d43170fdd7399ee17ea32d4f868b0c) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2010/10/18 18:08:25.0439 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2010/10/18 18:08:25.0537 avipbb (ad9bd66a862116e79cb45bb6be46055f) C:\Windows\system32\DRIVERS\avipbb.sys
2010/10/18 18:08:25.0668 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2010/10/18 18:08:25.0919 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2010/10/18 18:08:26.0042 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2010/10/18 18:08:26.0230 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2010/10/18 18:08:26.0336 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2010/10/18 18:08:26.0379 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2010/10/18 18:08:26.0465 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2010/10/18 18:08:26.0557 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2010/10/18 18:08:26.0626 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2010/10/18 18:08:26.0738 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/10/18 18:08:26.0833 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2010/10/18 18:08:26.0932 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2010/10/18 18:08:27.0021 CLFS (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2010/10/18 18:08:27.0126 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2010/10/18 18:08:27.0370 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2010/10/18 18:08:27.0452 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2010/10/18 18:08:27.0502 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2010/10/18 18:08:27.0597 CrystalSysInfo (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys
2010/10/18 18:08:27.0715 DfsC (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2010/10/18 18:08:27.0843 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2010/10/18 18:08:27.0971 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2010/10/18 18:08:28.0013 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2010/10/18 18:08:28.0142 e1express (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys
2010/10/18 18:08:28.0299 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2010/10/18 18:08:28.0555 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2010/10/18 18:08:28.0696 ElbyCDFL (ce37e3d51912e59c80c6d84337c0b4cd) C:\Windows\system32\Drivers\ElbyCDFL.sys
2010/10/18 18:08:28.0780 ElbyCDIO (178cc9403816c082d22a1d47fa1f9c85) C:\Windows\system32\Drivers\ElbyCDIO.sys
2010/10/18 18:08:28.0847 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2010/10/18 18:08:28.0993 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2010/10/18 18:08:29.0026 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2010/10/18 18:08:29.0153 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2010/10/18 18:08:29.0344 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2010/10/18 18:08:29.0450 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2010/10/18 18:08:29.0556 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/10/18 18:08:29.0598 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2010/10/18 18:08:29.0672 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2010/10/18 18:08:29.0713 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2010/10/18 18:08:29.0785 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2010/10/18 18:08:29.0893 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2010/10/18 18:08:29.0939 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/10/18 18:08:30.0014 HECI (d0fc694df051bc65946db616f20d1168) C:\Windows\system32\DRIVERS\HECI.sys
2010/10/18 18:08:30.0048 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2010/10/18 18:08:30.0152 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2010/10/18 18:08:30.0196 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2010/10/18 18:08:30.0285 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2010/10/18 18:08:30.0333 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\Windows\system32\DRIVERS\HPZius12.sys
2010/10/18 18:08:30.0427 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
2010/10/18 18:08:30.0471 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2010/10/18 18:08:30.0562 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/10/18 18:08:30.0664 iaStor (e9f704ca833bd24bfaa3b4a59707633a) C:\Windows\system32\DRIVERS\iaStor.sys
2010/10/18 18:08:30.0706 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2010/10/18 18:08:30.0876 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2010/10/18 18:08:30.0961 int15 (9d64201c9e5ac8d1f088762ba00ff3ab) C:\Acer\Empowering Technology\eRecovery\int15.sys
2010/10/18 18:08:31.0123 IntcAzAudAddService (aef2fa29204056b81bc4cbf30260dee1) C:\Windows\system32\drivers\RTKVHDA.sys
2010/10/18 18:08:31.0300 IntelDH (b7a420e4b137176234272d5ca9d51a49) C:\Windows\system32\Drivers\IntelDH.sys
2010/10/18 18:08:31.0412 intelide (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
2010/10/18 18:08:31.0448 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2010/10/18 18:08:31.0570 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/10/18 18:08:31.0617 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2010/10/18 18:08:31.0730 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2010/10/18 18:08:31.0866 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2010/10/18 18:08:32.0024 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2010/10/18 18:08:32.0145 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/10/18 18:08:32.0180 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2010/10/18 18:08:32.0288 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2010/10/18 18:08:32.0338 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/10/18 18:08:32.0472 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/10/18 18:08:32.0541 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2010/10/18 18:08:32.0653 libusb0 (e2f1dcf4a68cc6cf694fbfba1842f4cd) C:\Windows\system32\drivers\libusb0.sys
2010/10/18 18:08:32.0862 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2010/10/18 18:08:33.0172 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2010/10/18 18:08:33.0258 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2010/10/18 18:08:33.0283 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2010/10/18 18:08:33.0314 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2010/10/18 18:08:33.0451 ManyCam (c6d085c7045200143528136a43a65fde) C:\Windows\system32\DRIVERS\ManyCam.sys
2010/10/18 18:08:33.0636 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2010/10/18 18:08:33.0678 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2010/10/18 18:08:33.0800 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2010/10/18 18:08:33.0841 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2010/10/18 18:08:34.0062 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2010/10/18 18:08:34.0216 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2010/10/18 18:08:34.0315 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2010/10/18 18:08:34.0385 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2010/10/18 18:08:34.0508 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2010/10/18 18:08:34.0557 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2010/10/18 18:08:34.0674 mrxsmb (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/10/18 18:08:34.0793 mrxsmb10 (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/10/18 18:08:34.0941 mrxsmb20 (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/10/18 18:08:35.0136 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2010/10/18 18:08:35.0240 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2010/10/18 18:08:35.0334 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2010/10/18 18:08:35.0431 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2010/10/18 18:08:35.0520 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2010/10/18 18:08:35.0620 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/10/18 18:08:35.0685 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2010/10/18 18:08:35.0853 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2010/10/18 18:08:36.0034 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/10/18 18:08:36.0146 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2010/10/18 18:08:36.0180 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2010/10/18 18:08:36.0304 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
2010/10/18 18:08:36.0356 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
2010/10/18 18:08:36.0485 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2010/10/18 18:08:36.0523 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2010/10/18 18:08:36.0646 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
2010/10/18 18:08:36.0675 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2010/10/18 18:08:36.0704 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2010/10/18 18:08:36.0901 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
2010/10/18 18:08:37.0114 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2010/10/18 18:08:37.0265 NPF (6623e51595c0076755c29c00846c4eb2) C:\Windows\system32\drivers\npf.sys
2010/10/18 18:08:37.0305 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2010/10/18 18:08:37.0424 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2010/10/18 18:08:37.0485 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2010/10/18 18:08:37.0597 NTIDrvr (7f1c1f78d709c4a54cbb46ede7e0b48d) C:\Windows\system32\DRIVERS\NTIDrvr.sys
2010/10/18 18:08:37.0629 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2010/10/18 18:08:37.0706 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2010/10/18 18:08:38.0186 nvlddmkm (e633e4e0e6a65fea569dc2773f1c6d58) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2010/10/18 18:08:38.0418 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2010/10/18 18:08:38.0443 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2010/10/18 18:08:38.0543 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2010/10/18 18:08:38.0631 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
2010/10/18 18:08:38.0816 PAC207 (dca942c0a19a0ad2abcd9acf94eb4b10) C:\Windows\system32\DRIVERS\PFC027.SYS
2010/10/18 18:08:38.0937 Parport (8a79fdf04a73428597e2caf9d0d67850) C:\Windows\system32\DRIVERS\parport.sys
2010/10/18 18:08:38.0979 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2010/10/18 18:08:39.0079 Parvdm (6c580025c81caf3ae9e3617c22cad00e) C:\Windows\system32\DRIVERS\parvdm.sys
2010/10/18 18:08:39.0117 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2010/10/18 18:08:39.0262 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2010/10/18 18:08:39.0288 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2010/10/18 18:08:39.0427 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2010/10/18 18:08:39.0736 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2010/10/18 18:08:39.0879 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2010/10/18 18:08:40.0020 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2010/10/18 18:08:40.0084 PSDFilter (c2821f33b846a52fdc25ff554acf11f2) C:\Windows\system32\DRIVERS\psdfilter.sys
2010/10/18 18:08:40.0165 PSDNServ (28d3a91fe7791b970e6b15c88f98dfbd) C:\Windows\system32\drivers\PSDNServ.sys
2010/10/18 18:08:40.0191 psdvdisk (3a66f69459052de13ef8a0f77d728a73) C:\Windows\system32\drivers\psdvdisk.sys
2010/10/18 18:08:40.0265 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\Windows\system32\Drivers\PxHelp20.sys
2010/10/18 18:08:40.0377 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2010/10/18 18:08:40.0488 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2010/10/18 18:08:40.0553 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2010/10/18 18:08:40.0665 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2010/10/18 18:08:40.0726 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2010/10/18 18:08:40.0946 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
2010/10/18 18:08:40.0998 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
2010/10/18 18:08:41.0079 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
2010/10/18 18:08:41.0170 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/10/18 18:08:41.0223 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2010/10/18 18:08:41.0337 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2010/10/18 18:08:41.0381 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2010/10/18 18:08:41.0442 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2010/10/18 18:08:41.0612 s117bus (1f561844318914e7eb6e54673a4cc54c) C:\Windows\system32\DRIVERS\s117bus.sys
2010/10/18 18:08:41.0758 s117mdfl (ba93eec3cdf6a63b77ae66221aa4f902) C:\Windows\system32\DRIVERS\s117mdfl.sys
2010/10/18 18:08:41.0807 s117mdm (cba12fd8a8ee5b5cdfbbae2381cd6703) C:\Windows\system32\DRIVERS\s117mdm.sys
2010/10/18 18:08:41.0919 s117mgmt (bd6483e64b1da17e812b34bcdefd9459) C:\Windows\system32\DRIVERS\s117mgmt.sys
2010/10/18 18:08:41.0956 s117nd5 (c7ca36c3054b4cd47a1f6611b046e2f9) C:\Windows\system32\DRIVERS\s117nd5.sys
2010/10/18 18:08:42.0087 s117obex (e290b3a6b58fb72ca97dd48d64e4fc1c) C:\Windows\system32\DRIVERS\s117obex.sys
2010/10/18 18:08:42.0175 s117unic (5c4d1ba23c7511ac880e8ba7baa80dba) C:\Windows\system32\DRIVERS\s117unic.sys
2010/10/18 18:08:42.0234 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2010/10/18 18:08:42.0388 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2010/10/18 18:08:42.0432 Serenum (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys
2010/10/18 18:08:42.0511 Serial (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys
2010/10/18 18:08:42.0611 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2010/10/18 18:08:42.0745 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2010/10/18 18:08:42.0778 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2010/10/18 18:08:42.0894 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2010/10/18 18:08:42.0924 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2010/10/18 18:08:43.0050 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2010/10/18 18:08:43.0081 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2010/10/18 18:08:43.0190 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2010/10/18 18:08:43.0255 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2010/10/18 18:08:43.0395 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2010/10/18 18:08:43.0667 sptd (71e276f6d189413266ea22171806597b) C:\Windows\system32\Drivers\sptd.sys
2010/10/18 18:08:43.0672 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 71e276f6d189413266ea22171806597b
2010/10/18 18:08:43.0688 sptd - detected Locked file (1)
2010/10/18 18:08:43.0809 srv (5754e8bae40943871d0ab9becbf335e8) C:\Windows\system32\DRIVERS\srv.sys
2010/10/18 18:08:43.0923 srv2 (d47b09ff7d28ee44d728f57c2d1fab86) C:\Windows\system32\DRIVERS\srv2.sys
2010/10/18 18:08:44.0046 srvnet (32d52290341a740881521e118106acd6) C:\Windows\system32\DRIVERS\srvnet.sys
2010/10/18 18:08:44.0171 sscdbus (d6870895fe46a464a19141440eb6cc1e) C:\Windows\system32\DRIVERS\sscdbus.sys
2010/10/18 18:08:44.0253 sscdmdfl (0fe167362e4689b716cdc8d93adedda8) C:\Windows\system32\DRIVERS\sscdmdfl.sys
2010/10/18 18:08:44.0364 sscdmdm (55a15707e32b6709242ad127e62ca55a) C:\Windows\system32\DRIVERS\sscdmdm.sys
2010/10/18 18:08:44.0626 ssmdrv (3ad0362cf68de3ac500e981700242cca) C:\Windows\system32\DRIVERS\ssmdrv.sys
2010/10/18 18:08:44.0725 ss_bus (5a1d0ca8a5f1e7b4ec50b9d76c001f0e) C:\Windows\system32\DRIVERS\ss_bus.sys
2010/10/18 18:08:44.0784 ss_mdfl (f0a85580e36a3a85059037d39a9cf079) C:\Windows\system32\DRIVERS\ss_mdfl.sys
2010/10/18 18:08:44.0872 ss_mdm (84c3dbfd1bfa4adc0a950b3d5506cb00) C:\Windows\system32\DRIVERS\ss_mdm.sys
2010/10/18 18:08:44.0954 StarOpen (306521935042fc0a6988d528643619b3) C:\Windows\system32\drivers\StarOpen.sys
2010/10/18 18:08:45.0065 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2010/10/18 18:08:45.0127 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2010/10/18 18:08:45.0221 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2010/10/18 18:08:45.0277 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2010/10/18 18:08:45.0388 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
2010/10/18 18:08:45.0461 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
2010/10/18 18:08:45.0551 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
2010/10/18 18:08:45.0581 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2010/10/18 18:08:45.0653 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2010/10/18 18:08:45.0739 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
2010/10/18 18:08:45.0789 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
2010/10/18 18:08:45.0934 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2010/10/18 18:08:46.0144 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2010/10/18 18:08:46.0341 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
2010/10/18 18:08:46.0459 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2010/10/18 18:08:46.0504 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2010/10/18 18:08:46.0633 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2010/10/18 18:08:46.0662 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2010/10/18 18:08:46.0794 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2010/10/18 18:08:46.0828 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2010/10/18 18:08:46.0954 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2010/10/18 18:08:47.0109 usbaudio (292a25bb75a568ae2c67169ba2c6365a) C:\Windows\system32\drivers\usbaudio.sys
2010/10/18 18:08:47.0283 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/10/18 18:08:47.0409 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2010/10/18 18:08:47.0515 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2010/10/18 18:08:47.0592 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2010/10/18 18:08:47.0648 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2010/10/18 18:08:47.0742 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2010/10/18 18:08:47.0853 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2010/10/18 18:08:47.0887 usbser (a96191470581a7091420d25ecd444502) C:\Windows\system32\DRIVERS\usbser.sys
2010/10/18 18:08:48.0000 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/10/18 18:08:48.0127 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/10/18 18:08:48.0241 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/10/18 18:08:48.0365 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2010/10/18 18:08:48.0399 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2010/10/18 18:08:48.0494 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2010/10/18 18:08:48.0526 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2010/10/18 18:08:48.0555 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2010/10/18 18:08:48.0652 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2010/10/18 18:08:48.0707 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2010/10/18 18:08:48.0837 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2010/10/18 18:08:48.0875 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2010/10/18 18:08:49.0009 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/10/18 18:08:49.0051 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/10/18 18:08:49.0205 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2010/10/18 18:08:49.0298 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2010/10/18 18:08:49.0426 WebCamHelper (5124ac756d3585a3c080690ea98c6c11) C:\PROGRA~1\AVWEBC~1\WebCamHelper.sys
2010/10/18 18:08:49.0593 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2010/10/18 18:08:49.0655 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2010/10/18 18:08:49.0787 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2010/10/18 18:08:49.0863 WsAudioDevice_383 (85ece26f326c2d07ba77a60343468272) C:\Windows\system32\drivers\WsAudioDevice_383.sys
2010/10/18 18:08:49.0992 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/10/18 18:08:50.0304 XPADFL02 (6ab0d2d28e2a984fbba5295f2dd81878) C:\Windows\system32\DRIVERS\xpadfl02.sys
2010/10/18 18:08:50.0416 ================================================================================
2010/10/18 18:08:50.0416 Scan finished
2010/10/18 18:08:50.0416 ================================================================================
2010/10/18 18:08:50.0431 Detected object count: 1
2010/10/18 18:08:55.0273 Locked file(sptd) - User select action: Skip
2010/10/18 18:09:04.0972 Deinitialize success -
ComboFix 10-10-17.04 - Arthur 8/10/2010 19:05:21.1.4 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2030.1115 [GMT 2:00]
Lancé depuis: c:\users\Arthur\Desktop\Arthur.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\dir\install
c:\program files\DaemonTools_WhenUSave_Installer
c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner
c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Conditions générales.url
c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Confidentialité.url
c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Désinstaller.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\MessengerSkinner.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Website.url
c:\users\Arthur\AppData\Local\kysgauk_navfx.dat
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\93f0b126-e05b-5eb0-7a6d-697f6dff596b
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp2ADD.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp50FD.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp58DE.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp5C87.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp5F3F.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp6A27.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp7783.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp7DC.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp8046.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp8B4.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmp8FD6.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpA671.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpAD5A.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpB663.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpB6C6.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpC8DD.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpEF37.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpFB6.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpFEE.tmp
c:\users\Arthur\AppData\Local\MICROS~1\Windows\TEMPOR~1\tmpFF0B.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\93f0b126-e05b-5eb0-7a6d-697f6dff596b
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp2ADD.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp50FD.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp58DE.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5C87.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5F3F.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp6A27.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7783.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7DC.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8046.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8B4.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp8FD6.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpA671.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpAD5A.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB663.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpB6C6.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpC8DD.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpEF37.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFB6.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFEE.tmp
c:\users\Arthur\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFF0B.tmp
c:\users\Arthur\AppData\Roaming\MICROS~1\Windows\Recent\YouTube - Mathieu Chedid & Sean Lennon - L'Eclipse.url
c:\users\Arthur\mingwm10.dll
c:\users\Arthur\QtCore4.dll
c:\windows\system32\CmdLineExt.dll
c:\windows\wpe pro.INI
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-09-18 au 2010-10-18 ))))))))))))))))))))))))))))))))))))
.
2010-10-18 17:23 . 2010-10-18 17:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-18 17:23 . 2010-10-18 17:23 -------- d-----w- c:\users\Victor\AppData\Local\temp
2010-10-18 17:23 . 2010-10-18 17:23 -------- d-----w- c:\users\Les Jacq\AppData\Local\temp
2010-10-18 16:52 . 2010-10-18 16:52 -------- d-----w- c:\users\Arthur\AppData\Roaming\VSRevoGroup
2010-10-18 16:07 . 2010-10-18 16:08 -------- d-----w- C:\tdsskiller
2010-10-18 15:29 . 2010-10-18 15:29 -------- d-----w- c:\program files\Gadwin Systems
2010-10-16 21:15 . 2010-10-16 21:18 -------- d-----w- c:\program files\MediaCUB
2010-10-16 16:38 . 2010-10-16 16:38 -------- d-----w- C:\CA-Cheats.eu Free VIP 1.0
2010-10-16 16:29 . 2010-10-16 16:29 -------- d-----w- C:\Nexon
2010-10-16 16:29 . 2010-10-16 16:29 -------- d-----w- c:\programdata\NexonEU
2010-10-16 15:35 . 2010-10-17 18:15 -------- d-----w- c:\windows\system32\install
2010-10-16 15:34 . 2010-10-16 15:34 327680 ----a-w- C:\windrev.exe
2010-10-15 18:13 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C975B02-DC1C-4183-9F9D-330771838112}\mpengine.dll
2010-10-15 07:33 . 2010-10-15 07:33 -------- d-----w- c:\users\Les Jacq\AppData\Local\Apps
2010-10-15 06:52 . 2010-10-15 06:52 -------- d-----w- c:\users\Les Jacq\AppData\Local\GamersFirst LIVE!
2010-10-15 06:52 . 2010-10-15 19:07 -------- d-----w- c:\users\Les Jacq\AppData\Local\PMB Files
2010-10-15 06:51 . 2010-10-15 06:51 -------- d-----w- c:\users\Les Jacq\AppData\Local\Pando_Temp
2010-10-14 21:21 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2010-10-14 18:32 . 2010-09-10 16:35 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-14 18:32 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-10-14 17:05 . 2010-10-18 16:43 -------- d-----w- C:\BywifiShare
2010-10-14 17:05 . 2010-10-14 17:05 -------- d-----w- C:\BywifiSave
2010-10-14 17:05 . 2010-10-14 17:05 -------- d-----w- c:\program files\Bywifi
2010-10-13 10:10 . 2010-10-13 10:09 236544 ----a-w- c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Templates\Server.exe
2010-10-13 10:09 . 2010-10-13 10:09 236544 ----a-w- c:\users\Arthur\AppData\Roaming\Keylog_blackshades_fud.exe
2010-10-13 10:09 . 2010-10-13 10:13 434176 ----a-w- c:\users\Arthur\AppData\Roaming\cyclops public hack.exe
2010-10-13 08:25 . 2010-10-13 08:25 -------- d-----w- c:\program files\Softonic_France
2010-10-12 15:30 . 2010-10-18 17:21 -------- d-----w- c:\users\Arthur\AppData\Local\PMB Files
2010-10-12 15:30 . 2010-10-12 15:30 -------- d-----w- c:\programdata\PMB Files
2010-10-12 15:30 . 2010-10-12 15:30 238776 ----a-w- c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
2010-10-12 15:30 . 2010-10-12 15:30 -------- d-----w- c:\program files\Pando Networks
2010-10-10 16:05 . 2010-10-10 16:05 -------- d-----w- c:\program files\Atomic Email Hunter
2010-10-10 14:43 . 2010-10-10 14:44 -------- d-----w- c:\program files\AV WebCam Morpher
2010-10-10 14:42 . 2010-10-10 14:43 -------- d-----w- c:\users\Arthur\AppData\Roaming\GetRightToGo
2010-10-10 14:40 . 2010-10-10 14:41 -------- d-----w- c:\program files\VirtualCamera
2010-10-10 13:57 . 2010-10-10 13:57 -------- d-----w- c:\program files\Common Files\fwc
2010-10-10 13:57 . 2010-10-10 14:37 -------- d-----w- c:\program files\Fake Webcam
2010-10-10 13:37 . 2010-10-18 17:22 -------- d-----w- C:\dir
2010-10-09 20:28 . 2010-10-09 20:28 -------- d-----w- c:\program files\Groupe Eurower
2010-10-09 20:14 . 2010-10-09 20:25 -------- d-----w- c:\program files\MySmtp
2010-10-09 20:13 . 2010-10-09 20:13 290816 ------w- c:\windows\Setup1.exe
2010-10-09 20:13 . 2010-10-09 20:13 74752 ----a-w- c:\windows\ST6UNST.EXE
2010-10-09 14:24 . 2010-10-09 14:24 -------- d-----w- c:\program files\fec
2010-10-08 19:28 . 2010-10-08 19:29 -------- d-----w- c:\program files\WinHTTrack
2010-10-08 18:01 . 2010-10-16 11:36 -------- d-----w- c:\users\Arthur\AppData\Roaming\FileZilla
2010-10-08 18:01 . 2010-10-08 18:05 -------- d-----w- c:\program files\FileZilla FTP Client
2010-10-06 19:32 . 2010-10-06 19:37 -------- d-----w- c:\program files\AutoIt3
2010-10-05 20:32 . 2010-10-05 20:34 -------- d-----w- c:\users\Les Jacq\AppData\Roaming\vlc
2010-09-30 19:44 . 2010-09-30 19:44 -------- d-----w- c:\users\Arthur\AppData\Local\Broad Intelligence
2010-09-30 18:05 . 2010-09-30 18:05 -------- d-----w- c:\windows\system32\DivX Movies
2010-09-29 15:41 . 2010-09-30 19:06 744495 ----a-w- c:\windows\system32\ConsoleReader.exe
2010-09-29 03:24 . 2010-06-22 12:57 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-29 03:23 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-28 19:03 . 2010-09-28 19:36 -------- d-----w- C:\dexter
2010-09-28 18:46 . 2010-09-28 18:46 -------- d-----w- c:\program files\VirtualDubMOD
2010-09-27 18:45 . 2010-09-27 18:45 -------- d-----w- c:\program files\URUSoft
2010-09-25 20:53 . 2010-07-17 03:00 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-25 20:53 . 2010-07-17 03:00 423656 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2010-09-25 10:28 . 2010-09-25 10:28 -------- d--h--w- c:\windows\PIF
2010-09-20 18:21 . 2010-09-20 18:24 -------- d-----w- C:\Temp
2010-09-19 15:17 . 2009-08-24 08:15 761152 ----a-w- c:\windows\system32\msvcr100.dll
2010-09-19 15:16 . 2010-06-14 12:26 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-05-24 15:38 . 2008-11-07 22:46 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 16:00 . 2008-11-07 22:46 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41 . 2008-11-07 22:46 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 15:59 . 2008-11-07 22:46 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19 . 2008-11-07 22:46 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35 . 2008-11-07 22:46 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10 . 2008-11-07 22:46 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42 . 2008-11-07 22:46 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22 . 2008-11-07 22:46 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21 . 2008-11-07 22:46 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2006-05-03 09:06 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\System32\nbDX.dll
.
------- Sigcheck -------
[-] 2010-08-17 . B101CF60788B4B3D402315D3FB89E801 . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll
[7] 2008-01-18 . 27F10F348E508243F6254846F8370D0D . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552]
"{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
2010-06-13 17:10 2734688 ----a-w- c:\program files\Softonic_France\tbSoft.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-15 10:33 2515552 ----a-w- c:\program files\DVDVideoSoftTB\tbDVDV.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552]
"{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-09 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-10-12 2937528]
"bywifi"="c:\program files\Bywifi\bywifi.exe" [2010-02-09 2207744]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 4390912]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-07-06 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-06 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-06 81920]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-07-13 126976]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"phoenixInjector"="c:\windows\system32\ConsoleReader.exe" [2010-09-30 744495]
"bywifi"="c:\program files\Bywifi\bywifi.exe" [2010-02-09 2207744]
c:\users\Les Jacq\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - d:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]
c:\users\Arthur\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\
Lanceur.lnk - c:\program files\Micro Application\LauncherMA.exe [2009-2-10 485376]
LimeWire On Startup.lnk - d:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]
TrayIt!.lnk - c:\users\Arthur\Desktop\trayit_4_6_5_5\TrayIt!.exe [2010-10-13 204800]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\CLKERN.DLL
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
backup=c:\windows\pss\Empowering Technology Launcher.lnkCommon Startup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk]
backup=c:\windows\pss\GamersFirst LIVE!.lnkCommon Startup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PDFCreator.lnk]
backup=c:\windows\pss\PDFCreator.lnkCommon Startup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SnagIt 8.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SnagIt 8.lnk
backup=c:\windows\pss\SnagIt 8.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinStart Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinStart Manager.lnk
backup=c:\windows\pss\WinStart Manager.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^dptray_v1.5.exe.lnk]
backup=c:\windows\pss\dptray_v1.5.exe.lnkStartup
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dptray_v1.5.exe.lnk
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnkStartup
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 - Capture d'écran et lancement.lnk
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Real Desktop.lnk]
backup=c:\windows\pss\Real Desktop.lnkStartup
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Real Desktop.lnk
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-02-15 16:39 151552 ----a-w- c:\acer\AcerTour\Reminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-06-11 20:43 640376 ----a-w- c:\adobe master collection cs4\Acrobat 9.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 05:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0ENQBO]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-01-06 09:39 323392 ----a-w- c:\users\Arthur\Program Files\DNA\btdna.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2009-01-29 22:20 57344 ----a-w- c:\program files\SlySoft\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 15:57 86016 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-10 09:02 216520 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2010-07-13 22:49 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ManyCam]
2009-12-19 05:04 1824040 ----a-w- c:\program files\ManyCam 2.4\ManyCam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 03:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-18 21:33 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2008-01-29 15:38 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-07-21 17:28 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
2006-03-06 22:52 36864 ------w- c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2008-01-18 21:36 2153472 ----a-w- c:\windows\System32\oobefldr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9ba0cba84fec4;Service Google Update (gupdate1c9ba0cba84fec4);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-10 133104]
R2 QuestDns Service;QuestDns Service;c:\programdata\QuestDns\questdns117.exe [x]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 IntelDH;IntelDH Driver;c:\windows\system32\Drivers\IntelDH.sys [2007-09-01 5504]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2010-03-11 153736]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 XPADFL02;XPAD Filter Service 02;c:\windows\system32\DRIVERS\xpadfl02.sys [2006-12-24 27904]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-12-25 717296]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-03-19 108289]
S2 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [2008-05-19 57344]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 WebCamHelper;WebCamHelper;c:\progra~1\AVWEBC~1\WebCamHelper.sys [2007-07-06 2688]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2008-11-19 16640]
.
Contenu du dossier 'Tâches planifiées'
2010-10-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-12 18:45]
2010-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-10 18:46]
2010-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-10 18:46]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
uSearchMigratedDefaultURL = hxxp://google.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 127.0.0.1:8080
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.cherche.us/keyword/%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Download all links with IDM - c:\users\Arthur\AppData\Local\Temp\Rar$EX03.285\IEGetAll.htm
IE: Download FLV video content with IDM - c:\users\Arthur\AppData\Local\Temp\Rar$EX03.285\IEGetVL.htm
IE: Download with IDM - c:\users\Arthur\AppData\Local\Temp\Rar$EX03.285\IEExt.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{09E90109-A9AA-4980-BCEF-76F8D924E902} - c:\program files\Bywifi\bywifici.exe
Trusted Zone: chat-land.org
FF - ProfilePath - c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com|https://outlook.live.com/owa/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - prefs.js: network.proxy.type - 2
FF - component: c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll
FF - component: c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft Silverlight\4.0.50917.0\npctrl.1.0.20926.0.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\Sony\Media Go\npmediago.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\users\Arthur\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -
BHO-{74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
BHO-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - c:\progra~1\MEGAUP~2\MEGAUP~1.DLL
Toolbar-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - c:\progra~1\MEGAUP~2\MEGAUP~1.DLL
WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - c:\progra~1\MEGAUP~2\MEGAUP~1.DLL
HKCU-Run-Acer Tour Reminder - (no file)
HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
HKCU-Run-fsm - (no file)
HKLM-Run-Persistence - c:\windows\system32\igfxpers.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-Apanel - c:\acersw\config\NewSetApanel.cmd
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-RegistryMechanic - (no file)
MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
MSConfigStartUp-Babylon Client - c:\program files\Babylon\Babylon-Pro\Babylon.exe
MSConfigStartUp-HotKeysCmds - c:\windows\system32\hkcmd.exe
MSConfigStartUp-IgfxTray - c:\windows\system32\igfxtray.exe
MSConfigStartUp-Real Desktop - c:\program files\Real Desktop\Real Desktop.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-AoA Audio Extractor_is1 - c:\program files\AoA Audio Extractor\unins000.exe
AddRemove-Apophysis 2.0 - c:\program files\Apophysis 2.0\uninstall.exe
AddRemove-ArtMoney SE_is1 - c:\program files\ArtMoney\Uninstall\unins000.exe
AddRemove-AutocompletePro3_is1 - c:\program files\AutocompletePro\unins000.exe
AddRemove-BearShare MediaBar - c:\program files\BearShare Applications\BearShare MediaBar\Uninstall.exe
AddRemove-CaptEcran_is1 - c:\program files\CaptEcran\unins000.exe
AddRemove-Gimp Pack Mode_is1 - c:\program files\Gimp Pack Mode\unins001.exe
AddRemove-Gtk+ Runtime Environment - c:\users\Arthur\Desktop\GTK\uninst.exe
AddRemove-gtkmm - c:\users\Arthur\Desktop\GTK\gtkmm-uninst.exe
AddRemove-Hedgewars 0.9.7 - c:\program files\Hedgewars 0.9.7\Uninstall.exe
AddRemove-Little Ink Pot's Thredgeholder Plugin_is1 - c:\users\Arthur\Desktop\PhotoshopCS3Portable\Photoshop\Modules externes\Little Ink Pot\unins000.exe
AddRemove-No-IP.com DUC - c:\program files\No-IP\DUC20.exe
AddRemove-PhotoFiltre - c:\program files\PhotoFiltre\Uninst.exe
AddRemove-Pixie_is1 - c:\program files\Pixie\unins000.exe
AddRemove-Podmailing - c:\program files\Podmailing\uninstall.exe
AddRemove-Presse Papier_is1 - c:\program files\PressePapier\unins000.exe
AddRemove-QuizFaber v2.10 - c:\program files\QuizFaber v2.10\uninstall.exe
AddRemove-RAR Password Cracker - c:\program files\RAR Password Cracker\uninstall.exe
AddRemove-ReadPlease 2003_is1 - c:\program files\ReadPlease 2003\unins000.exe
AddRemove-Real Desktop Standard_is1 - c:\program files\Real Desktop\unins000.exe
AddRemove-ShopperReportsSA - c:\program files\ShopperReports3\bin\3.0.485.0\ShopperReportsUninstaller.exe
AddRemove-{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D} - c:\program files\PDFCreator\unins000.exe
AddRemove-{24BC8B57-716C-444F-B46B-A3349B9164C5}_is1 - c:\program files\Aegisub\unins000.exe
AddRemove-la suite e-anim 9.01.000 - c:\users\Arthur\Documents\e-anim\Uninstal.exe
AddRemove-Nick Chase - A Detective Story - c:\program files\Nick Chase - A Detective Story\Uninstal.exe
AddRemove-PhotoFiltre Studio X - c:\program files\PhotoFiltre Studio X\Uninst.exe
AddRemove-PhotoZoom Pro 2 - c:\program files\PhotoZoom Pro 2\Uninstall.exe
AddRemove-Zylom Games Player Plugin - c:\program files\Zylom Games\UninstallPlugin.exe
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(784)
c:\windows\system32\CLKERN.DLL
- - - - - - - > 'lsass.exe'(672)
c:\windows\system32\CLKERN.DLL
.
Heure de fin: 2010-10-18 19:35:27
ComboFix-quarantined-files.txt 2010-10-18 17:35
Avant-CF: 28 170 985 472 octets libres
Après-CF: 39 847 002 112 octets libres
- - End Of File - - 863E268405BC9A33B72B821B9498630D -
======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par C_XX le 16/09/10 à 13:30
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org
C:\Program Files\Ad-Remover\main.exe (CLEAN [3]) -> Lancé à 21:37:49 le 18/10/2010, Mode normal
Microsoft® Windows Vista(TM) Édition Familiale Premium Service Pack 1 (X86)
Arthur@PCSUPERPUISSANT (Acer Aspire M5500)
============== ACTION(S) ==============
Service: "QuestDns Service" Stoppé et supprimé
0,Dossier supprimé: C:\Program Files\Mozilla FireFox\extensions\{C91E1C68-B60A-4C9F-B53B-AAAEF0E7EF97}
0,Fichier supprimé: C:\Users\Arthur\AppData\Roaming\Mozilla\FireFox\Profiles\6eqvbm1u.default\searchplugins\conduit.xml
0,Fichier supprimé: C:\Users\Arthur\scriptjava.html
0,Fichier supprimé: C:\Users\Arthur\temp1.6
0,Dossier supprimé: C:\Users\Arthur\AppData\LocalLow\Conduit
0,Dossier supprimé: C:\Program Files\Conduit
0,Dossier supprimé: C:\Program Files\QuestDns
0,Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports
0,Dossier supprimé: C:\Users\Arthur\AppData\LocalLow\ShopperReports3
0,Dossier supprimé: C:\Users\Arthur\AppData\LocalLow\Smart-Shopper
0,Dossier supprimé: C:\Program Files\Trymedia
(!) -- Fichiers temporaires supprimés.
-- Fichier ouvert: C:\Users\Arthur\AppData\Roaming\Mozilla\FireFox\Profiles\6eqvbm1u.default\Prefs.js --
Ligne supprimée: user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER...
Ligne supprimée: user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226...
Ligne supprimée: user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&Sea...
Ligne supprimée: user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=");
-- Fichier Fermé --
1,Clé supprimée: HKLM\Software\Classes\CLSID\{28c5847d-727b-2e59-87bb-6432b7a2186f}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{28c5847d-727b-2e59-87bb-6432b7a2186f}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}
1,Clé supprimée: HKLM\Software\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
1,Clé supprimée: HKLM\Software\Classes\Interface\{DB885111-F39F-4D88-9EE5-C88460B6DF7B}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{F42C7B47-5234-4BF5-8882-DAAC0D64870E}
1,Clé supprimée: HKLM\Software\Classes\Interface\{F42C7B47-5234-4BF5-8882-DAAC0D64870E}
1,Clé supprimée: HKLM\Software\Classes\Interface\{F7BEBBB1-7E6B-4561-9444-6F4866D60C7D}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{01BCB858-2F62-4F06-A8F4-48F927C15333}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{ACC62306-9A63-4864-BD2F-C8825D2D7EA6}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{DC3020B4-815F-427B-A5DA-82DC6634EBAD}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{F0CF944C-F160-4F65-8F0A-2773322FF357}
3,Clé supprimée: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gfizbssl
0,Clé supprimée: HKLM\Software\Classes\BHO.HelperObject
0,Clé supprimée: HKLM\Software\Classes\BHO.HelperObject.1
0,Clé supprimée: HKLM\Software\Classes\DiscoveryHelper.iMesh6Discovery
0,Clé supprimée: HKLM\Software\Classes\DiscoveryHelper.iMesh6Discovery.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.AsyncReporter
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.AsyncReporter.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDic
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDic.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDisp
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.CntntDisp.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Dwnldr
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Dwnldr.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbGuru
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.HbGuru.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.KOPFF
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.KOPFF.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaNvgtnTrpr
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaNvgtnTrpr.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaPSExecuter
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.MozillaPSExecuter.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.ReportData
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.ReportData.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Reporter
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Reporter.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Scopes
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Scopes.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Stock
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.Stock.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiate
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiate.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiateOrRandomTS
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerImmidiateOrRandomTS.1
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerOnceInDay
0,Clé supprimée: HKLM\Software\Classes\ShopperReports.TriggerOnceInDay.1
0,Clé supprimée: HKLM\Software\Classes\SuggestMeYes.SuggestMeYesBHO
0,Clé supprimée: HKLM\Software\Classes\SuggestMeYes.SuggestMeYesBHO.1
0,Clé supprimée: HKLM\Software\Classes\Toolbar.CT1055551
0,Clé supprimée: HKLM\Software\Classes\Toolbar.CT2269050
0,Clé supprimée: HKLM\Software\Classes\Toolbar.CT2504091
0,Clé supprimée: HKLM\Software\Classes\Toolbar.CT2542115
0,Clé supprimée: HKLM\Software\Classes\AppID\BRNstIE.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D}
0,Clé supprimée: HKLM\Software\Classes\AppID\CmndFF.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306}
0,Clé supprimée: HKLM\Software\Classes\AppID\mozillaps.dll
1,Clé supprimée: HKLM\Software\Classes\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE}
0,Clé supprimée: HKLM\Software\Classes\AppID\Pltfrm.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227}
0,Clé supprimée: HKLM\Software\Conduit
0,Clé supprimée: HKLM\Software\QuestDns
0,Clé supprimée: HKLM\Software\ShopperReports3
0,Clé supprimée: HKCU\Software\Conduit
0,Clé supprimée: HKCU\Software\PopCap
0,Clé supprimée: HKCU\Software\ShopperReports3
0,Clé supprimée: HKCU\Software\Zugo
0,Clé supprimée: HKCU\Software\AppDataLow\Software\Conduit
0,Clé supprimée: HKCU\Software\AppDataLow\Software\ShopperReports3
0,Clé supprimée: HKCU\Software\AppDataLow\df3f0ab8-3495-26ee-6b42-8b65255cbbfe
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
0,Clé supprimée: HKCU\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E6A6A4A475FCE37F8B5AC2F1244DEB2BFCA5615A
0,Clé supprimée: HKCU\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7EE743314C844C7F445B8B1D7617612DF1FDD50F
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\FLVPlayer.exe
0,Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0|goicfboogidikkejccmclpieicihhlpo jimddp
0,Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0|goicfboogidikkejccmclpieicihhlpo hpfanicgkffmccehnpkikogcffaepkfp
0,Valeur supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\Trust Database\0|goicfboogidikkejccmclpieicihhlpo dgnckdmmolaijpbbakmplfhlfpdhglgc
0,Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|Shopperreports@shopperreports.com
============== SCAN ADDITIONNEL ==============
** Mozilla Firefox Version [3.6.10 (fr)] **
-- C:\Users\Arthur\AppData\Roaming\Mozilla\FireFox\Profiles\6eqvbm1u.default\Prefs.js --
browser.download.dir, D:\\les dossier du bureau arthur\\Downloads
browser.startup.homepage, hxxp://www.google.com|hxxp://www.hotmail.com/
browser.startup.homepage_override.mstone, rv:1.9.2.10
-- C:\Users\Les Jacq\AppData\Roaming\Mozilla\FireFox\Profiles\c15t3sa0.default\Prefs.js --
browser.download.dir, C:\\Users\\Les Jacq\\Downloads
browser.search.defaultenginename, Yahoo
browser.search.defaulturl, hxxp://isearch.babylon.com/web/{searchTerms}?babsrc=browsersearch
browser.search.selectedEngine, Google
browser.startup.homepage, hxxp://google.com
browser.startup.homepage_override.mstone, rv:1.9.2.10
keyword.URL, hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=971163&p=
-- C:\Users\Victor\AppData\Roaming\Mozilla\FireFox\Profiles\nt44v8s6.default\Prefs.js --
browser.download.dir, C:\\Users\\Victor\\Downloads
browser.download.lastDir, C:\\Users\\Victor\\Desktop
browser.search.defaultenginename, Yahoo
browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
browser.search.selectedEngine, Yahoo
browser.startup.homepage_override.mstone, rv:1.9.2.3
keyword.URL, hxxp://fr.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=971163&p=
========================================
** Internet Explorer Version [8.0.6001.18975] **
[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no
[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
========================================
C:\Program Files\Ad-Remover\Quarantine: 46 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)
C:\Ad-Report-CLEAN[3].txt - 18/10/2010 (11033 Octet(s))
Fin à: 21:43:42, 18/10/2010
============== E.O.F ============== -
Merci encore de s'occuper de mon cas aussi bien et bénévolement ;)
http://www.virustotal.com/file-scan/reanalysis.html?id=056769d66e01d022f78b5e32113497b08aa5f73cc93f5df9aebc5b1428ac180f-1287500371 -
clic sur reanalise stp
-
http://www.virustotal.com/file-scan/report.html?id=056769d66e01d022f78b5e32113497b08aa5f73cc93f5df9aebc5b1428ac180f-1287500371
J'ai l'impression qu'il y a une erreur ? -
__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------
Toujours avec toutes les protections désactivées, fais ceci :
▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
KillAll::
FCopy::
c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll|c:\windows\System32\shsvcs.dll
------------------------------------------------------------------
▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes
▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix
▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
-
Je me suis jamais autant poiler de ma vie en voyant les jolies messages m'indiquant que je ne pouvait pas ouvrir l'application (en rapport avec l'admin je crois) qui apparaissait a chaque clic sur une application... Ducoup mon pc a eu le droit a un arrêt forcé...
Une tite explication svp x') -
M'enfin je ne suis même pas sur que ce soit le bon fichier texte... mais bon je crois bien x')
ComboFix 10-10-17.04 - Arthur 9/10/2010 18:07:12.2.4 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2030.1083 [GMT 2:00]
Lancé depuis: c:\users\Arthur\Desktop\Arthur.exe
Commutateurs utilisés :: c:\users\Arthur\Desktop\CFScript.txt
.
[i] ADS - Windows: deleted 24 bytes in 2 streams. /i
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--------------- FCopy ---------------
c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll --> c:\windows\System32\shsvcs.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-09-19 au 2010-10-19 ))))))))))))))))))))))))))))))))))))
.
2010-10-19 16:19 . 2010-10-19 16:21 -------- d-----w- c:\users\Arthur\AppData\Local\temp
2010-10-19 16:19 . 2010-10-19 16:19 -------- d-----w- c:\users\Victor\AppData\Local\temp
2010-10-19 16:19 . 2010-10-19 16:19 -------- d-----w- c:\users\Les Jacq\AppData\Local\temp
2010-10-19 16:19 . 2010-10-19 16:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-19 14:53 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FC277462-D340-4A8E-A664-A5F4F1FD2843}\mpengine.dll
2010-10-18 19:37 . 2010-10-18 19:43 -------- d-----w- c:\program files\Ad-Remover
2010-10-18 16:52 . 2010-10-18 16:52 -------- d-----w- c:\users\Arthur\AppData\Roaming\VSRevoGroup
2010-10-18 16:07 . 2010-10-18 16:08 -------- d-----w- C:\tdsskiller
2010-10-18 15:29 . 2010-10-18 15:29 -------- d-----w- c:\program files\Gadwin Systems
2010-10-16 21:15 . 2010-10-16 21:18 -------- d-----w- c:\program files\MediaCUB
2010-10-16 16:38 . 2010-10-16 16:38 -------- d-----w- C:\CA-Cheats.eu Free VIP 1.0
2010-10-16 16:29 . 2010-10-18 17:47 -------- d-----w- C:\Nexon
2010-10-16 16:29 . 2010-10-16 16:29 -------- d-----w- c:\programdata\NexonEU
2010-10-16 15:35 . 2010-10-17 18:15 -------- d-----w- c:\windows\system32\install
2010-10-16 15:34 . 2010-10-16 15:34 327680 ----a-w- C:\windrev.exe
2010-10-15 07:33 . 2010-10-15 07:33 -------- d-----w- c:\users\Les Jacq\AppData\Local\Apps
2010-10-15 06:52 . 2010-10-15 06:52 -------- d-----w- c:\users\Les Jacq\AppData\Local\GamersFirst LIVE!
2010-10-15 06:52 . 2010-10-15 19:07 -------- d-----w- c:\users\Les Jacq\AppData\Local\PMB Files
2010-10-15 06:51 . 2010-10-15 06:51 -------- d-----w- c:\users\Les Jacq\AppData\Local\Pando_Temp
2010-10-14 21:21 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2010-10-14 18:32 . 2010-09-10 16:35 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-14 18:32 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-10-14 17:05 . 2010-10-19 15:26 -------- d-----w- C:\BywifiShare
2010-10-14 17:05 . 2010-10-14 17:05 -------- d-----w- C:\BywifiSave
2010-10-14 17:05 . 2010-10-14 17:05 -------- d-----w- c:\program files\Bywifi
2010-10-13 10:10 . 2010-10-13 10:09 236544 ----a-w- c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Templates\Server.exe
2010-10-13 10:09 . 2010-10-13 10:09 236544 ----a-w- c:\users\Arthur\AppData\Roaming\Keylog_blackshades_fud.exe
2010-10-13 10:09 . 2010-10-13 10:13 434176 ----a-w- c:\users\Arthur\AppData\Roaming\cyclops public hack.exe
2010-10-13 08:25 . 2010-10-13 08:25 -------- d-----w- c:\program files\Softonic_France
2010-10-12 15:30 . 2010-10-19 15:17 -------- d-----w- c:\users\Arthur\AppData\Local\PMB Files
2010-10-12 15:30 . 2010-10-12 15:30 -------- d-----w- c:\programdata\PMB Files
2010-10-12 15:30 . 2010-10-12 15:30 238776 ----a-w- c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
2010-10-12 15:30 . 2010-10-12 15:30 -------- d-----w- c:\program files\Pando Networks
2010-10-10 16:05 . 2010-10-10 16:05 -------- d-----w- c:\program files\Atomic Email Hunter
2010-10-10 14:43 . 2010-10-10 14:44 -------- d-----w- c:\program files\AV WebCam Morpher
2010-10-10 14:42 . 2010-10-10 14:43 -------- d-----w- c:\users\Arthur\AppData\Roaming\GetRightToGo
2010-10-10 14:40 . 2010-10-10 14:41 -------- d-----w- c:\program files\VirtualCamera
2010-10-10 13:57 . 2010-10-10 13:57 -------- d-----w- c:\program files\Common Files\fwc
2010-10-10 13:57 . 2010-10-10 14:37 -------- d-----w- c:\program files\Fake Webcam
2010-10-10 13:37 . 2010-10-18 17:22 -------- d-----w- C:\dir
2010-10-09 20:28 . 2010-10-09 20:28 -------- d-----w- c:\program files\Groupe Eurower
2010-10-09 20:14 . 2010-10-09 20:25 -------- d-----w- c:\program files\MySmtp
2010-10-09 20:13 . 2010-10-09 20:13 290816 ------w- c:\windows\Setup1.exe
2010-10-09 20:13 . 2010-10-09 20:13 74752 ----a-w- c:\windows\ST6UNST.EXE
2010-10-09 14:24 . 2010-10-09 14:24 -------- d-----w- c:\program files\fec
2010-10-08 19:28 . 2010-10-08 19:29 -------- d-----w- c:\program files\WinHTTrack
2010-10-08 18:01 . 2010-10-16 11:36 -------- d-----w- c:\users\Arthur\AppData\Roaming\FileZilla
2010-10-08 18:01 . 2010-10-08 18:05 -------- d-----w- c:\program files\FileZilla FTP Client
2010-10-06 19:32 . 2010-10-06 19:37 -------- d-----w- c:\program files\AutoIt3
2010-10-05 20:32 . 2010-10-05 20:34 -------- d-----w- c:\users\Les Jacq\AppData\Roaming\vlc
2010-09-30 19:44 . 2010-09-30 19:44 -------- d-----w- c:\users\Arthur\AppData\Local\Broad Intelligence
2010-09-30 18:05 . 2010-09-30 18:05 -------- d-----w- c:\windows\system32\DivX Movies
2010-09-29 15:41 . 2010-09-30 19:06 744495 ----a-w- c:\windows\system32\ConsoleReader.exe
2010-09-29 03:24 . 2010-06-22 12:57 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-29 03:23 . 2010-08-26 04:23 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-09-28 19:03 . 2010-09-28 19:36 -------- d-----w- C:\dexter
2010-09-28 18:46 . 2010-09-28 18:46 -------- d-----w- c:\program files\VirtualDubMOD
2010-09-27 18:45 . 2010-09-27 18:45 -------- d-----w- c:\program files\URUSoft
2010-09-25 20:53 . 2010-07-17 03:00 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-25 20:53 . 2010-07-17 03:00 423656 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2010-09-25 10:28 . 2010-09-25 10:28 -------- d--h--w- c:\windows\PIF
2010-09-20 18:21 . 2010-09-20 18:24 -------- d-----w- C:\Temp
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-05-24 15:38 . 2008-11-07 22:46 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-18 16:00 . 2008-11-07 22:46 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 13:41 . 2008-11-07 22:46 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-05-18 15:59 . 2008-11-07 22:46 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 11:19 . 2008-11-07 22:46 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 17:35 . 2008-11-07 22:46 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 10:10 . 2008-11-07 22:46 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 10:42 . 2008-11-07 22:46 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 10:22 . 2008-11-07 22:46 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 10:21 . 2008-11-07 22:46 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2006-05-03 09:06 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\System32\nbDX.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552]
"{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
2010-06-13 17:10 2734688 ----a-w- c:\program files\Softonic_France\tbSoft.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-15 10:33 2515552 ----a-w- c:\program files\DVDVideoSoftTB\tbDVDV.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552]
"{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-09 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-10-12 2937528]
"bywifi"="c:\program files\Bywifi\bywifi.exe" [2010-02-09 2207744]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 4390912]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-07-06 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-06 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-06 81920]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2010-07-13 126976]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"phoenixInjector"="c:\windows\system32\ConsoleReader.exe" [2010-09-30 744495]
"bywifi"="c:\program files\Bywifi\bywifi.exe" [2010-02-09 2207744]
c:\users\Les Jacq\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - d:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
backup=c:\windows\pss\Empowering Technology Launcher.lnkCommon Startup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk]
backup=c:\windows\pss\GamersFirst LIVE!.lnkCommon Startup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PDFCreator.lnk]
backup=c:\windows\pss\PDFCreator.lnkCommon Startup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SnagIt 8.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SnagIt 8.lnk
backup=c:\windows\pss\SnagIt 8.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinStart Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinStart Manager.lnk
backup=c:\windows\pss\WinStart Manager.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^dptray_v1.5.exe.lnk]
backup=c:\windows\pss\dptray_v1.5.exe.lnkStartup
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dptray_v1.5.exe.lnk
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnkStartup
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 - Capture d'écran et lancement.lnk
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^Arthur^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Real Desktop.lnk]
backup=c:\windows\pss\Real Desktop.lnkStartup
path=c:\users\Arthur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Real Desktop.lnk
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-02-15 16:39 151552 ----a-w- c:\acer\AcerTour\Reminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-06-11 20:43 640376 ----a-w- c:\adobe master collection cs4\Acrobat 9.0\Acrobat\acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 05:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0ENQBO]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2010-01-06 09:39 323392 ----a-w- c:\users\Arthur\Program Files\DNA\btdna.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2009-01-29 22:20 57344 ----a-w- c:\program files\SlySoft\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 15:57 86016 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-10 09:02 216520 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2010-07-13 22:49 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ManyCam]
2009-12-19 05:04 1824040 ----a-w- c:\program files\ManyCam 2.4\ManyCam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 03:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-18 21:33 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2008-01-29 15:38 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-07-21 17:28 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
2006-03-06 22:52 36864 ------w- c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2008-01-18 21:36 2153472 ----a-w- c:\windows\System32\oobefldr.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9ba0cba84fec4;Service Google Update (gupdate1c9ba0cba84fec4);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-10 133104]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 IntelDH;IntelDH Driver;c:\windows\system32\Drivers\IntelDH.sys [2007-09-01 5504]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 PAC207;SoC PC-Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2006-12-05 507136]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2010-03-11 153736]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 XPADFL02;XPAD Filter Service 02;c:\windows\system32\DRIVERS\xpadfl02.sys [2006-12-24 27904]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-12-25 717296]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-03-19 108289]
S2 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [2008-05-19 57344]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-09 18944]
S2 WebCamHelper;WebCamHelper;c:\progra~1\AVWEBC~1\WebCamHelper.sys [2007-07-06 2688]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-09 33792]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2008-11-19 16640]
.
Contenu du dossier 'Tâches planifiées'
2010-10-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-12 18:45]
2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-10 18:46]
2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-10 18:46]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://google.cherche.us/Result.php?client=pub-0420647136319153&cof=GIMP%3A009900%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A11%3BDIV%3A%23FFFFF0%3B&ie=ISO-8859-1&q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 127.0.0.1:8080
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Download all links with IDM - c:\users\Arthur\AppData\Local\Temp\Rar$EX03.285\IEGetAll.htm
IE: Download FLV video content with IDM - c:\users\Arthur\AppData\Local\Temp\Rar$EX03.285\IEGetVL.htm
IE: Download with IDM - c:\users\Arthur\AppData\Local\Temp\Rar$EX03.285\IEExt.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{09E90109-A9AA-4980-BCEF-76F8D924E902} - c:\program files\Bywifi\bywifici.exe
Trusted Zone: chat-land.org
FF - ProfilePath - c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com|https://outlook.live.com/owa/
FF - prefs.js: network.proxy.type - 2
FF - component: c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll
FF - component: c:\users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\6eqvbm1u.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft Silverlight\4.0.50917.0\npctrl.1.0.20926.0.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\Sony\Media Go\npmediago.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\users\Arthur\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'Explorer.exe'(4320)
c:\program files\RocketDock\RocketDock.dll
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\BurnAware Free\NMSAccess32.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\system32\WUDFHost.exe
c:\windows\RtHDVCpl.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Brother\Brmfcmon\BrMfcmon.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Heure de fin: 2010-10-19 18:32:31 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-10-19 16:32
Avant-CF: 39 340 331 008 octets libres
Après-CF: 39 175 307 264 octets libres
- - End Of File - - 0D4B108CD9D3E44A96B0C7F510912A43 -
j'ai absolument rien compris
-
En gros après le redémarrage et la fin du scan de Combofix je ne pouvait plus ouvrir aucune application avec tout le temps le même message d'erreur qui concernait l'administrateur et "explorer.exe" je crois ^^ J'ai donc étein le PC direct avec la multiprise... J'ai redémarrer et ça a marcher seulement comme j'ai déjà fait des scan avec combofix avant le scan que je vien d'envoyer je ne suis pas sure que ce soit le bon x')
- 1
- 2
- 3
- 4
- 5
Suivant
