Long écran noir au démarrage
Résolu
Bonjour,
je vous expose mon problème: lors du démarrage de mon pc, après le bios et avant l'écran bienvenue de Vista, un écran noir de 8 minutes a fait son apparition depuis environ une semaine. de plus impossible de lancer un scan malwarebyte: celui si se bloque a 4 seconde et il "ne répond plus" et ce que je le lance en mode sans échec ou non (j'ai aussi désinstaller réinstaller plusieurs fois malwarebyte mais rien n'y fait!
je pense bien sur avoir un virus mais aucunes manières de le localiser
merci de vos réponses
--
Tous pour un et un pour tous!!!
vive le jeu de rôle papier! vive les jeux de plateaux et vive le couscous!!!!!!
je vous expose mon problème: lors du démarrage de mon pc, après le bios et avant l'écran bienvenue de Vista, un écran noir de 8 minutes a fait son apparition depuis environ une semaine. de plus impossible de lancer un scan malwarebyte: celui si se bloque a 4 seconde et il "ne répond plus" et ce que je le lance en mode sans échec ou non (j'ai aussi désinstaller réinstaller plusieurs fois malwarebyte mais rien n'y fait!
je pense bien sur avoir un virus mais aucunes manières de le localiser
merci de vos réponses
--
Tous pour un et un pour tous!!!
vive le jeu de rôle papier! vive les jeux de plateaux et vive le couscous!!!!!!
11 réponses
-
Contributeur sécuritébonjour
Telecharge combofix :
Faire un clic droit sur le lien
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Choisir : "Enregistrer la cible du lien sous..."
* Choisir le Bureau comme destination.
* Dans le champ "Nom du fichier", renommer ComboFix.exe en CCM.exe par exemple, puis enregistrer.
* Attention ! L'étape de renommage est obligatoire sous peine de voir afficher le message "ComboFix.exe n'est pas une application win32 valide" et de le rendre ainsi totalement inefficace.
Note importante :tu est sous Vista
la désactivation du Contrôle des comptes utilisateurs est obligatoire
Tuto : https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uacer-l-uac
pour toute manipulation fait comme ceci( clic droit "exécuter en tant qu'administrateur" pour Vista/7 )
-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
Avant d'utiliser ComboFix :
-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur Combofix.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
-Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. risque de figer l'ordi
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)
-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.
-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordi (plantage complet)
::Si combofix détecte quelque chose et de demande a redémarrer tu accepte
-
merci !
alors voila le rapport:
ComboFix 10-10-25.04 - sushi 26/10/2010 15:40:00.1.4 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3325.2523 [GMT 2:00]
Lancé depuis: c:\users\sushi\Desktop\ccm.exe
SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.
[i] ADS - Windows: deleted 48 bytes in 1 streams. [/i]
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Install.exe
c:\program files\Search Settings
c:\program files\Search Settings\kb127\SearchSettings.dll
c:\program files\Search Settings\kb127\SearchSettingsRes409.dll
c:\program files\Search Settings\SearchSettings.exe
c:\programdata\vlc-1.0.5-win32.exe
c:\windows\system32\spool\prtprocs\w32x86\aloaha_prntproc.dll
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-09-26 au 2010-10-26 ))))))))))))))))))))))))))))))))))))
.
2010-10-26 13:51 . 2010-10-26 13:51 -------- d-----w- c:\users\sushi\AppData\Local\temp
2010-10-26 13:51 . 2010-10-26 13:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-26 12:56 . 2010-10-26 12:56 -------- d-----w- C:\ccm
2010-10-26 12:38 . 2010-10-26 12:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-10-26 12:38 . 2010-10-26 12:55 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-10-26 12:02 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{84CA36CB-66FA-4571-A84C-F4CE6EB98B6E}\mpengine.dll
2010-10-26 11:07 . 2010-10-26 11:42 -------- d-----w- c:\users\sushi\AppData\Local\Darksiders
2010-10-26 11:03 . 2010-10-26 11:03 -------- d-----w- c:\program files\THQ
2010-10-22 11:25 . 2010-10-25 15:43 -------- d-----w- c:\users\sushi\AppData\Local\LogMeIn Hamachi
2010-10-22 11:25 . 2010-10-26 13:51 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\LogMeIn Hamachi
2010-10-22 11:25 . 2010-10-22 11:25 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-10-21 23:23 . 2010-10-21 23:23 -------- d-----w- c:\program files\Paradox Interactive
2010-10-21 21:12 . 2010-10-21 21:13 -------- d-----w- c:\program files\NyxQuest - Kindred Spirits
2010-10-21 09:39 . 2010-10-22 08:41 7168 ----a-w- c:\windows\system32\drivers\ute4odq4.sys
2010-10-21 09:37 . 2010-10-22 08:41 -------- d-----w- c:\programdata\Kaspersky Lab
2010-10-21 09:21 . 2010-09-30 15:18 30528 ----a-w- c:\windows\system32\TURegOpt.exe
2010-10-21 09:21 . 2010-09-30 15:12 21312 ----a-w- c:\windows\system32\authuitu.dll
2010-10-21 09:21 . 2010-09-30 15:12 30016 ----a-w- c:\windows\system32\uxtuneup.dll
2010-10-21 09:21 . 2010-10-21 09:21 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-10-21 09:02 . 2010-10-21 09:02 -------- d-----w- c:\users\sushi\AppData\Roaming\GlarySoft
2010-10-21 08:57 . 2010-10-21 08:57 -------- d-----w- c:\program files\Glary Utilities
2010-10-21 08:50 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-21 08:50 . 2010-10-21 08:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-21 08:50 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-20 23:11 . 2010-10-25 16:00 -------- d-----w- c:\users\sushi\AppData\Local\Windows Live
2010-10-20 23:11 . 2009-08-04 08:02 754688 ----a-w- c:\windows\system32\webservices.dll
2010-10-20 22:46 . 2010-10-08 08:38 57960 ----a-w- c:\windows\system32\OpenCL.dll
2010-10-20 22:46 . 2010-10-08 08:38 888424 ----a-w- c:\windows\system32\nvdispco322050.dll
2010-10-20 22:46 . 2010-10-08 08:38 813672 ----a-w- c:\windows\system32\nvgenco322030.dll
2010-10-20 22:46 . 2010-10-08 08:38 5399656 ----a-w- c:\windows\system32\nvwgf2um.dll
2010-10-20 22:46 . 2010-10-08 08:38 2911848 ----a-w- c:\windows\system32\nvcuvid.dll
2010-10-20 22:46 . 2010-10-08 08:38 14899816 ----a-w- c:\windows\system32\nvoglv32.dll
2010-10-20 22:46 . 2010-10-08 08:38 10055304 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2010-10-20 22:46 . 2010-10-08 08:38 4836456 ----a-w- c:\windows\system32\nvcuda.dll
2010-10-20 22:46 . 2010-10-08 08:38 2666088 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-10-20 22:46 . 2010-10-08 08:38 13019752 ----a-w- c:\windows\system32\nvcompiler.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2010-10-20 20:04 . 2010-10-20 20:04 -------- d-----w- c:\program files\QuickTime
2010-10-20 19:58 . 2010-10-20 19:58 -------- d-----w- c:\program files\Apple Software Update
2010-10-17 21:39 . 2010-10-17 21:39 -------- d-----w- c:\users\sushi\AppData\Roaming\Sony Online Entertainment
2010-10-16 21:37 . 2009-02-05 00:49 451072 ----a-w- c:\windows\system32\ISSRemoveSP.exe
2010-10-10 17:30 . 2008-07-03 12:27 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-10-10 17:30 . 2008-07-03 12:27 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-10-10 17:30 . 2008-07-03 12:27 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-10-08 00:03 . 2010-10-08 00:03 600680 ----a-w- c:\windows\system32\nvvsvc.exe
2010-10-08 00:03 . 2010-10-08 00:03 1881704 ----a-w- c:\windows\system32\nvsvcr.dll
2010-10-08 00:03 . 2010-10-08 00:03 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-10-08 00:03 . 2010-10-08 00:03 3416680 ----a-w- c:\windows\system32\nvcpl.dll
2010-10-08 00:03 . 2010-10-08 00:03 2079336 ----a-w- c:\windows\system32\nvsvc.dll
2010-10-03 13:41 . 2010-10-23 12:33 -------- d-----w- c:\users\sushi\AppData\Roaming\vlc
2010-09-29 19:08 . 2010-09-29 19:08 -------- d-----w- c:\program files\Microsoft LifeCam
2010-09-29 18:26 . 2010-10-10 17:30 -------- d-----w- c:\users\sushi\AppData\Roaming\AVS4YOU
2010-09-29 18:25 . 2010-10-13 13:03 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-09-29 18:25 . 2010-10-13 13:03 -------- d-----w- c:\program files\AVS4YOU
2010-09-29 18:25 . 2010-09-29 18:26 -------- d-----w- c:\programdata\AVS4YOU
2010-09-29 18:25 . 2010-06-22 14:05 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-09-29 18:25 . 2010-06-22 14:05 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-09-29 10:49 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-28 16:20 . 2010-09-28 16:20 -------- d-----w- c:\program files\Winamp Detect
2010-09-28 15:30 . 2010-09-28 15:30 -------- d-----w- c:\users\sushi\AppData\Roaming\SEGA
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-21 21:12 . 2008-06-28 11:08 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-10-19 09:41 . 2009-10-04 18:50 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-08 08:38 . 2010-10-20 22:46 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2010-10-08 08:38 . 2007-12-07 09:57 10021992 ----a-w- c:\windows\system32\nvd3dum.dll
2010-10-08 08:38 . 2007-12-07 09:57 1718376 ----a-w- c:\windows\system32\nvapi.dll
2010-09-23 12:23 . 2008-06-28 11:08 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2010-09-22 22:47 . 2010-09-22 22:47 49016 ----a-w- c:\windows\system32\sirenacm.dll
2010-09-19 09:49 . 2008-08-14 05:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2010-09-07 15:12 . 2010-09-15 16:20 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-09-15 16:20 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-09-15 16:20 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-09-15 16:20 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-09-15 16:20 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-09-15 16:20 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-09-07 14:47 . 2010-09-15 16:20 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-05 15:31 . 2010-09-05 15:31 16896 ----a-r- c:\users\sushi\AppData\Roaming\Microsoft\Installer\{96443F45-13E2-11D6-AC87-00D0B7A9E540}\Icon96443F453.exe
2010-08-18 15:10 . 2010-09-23 12:23 809560 ----a-r- c:\windows\system32\tmp6875.tmp
2010-08-18 15:10 . 2010-08-18 15:10 809560 ----a-r- c:\windows\system32\tmp6864.tmp
2010-08-17 14:11 . 2010-09-15 16:23 128000 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-10 03:15 . 2010-08-10 03:15 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 03:15 . 2010-08-10 03:15 69632 ----a-w- c:\windows\system32\QuickTime.qts
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
------- Sigcheck -------
[-] 2009-04-11 . A43FF743C9DBAC2264C0D750DA02DEE1 . 3956224 . . [6.0.6000.16386] . . c:\windows\explorer.exe
[7] 2009-04-11 . D07D4C3038F3578FFCE1C0237F2A1253 . 2926592 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[-] 2008-12-11 . C43B5567C0BE226C5676C950B5B985E4 . 2928640 . . [6.0.6000.16386] . . c:\windows\Resources\Themes\Windows 7 Style For Vista\Explorer\explorer.exe
[7] 2008-10-30 . 50BA5850147410CDE89C523AD3BC606E . 2927616 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[7] 2008-10-29 . 4F554999D7D5F05DAAEBBA7B5BA1089D . 2927104 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[7] 2008-10-29 . 37440D09DEAE0B672A04DCCF7ABF06BE . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[7] 2008-10-28 . E7156B0B74762D9DE0E66BDCDE06E5FB . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[7] 2008-01-19 . FFA764631CB70A30065C12EF8E174F9F . 2927104 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
[7] 2007-10-15 . BD06F0BF753BC704B653C3A50F89D362 . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[7] 2007-10-15 . 6D06CD98D954FE87FB2DB8108793B399 . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[7] 2006-11-02 . FD8C53FB002217F6F888BCF6F5D7084D . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[-] 2009-06-16 . 690D53BD10A804BB6D0A772D1C0E6907 . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll
[7] 2009-04-11 . C818C44C201898399BF999BB6B35D4E3 . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6002.18005_none_cf1bd6361a0f622e\shsvcs.dll
[7] 2008-01-19 . 27F10F348E508243F6254846F8370D0D . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll
[7] 2006-11-02 . B264DFA21677728613267FE63802B332 . 245248 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6000.16386_none_caf99b2e2002860e\shsvcs.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-11 4702208]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe" [2009-02-25 24576]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2008-09-05 159744]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Assistant Smart Wizard NETGEAR pour WG311v3.lnk]
backup=c:\windows\pss\Assistant Smart Wizard NETGEAR pour WG311v3.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WG111v3 Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG111v3 Smart Wizard.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PyGrenouille.lnk]
backup=c:\windows\pss\PyGrenouille.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DesktopEarth AutoStart.lnk]
backup=c:\windows\pss\DesktopEarth AutoStart.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dragon NaturallySpeaking.lnk]
backup=c:\windows\pss\Dragon NaturallySpeaking.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk]
backup=c:\windows\pss\hamachi.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Warkeys Update.lnk]
path=c:\users\sushi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warkeys Update.lnk
backup=c:\windows\pss\Warkeys Update.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ESL Wire
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intra Proxy]
c:\programdata\pollaudioaudio.x2sb5mv [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\360desktop]
2009-11-06 11:24 1065800 ----a-w- c:\program files\360desktop\360desktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-09-19 09:48 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 12:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-12-23 16:05 143360 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX6000 Series]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBIE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX6000 Series (Copie 1)]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBIE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-16 14:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 13:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 13:39 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-09-22 22:47 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2005-08-18 08:55 99328 ----a-w- c:\program files\OpenVPN\bin\openvpn-gui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 03:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2009-09-23 00:41 306088 ----a-w- d:\jeux\ GTA IV\Rockstar Games Social Club\RGSCLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
2007-02-09 14:54 16896 ----a-w- c:\program files\GoogleEULA\EULALauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2010-05-20 13:27 762736 ----a-w- c:\windows\vVX3000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
"ISUSPM Startup"=c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SearchSettings"=c:\program files\Search Settings\SearchSettings.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "c:\programdata\Nuance\NaturallySpeaking10\Ereg.ini
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"VX3000"=c:\windows\vVX3000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3441857192-1552460990-2656611465-1000]
"EnableNotificationsRef"=dword:00000007
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 135664]
R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-08 1136600]
R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrusb.sys [2006-12-22 449536]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\jeux\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:\windows\system32\DRIVERS\ESLvnic.sys [2010-04-21 24504]
R3 fbxusb;Carte réseau virtuelle FreeBox USB (32 bits);c:\windows\system32\DRIVERS\fbxusb32.sys [2007-08-27 31128]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2010-01-26 243056]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-05-06 2785582]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2007-12-28 289280]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010-02-24 10064]
R3 ute4odq4;AVZ Kernel Driver;c:\windows\system32\Drivers\ute4odq4.sys [2010-10-22 7168]
R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys [2009-12-17 31824]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2008-06-30 717296]
R4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-09-30 1051968]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2007-04-13 137216]
S1 aswSP;aswSP; [x]
S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2007-04-23 25896]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2009-12-17 123280]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2009-12-17 41616]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-07 369256]
S3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2007-08-02 22784]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [2006-10-01 26624]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2009-12-17 99152]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2009-12-17 110096]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2010-10-26 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-10-21 19:55]
2010-10-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-07 17:11]
2010-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 01:09]
2010-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 01:09]
2010-05-10 c:\windows\Tasks\NatSpeak Periodic Acoustic Optimization.job
- c:\progra~1\Nuance\NATURA~1\Program\schedmgr.exe [2008-10-16 10:20]
2010-05-10 c:\windows\Tasks\NatSpeak Periodic Language Model Optimization.job
- c:\progra~1\Nuance\NATURA~1\Program\schedmgr.exe [2008-10-16 10:20]
2010-10-26 c:\windows\Tasks\User_Feed_Synchronization-{6B86C4C2-EC50-4951-8C65-E892460A1336}.job
- c:\windows\system32\msfeedssync.exe [2008-06-27 07:33]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.wibeez.com/renseignement
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: &Envoyer à OneNote - /105
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
FF - ProfilePath - c:\users\sushi\AppData\Roaming\Mozilla\Firefox\Profiles\r676yh21.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?rlz=1R0GGLL_fr
FF - prefs.js: keyword.URL - hxxp://www.wibeez.com/renseignement?search&q=
FF - component: c:\users\sushi\AppData\Roaming\Mozilla\Firefox\Profiles\r676yh21.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\progra~1\MICROS~2\Office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\MICROS~2\Office14\NPSPWRAP.DLL
FF - plugin: c:\program files\firefox3.5\plugins\npdeployJava1.dll
FF - plugin: c:\program files\firefox3.5\plugins\npwachk.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\program files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.
- - - - ORPHELINS SUPPRIMES - - - -
Toolbar-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-DivXUpdate - c:\program files\DivX\DivX Update\DivXUpdate.exe
MSConfigStartUp-PWRISOVM - (no file)
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-26 15:51
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.0 by Gmer, http://www.gmer.net
Windows 6.0.6002
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x88448078]<<
1 ntkrnlpa!IofCallDriver[0x84246962] -> \Device\Harddisk0\DR0[0x8813FAC8]
2 ntkrnlpa[0x84246962] -> CLASSPNP.SYS[0x8CFD08B3] -> \Device\Harddisk0\DR0[0x8813FAC8]
3 CLASSPNP[0x8CFD08B3] -> ntkrnlpa!IofCallDriver[0x84246962] -> [0x86D57918]
4 ntkrnlpa[0x84246962] -> acpi.sys[0x80C946BC] -> [0x86D57918]
5 acpi[0x80C946BC] -> ntkrnlpa!IofCallDriver[0x84246962] -> \Device\Ide\IdeDeviceP2T0L0-2[0x87788030]
\Driver\atapi[0x87778988] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x88448078
6 ntkrnlpa[0x84246962] -> UNKNOWN[0x8844807F] -> \Device\Ide\IdeDeviceP2T0L0-2[0x87788030]
kernel: MBR read successfully
detected hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8cfd0d24
\Driver\ACPI -> acpi.sys @ 0x80c94d68
\Driver\atapi -> 0x88448078
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3441857192-1552460990-2656611465-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:27,67,61,fa,1a,3e,73,fa,8c,d3,89,64,5b,e6,df,7c,1f,cb,d1,1f,c4,b6,53,
e9,96,f3,7c,44,06,f2,0d,72,2c,51,18,e6,97,07,39,01,82,88,4a,15,c7,c2,bb,db,\
"??"=hex:a2,6a,6b,4b,2f,6b,b1,dc,98,1f,04,d7,0d,c8,2e,2c
[HKEY_USERS\S-1-5-21-3441857192-1552460990-2656611465-1000\Software\SecuROM\License information*]
"datasecu"=hex:5b,8f,85,0b,da,36,db,64,df,a2,da,1b,f4,de,31,d5,09,1e,5a,b7,32,
0b,92,89,9a,38,0d,3c,7b,94,63,18,be,ec,fd,a8,23,5d,50,f3,5a,3f,5e,71,d6,f5,\
"rkeysecu"=hex:3d,db,a4,11,63,cc,df,71,4c,34,7e,49,df,6d,46,de
.
Heure de fin: 2010-10-26 15:55:50
ComboFix-quarantined-files.txt 2010-10-26 13:55
Avant-CF: 75 258 810 368 octets libres
Après-CF: 75 309 109 248 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
- - End Of File - - 0FF00611485BD614FB2B458CEBC6553B
-
la liste me semble longue...
--
Tous pour un et un pour tous!!!
vive le jeu de rôle papier! vive les jeux de plateaux et vive le couscous!!!!!! -
Contributeur sécurité****************************************************
/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\
Ouvre le Bloc-Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Copie ce texte ( en gras )d'une traite ( CTRL+C pour copier ) puis colle-le ( CTRL+V dans le bloc-note )
Driver::
ute4odq4
File::
c:\windows\system32\tmp6875.tmp
c:\windows\system32\tmp6864.tmp
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SearchSettings"=-
Sauvegarde ce fichier sur ton bureau sous le nom de CFScript.txt.
Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Cela va relancer Combofix,
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports. -
encore merci pour le temps passé a éssayer de résoudre mon probleme voila le rapport combofix:
ComboFix 10-10-25.04 - sushi 27/10/2010 12:57:24.2.4 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3325.2448 [GMT 2:00]
Lancé depuis: c:\users\sushi\Desktop\ccm.exe
Commutateurs utilisés :: c:\users\sushi\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
* Un nouveau point de restauration a été créé
FILE ::
"c:\windows\system32\tmp6864.tmp"
"c:\windows\system32\tmp6875.tmp"
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\tmp6864.tmp
c:\windows\system32\tmp6875.tmp
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_UTE4ODQ4
-------\Service_ute4odq4
((((((((((((((((((((((((((((( Fichiers créés du 2010-09-27 au 2010-10-27 ))))))))))))))))))))))))))))))))))))
.
2010-10-27 11:11 . 2010-10-27 11:20 -------- d-----w- c:\users\sushi\AppData\Local\temp
2010-10-27 11:11 . 2010-10-27 11:11 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-10-27 11:11 . 2010-10-27 11:11 -------- d-----w- c:\users\Invité\AppData\Local\temp
2010-10-27 11:11 . 2010-10-27 11:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-27 11:11 . 2010-10-27 11:11 -------- d-----w- c:\users\ASPNET\AppData\Local\temp
2010-10-27 11:11 . 2010-10-27 11:11 -------- d-----w- c:\users\Administrateur\AppData\Local\temp
2010-10-27 08:47 . 2010-08-26 16:34 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-10-27 08:47 . 2010-08-26 16:33 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-10-27 08:47 . 2010-08-26 14:23 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-10-26 12:56 . 2010-10-26 12:56 -------- d-----w- C:\ccm
2010-10-26 12:38 . 2010-10-26 12:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-10-26 12:38 . 2010-10-26 12:55 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-10-26 12:02 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{84CA36CB-66FA-4571-A84C-F4CE6EB98B6E}\mpengine.dll
2010-10-26 11:07 . 2010-10-26 11:42 -------- d-----w- c:\users\sushi\AppData\Local\Darksiders
2010-10-26 11:03 . 2010-10-26 11:03 -------- d-----w- c:\program files\THQ
2010-10-22 11:25 . 2010-10-25 15:43 -------- d-----w- c:\users\sushi\AppData\Local\LogMeIn Hamachi
2010-10-22 11:25 . 2010-10-27 11:19 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\LogMeIn Hamachi
2010-10-22 11:25 . 2010-10-22 11:25 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-10-21 23:23 . 2010-10-21 23:23 -------- d-----w- c:\program files\Paradox Interactive
2010-10-21 21:12 . 2010-10-21 21:13 -------- d-----w- c:\program files\NyxQuest - Kindred Spirits
2010-10-21 09:39 . 2010-10-22 08:41 7168 ----a-w- c:\windows\system32\drivers\ute4odq4.sys
2010-10-21 09:37 . 2010-10-22 08:41 -------- d-----w- c:\programdata\Kaspersky Lab
2010-10-21 09:21 . 2010-09-30 15:18 30528 ----a-w- c:\windows\system32\TURegOpt.exe
2010-10-21 09:21 . 2010-09-30 15:12 21312 ----a-w- c:\windows\system32\authuitu.dll
2010-10-21 09:21 . 2010-09-30 15:12 30016 ----a-w- c:\windows\system32\uxtuneup.dll
2010-10-21 09:21 . 2010-10-21 09:21 -------- d-----w- c:\program files\TuneUp Utilities 2010
2010-10-21 09:02 . 2010-10-21 09:02 -------- d-----w- c:\users\sushi\AppData\Roaming\GlarySoft
2010-10-21 08:57 . 2010-10-21 08:57 -------- d-----w- c:\program files\Glary Utilities
2010-10-21 08:50 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-21 08:50 . 2010-10-21 08:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-21 08:50 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-20 23:11 . 2010-10-27 09:29 -------- d-----w- c:\users\sushi\AppData\Local\Windows Live
2010-10-20 23:11 . 2009-08-04 08:02 754688 ----a-w- c:\windows\system32\webservices.dll
2010-10-20 22:46 . 2010-10-08 08:38 57960 ----a-w- c:\windows\system32\OpenCL.dll
2010-10-20 22:46 . 2010-10-08 08:38 888424 ----a-w- c:\windows\system32\nvdispco322050.dll
2010-10-20 22:46 . 2010-10-08 08:38 813672 ----a-w- c:\windows\system32\nvgenco322030.dll
2010-10-20 22:46 . 2010-10-08 08:38 5399656 ----a-w- c:\windows\system32\nvwgf2um.dll
2010-10-20 22:46 . 2010-10-08 08:38 2911848 ----a-w- c:\windows\system32\nvcuvid.dll
2010-10-20 22:46 . 2010-10-08 08:38 14899816 ----a-w- c:\windows\system32\nvoglv32.dll
2010-10-20 22:46 . 2010-10-08 08:38 10055304 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2010-10-20 22:46 . 2010-10-08 08:38 4836456 ----a-w- c:\windows\system32\nvcuda.dll
2010-10-20 22:46 . 2010-10-08 08:38 2666088 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-10-20 22:46 . 2010-10-08 08:38 13019752 ----a-w- c:\windows\system32\nvcompiler.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2010-10-20 20:04 . 2010-10-20 20:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2010-10-20 20:04 . 2010-10-20 20:04 -------- d-----w- c:\program files\QuickTime
2010-10-20 19:58 . 2010-10-20 19:58 -------- d-----w- c:\program files\Apple Software Update
2010-10-17 21:39 . 2010-10-17 21:39 -------- d-----w- c:\users\sushi\AppData\Roaming\Sony Online Entertainment
2010-10-16 21:37 . 2009-02-05 00:49 451072 ----a-w- c:\windows\system32\ISSRemoveSP.exe
2010-10-10 17:30 . 2008-07-03 12:27 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-10-10 17:30 . 2008-07-03 12:27 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-10-10 17:30 . 2008-07-03 12:27 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-10-08 00:03 . 2010-10-08 00:03 600680 ----a-w- c:\windows\system32\nvvsvc.exe
2010-10-08 00:03 . 2010-10-08 00:03 1881704 ----a-w- c:\windows\system32\nvsvcr.dll
2010-10-08 00:03 . 2010-10-08 00:03 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-10-08 00:03 . 2010-10-08 00:03 3416680 ----a-w- c:\windows\system32\nvcpl.dll
2010-10-08 00:03 . 2010-10-08 00:03 2079336 ----a-w- c:\windows\system32\nvsvc.dll
2010-10-03 13:41 . 2010-10-23 12:33 -------- d-----w- c:\users\sushi\AppData\Roaming\vlc
2010-09-29 19:08 . 2010-09-29 19:08 -------- d-----w- c:\program files\Microsoft LifeCam
2010-09-29 18:26 . 2010-10-10 17:30 -------- d-----w- c:\users\sushi\AppData\Roaming\AVS4YOU
2010-09-29 18:25 . 2010-10-13 13:03 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-09-29 18:25 . 2010-10-13 13:03 -------- d-----w- c:\program files\AVS4YOU
2010-09-29 18:25 . 2010-09-29 18:26 -------- d-----w- c:\programdata\AVS4YOU
2010-09-29 18:25 . 2010-06-22 14:05 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-09-29 18:25 . 2010-06-22 14:05 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-09-29 10:49 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-28 16:20 . 2010-09-28 16:20 -------- d-----w- c:\program files\Winamp Detect
2010-09-28 15:30 . 2010-09-28 15:30 -------- d-----w- c:\users\sushi\AppData\Roaming\SEGA
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-21 21:12 . 2008-06-28 11:08 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-10-19 09:41 . 2009-10-04 18:50 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-08 08:38 . 2010-10-20 22:46 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2010-10-08 08:38 . 2007-12-07 09:57 10021992 ----a-w- c:\windows\system32\nvd3dum.dll
2010-10-08 08:38 . 2007-12-07 09:57 1718376 ----a-w- c:\windows\system32\nvapi.dll
2010-09-23 12:23 . 2008-06-28 11:08 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2010-09-22 22:47 . 2010-09-22 22:47 49016 ----a-w- c:\windows\system32\sirenacm.dll
2010-09-19 09:49 . 2008-08-14 05:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2010-09-07 15:12 . 2010-09-15 16:20 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-09-15 16:20 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-09-15 16:20 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-09-15 16:20 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-09-15 16:20 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-09-15 16:20 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-09-07 14:47 . 2010-09-15 16:20 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-05 15:31 . 2010-09-05 15:31 16896 ----a-r- c:\users\sushi\AppData\Roaming\Microsoft\Installer\{96443F45-13E2-11D6-AC87-00D0B7A9E540}\Icon96443F453.exe
2010-08-26 16:33 . 2010-10-27 08:47 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2010-08-26 16:33 . 2010-10-27 08:47 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2010-08-26 16:33 . 2010-10-27 08:47 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2010-08-26 16:33 . 2010-10-27 08:47 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2010-08-17 14:11 . 2010-09-15 16:23 128000 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-10 03:15 . 2010-08-10 03:15 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 03:15 . 2010-08-10 03:15 69632 ----a-w- c:\windows\system32\QuickTime.qts
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
------- Sigcheck -------
[-] 2009-04-11 . A43FF743C9DBAC2264C0D750DA02DEE1 . 3956224 . . [6.0.6000.16386] . . c:\windows\explorer.exe
[7] 2009-04-11 . D07D4C3038F3578FFCE1C0237F2A1253 . 2926592 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[-] 2008-12-11 . C43B5567C0BE226C5676C950B5B985E4 . 2928640 . . [6.0.6000.16386] . . c:\windows\Resources\Themes\Windows 7 Style For Vista\Explorer\explorer.exe
[7] 2008-10-30 . 50BA5850147410CDE89C523AD3BC606E . 2927616 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[7] 2008-10-29 . 4F554999D7D5F05DAAEBBA7B5BA1089D . 2927104 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[7] 2008-10-29 . 37440D09DEAE0B672A04DCCF7ABF06BE . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[7] 2008-10-28 . E7156B0B74762D9DE0E66BDCDE06E5FB . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[7] 2008-01-19 . FFA764631CB70A30065C12EF8E174F9F . 2927104 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
[7] 2007-10-15 . BD06F0BF753BC704B653C3A50F89D362 . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[7] 2007-10-15 . 6D06CD98D954FE87FB2DB8108793B399 . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[7] 2006-11-02 . FD8C53FB002217F6F888BCF6F5D7084D . 2923520 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[-] 2009-06-16 . 690D53BD10A804BB6D0A772D1C0E6907 . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll
[7] 2009-04-11 . C818C44C201898399BF999BB6B35D4E3 . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6002.18005_none_cf1bd6361a0f622e\shsvcs.dll
[7] 2008-01-19 . 27F10F348E508243F6254846F8370D0D . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll
[7] 2006-11-02 . B264DFA21677728613267FE63802B332 . 245248 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6000.16386_none_caf99b2e2002860e\shsvcs.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-11 4702208]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.24\RivaTunerWrapper.exe" [2009-02-25 24576]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2008-09-05 159744]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Assistant Smart Wizard NETGEAR pour WG311v3.lnk]
backup=c:\windows\pss\Assistant Smart Wizard NETGEAR pour WG311v3.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WG111v3 Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG111v3 Smart Wizard.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PyGrenouille.lnk]
backup=c:\windows\pss\PyGrenouille.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^DesktopEarth AutoStart.lnk]
backup=c:\windows\pss\DesktopEarth AutoStart.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dragon NaturallySpeaking.lnk]
backup=c:\windows\pss\Dragon NaturallySpeaking.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk]
backup=c:\windows\pss\hamachi.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^sushi^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Warkeys Update.lnk]
path=c:\users\sushi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warkeys Update.lnk
backup=c:\windows\pss\Warkeys Update.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intra Proxy]
c:\programdata\pollaudioaudio.x2sb5mv [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\360desktop]
2009-11-06 11:24 1065800 ----a-w- c:\program files\360desktop\360desktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-09-19 09:48 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 12:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-12-23 16:05 143360 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40 687560 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX6000 Series]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBIE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX6000 Series (Copie 1)]
2006-09-22 04:01 139264 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIBIE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-16 14:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 13:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 13:39 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-09-22 22:47 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 13:40 155648 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2005-08-18 08:55 99328 ----a-w- c:\program files\OpenVPN\bin\openvpn-gui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 03:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2009-09-23 00:41 306088 ----a-w- d:\jeux\ GTA IV\Rockstar Games Social Club\RGSCLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
2007-02-09 14:54 16896 ----a-w- c:\program files\GoogleEULA\EULALauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2010-05-20 13:27 762736 ----a-w- c:\windows\vVX3000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
"ISUSPM Startup"=c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "c:\programdata\Nuance\NaturallySpeaking10\Ereg.ini
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"VX3000"=c:\windows\vVX3000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3441857192-1552460990-2656611465-1000]
"EnableNotificationsRef"=dword:00000007
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 135664]
R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-08 1136600]
R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrusb.sys [2006-12-22 449536]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\jeux\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:\windows\system32\DRIVERS\ESLvnic.sys [2010-04-21 24504]
R3 fbxusb;Carte réseau virtuelle FreeBox USB (32 bits);c:\windows\system32\DRIVERS\fbxusb32.sys [2007-08-27 31128]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2010-01-26 243056]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-05-06 2785582]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2007-12-28 289280]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010-02-24 10064]
R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys [2009-12-17 31824]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2008-06-30 717296]
R4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-09-30 1051968]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2007-04-13 137216]
S1 aswSP;aswSP; [x]
S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2007-04-23 25896]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2009-12-17 123280]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2009-12-17 41616]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-07 369256]
S3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2007-08-02 22784]
S3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [2006-10-01 26624]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2009-12-17 99152]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2009-12-17 110096]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
2010-10-27 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-10-21 19:55]
2010-10-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-07 17:11]
2010-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 01:09]
2010-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 01:09]
2010-05-10 c:\windows\Tasks\NatSpeak Periodic Acoustic Optimization.job
- c:\progra~1\Nuance\NATURA~1\Program\schedmgr.exe [2008-10-16 10:20]
2010-05-10 c:\windows\Tasks\NatSpeak Periodic Language Model Optimization.job
- c:\progra~1\Nuance\NATURA~1\Program\schedmgr.exe [2008-10-16 10:20]
2010-10-27 c:\windows\Tasks\User_Feed_Synchronization-{6B86C4C2-EC50-4951-8C65-E892460A1336}.job
- c:\windows\system32\msfeedssync.exe [2008-06-27 07:33]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.wibeez.com/renseignement
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: &Envoyer à OneNote - /105
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
FF - ProfilePath - c:\users\sushi\AppData\Roaming\Mozilla\Firefox\Profiles\r676yh21.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox?rlz=1R0GGLL_fr
FF - prefs.js: keyword.URL - hxxp://www.wibeez.com/renseignement?search&q=
FF - component: c:\users\sushi\AppData\Roaming\Mozilla\Firefox\Profiles\r676yh21.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-27 13:20
Windows 6.0.6002 Service Pack 2 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.0 by Gmer, http://www.gmer.net
Windows 6.0.6002
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x88583188]<<
1 ntkrnlpa!IofCallDriver[0x84258962] -> \Device\Harddisk0\DR0[0x87BBE6B0]
2 ntkrnlpa[0x84258962] -> CLASSPNP.SYS[0x8CFD98B3] -> \Device\Harddisk0\DR0[0x87BBE6B0]
3 CLASSPNP[0x8CFD98B3] -> ntkrnlpa!IofCallDriver[0x84258962] -> [0x86D538A0]
4 ntkrnlpa[0x84258962] -> acpi.sys[0x80C916BC] -> [0x86D538A0]
5 acpi[0x80C916BC] -> ntkrnlpa!IofCallDriver[0x84258962] -> \Device\Ide\IdeDeviceP2T0L0-2[0x8778C030]
\Driver\atapi[0x87782C18] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x88583188
6 ntkrnlpa[0x84258962] -> UNKNOWN[0x8858318F] -> \Device\Ide\IdeDeviceP2T0L0-2[0x8778C030]
kernel: MBR read successfully
detected hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8cfd9d24
\Driver\ACPI -> acpi.sys @ 0x80c91d68
\Driver\atapi -> 0x88583188
Warning: possible MBR rootkit infection !
user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_USERS\S-1-5-21-3441857192-1552460990-2656611465-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:27,67,61,fa,1a,3e,73,fa,8c,d3,89,64,5b,e6,df,7c,1f,cb,d1,1f,c4,b6,53,
e9,96,f3,7c,44,06,f2,0d,72,2c,51,18,e6,97,07,39,01,82,88,4a,15,c7,c2,bb,db,\
"??"=hex:a2,6a,6b,4b,2f,6b,b1,dc,98,1f,04,d7,0d,c8,2e,2c
[HKEY_USERS\S-1-5-21-3441857192-1552460990-2656611465-1000\Software\SecuROM\License information*]
"datasecu"=hex:5b,8f,85,0b,da,36,db,64,df,a2,da,1b,f4,de,31,d5,09,1e,5a,b7,32,
0b,92,89,9a,38,0d,3c,7b,94,63,18,be,ec,fd,a8,23,5d,50,f3,5a,3f,5e,71,d6,f5,\
"rkeysecu"=hex:3d,db,a4,11,63,cc,df,71,4c,34,7e,49,df,6d,46,de
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\NvXDSync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\programdata\EPSON\EPW!3 SSRP\E_S30RP1.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Razer\DeathAdder\razertra.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Razer\DeathAdder\razerofa.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Heure de fin: 2010-10-27 13:27:40 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-10-27 11:27
ComboFix2.txt 2010-10-26 13:55
Avant-CF: 75 141 967 872 octets libres
Après-CF: 74 758 684 672 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=9 Sets=1,2,3,4,5,6,7,8,9
- - End Of File - - F1DDFE07803C56525C21FA286AADFF23 -
et voila le rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55:52, on 27/10/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\sushi\Downloads\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wibeez.com/renseignement
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.24\RivaTunerWrapper.exe" /S
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O8 - Extra context menu item: &Envoyer à OneNote - res:///105
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - (no file)
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - D:\jeux\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
-
Contributeur sécuritéDÉSACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRÉSENTS !!!!!(car il est détecte a tort comme infection)
Télécharge ici :List_Kill'em de gen-hackman
http://sd-4.archive-host.com/membres/up/829108531491024/Mes_Tools/List_Killem_Install.exe
et enregistre le sur ton bureau
windows 7 => clic droit "exécuter en tant que administrateur
sur le raccourci sur ton bureau pour lancer l'installation
Laisse coché :
Exécuter List_Kill'em
une fois terminée , clic sur "terminer" et le programme se lancera seul
Il commencera par telecharger et installer ses mises à jour , puis te donnera son menu
choisis l'option Search
laisse travailler l'outil
il se peut qu'une boite de dialogue s'ouvre , dans ce cas clique sur "ok" ou "Agrée"
à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.
Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
------ NE LE POSTE PAS SUR LE FORUM-------
Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/
Clique sur Parcourir et cherche le fichier C:\List'em.txt
Clique sur Ouvrir.
Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt
est ajouté dans la page.
Copie ce lien dans ta réponse. -
voila le lien!
mon antivirus est coupé et mon pare feu aussi!
http://www.cijoint.fr/cjlink.php?file=cj201010/cijWpBVjqB.txt--
Tous pour un et un pour tous!!!
vive le jeu de rôle papier! vive les jeux de plateaux et vive le couscous!!!!!! -
http://www.cijoint.fr/cjlink.php?file=cj201010/cijR09jB0X.txt
Tous pour un et un pour tous!!!
vive le jeu de rôle papier! vive les jeux de plateaux et vive le couscous!!!!!! -
Contributeur sécuritésalut
relance List_Kill'em et lance l'option 2 (clean)
poste le rapport générer
-
hello!
un grand merci; depuis ce dernier lancement de list_kill'em plus de problème!!
encore une fois merci d'avoir pris de votre temps pour m'aider!
-
Contributeur sécuritéTélécharge DelFix sur ton bureau.
http://sd-1.archive-host.com/membres/up/17959594961240255/DelFix.exe
3.1 - Option Recherche
Téléchargez DelFix sur votre bureau.
Lancez le, tapez 1 et validez en appuyant sur [Entrée]
Patientez quelques secondes puis copiez/collez le contenu du rapport qui s'ouvrira sur le forum qui vous prend en charge.
Note : Le rapport est sauvegardé sous C:\DelFixSearch.txt
-------------------------
3.2 - Option Suppression
Téléchargez DelFix sur votre bureau
Lancez le, tapez 2 et validez en appuyant sur [Entrée]
Patientez quelques secondes puis copiez/collez le contenu du rapport qui s'ouvrira sur le forum qui vous prend en charge.
Note : Le rapport est sauvegardé sous C:\DelFixSuppr.txt
--------------Après------------------
tu va télécharger Ccleaner http://dl.commentcamarche.net/...
ouvre "Ccleaner" vas dans l'onglet "Option" puis "Avancé" puis décoches "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures."
. Puis vas dans l'onglet "Nettoyeur" fais "Analyse" puis "Lancer le nettoyage".
Puis vas dans l'onglet "Registre" puis fait "Chercher des erreurs" puis "Réparer les erreurs sélectionnée"
. Tu refais tous ca 4-5 fois (le nettoyage et le registre).
Puis reste dans "Ccleaner" puis va dans "Option" puis "Propriété" puis coches "Nettoyer automatiquement l'ordinateur au démarrage".
içi mode d'emploi pour ccleaner
https://www.malekal.com/tutoriel-ccleaner/
--------------Apres----------------
scan en ligne
fait les scan içi
https://www.eset.com/
-
