Rapports Bitfender et Hijackthis à analyser

Question

Bonjour, 



Configuration: Windows XP / Firefox 3.6.3

Mon PC rame et j'aimerais bien que quelqu'un m'aide à le nettoyer. 

J'ai scanné avec Bitfender et Hijackthis.

Voici les rapports : 

QuickScan Beta 32-bit v0.9.9.52
-------------------------------
Date de l'analyse :  Sun Nov 21 19:35:31 2010
ID de la machine : 985B8739



Aucune infection détectée.
--------------------------



Processus
---------
Ad-Aware Service Application             1620    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
Ad-Aware Tray Application                3200    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
Adobe Reader and Acrobat Manager         3000    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Application Launcher                     2808    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
AVG Internet Security                     232    C:\Program Files\AVG\AVG8\avgcsrvx.exe
AVG Internet Security                     840    C:\Program Files\AVG\AVG8\avgrsx.exe
AVG Internet Security                     780    C:\PROGRA~1\AVG\AVG8\avgemc.exe
AVG Internet Security                    2076    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
AVG Internet Security                    2756    C:\PROGRA~1\AVG\AVG8\avgtray.exe
AVG Internet Security                    1884    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
brother Industries Ltd brss01a.exe       1720    C:\WINDOWS\system32\brss01a.exe
brother Industries Ltd brsvc01a          1692    C:\WINDOWS\system32\brsvc01a.exe
CAPI_Worker Module                       2372    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
ControlCenter2                           2652    C:\Program Files\Brother\ControlCenter2\brctrcen.exe
DAEMON Tools Lite                        3424    C:\Program Files\DAEMON Tools Lite\DTLite.exe
Device Management                        3972    C:\Program Files\Common Files\Teleca Shared\Generic.exe
eMule                                    3504    C:\Program Files\eMule\emule.exe
FinePixViewer                            3588    C:\Program Files\FinePixViewerS\QuickDCF2.exe
Firefox                                  2668    C:\Program Files\Mozilla Firefox\firefox.exe
Java(TM) Platform SE 6 U14                188    C:\Program Files\Java\jre6\bin\jqs.exe
Microsoft ActiveSync                     3296    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
Microsoft ActiveSync                     3512    C:\PROGRA~1\MICROS~3apimgr.exe
Microsoft Office Live Add-In             3276    C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
Microsoft Office XP                      2932    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
Microsoft Search Enhancement Pack         272    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
Microsoft® Windows® Operating System     1292    C:\Program Files\Outlook Express\msimn.exe
Microsoft® Windows® Operating System     1216    C:\WINDOWS\explorer.exe
Microsoft® Windows® Operating System     2484    C:\WINDOWS\system32\alg.exe
Microsoft® Windows® Operating System      836    C:\WINDOWS\system32\csrss.exe
Microsoft® Windows® Operating System     3312    C:\WINDOWS\system32\ctfmon.exe
Microsoft® Windows® Operating System      916    C:\WINDOWS\system32\lsass.exe
Microsoft® Windows® Operating System      904    C:\WINDOWS\system32\services.exe
Microsoft® Windows® Operating System      748    C:\WINDOWS\system32\smss.exe
Microsoft® Windows® Operating System     1724    C:\WINDOWS\system32\spoolsv.exe
Microsoft® Windows® Operating System      516    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1912    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1220    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1800    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1316    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1164    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1124    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     1060    C:\WINDOWS\system32\svchost.exe
Microsoft® Windows® Operating System     2280    C:\WINDOWS\system32\wbem\unsecapp.exe
Microsoft® Windows® Operating System     2396    C:\WINDOWS\system32\wbem\wmiprvse.exe
Microsoft® Windows® Operating System      860    C:\WINDOWS\system32\winlogon.exe
NVIDIA Driver Helper Service, Version 8   248    C:\WINDOWS\system32
vsvc32.exe
PaperPort                                2584    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
QuickTime                                3024    C:\Program Files\QuickTime\qttask.exe
Skype                                    3400    C:\Program Files\Skype\Phone\Skype.exe
Skype Extras Manager                     1480    C:\Program Files\Skype\Plugin Manager\skypePM.exe
Status Monitor                           3976    C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
Status Monitor                           3648    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
w3dbsmgr.exe                             3676    C:\PVSW\Bin\w3dbsmgr.exe
Windows Live Communications Platform     3248    C:\Program Files\Windows Live\Contacts\wlcomm.exe
Windows Live Messenger                   3188    C:\Program Files\Windows Live\Messenger\msnmsgr.exe


Activité du réseau
------------------
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 209.85.149.147
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 74.125.39.18
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 74.125.39.18
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 66.46.185.73
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 194.90.36.202
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 212.150.35.67
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 74.125.39.18
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 66.46.185.73
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 74.125.39.18
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 74.125.39.18
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 74.125.39.18
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 66.46.185.73
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 88.221.61.115
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 209.85.149.113
Processus avgnsx.exe (2076) connecté sur le port 80 (HTTP) --> 209.85.149.113
Processus firefox.exe (2668) connecté sur le port 443 (HTTP over SSL) --> 66.29.219.22
Processus firefox.exe (2668) connecté sur le port 443 (HTTP over SSL) --> 209.85.149.147
Processus firefox.exe (2668) connecté sur le port 443 (HTTP over SSL) --> 66.29.219.22
Processus firefox.exe (2668) connecté sur le port 443 (HTTP over SSL) --> 66.29.219.22
Processus firefox.exe (2668) connecté sur le port 443 (HTTP over SSL) --> 74.125.39.18
Processus msnmsgr.exe (3188) connecté sur le port 1863 (MSN) --> 64.4.44.78
Processus Skype.exe (3400) connecté sur le port 49663 --> 84.229.11.15
Processus Skype.exe (3400) connecté sur le port 49938 --> 77.125.80.12
Processus Skype.exe (3400) connecté sur le port 27918 --> 84.110.9.218
Processus emule.exe (3504) connecté sur le port 4232 --> 212.179.18.140

Processus svchost.exe (1124) écoute sur les ports: 135 (RPC)
Processus Skype.exe (3400) écoute sur les ports: 80 (HTTP), 443 (HTTP over SSL), 32925
Processus emule.exe (3504) écoute sur les ports: 29417
Processus w3dbsmgr.exe (3676) écoute sur les ports: 1583, 3351


Fichiers critiques et Autorun
-----------------------------
Ad-Aware Admin Application               C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Adobe Acrobat                            C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
Adobe Reader and Acrobat Manager         C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Application Launcher                     C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
AVG Internet Security                    C:\Program Files\AVG\AVG8\avgtray.exe
AVG Internet Security                    C:\WINDOWS\system32\avgrsstx.dll
BrStDvPt                                 C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
ControlCenter2                           C:\Program Files\Brother\ControlCenter2\brctrcen.exe
DAEMON Tools Lite                        C:\Program Files\DAEMON Tools Lite\DTLite.exe
eMule                                    C:\Program Files\eMule\emule.exe
FinePixViewer                            C:\Program Files\FinePixViewerS\QuickDCF2.exe
Microsoft ActiveSync                     C:\Program Files\Microsoft ActiveSync\wcescomm.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\browseui.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\crypt32.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\cryptnet.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\cscdll.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\ctfmon.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\dimsntfy.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\dumprep.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\logonui.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\sclgntfy.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\shell32.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\stobject.dll
Microsoft® Windows® Operating System     c:\windows\system32\userinit.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\wlnotify.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\WPDShServiceObj.dll
NVIDIA Compatible Windows 2000 Display   C:\WINDOWS\system32\NvCpl.dll
NVIDIA Media Center Library              C:\WINDOWS\system32\NvMcTray.dll
PaperPort                                C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
PaperPort                                C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
QuickTime                                C:\Program Files\QuickTime\qttask.exe
Realtek AC97 Audio - Event Monitor       C:\WINDOWS\ALCMTR.EXE
Skype                                    C:\Program Files\Skype\Phone\Skype.exe
SSBkgdUpdate Application                 C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
Status Monitor                           C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
w3dbsmgr.exe                             C:\PVSW\Bin\w3dbsmgr.exe
Windows Live Messenger                   C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Windows® Internet Explorer               C:\WINDOWS\system32\msfeedssync.exe
Windows® Internet Explorer               C:\WINDOWS\system32\webcheck.dll


Plugins du navigateur
---------------------
AcroIEHelperShim Library                 c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
Adobe Acrobat                            C:\Program Files\Internet Explorer\plugins
ppdf32.dll
Adobe Acrobat                            C:\Program Files\Mozilla Firefox\plugins
ppdf32.dll
Adobe® Flash® Player ActiveX             C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
AVG Internet Security                    c:\program files\avg\avg8\avgssie.dll
bdoscandel.exe                           C:\WINDOWS\bdoscandel.exe
bdscanonline                             C:\WINDOWS\Downloaded Program Files\oscan8.ocx
bdupd.dll                                C:\WINDOWS\Downloaded Program Files\bdupd.dll
BitDefender QuickScan                    C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
BitDefender QuickScan                    C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins
pqscan.dll
BitDefender QuickScan                    C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins
pqscan.dll (deleted)
frozen.dll                               C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
googletoolbar-ff2.dll                    C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
googletoolbar-ff3.dll                    C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
googletoolbarloader.dll                  C:\Documents and Settings\Yael\Application Data\Mozilla\Firefox\Profiles\bt7s07d1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
ICQ                                      C:\Program Files\ICQ7.2\ICQ.exe
IEAWSDC.DLL                              C:\WINDOWS\Downloaded Program Files\IEAWSDC.DLL
InstallShield Update Service             C:\WINDOWS\Downloaded Program Files\dwusplay.dll
InstallShield Update Service             C:\WINDOWS\Downloaded Program Files\dwusplay.exe
InstallShield Update Service             C:\WINDOWS\Downloaded Program Files\isusweb.dll
ipsupd.dll                               C:\WINDOWS\Downloaded Program Files\ipsupd.dll
Java Deployment Toolkit 6.0.140.8        C:\Program Files\Mozilla Firefox\plugins
pdeploytk.dll
Java(TM) Platform SE 6 U14               c:\program files\java\jre6\bin\jp2ssv.dll
Java(TM) Platform SE 6 U14               c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
Messenger                                C:\Program Files\Messenger\msmsgs.exe
Microsoft Office Live Plug-in for Firef  C:\Program Files\Microsoft\Office Live
pOLW.dll
Microsoft Search Enhancement Pack        c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll
Microsoft® Windows Live Login Helper     c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
Microsoft® Windows Media Player Firefox  C:\Program Files\Mozilla Firefox\plugins
p-mswmp.dll
Microsoft® Windows® Operating System     C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
Microsoft® Windows® Operating System     C:\WINDOWS\system32\mswsock.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32svpsp.dll
Microsoft® Windows® Operating System     C:\WINDOWS\system32\winrnr.dll
Mozilla ActiveX control and plugin supp  C:\Program Files\Mozilla Firefox\plugins
pmozax.dll
Mozilla Default Plug-in                  C:\Program Files\Mozilla Firefox\plugins
pnul32.dll
nppdf32.FRA                              C:\Program Files\Internet Explorer\plugins
ppdf32.FRA
nppdf32.FRA                              C:\Program Files\Mozilla Firefox\plugins
ppdf32.FRA
NPSWF32.dll                              C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
Picasa                                   C:\Program Files\Picasa2
pPicasa2.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin2.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin3.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin4.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin5.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin6.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Internet Explorer\plugins
pqtplugin7.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin2.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin3.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin4.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin5.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin6.dll
QuickTime Plug-in 7.0.3                  C:\Program Files\Mozilla Firefox\plugins
pqtplugin7.dll
Silverlight Plug-In                      C:\Program Files\Microsoft Silverlight\4.0.50917.0
pctrl.dll
Windows Genuine Advantage                C:\Program Files\Mozilla Firefox\plugins
pLegitCheckPlugin.dll
Windows Live Toolbar                     c:\program files\windows live	oolbar\wltcore.dll
Windows Live® Photo Gallery              C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
Windows Presentation Foundation          C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
Windows® Internet Explorer               C:\WINDOWS\system32\ieframe.dll


Fichiers manquants
------------------
Fichier non trouvé : C:\WINDOWS\System32\appmgmts.dll
  --> HKLM\System\ControlSet001\services\AppMgmt\Parameters\"ServiceDll"

Fichier non trouvé : System32\Drivers\Bulk533.sys
  --> HKLM\System\ControlSet001\services\USBCamera\"ImagePath"

Fichier non trouvé : System32\Drivers\Ca533av.sys
  --> HKLM\System\ControlSet001\services\Ca533av\"ImagePath"


Analyse
-------


Aucun fichier téléchargé vers le serveur.

Analyse terminée - la communication a duré 28 secondes
Trafic total - 0.11 Mo envoyés, 637.77 Ko reçus
1414 fichiers et modules analysés - 180 seconds

==============================================================================


Et l'autre : 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:30, on 21/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\eMule\emule.exe
C:\PROGRA~1\MICROS~3apimgr.exe
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: (no name) - {00e71626-0bef-11dc-8314-0800200c9a66} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: ???? ?????? ?? Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\w3dbsmgr.exe
O4 - Global Startup: Exif Launcher S.lnk = C:\Program Files\FinePixViewerS\QuickDCF2.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &??? ?- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://www.comsecure.co.il/OnlineScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

ancri · Answer

Salut, 

Y a ti quelqu'un qui pourrait me répondre ?

Utilisateur anonyme · Answer

salut, je vais te prendre en charge :

commence par ceci: https://www.cjoint.com/c/2kqmybfixvQ 

quand c fais, on y va.

Utilisateur anonyme · Answer

on y va:

HIJACKTHIS ne montre rien en même temps, normale, il est dépasser et ne suffit plus.
pour une analyse :


                          ----->ZHPDIAG<-----

/!\ utilisateur de vista et seven, désactiver l'UAC./!\

/!\ utilisateur de vista et seven faite clique droit et "éxécuter en temps qu'administrateur/!\

>  Télécharge zhpdiag (de Nicolas Coolman)

> Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.

>  /!\Utilisateur de Vista et Seven : Clique droit sur le logo de ZHPdiag, « exécuter en tant qu'Administrateur »/!\

> Clique sur la petite loupe en haut à gauche pour débuter l'analyse :

>attention, le scan peut durer un certain temps, ne touche a rien d'autre tant que le scan est en cour

> Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette

>  Héberge le rapport ZHPDiag.txt sur cijoint, puis copie/colle le lien fourni                                          dans ta prochaine réponse sur le forum.

ancri · Answer

Salut, merci pour ta réponse.

J'ai lancé ZHPdiag, mais il coince à 80 % lors de la recherche de Master Boot Record Infection. Et il plante aussi le PC à ce moment-là. 

Le seul rapport que j'ai est ainsi tronqué, il s'est enregistré sur mon bureau : 

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			-q -z 
Windows Version:		Windows XP Home Edition
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x000004bd

Kernel Drivers (total 134):
  0x804D7000 \WINDOWS\system32
tkrnlpa.exe
  0x806D0000 \WINDOWS\system32\hal.dll
  0xF7A3C000 \WINDOWS\system32\KDCOM.DLL
  0xF794C000 \WINDOWS\system32\BOOTVID.dll
  0xF7348000 spdt.sys
  0xF7A3E000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xF7330000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xF7302000 ACPI.sys
  0xF72F1000 pci.sys
  0xF753C000 ohci1394.sys
  0xF754C000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xF755C000 isapnp.sys
  0xF7B04000 pciide.sys
  0xF77BC000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF756C000 MountMgr.sys
  0xF72D2000 ftdisk.sys
  0xF77C4000 PartMgr.sys
  0xF757C000 VolSnap.sys
  0xF72BA000 atapi.sys
  0xF72A1000 nvata.sys
  0xF758C000 disk.sys
  0xF759C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7281000 fltmgr.sys
  0xF726F000 sr.sys
  0xF75AC000 Lbd.sys
  0xF75BC000 PxHelp20.sys
  0xF7258000 KSecDD.sys
  0xF71CB000 Ntfs.sys
  0xF719E000 NDIS.sys
  0xF7184000 Mup.sys
  0xF761C000 \SystemRoot\system32\DRIVERS
ic1394.sys
  0xF775C000 \SystemRoot\system32\DRIVERS\AmdK8.sys
  0xF61B3000 \SystemRoot\system32\DRIVERS
v4_mini.sys
  0xF619F000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF78A4000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xF617B000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF78AC000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF776C000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xF777C000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xF778C000 \SystemRoot\system32\DRIVERSedbook.sys
  0xF6158000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF6130000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xF7A08000 \SystemRoot\system32\DRIVERS
vnetbus.sys
  0xF60E5000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
  0xF60AE000 \SystemRoot\system32\DRIVERS\NVSNPU.SYS
  0xF6075000 \SystemRoot\System32\Drivers\atnuxnh6.SYS
  0xF7914000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xF779C000 \SystemRoot\system32\DRIVERS\serial.sys
  0xF7A18000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xF6061000 \SystemRoot\system32\DRIVERS\parport.sys
  0xF6CA0000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF791C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7BC5000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xF6C90000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0xF7A1C000 \SystemRoot\system32\DRIVERS
distapi.sys
  0xF604A000 \SystemRoot\system32\DRIVERS
diswan.sys
  0xF6C80000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0xF6C70000 \SystemRoot\system32\DRIVERSaspptp.sys
  0xF7924000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xF6039000 \SystemRoot\system32\DRIVERS\psched.sys
  0xF6C60000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF793C000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF792C000 \SystemRoot\system32\DRIVERSaspti.sys
  0xF6C50000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0xF7934000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF7AA2000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xF5FDB000 \SystemRoot\system32\DRIVERS\update.sys
  0xF7A24000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xF76EC000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF76FC000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF7ADC000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF0712000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xF06EE000 \SystemRoot\system32\drivers\portcls.sys
  0xF770C000 \SystemRoot\system32\drivers\drmk.sys
  0xF771C000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
  0xEE3C2000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xF7A4A000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xF7C62000 \SystemRoot\System32\Drivers\Null.SYS
  0xF7A4C000 \SystemRoot\System32\Drivers\Beep.SYS
  0xEE3B2000 \SystemRoot\System32\drivers\vga.sys
  0xF7A4E000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF7A50000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xEE3AA000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xEE3A2000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF30E0000 \SystemRoot\system32\DRIVERSasacd.sys
  0xB9B3D000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB9AE4000 \SystemRoot\system32\DRIVERS	cpip.sys
  0xB9ACB000 \SystemRoot\System32\Drivers\avgtdix.sys
  0xB9AA3000 \SystemRoot\system32\DRIVERS
etbt.sys
  0xB9A81000 \SystemRoot\System32\drivers\afd.sys
  0xECA6C000 \SystemRoot\system32\DRIVERS
etbios.sys
  0xEC3CF000 \SystemRoot\System32\Drivers\StarOpen.SYS
  0xB9A56000 \SystemRoot\system32\DRIVERSdbss.sys
  0xB99BE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xECA4C000 \SystemRoot\System32\Drivers\Fips.SYS
  0xB9998000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xECA3C000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xECA2C000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0xEFB7A000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xECA1C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xEC3C7000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xEC3BF000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0xB995F000 \SystemRoot\system32\DRIVERSt73.sys
  0xEC3B7000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xF43A4000 \SystemRoot\system32\DRIVERS\usbprint.sys
  0xEFB5A000 \SystemRoot\System32\Drivers\BrScnUsb.sys
  0xEFB56000 \SystemRoot\System32\Drivers\BrUsbSer.sys
  0xB7D7A000 \SystemRoot\System32\Drivers\BrSerIf.sys
  0xEC5B3000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xEE3BA000 \SystemRoot\System32\Drivers\avgmfx86.sys
  0xB7D29000 \SystemRoot\System32\Drivers\avgldx86.sys
  0xB36AA000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xF767C000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xB3691000 \SystemRoot\System32\Drivers\dump_nvata.sys
  0xF7A5C000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB3C33000 \SystemRoot\System32\drivers\Dxapi.sys
  0xF782C000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xF7C2C000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32
v4_disp.dll
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xF5261000 \SystemRoot\system32\DRIVERS
disuio.sys
  0xB24A4000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xF7A90000 \SystemRoot\System32\Drivers\ParVdm.SYS
  0xF762C000 \SystemRoot\system32\drivers\ip6fw.sys
  0xB23F4000 \SystemRoot\system32\drivers	cpip6.sys
  0xB234C000 \SystemRoot\system32\DRIVERS\srv.sys
  0xB17EF000 \SystemRoot\system32\drivers\wdmaud.sys
  0xB2074000 \SystemRoot\system32\drivers\sysaudio.sys
  0xB14B6000 \SystemRoot\System32\Drivers\HTTP.sys
  0xEFC03000 \??\C:\DOCUME~1\Yael\LOCALS~1\Temp\mbr.sys
  0x7C950000 \WINDOWS\system32
tdll.dll
  0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll

Processes (total 58):
       0 System Idle Process
       4 System
     752 C:\WINDOWS\system32\smss.exe
     836 csrss.exe
     860 C:\WINDOWS\system32\winlogon.exe
     904 C:\WINDOWS\system32\services.exe
     916 C:\WINDOWS\system32\lsass.exe
    1064 C:\WINDOWS\system32\svchost.exe
    1124 svchost.exe
    1164 C:\WINDOWS\system32\svchost.exe
    1216 svchost.exe
    1324 svchost.exe
    1628 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    1696 C:\WINDOWS\system32\brsvc01a.exe
    1724 C:\WINDOWS\system32\brss01a.exe
    1728 C:\WINDOWS\system32\spoolsv.exe
    1828 svchost.exe
    2028 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
     468 C:\WINDOWS\system32\svchost.exe
     528 C:\Program Files\Java\jre6\bin\jqs.exe
     368 C:\WINDOWS\system32
vsvc32.exe
     776 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    1340 C:\WINDOWS\system32\svchost.exe
    1440 C:\PROGRA~1\AVG\AVG8\avgemc.exe
    1508 C:\Program Files\AVG\AVG8\avgrsx.exe
    1560 C:\PROGRA~1\AVG\AVG8\avgnsx.exe
     356 C:\Program Files\AVG\AVG8\avgcsrvx.exe
     396 C:\WINDOWS\system32\wuauclt.exe
    1512 unsecapp.exe
    1524 alg.exe
    1532 wmiprvse.exe
    2640 C:\WINDOWS\explorer.exe
    3104 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    3212 C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    3268 C:\Program Files\Brother\ControlCenter2\brctrcen.exe
    3288 C:\PROGRA~1\AVG\AVG8\avgtray.exe
    3348 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    3416 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    3428 C:\Program Files\QuickTime\qttask.exe
    3536 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    3624 C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    3664 C:\WINDOWS\system32\ctfmon.exe
    3696 C:\Program Files\Skype\Phone\Skype.exe
    3708 C:\Program Files\DAEMON Tools Lite\DTLite.exe
    3828 C:\Program Files\eMule\emule.exe
    3912 C:\Program Files\FinePixViewerS\QuickDCF2.exe
    3948 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    3956 C:\PVSW\Bin\w3dbsmgr.exe
    4068 C:\PROGRA~1\MICROS~3apimgr.exe
     432 C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
    1320 C:\Program Files\Windows Live\Contacts\wlcomm.exe
    3040 C:\Program Files\Skype\Plugin Manager\skypePM.exe
     704 C:\Program Files\Common Files\Teleca Shared\Generic.exe
    3088 C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    4036 C:\Program Files\ZHPDiag\ZHPDiag.exe
    3124 wmiprvse.exe
    3788 C:\WINDOWS\system32\cmd.exe
    2904 C:\Program Files\ZHPDiag\mbrcheck.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000000'00007e00  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000013'8836ac00  (NTFS)

PhysicalDrive0 Model Number: WDCWD2500JS-55NCB1, Rev: 10.02E01

      Size  Device Name          MBR Status
  --------------------------------------------
    232 GB  \.\PhysicalDrive0   



C'est tout.

Que faire pour le débloquer ? Faut utiliser autre chose ?

@ peluche

Utilisateur anonyme · Answer

salut,

on va essayer autrement:

Redémarre ton pc en mode sans échec avec prise en charge réseau
https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

puis, relance ZHPDIAG di moi si ce dernier bloque toujours. 
+++

ancri · Answer

Re-salut,

Il s'avère qu'en mode sans échec avec prise en charge réseau, ça bloque aussi. 

Faut-il le laisser toute la nuit pour voir ou essayer autre chose ? 

Merci

Master Flex · Answer

Salut Ancri, alors on va faire essayer ceci : 

Redémarre ton pc en mode sans échec avec prise en charge réseau 
https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

Télécharge Random's System Information Tool (RSIT)sur le site suivant http://images.malwareremoval.com/random/RSIT.exe de Random/Random, et enregistre le sur ton Bureau.

 Sous Windows 7: Suivre https://www.androidworld.fr/ pour rendre RSIT compatible avec Windows 7.

Ensuite double clique sur RSIT.exe pour lancer l'outil.

Clique sur "Continue" à l'écran Disclaimer.

Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) et tu devras accepter la licence.

Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Tutoriel illustré pour t'aider : https://www.androidworld.fr/

https://www.androidworld.fr/ Comment héberger les rapports trop longs de RSIT

ancri · Answer

Ils sont hébergés là : 

https://www.androidworld.fr/

et

https://www.androidworld.fr/

ancri · Answer

J'ai oublié de les fusionner j'espère que c'est pas grave.

ancri · Answer

Alors Master Flex bonjour et merci d'avoir accepté de m'aider. J'avais pas vu que j'avais changé de helper ! 

@ +

ancri · Answer

par erreur j'ai arrêté la réception des réponses par mail, alors j'écris ce message juste pour essayer de les recevoir à nouveau. Ne t'occupe pas du message. Sorry

Master Flex · Answer

pas de problème alors  il y a un fichier qui me semble douteux on va analyser ça ensemble avec 

-----> virus total <-----


Rends toi sur ce site :

https://www.virustotal.com/gui/

Copie ce qui suit et colle le dans l'espace pour la recherche :


C:\WINDOWS\system32\wininet.dll


Clique sur Send File ( = " Envoyer le fichier " ). 

Un rapport va s'élaborer ligne à ligne. 

N'oublie pas de bien me donner l'adresse des résultats ;)

ancri · Answer

Salut,

Voici l'adresse des résultats : 

http://www.virustotal.com/file-scan/report.html?id=013a5ae0a5b965e71ef16758d48e106d5111d92a9139fe9ca5c87bc4bd638021-1290579580

Master Flex · Answer

Bonjour très bien, le fichier est légitime ne t'inquiètes pas ;) peux tu maintenant faire ceci stp:  

C'est un outil généraliste qui va supprimer les restes d'infection, 
   
[*] Télécharge Malwarebytes 
  

[*] Tu auras un tutoriel à ta disposition ici pour l'installer et l'utiliser correctement.  

[*] Fais la mise à jour du logiciel (elle se fait normalement à l'installation)  

[*] Lance une analyse complète en cliquant sur "Exécuter un examen complet"  

[*] Sélectionne les disques que tu veux analyser et clique sur "Lancer l'examen" 

[*] L'analyse peut durer un bon moment..... 

[*] Une fois l'analyse terminée, clique sur "OK" puis sur "Afficher les résultats" 

[*] Vérifie que tout est bien coché et clique sur "Supprimer la sélection" => et ensuite sur "OK" 

[*] Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum 

* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Fais le en cliquant sur "oui" à la question posée

ancri · Answer

Voici le rapport : 

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de donn?es: 5184

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

25/11/2010 08:24:28
mbam-log-2010-11-25 (08-24-28).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
El?ment(s) analys?(s): 286123
Temps ?coul?: 1 heure(s), 27 minute(s), 21 seconde(s)

Processus m?moire infect?(s): 0
Module(s) m?moire infect?(s): 0
Cl?(s) du Registre infect?e(s): 0
Valeur(s) du Registre infect?e(s): 0
El?ment(s) de donn?es du Registre infect?(s): 0
Dossier(s) infect?(s): 0
Fichier(s) infect?(s): 2

Processus m?moire infect?(s):
(Aucun ?l?ment nuisible d?tect?)

Module(s) m?moire infect?(s):
(Aucun ?l?ment nuisible d?tect?)

Cl?(s) du Registre infect?e(s):
(Aucun ?l?ment nuisible d?tect?)

Valeur(s) du Registre infect?e(s):
(Aucun ?l?ment nuisible d?tect?)

El?ment(s) de donn?es du Registre infect?(s):
(Aucun ?l?ment nuisible d?tect?)

Dossier(s) infect?(s):
(Aucun ?l?ment nuisible d?tect?)

Fichier(s) infect?(s):
C:\Documents and Settings\Yael\My Documents\macromediacrack\Keygen Macromedia Studio 8.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
D:\SetUp\Nero6.6\Keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Master Flex · Answer

Salut désolé pour le temps alors j'aimerais que tu réessayes zhp diag stp

en refaisant ceci stp

ancri · Answer

Pas de problème pour le temps, je viens seulement de rentrer du bureau !
Je désinstalle donc zhp diag avant de le réinstaller ? Right ?

Utilisateur anonyme · Answer

salut, pour avancer en attendant MASTER FLEX: il coince, c'est a dire? au bout de combien de temps tu quitte parce qu'il "coince"??
++

ancri · Answer

Salut,

J'ai peut-être pas attendu assez longtemps. Quand j'aurai fini de travailler sur l'ordinateur, je referai un essai.

@ +

Master Flex · Answer

Bonjour désolé pour l'attente il y avait un problème de connexion chez moi :)

alors dis moi peux tu me faire ceci stp : 

LIST_KILL'EM

* Télécharge  List_Kill'em de gen-hackman

* list&Kill'em est un scanner généraliste qui repère et supprime de nombreuses infections ,


 ICI  >> List&Kill'em de gen-hackman
* enregistre le sur ton bureau
* si tu as XP => double clique
* si tu as Vista ou windows 7 => clic droit >> executer en tant qu'administrateur
*sur le raccourci sur ton bureau pour lancer l'installation
>> Laisse coché :

* Executer Shortcut
* Executer List_Kill'em

*une fois terminée , clic sur "terminer" et le programme se lancera seul
*choisis l'option >>  SEARCH 
*laisse travailler l'outil
* il se peut qu'une boite de dialogue s'ouvre , dans ce cas clique sur ok
* A l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.

* Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
* Héberge le rapport sur ce site,
>> Cijoint.fr
* puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.


Pour t aider ,pour heberger le rapport
* rends toi sur Cijoint.fr
* clic sur Parcourir
* trouve >> le rapport que tu viens d'enregistrer qui doit par exemple être sur ton bureau
* et valide en cliquant sur >> Cliquez ici pour déposer le Fichier
* un lien de ce genre http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt te sera généré,
* il te suffit de le poster

* Réactive ton antivirus

* Réactive l'UAC

ancri · Answer

Voici le rapport : http://www.cijoint.fr/cjlink.php?file=cj201011/cijrbcsEqC.txt 

Bonne lecture !

Master Flex · Answer

Salut très bien peux tu me passer ces fichiers sur virus total en faisant ceci stp : 


Rends toi sur ce site :

https://www.virustotal.com/gui/

Copie ce qui suit et colle le dans l'espace pour la recherche : 

C:\WINDOWS\ServicePackFiles\i386\explorer.exe

C:\WINDOWS\System32\drivers\etc\hosts.msn



Clique sur Send File ( = " Envoyer le fichier " ).

Un rapport va s'élaborer ligne à ligne. 
Poste ensuite le lien des réponses stp

ancri · Answer

Salut


http://www.virustotal.com/file-scan/report.html?id=61be4b8b1da05fc1c09d18111c0ff160db2b60f08882fdb45c3b97927e34e34d-1291012311


et

http://www.virustotal.com/file-scan/report.html?id=f16c19748cefd356850be752ae3f4d30826ee9391e2d5e13cf628aeb7318b9fd-1291012561

Merci

Utilisateur anonyme · Answer

salut, juste parce que je suis en contact avec nicolas coolman pour le bug de zhpdiag, il me demande de tester ceci: 

télécharge le de nouveau ici: http://www.premiumorange.com/zeb-help-process/zhpdiag.html tout en bas de la page.
en le lancant,  vérifie que tu es bien a cette mise a jours:  
Dernière mise à jour le 28/11/2010 à 18h04   
lance et vois si ca marche. 

bonne journée. 
niveau supérieur sur HELPER FORMATION.

ancri · Answer

Salut, 

On dirait que ça a marché ce coup-ci, sauf que pour l'éteindre j'ai dû redémarrer le PC.

Voici le rapport tant attendu : 

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Home Edition
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x0000041d

Kernel Drivers (total 133):
  0x804D7000 \WINDOWS\system32
tkrnlpa.exe
  0x806D0000 \WINDOWS\system32\hal.dll
  0xF7A3C000 \WINDOWS\system32\KDCOM.DLL
  0xF794C000 \WINDOWS\system32\BOOTVID.dll
  0xF7348000 spki.sys
  0xF7A3E000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xF7330000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xF7302000 ACPI.sys
  0xF72F1000 pci.sys
  0xF753C000 ohci1394.sys
  0xF754C000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xF755C000 isapnp.sys
  0xF7B04000 pciide.sys
  0xF77BC000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xF756C000 MountMgr.sys
  0xF72D2000 ftdisk.sys
  0xF77C4000 PartMgr.sys
  0xF757C000 VolSnap.sys
  0xF72BA000 atapi.sys
  0xF72A1000 nvata.sys
  0xF758C000 disk.sys
  0xF759C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xF7281000 fltmgr.sys
  0xF726F000 sr.sys
  0xF75AC000 Lbd.sys
  0xF75BC000 PxHelp20.sys
  0xF7258000 KSecDD.sys
  0xF71CB000 Ntfs.sys
  0xF719E000 NDIS.sys
  0xF7184000 Mup.sys
  0xF75EC000 \SystemRoot\system32\DRIVERS
ic1394.sys
  0xF76CC000 \SystemRoot\system32\DRIVERS\AmdK8.sys
  0xF5B52000 \SystemRoot\system32\DRIVERS
v4_mini.sys
  0xF5B3E000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xF7874000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xF5B1A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xF787C000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xF76DC000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xF76EC000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xF76FC000 \SystemRoot\system32\DRIVERSedbook.sys
  0xF5AF7000 \SystemRoot\system32\DRIVERS\ks.sys
  0xF5ACF000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xF79F4000 \SystemRoot\system32\DRIVERS
vnetbus.sys
  0xF5A84000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
  0xF5A4D000 \SystemRoot\system32\DRIVERS\NVSNPU.SYS
  0xF5A14000 \SystemRoot\System32\Drivers\ah07dmjg.SYS
  0xF78E4000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xF6617000 \SystemRoot\system32\DRIVERS\serial.sys
  0xF6AD3000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xF5A00000 \SystemRoot\system32\DRIVERS\parport.sys
  0xF6607000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xF78EC000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xF7BEC000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xF65F7000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0xF6ACF000 \SystemRoot\system32\DRIVERS
distapi.sys
  0xF59E9000 \SystemRoot\system32\DRIVERS
diswan.sys
  0xF65E7000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0xF65D7000 \SystemRoot\system32\DRIVERSaspptp.sys
  0xF78F4000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xF59D8000 \SystemRoot\system32\DRIVERS\psched.sys
  0xF65C7000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xF78FC000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xF7904000 \SystemRoot\system32\DRIVERSaspti.sys
  0xF65B7000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0xF790C000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xF7A7A000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xF597A000 \SystemRoot\system32\DRIVERS\update.sys
  0xF6AC7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xF762C000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xF763C000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xF7AB4000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xF0090000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xF006C000 \SystemRoot\system32\drivers\portcls.sys
  0xF764C000 \SystemRoot\system32\drivers\drmk.sys
  0xF765C000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
  0xF7894000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xF7ACE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xF7BCC000 \SystemRoot\System32\Drivers\Null.SYS
  0xF7AD0000 \SystemRoot\System32\Drivers\Beep.SYS
  0xF001C000 \SystemRoot\System32\drivers\vga.sys
  0xF7AD2000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xF7AD4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xEF6A6000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xEF69E000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xF4ADF000 \SystemRoot\system32\DRIVERSasacd.sys
  0xECE16000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xECDBD000 \SystemRoot\system32\DRIVERS	cpip.sys
  0xECDA4000 \SystemRoot\System32\Drivers\avgtdix.sys
  0xECD7C000 \SystemRoot\system32\DRIVERS
etbt.sys
  0xECD5A000 \SystemRoot\System32\drivers\afd.sys
  0xEF5AC000 \SystemRoot\system32\DRIVERS
etbios.sys
  0xEF696000 \SystemRoot\System32\Drivers\StarOpen.SYS
  0xECD2F000 \SystemRoot\system32\DRIVERSdbss.sys
  0xECC97000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xEF58C000 \SystemRoot\System32\Drivers\Fips.SYS
  0xECC71000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xEF57C000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xEE7E4000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0xF2A4A000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xEE7D4000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xEF686000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xEF67E000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0xECC38000 \SystemRoot\system32\DRIVERSt73.sys
  0xEB743000 \SystemRoot\system32\DRIVERS\usbprint.sys
  0xEEBA2000 \SystemRoot\System32\Drivers\BrScnUsb.sys
  0xEEB9E000 \SystemRoot\System32\Drivers\BrUsbSer.sys
  0xB5170000 \SystemRoot\System32\Drivers\BrSerIf.sys
  0xEB73B000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xEEB9A000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xEB733000 \SystemRoot\System32\Drivers\avgmfx86.sys
  0xB511F000 \SystemRoot\System32\Drivers\avgldx86.sys
  0xF76AC000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xB08C9000 \SystemRoot\System32\Drivers\dump_nvata.sys
  0xF7A46000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB106B000 \SystemRoot\System32\drivers\Dxapi.sys
  0xEB70B000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xF7BB5000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32
v4_disp.dll
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xF5956000 \SystemRoot\system32\DRIVERS
disuio.sys
  0xAF68C000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xF7A84000 \SystemRoot\System32\Drivers\ParVdm.SYS
  0xF779C000 \SystemRoot\system32\drivers\ip6fw.sys
  0xAF62C000 \SystemRoot\system32\drivers	cpip6.sys
  0xAF5AC000 \SystemRoot\system32\DRIVERS\srv.sys
  0xAEA9F000 \SystemRoot\system32\drivers\wdmaud.sys
  0xAF33C000 \SystemRoot\system32\drivers\sysaudio.sys
  0xAE6C6000 \SystemRoot\System32\Drivers\HTTP.sys
  0xAC971000 \SystemRoot\system32\drivers\kmixer.sys
  0x7C950000 \WINDOWS\system32
tdll.dll
  0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll

Processes (total 55):
       0 System Idle Process
       4 System
     764 C:\WINDOWS\system32\smss.exe
     844 csrss.exe
     868 C:\WINDOWS\system32\winlogon.exe
     912 C:\WINDOWS\system32\services.exe
     924 C:\WINDOWS\system32\lsass.exe
    1076 C:\WINDOWS\system32\svchost.exe
    1136 svchost.exe
    1280 C:\WINDOWS\system32\svchost.exe
    1352 svchost.exe
    1476 svchost.exe
    1776 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    1852 C:\WINDOWS\system32\brsvc01a.exe
    1884 C:\WINDOWS\system32\brss01a.exe
    1880 C:\WINDOWS\system32\spoolsv.exe
     236 svchost.exe
     328 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
     352 C:\WINDOWS\system32\svchost.exe
     412 C:\Program Files\Java\jre6\bin\jqs.exe
     488 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
     712 C:\WINDOWS\system32\svchost.exe
    1240 C:\PROGRA~1\AVG\AVG8\avgemc.exe
    1332 C:\Program Files\AVG\AVG8\avgrsx.exe
    1360 C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    2008 C:\Program Files\AVG\AVG8\avgcsrvx.exe
    1312 unsecapp.exe
    1692 wmiprvse.exe
    1696 alg.exe
    2628 C:\WINDOWS\explorer.exe
    3240 C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    3404 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    3436 C:\Program Files\Brother\ControlCenter2\brctrcen.exe
    3468 C:\PROGRA~1\AVG\AVG8\avgtray.exe
    3504 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    3588 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    3600 C:\Program Files\QuickTime\qttask.exe
    3688 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    3728 C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    3772 C:\WINDOWS\system32\ctfmon.exe
    3796 C:\Program Files\Skype\Phone\Skype.exe
    3824 C:\Program Files\DAEMON Tools Lite\DTLite.exe
    3920 C:\Program Files\eMule\emule.exe
     280 C:\Program Files\FinePixViewerS\QuickDCF2.exe
     296 C:\PROGRA~1\MICROS~3apimgr.exe
    1648 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    1408 C:\PVSW\Bin\w3dbsmgr.exe
    2456 C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
    3344 C:\Program Files\Skype\Plugin Manager\skypePM.exe
    3384 C:\Program Files\Windows Live\Contacts\wlcomm.exe
    4088 C:\Program Files\Common Files\Teleca Shared\Generic.exe
    2536 C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    2792 C:\Program Files\Outlook Express\msimn.exe
    2236 C:\Program Files\Mozilla Firefox\firefox.exe
    1676 C:\Program Files\ZHPDiag\mbrcheck.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000000'00007e00  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000013'8836ac00  (NTFS)

PhysicalDrive0 Model Number: WDCWD2500JS-55NCB1, Rev: 10.02E01

      Size  Device Name          MBR Status
  --------------------------------------------
    232 GB  \.\PhysicalDrive0

Utilisateur anonyme · Answer

salut,
non, c'est pas ca que je veux... 
tu as un document sur ton bureau "log zhpdiag" ou quelque chose comme ca...

ancri · Answer

j'ai trouvé ça dans le Program Files/ZHPDiag : 

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.1 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD2500JS-55NCB1 rev.10.02E01 -> \Device\00000061

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys 
C:\WINDOWS\system32\drivers
vata.sys NVIDIA Corporation NVIDIA nForce(TM) IDE Driver
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x86395AB8]
3 CLASSPNP[0xF77CFFD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\00000062[0x8637BF18]
5 ACPI[0xF761B620] -> nt!IofCallDriver[0x804E37D5] -> \Device\00000061[0x8629E030]
kernel: MBR read successfully
user & kernel MBR OK 


Mais c'est tout. 
Peut être que quand il a bloqué à 100 % ce coup-ci il n'a pas fini d'enregistrer ?

ancri · Answer

Ben il s'avère qu'il n'y a rien de tel. 

Je vais le laisser bosser un peu plus longtemps pour voir s'il arrive à terminer

ancri · Answer

Rien à faire. Ca bloque à 100 % maintenant sans générer le fameux rapport.

ancri · Answer

Merci en tout cas de ce service personnalisé ! 

Et ben ça a marché ! Eureka ! 

Le rapport est là : http://www.cijoint.fr/cjlink.php?file=cj201011/cijT84ZDj3.txt

@ +

ancri · Answer

Merci c'était trop sympa ! 

On verra ce que 91 300 et Master Flex auront à dire.

Bonne continuation

Master Flex · Answer

Salut ancri ésolé pour cette petite absence je vois qu'on est venu en renfort c'est bien :) alors tu as bien des infections on va régler ça :) on va commencer par les toolbars.

"Une toolbar" = "barre d'outils" - est un ensemble de boutons présents sur une interface graphique, offrant à l'utilisateur la possibilité d'accéder rapidement à un certain nombre de fonctionnalités, tel qu'un moteur de recherche, des options d'impression, des gestions de pop-up etc. cependant, certaines sont infectées et piégées, c'est le cas pour toi. Mais comme je t'ai dit ne t'inquiète pas pour les supprimer, on va utiliser ad-remover :)


Fais ceci stp  


> Télécharge ad-remover(de C_XX) sur ton Bureau  

>Déconnecte toi et ferme toutes les applications en cours  

> Double-clique sur l'icône AD-Remover  

> Au menu principal, clique sur "scanner"  

> Confirme le lancement de l'analyse et laisse l'outil travailler  

> Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt ) 

Ad-Remover est un outil spécifique conçu par C_XX , son rôle est la suppression d'adwares comme Eorezo, MyWebSearch, Navipromo, Winsudate, Search Settings, ...

ancri · Answer

Salut,

Voici le rapport : 
======= REPORT FROM AD-REMOVER 2.0.0.2,B | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 11/11/10 at 11:40
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Launched at 18:54:02 on 30/11/2010, Normal boot

Microsoft Windows XP Home Edition Service Pack 3 (X86) 
Yael@COMPUTER-XP ( ) 
 
============== SEARCH ==============


File found: C:\Documents and Settings\Yael\Application Data\Mozilla\FireFox\Profiles\bt7s07d1.default\searchplugins\askcom.xml

Key found: HKLM\Software\Classes\CLSID\{72b3882f-453a-4633-aac9-8c3dced62aff}

Value found: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}


============== ADDITIONNAL SCAN ==============

** Mozilla Firefox Version [3.6.3 (fr)] **

-- C:\Documents and Settings\Yael\Application Data\Mozilla\FireFox\Profiles\bt7s07d1.default\Prefs.js --
browser.download.lastDir, C:\Documents and Settings\Yael\????? ??????
browser.search.defaultenginename, ICQ Search
browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
browser.search.selectedEngine, Google
browser.startup.homepage, hxxp://mail.google.com/a/capretraite.fr/#inbox|hxxps://upsider.aceproject.com/Tab.asp?Tab=1
browser.startup.homepage_override.mstone, rv:1.9.2.3
keyword.URL, hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=

-- C:\Documents and Settings\?????\Application Data\Mozilla\FireFox\Profiles\87v6qgy9.default\Prefs.js --
browser.download.lastDir, C:\?????
browser.startup.homepage, hxxp://www.babakama.co.il/?sid=8
browser.startup.homepage_override.mstone, rv:1.9.2.3

========================================

** Internet Explorer Version [8.0.6001.18702] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\windows\system32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Show_ToolBar: yes
Start Page: hxxp://start.icq.com/

[HKLM\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\windows\system32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: C:\Documents and Settings\All Users\Application Data\ICQ\ICQNewTab
ewTab.html
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 File(s)
C:\Program Files\Ad-Remover\Backup: 1 File(s)

C:\Ad-Report-SCAN[1].txt - 30/11/2010 (853 Byte(s)) 

End at: 18:56:03, 30/11/2010 
 
============== E.O.F ============== 



Merci

Master Flex · Answer

ok alors on continue :

Tu es infecter par ASK : La ASK toolbar est une barre d'outil néfaste qui s'installe, parfois à votre insu, avec de nombreux programmes (notamment les gratuits). Elle peut espionner votre navigation et récupérer des informations personnelles, c'est pour cela qu'elle est considérée comme un spyware. 

donc relance Ad Remover

>Déconnecte toi et ferme toutes les applications en cours

> Double-clique sur l'icône AD-Remover

> Au menu principal, clique sur "nettoyer"

> Confirme le lancement de l'analyse et laisse l'outil travailler

> Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report-CLEAN.txt )

Utilisateur anonyme · Answer

bonsoir a vous deux, 

juste une intervention de ma part: 

ancri, comment est configuré ton clavier ?? en quel langue?  

a noter: ma question est sérieuse et porte sur la désinfection.

merci 

niveau supérieur sur HELPER FORMATION.

ancri · Answer

Salut, mon clavier c'est un qwerty configuré en trois langues : français, anglais et hébreu. 

Les lettres étrangères que tu vois dans les rapports c'est de l'hébreu. Généralement c'est les mises à jour de windows.

J'ai rien trouvé de mieux à faire que de mettre windows en hébreu (c'était une erreur de commande sur le Net), alors qu'en anglais ou en français ce serait quand même plus facile.

ancri · Answer

Et plop :


======= REPORT FROM AD-REMOVER 2.0.0.2,B | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 11/11/10 at 11:40
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 21:08:38 on 30/11/2010, Normal boot

Microsoft Windows XP Home Edition Service Pack 3 (X86) 
Yael@COMPUTER-XP ( ) 
 
============== ACTION(S) ==============


File deleted: C:\Documents and Settings\Yael\Application Data\Mozilla\FireFox\Profiles\bt7s07d1.default\searchplugins\askcom.xml

(!) -- Temporary files deleted.


Key deleted: HKLM\Software\Classes\CLSID\{72b3882f-453a-4633-aac9-8c3dced62aff}

Value deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}


============== ADDITIONNAL SCAN ==============

** Mozilla Firefox Version [3.6.3 (fr)] **

-- C:\Documents and Settings\Yael\Application Data\Mozilla\FireFox\Profiles\bt7s07d1.default\Prefs.js --
browser.download.lastDir, C:\Documents and Settings\Yael\????? ??????
browser.search.defaultenginename, ICQ Search
browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
browser.search.selectedEngine, Google
browser.startup.homepage, hxxp://mail.google.com/a/capretraite.fr/#inbox|hxxps://upsider.aceproject.com/Tab.asp?Tab=1
browser.startup.homepage_override.mstone, rv:1.9.2.3
keyword.URL, hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=

-- C:\Documents and Settings\?????\Application Data\Mozilla\FireFox\Profiles\87v6qgy9.default\Prefs.js --
browser.download.lastDir, C:\?????
browser.startup.homepage, hxxp://www.babakama.co.il/?sid=8
browser.startup.homepage_override.mstone, rv:1.9.2.3

========================================

** Internet Explorer Version [8.0.6001.18702] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\Main] 
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\windows\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 1 File(s)
C:\Program Files\Ad-Remover\Backup: 14 File(s)

C:\Ad-Report-CLEAN[1].txt - 30/11/2010 (601 Byte(s)) 
C:\Ad-Report-SCAN[1].txt - 30/11/2010 (3125 Byte(s)) 

End at: 21:10:58, 30/11/2010 
 
============== E.O.F ==============

Master Flex · Answer

parfait :) 

on va maintenant  utiliser * UsbFix, qui est un programme spécifique , son rôle est la suppression d'infection se propageant via les supports amovibles
* Il rétablit certaines fonctions de sécurité endommagées, comme l'accès au registre, au gestionnaire des tâches, à l'affichage des fichiers cachés etc . 

                                ----->USBFIX<----- 

> Télécharge http://www.teamxscript.org/too/UsbFix.exe (créé par El Desaparecido & C_XX)

> /!\Si ton antivirus affiche une alerte, ignore le et désactive le temporairement.

>  Branche (si possible) toutes tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir 

> Double clique sur le raccourci UsbFix sur ton Bureau, l'installation se fera automatiquement

> Clique sur Recherche

> Laisse travailler l'outil /!\ le scan peut rester un long moment sur 48%, il n'est pas bloquer, ne quitte pas, il faudrait tout recommencer.../!\

> A la fin, le bloc note s'ouvre avec le rapport, sélectionne le (Ctrl+A) copie le (Ctrl+C) et colle le dans ta prochaine réponse (Ctrl+V)

ancri · Answer

Et voilà : 

############################## | UsbFix 7.035 | [Research]

User: Yael (Administrator) # COMPUTER-XP [ ]
Updated 22/11/10 by El Desaparecido / C_XX
Started at 22:45:05 | 30/11/2010
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: AMD Athlon(tm) 64 Processor 3500+
Microsoft Windows XP Home Edition (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Windows Firewall: Enabled
Antivirus: AVG Anti-Virus Free 8.5 [Enabled | Updated]
Antivirus: Lavasoft Ad-Watch Live! Antivirus  [Enabled | Updated]
RAM -> 959 Mb 
C:\ (%systemdrive%) -> Fixed drive # 78 Gb (12 Mb free - 16%) [] # NTFS
D:\ -> Fixed drive # 155 Gb (117 Mb free - 76%) [] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Removable drive # 8 Gb (7 Mb free - 99%) [A-DATA UFD] # FAT32
H:\ -> Removable drive # 4 Gb (4 Mb free - 97%) [] # FAT32

################## | Files # Infected Folders |


Found ! F:\autorun.inf

################## | Registry |

Found ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoFind
Found ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoRun

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{4600e4f2-9dc1-11de-b2cd-001485379c1c}
Shell\AutoRun\Command = G:\start.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{5388694f-059c-11dd-88de-806d6172696f}
Shell\open\Command = %SystemRoot%\Explorer.exe /idlist,%I,%L

HKCU\.\.\.\.\Explorer\MountPoints2\{77020014-167b-11df-86cc-001485379c1c}
Shell\AutoRun\Command = G:\LaunchU3.exe -a

HKCU\.\.\.\.\Explorer\MountPoints2\{bb4cc7f5-ef57-11df-8735-001485379c1c}
Shell\AutoRun\Command = G:\LaunchU3.exe -a


################## | Vaccin |

F:\Autorun.inf -> Folder created by Panda USB Vaccine

################## | E.O.F |

Master Flex · Answer

Ok maintenant relance UsbFix

> Clique sur Suppression

> Laisse travailler l'outil /!\ le scan peut rester un long moment sur 48%, il n'est pas bloquer, ne quitte pas, il faudrait tout recommencer.../!\

> A la fin, le bloc note s'ouvre avec le rapport, sélectionne le (Ctrl+A) copie le (Ctrl+C) et colle le dans ta prochaine réponse (Ctrl+V)

ancri · Answer

############################## | UsbFix 7.035 | [Deletion]

User: Yael (Administrator) # COMPUTER-XP [ ]
Updated 22/11/10 by El Desaparecido / C_XX
Started at 23:47:22 | 30/11/2010
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: AMD Athlon(tm) 64 Processor 3500+
Microsoft Windows XP Home Edition (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Windows Firewall: Enabled
Antivirus: AVG Anti-Virus Free 8.5 [Enabled | Updated]
Antivirus: Lavasoft Ad-Watch Live! Antivirus  [Enabled | Updated]
RAM -> 959 Mb 
C:\ (%systemdrive%) -> Fixed drive # 78 Gb (12 Mb free - 16%) [] # NTFS
D:\ -> Fixed drive # 155 Gb (117 Mb free - 76%) [] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Removable drive # 8 Gb (7 Mb free - 99%) [A-DATA UFD] # FAT32
H:\ -> Removable drive # 4 Gb (3 Mb free - 90%) [] # FAT32

################## | Files # Infected Folders |


Deleted ! C:\Recycler\S-1-5-21-796845957-1425521274-725345543-1004
Deleted ! C:\Recycler\S-1-5-21-796845957-1425521274-725345543-1005
Deleted ! D:\Recycler\S-1-5-21-796845957-1425521274-725345543-1004
Deleted ! D:\Recycler\S-1-5-21-796845957-1425521274-725345543-1005
Not deleted ! F:\autorun.inf

################## | Registry |

Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoFind
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoRun

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{4600e4f2-9dc1-11de-b2cd-001485379c1c}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{77020014-167b-11df-86cc-001485379c1c}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{bb4cc7f5-ef57-11df-8735-001485379c1c}

################## | Listing |

[30/11/2010 - 22:45:33 | D ] 	C:\$AVG8.VAULT$
[30/11/2010 - 21:12:37 | N | 7233] 	C:\aaw7boot.log
[30/11/2010 - 21:10:59 | N | 3198] 	C:\Ad-Report-CLEAN[1].txt
[30/11/2010 - 18:56:03 | N | 3125] 	C:\Ad-Report-SCAN[1].txt
[08/04/2008 - 19:29:34 | N | 0] 	C:\AUTOEXEC.BAT
[29/06/2009 - 13:35:42 | RASHD ] 	C:\autorun.inf
[23/09/2009 - 08:37:48 | D ] 	C:\bin
[08/04/2008 - 19:24:36 | N | 211] 	C:\boot.ini
[20/08/2009 - 16:19:45 | D ] 	C:\Brother
[08/04/2008 - 19:29:34 | N | 0] 	C:\CONFIG.SYS
[23/09/2009 - 08:46:13 | D ] 	C:\Creative
[23/11/2010 - 21:23:51 | D ] 	C:\Documents and Settings
[23/09/2009 - 08:44:19 | D ] 	C:\guiboui creative
[21/11/2010 - 19:48:06 | D ] 	C:\Hijackthis
[08/04/2008 - 19:29:34 | N | 0] 	C:\IO.SYS
[28/11/2010 - 08:21:51 | D ] 	C:\Kill'em
[28/11/2010 - 08:43:10 | N | 39628] 	C:\List'em.txt
[24/11/2010 - 22:14:55 | N | 127] 	C:\mbam-error.txt
[09/12/2008 - 09:52:11 | D ] 	C:\monsite2009
[08/04/2008 - 19:29:34 | N | 0] 	C:\MSDOS.SYS
[02/03/2006 - 14:00:00 | N | 47564] 	C:\NTDETECT.COM
[03/09/2008 - 21:21:50 | N | 250048] 	C:
tldr
[30/11/2010 - 21:12:37 | ASH | 1509949440] 	C:\pagefile.sys
[30/11/2010 - 18:53:48 | D ] 	C:\Program Files
[23/09/2009 - 08:37:47 | N | 306] 	C:\pvinst.log
[23/09/2009 - 08:50:56 | D ] 	C:\PVSW
[23/09/2009 - 08:50:51 | D ] 	C:\pvswarch
[03/03/2010 - 08:58:28 | D ] 	C:av bencheetrit
[30/11/2010 - 23:52:28 | SHD ] 	C:\RECYCLER
[31/08/2010 - 21:53:17 | N | 12168] 	C:\Rescued document 1.txt
[15/09/2010 - 21:12:59 | N | 5765] 	C:\Rescued document 2.txt
[15/09/2010 - 21:13:32 | N | 21446] 	C:\Rescued document 3.txt
[12/10/2010 - 22:55:54 | N | 7423] 	C:\Rescued document 4.txt
[13/10/2010 - 08:28:52 | N | 58] 	C:\Rescued document 5.txt
[13/10/2010 - 08:28:53 | N | 301] 	C:\Rescued document 6.txt
[18/11/2010 - 15:12:59 | N | 3726] 	C:\Rescued document 7.txt
[18/11/2010 - 15:13:06 | N | 513] 	C:\Rescued document 8.txt
[18/11/2010 - 15:13:07 | N | 420] 	C:\Rescued document 9.txt
[11/08/2010 - 08:29:15 | N | 1303] 	C:\Rescued document.txt
[25/11/2010 - 23:38:51 | D ] 	C:sit
[30/06/2009 - 14:39:03 | SHD ] 	C:\System Volume Information
[30/06/2009 - 14:34:24 | N | 0] 	C:\TCleaner.txt
[30/11/2010 - 23:52:28 | D ] 	C:\UsbFix
[30/11/2010 - 23:52:33 | A | 1429] 	C:\UsbFix.txt
[30/11/2010 - 15:55:51 | D ] 	C:\WINDOWS
[25/11/2010 - 19:31:10 | D ] 	C:\?????
[25/03/2009 - 18:48:08 | D ] 	D:\$AVG8.VAULT$
[21/08/2009 - 02:16:48 | D ] 	D:\0bab2b4a21f713c3ab3c490d
[30/11/2010 - 08:35:38 | D ] 	D:\antispywares
[29/06/2009 - 13:35:42 | RASHD ] 	D:\autorun.inf
[18/04/2008 - 11:36:37 | D ] 	D:\BAHOLYFRO
[19/12/2007 - 15:54:01 | N | 220851] 	D:\Computer.wab
[21/03/2009 - 21:42:45 | D ] 	D:\emule
[08/04/2008 - 20:35:14 | D ] 	D:\f17b87bb42d16768827c
[18/10/2009 - 09:17:13 | D ] 	D:\films
[21/11/2003 - 23:20:23 | N | 75500696] 	D:\flashmx2004_trial_en_win.zip
[25/12/2007 - 06:23:11 | D ] 	D:\Games
[25/12/2007 - 18:45:19 | N | 687536284] 	D:\Image1.nrg
[21/11/2003 - 23:30:10 | N | 7057] 	D:\Macromedia.Flash.MX.2004.Pro.v7.0.1-keygen.rar
[25/12/2007 - 06:42:41 | D ] 	D:\Outlook Express
[28/02/2008 - 09:33:51 | D ] 	D:\passages
[30/11/2010 - 23:52:28 | SHD ] 	D:\RECYCLER
[09/04/2008 - 06:33:59 | D ] 	D:\SetUp
[25/12/2007 - 06:24:47 | D ] 	D:\SetUp Don't Delete !!! System files !!!
[04/08/2004 - 00:56:58 | N | 28672] 	D:\setupSNK.exe
[25/12/2007 - 06:24:47 | D ] 	D:\SMRTNTKY
[16/07/2009 - 02:01:00 | SHD ] 	D:\System Volume Information
[21/06/2010 - 16:57:38 | D ] 	D:\????? ??l;jp0oo0??
[06/05/2008 - 14:26:23 | R | 309] 	F:\autorun.inf
[23/10/2007 - 09:45:39 | R | 1336632] 	F:\LaunchU3.exe
[06/05/2008 - 14:11:20 | R | 5600229] 	F:\LaunchPad.zip
[30/03/2008 - 11:49:08 | D ] 	H:\Documents
[30/03/2008 - 11:49:08 | HD ] 	H:\System
[23/10/2007 - 10:45:40 | N | 1336632] 	H:\LaunchU3.exe
[29/06/2009 - 14:35:44 | RSHD ] 	H:\autorun.inf
[10/05/2010 - 17:28:06 | D ] 	H:\.Trashes
[10/05/2010 - 17:28:06 | D ] 	H:\.Spotlight-V100
[10/05/2010 - 17:28:06 | D ] 	H:\.fseventsd
[10/10/2009 - 21:12:40 | N | 3532380] 	H:\???? ????? -'? ???? ???????.mp3
[10/10/2009 - 21:11:22 | N | 3637454] 	H:\07 - ?????? ???? ?? ???? ??? ???? ?????? - ??? ????? ????.mp3
[10/10/2009 - 21:11:18 | N | 3715168] 	H:\06 - ?????? ???? ?? ??? ???????, ???? ????, ????? ??? ?????? ??? - ???? ??? ????.mp3
[10/10/2009 - 21:12:38 | N | 5613493] 	H:\???? ????? - ??? ????.mp3
[10/10/2009 - 21:12:38 | N | 3842085] 	H:\???? ????? - ???? ??? ???.mp3
[10/10/2009 - 21:11:00 | N | 5761625] 	H:\0 Matisyahu - Jerusalem.mp3
[10/10/2009 - 21:12:04 | N | 3932719] 	H:\Jewish - Avraham Fried - The Baal Shem Tov's Songs - 11 - Ni.mp3
[10/10/2009 - 21:12:08 | N | 6764686] 	H:\Matisyahu - Dispatch The Troops.mp3
[10/10/2009 - 21:14:48 | N | 3958663] 	H:\???? ????? - ????? ?? ???.mp3
[10/10/2009 - 21:11:18 | N | 5819339] 	H:\05 Matisyahu - Indestructible.mp3
[10/10/2009 - 21:11:46 | N | 4070420] 	H:\Avraham Fried - k'shem.mp3
[10/10/2009 - 21:11:10 | N | 6252195] 	H:\03. ?????? ???? - ????? ????.mp3
[10/10/2009 - 21:12:16 | N | 4352206] 	H:\Mordechai Ben David - Niggun Rashi ????? ?? ??? - ???? ??''?.mp3
[10/10/2009 - 21:11:54 | N | 2311182] 	H:\Avraham Fried - Yerusahalayim.mp3
[10/10/2009 - 21:12:00 | N | 2311182] 	H:\ISRAEL-Avraham Fried - Adon.mp3
[10/10/2009 - 21:11:16 | N | 5773395] 	H:\05 - Matisyahu - Live at Stubbs - King Without a Crown.mp3
[10/10/2009 - 21:12:12 | N | 7274499] 	H:\Matisyahu - King Without A Crown.mp3
[10/10/2009 - 21:11:36 | N | 4653262] 	H:\15 - ?????? ???? ?? ?? ???? ?????? ??? - ??????? ?????.mp3
[10/10/2009 - 21:13:28 | N | 4720846] 	H:\????? ?? ??? - ?????? - ??? ????.mp3
[10/10/2009 - 21:11:44 | N | 6009496] 	H:\avraham fried - Dovid Melech.mp3
[10/10/2009 - 21:11:18 | N | 4837028] 	H:\05. ???? ????? - ?? ????.mp3
[10/10/2009 - 21:11:40 | N | 3670222] 	H:\Avraham Fried - atoh.mp3
[10/10/2009 - 21:11:42 | N | 4901120] 	H:\Avraham Fried - Baruch Haba.mp3
[10/10/2009 - 21:13:40 | N | 7637143] 	H:\?????? ???? - ?????.mp3
[10/10/2009 - 21:11:58 | N | 6504656] 	H:\Cpia de matisyahu - shake off the dust arise - king without a crown.mp3
[10/10/2009 - 21:11:54 | N | 5385460] 	H:\Avraham Fried - yedid nefesh.mp3
[10/10/2009 - 21:12:10 | N | 5650449] 	H:\Matisyahu - Got no Water.mp3
[10/10/2009 - 21:10:54 | N | 5757134] 	H:\ ??? ???? - ??? ??? ?????.mp3
[10/10/2009 - 21:13:26 | N | 8644388] 	H:\????? ?? ??? - ???.mp3
[10/10/2009 - 21:11:48 | N | 6073649] 	H:\Avraham Fried - Shiru lamelech.mp3
[10/10/2009 - 21:11:22 | N | 6089711] 	H:\06 Torah Medley Avraham Fried Avinu Malkeinu Religious 128kbps.mp3
[10/10/2009 - 21:13:24 | N | 6107512] 	H:\????? ?? ??? - 05 ??? ????.mp3
[10/10/2009 - 21:12:06 | N | 6107898] 	H:\Matisyahu - Candle.mp3
[10/10/2009 - 21:11:28 | N | 10026736] 	H:\09 Matisyahu - Exaltation.mp3
[10/10/2009 - 21:12:14 | N | 8467343] 	H:\Matisyahu - Rastaman Chant.mp3
[10/10/2009 - 21:11:50 | N | 6778550] 	H:\Avraham Fried - tzion.mp3
[10/10/2009 - 21:13:34 | N | 6779214] 	H:\??? ???? - ??????-????? ???.mp3
[10/10/2009 - 21:13:38 | N | 17206584] 	H:\?????? ????? - ????? ???.mp3
[10/10/2009 - 21:11:46 | N | 7340238] 	H:\Avraham Fried - eilu v'eilu.mp3
[10/10/2009 - 21:13:32 | N | 14765402] 	H:\????? ?? ???- ???? ????.mp3
[10/10/2009 - 21:11:20 | N | 3024825] 	H:\06 Matisyahu - What I'm Fighting For.mp3
[10/10/2009 - 21:11:22 | N | 3024825] 	H:\06-matisyahu-what_im_fighting_for.mp3
[10/10/2009 - 21:11:38 | N | 2489657] 	H:\Avraham Fried - Ani Maamin mashiah.mp3
[10/10/2009 - 21:13:24 | N | 2512318] 	H:\????? ?? ??? - ??? ??? ?????.mp3
[10/10/2009 - 21:11:58 | N | 3300560] 	H:\Avraham Fried - ????? ?? ??? - ?????.mp3
[10/10/2009 - 21:11:58 | N | 2703566] 	H:\Avraham Fried (Hop Sasa) - Hop Sasa.mp3
[10/10/2009 - 21:13:06 | N | 2721890] 	H:\????? - ????? ?? ??? - ????? ????? - ??????? ?? ??????.mp3
[10/10/2009 - 21:13:32 | N | 2879181] 	H:\????? ??-??? - ????-???.mp3
[10/10/2009 - 21:13:08 | N | 3021181] 	H:\???? ???? ????.mp3
[10/10/2009 - 21:11:16 | N | 3256526] 	H:\05 - ?????? ???? ?? ??? ?? ??? - ?? ????? ???????.mp3
[10/10/2009 - 21:13:36 | N | 3497061] 	H:\??? ????- ??? ?????.mp3

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
F:\Autorun.inf -> Folder created by Panda USB Vaccine
H:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_COMPUTER-XP.zip
http://www.teamxscript.org/Upload.php
Thank you for your contribution.

################## | E.O.F |

Master Flex · Answer

très bien :) nos petits amis s'en vont tranquillement peux tu me refaire scan avec zhp diag stp afin de voir si il reste des couche tard :) et poster le rapport dans ta prochaine réponse.

petit rappel au cas où tu aurais oublié la marche à suivre ;)

/!\ utilisateur de vista et seven, désactiver l'UAC./!\

/!\ utilisateur de vista et seven faite clique droit et "éxécuter en temps qu'administrateur/!\

>  Télécharge zhpdiag (de Nicolas Coolman)

> Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.

>  /!\Utilisateur de Vista et Seven : Clique droit sur le logo de ZHPdiag, « exécuter en tant qu'Administrateur »/!\

> Clique sur la petite loupe en haut à gauche pour débuter l'analyse :

>attention, le scan peut durer un certain temps, ne touche a rien d'autre tant que le scan est en cour

> Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette

>  Héberge le rapport ZHPDiag.txt sur cijoint, puis copie/colle le lien fourni                                          dans ta prochaine réponse sur le forum.

   ->tu trouveras un lien comme celui ci: http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt c'est ce lien qu'il faudra me donner.

ancri · Answer

Salut, 

Voilà le rapport : http://www.cijoint.fr/cjlink.php?file=cj201012/cijP7o5SzY.txt

ancri · Answer

Salut,

Où avez-vous disparus ? Il est ok ce rapport ?

Utilisateur anonyme · Answer

salut,

puisque MASTER FLEX n'a pas énormément de temps en ce moment, je fais avancer: 

plus d'infection visible sur le rapport mais,

1/ désinstalle:

AD-AWARE: il est obsolète et ne sert plus a rien a part prendre de la place sur le PC.

spybot: comme ad-aware, il ne sert plus a rien. 

les deux peuvent être remplacer par MBAM bien plus performant.

2/ emule:

si tu utilise le P2P, tu sera toujours infecter, le P2P est un vecteur d'infection très important: lis ceci: Les dangers du P2P.

désinstalle donc emule pour mieux te protéger.

quand ceci sera fait, préviens moi.
@+++

ancri · Answer

Salut,

Désolée, j'avais plein de boulot et j'ai pas eu le temps de te répondre. En plus, j'avais du mal à me défaire d'Emule, même si je m'en sers pas beaucoup.

J'ai bien peur que mon PC rame de plus en plus. Il se peut qu'il y ait quelque chose qu'on ait pas vu ? Ou ça vient d'autre chose ? 

@ +

ancri · Answer

Bonjour Jacques,

Merci de ton aide. Voici le rapport de Delfix :

########## DelFix - Nettoyeur d'outils de d?sinfection ##########
#
# DelFix v6.7 - Rapport cr?? le 21/12/2010 ? 08:01
# Mis ? jour le 28/11/10 ? 13h30 par Xplode
# Syst?me d'exploitation : Microsoft Windows XP (32 bits) [Version 5.1.2600] Service Pack 3
# Nom d'utilisateur : Yael - COMPUTER-XP (Administrateur)
# Ex?cut? depuis : C:\Documents and Settings\Yael\????? ??????\DelFix.exe
# Option [Suppression]


~~~~~~ Dossier(s) ~~~~~~

Supprim? : C:\USBFix
Supprim? : C:\RSIT
Supprim? : C:\Kill'em
Supprim? : C:\Program Files\Ad-Remover
Supprim? : C:\Program Files\List_Kill'em
Supprim? : C:\Program Files\ZHPDiag
Supprim? : C:\Program Files	rend micro

~~~~~~ Fichier(s) ~~~~~~

Supprim? : C:\List'em.txt
Supprim? : C:\UsbFix.txt
Supprim? : C:\UsbFix_Upload_Me_COMPUTER-XP.zip
Supprim? : C:\Ad-Report-CLEAN[1].txt
Supprim? : C:\Ad-Report-SCAN[1].txt
Supprim? : C:\TCleaner.txt
Supprim? : C:\WINDOWS\System32	mp.reg
Supprim? : C:\WINDOWS\System32	mp.txt
Supprim? : C:\Documents and Settings\Yael\????? ??????\List_Killem_Install.exe
Supprim? : C:\Documents and Settings\Yael\????? ??????\UsbFix.exe
Supprim? : C:\Documents and Settings\Yael\????? ??????\AD-R.lnk
Supprim? : C:\Documents and Settings\Yael\????? ??????\ZHPDiag.Txt
Supprim? : C:\Documents and Settings\Yael\????? ??????\List_Kill'em.lnk

~~~~~~ Registre ~~~~~~

Cl? Supprim?e : HKCU\SOFTWARE\Ad-Remover
Cl? Supprim?e : HKCU\SOFTWARE\USBFix
Cl? Supprim?e : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\List_Kill'em
Cl? Supprim?e : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ZHP
Cl? Supprim?e : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\HijackThis
Cl? Supprim?e : HKLM\Software\OldTimer Tools
Cl? Supprim?e : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Remover
Cl? Supprim?e : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\USBFix

~~~~~~ Autre ~~~~~~

-> ESET Online Scanner ... D?sinstall? avec succ?s
-> BitDefender Online Scanner ... D?sinstall? avec succ?s

########## EOF - "C:\DelFixSuppr.txt" - [2251 octets] ##########




@ +

ancri · Answer

Salut, Voilà le rapport : ?????????? List'em by g3n-h@ckm@n 2.1.2.8 ?????????? User : Yael (Administrators) Update on 22/12/2010 by g3n-h@ckm@n ::::: 22.30 Start at: 22:02:11 | 23/12/2010 AMD Athlon(tm) 64 Processor 3500+ Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Disabled AV : AVG Anti-Virus Free 8.5 [ Enabled | Updated ] A:\ -> ???? ????????? ?3 1/2 ????' C:\ -> ???? ???? ????? | 78.13 Go (8.8 Go free) | NTFS D:\ -> ???? ???? ????? | 154.75 Go (116.84 Go free) | NTFS E:\ -> ??????? | 699.7 Mo (0 Mo free) [Nouveau] | CDFS F:\ -> ???? ????? ????? | 7.54 Go (7.39 Go free) [A-DATA UFD] | FAT32 G:\ -> ???? ????? ????? ????? Sessions ????? C:\Documents and settings\Yael Boot: Normal ?????? Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer C:\WINDOWS\System32\smss.exe ---- 64 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ---- C:\WINDOWS\system32\csrss.exe ---- 3364 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\WINDOWS\system32\winlogon.exe ---- 1972 Ko ---- High ---- winlogon.exe ---- C:\WINDOWS\system32\services.exe ---- 2372 Ko ---- Normal ---- C:\WINDOWS\system32\services.exe ---- C:\WINDOWS\system32\lsass.exe ---- 1976 Ko ---- Normal ---- C:\WINDOWS\system32\lsass.exe ---- C:\WINDOWS\system32\svchost.exe ---- 1884 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k DcomLaunch ---- C:\WINDOWS\system32\svchost.exe ---- 1604 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k rpcss ---- C:\WINDOWS\System32\svchost.exe ---- 24136 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k netsvcs ---- C:\WINDOWS\system32\svchost.exe ---- 2036 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k NetworkService ---- C:\WINDOWS\system32\svchost.exe ---- 1780 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\WINDOWS\system32\brsvc01a.exe ---- 68 Ko ---- Normal ---- C:\WINDOWS\system32\brsvc01a.exe ---- C:\WINDOWS\system32\brss01a.exe ---- 684 Ko ---- Normal ---- brss01a.exe ---- C:\WINDOWS\system32\spoolsv.exe ---- 3744 Ko ---- Normal ---- C:\WINDOWS\system32\spoolsv.exe ---- C:\WINDOWS\system32\svchost.exe ---- 568 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---- 2880 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---- AVG Technologies C:\WINDOWS\System32\svchost.exe ---- 188 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k eapsvcs ---- C:\Program Files\Java\jre6\bin\jqs.exe ---- 1396 Ko ---- Idle ---- C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf ---- Sun Microsystems, Inc. C:\WINDOWS\system32 vsvc32.exe ---- 596 Ko ---- Normal ---- C:\WINDOWS\system32 vsvc32.exe ---- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 808 Ko ---- Normal ---- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- Microsoft Corporation C:\WINDOWS\system32\svchost.exe ---- 1624 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k imgsvc ---- C:\PROGRA~1\AVG\AVG8\avgemc.exe ---- 508 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgemc.exe ---- AVG Technologies C:\PROGRA~1\AVG\AVG8\avgrsx.exe ---- 23012 Ko ---- Normal ---- avgrsx.exe ---- AVG Technologies C:\Program Files\AVG\AVG8\avgcsrvx.exe ---- 2616 Ko ---- Normal ---- /pipeName=1e0866a8-bf11-455b-b3cf-4010229b9814 /coreSdkOptions=0 /binaryPath=C:\Program Files\AVG\AVG8\ ---- AVG Technologies C:\WINDOWS\Explorer.EXE ---- 15720 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- 348 Ko ---- Normal ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe ---- 768 Ko ---- Normal ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun ---- C:\WINDOWS\System32\alg.exe ---- 136 Ko ---- Normal ---- C:\WINDOWS\System32\alg.exe ---- C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe ---- 708 Ko ---- Normal ---- C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions ---- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- 1268 Ko ---- Normal ---- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- Adobe Systems, Incorporated C:\Program Files\QuickTime\qttask.exe ---- 468 Ko ---- Normal ---- C:\Program Files\QuickTime\qttask.exe -atboottime ---- C:\WINDOWS\system32\ctfmon.exe ---- 736 Ko ---- Normal ---- C:\WINDOWS\system32\ctfmon.exe ---- C:\Program Files\DAEMON Tools Lite\DTLite.exe ---- 608 Ko ---- Normal ---- C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun ---- DT Soft Ltd C:\Program Files\TechSmith\Jing\Jing.exe ---- 6488 Ko ---- Normal ---- C:\Program Files\TechSmith\Jing\Jing.exe ---- TechSmith Corporation C:\PROGRA~1\MICROS~3 apimgr.exe ---- 728 Ko ---- Normal ---- C:\PROGRA~1\MICROS~3 apimgr.exe -Embedding ---- Microsoft Corporation C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- 804 Ko ---- Normal ---- C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe ---- 848 Ko ---- Normal ---- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe Brother MFC-425CN /STARTUP ---- C:\PVSW\Bin\w3dbsmgr.exe ---- 2068 Ko ---- Normal ---- C:\PVSW\Bin\w3dbsmgr.exe -SRDE ---- C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe ---- 716 Ko ---- Normal ---- BrMfcmon.exe USB001 Brother MFC-425CN USB Printer ---- C:\Program Files\Skype\Plugin Manager\skypePM.exe ---- 3244 Ko ---- Normal ---- C:\Program Files\Skype\Plugin Manager\skypePM.exe /SILENT ---- EasyBits Software AS C:\Program Files\Common Files\Teleca Shared\Generic.exe ---- 764 Ko ---- Normal ---- C:\Program Files\Common Files\Teleca Shared\Generic.exe -Embedding ---- C:\Program Files\Outlook Express\msimn.exe ---- 4928 Ko ---- Normal ---- C:\Program Files\Outlook Express\msimn.exe ---- C:\WINDOWS\system32\msfeedssync.exe ---- 164 Ko ---- Normal ---- C:\WINDOWS\system32\msfeedssync.exe sync ---- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe ---- 856 Ko ---- Normal ---- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe ---- Microsoft Corporation C:\WINDOWS\system32\csrss.exe ---- 916 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\WINDOWS\system32\winlogon.exe ---- 1688 Ko ---- High ---- winlogon.exe ---- C:\WINDOWS\Explorer.EXE ---- 5312 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- C:\WINDOWS\system32\RUNDLL32.EXE ---- 252 Ko ---- Normal ---- C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- 252 Ko ---- Normal ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe ---- 484 Ko ---- Normal ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun ---- C:\PROGRA~1\AVG\AVG8\avgtray.exe ---- 900 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgtray.exe ---- AVG Technologies C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe ---- 288 Ko ---- Normal ---- C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions ---- C:\Program Files\QuickTime\qttask.exe ---- 256 Ko ---- Normal ---- C:\Program Files\QuickTime\qttask.exe -atboottime ---- C:\WINDOWS\system32\ctfmon.exe ---- 440 Ko ---- Normal ---- C:\WINDOWS\system32\ctfmon.exe ---- C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- 780 Ko ---- Normal ---- C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe ---- 400 Ko ---- Normal ---- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe Brother MFC-425CN /STARTUP ---- C:\PROGRA~1\MICROS~3 apimgr.exe ---- 500 Ko ---- Normal ---- C:\PROGRA~1\MICROS~3 apimgr.exe -Embedding ---- Microsoft Corporation C:\Program Files\Mozilla Firefox\firefox.exe ---- 72976 Ko ---- Normal ---- C:\Program Files\Mozilla Firefox\firefox.exe ---- Mozilla Corporation C:\Program Files\Microsoft ActiveSync\wcescomm.exe ---- 928 Ko ---- Normal ---- C:\Program Files\Microsoft ActiveSync\wcescomm.exe ---- Microsoft Corporation C:\Program Files\Microsoft Office\Office10\WINWORD.EXE ---- 20484 Ko ---- Normal ---- C:\Program Files\Microsoft Office\Office10\WINWORD.EXE /n /dde ---- Microsoft Corporation C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe ---- 864 Ko ---- Normal ---- C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe Object -Embedding ---- Microsoft Corporation C:\Program Files\Mozilla Firefox\firefox.exe ---- 165028 Ko ---- Normal ---- C:\Program Files\Mozilla Firefox\firefox.exe -requestPending -osint -url http://www.le-rsi.fr/action_sanitaire_et_sociale/invalides_retraites/aide_maintien_domicile/garde_a_domicile.php ---- Mozilla Corporation C:\Program Files\Windows Media Player\wmplayer.exe ---- 35176 Ko ---- Normal ---- C:\Program Files\Windows Media Player\wmplayer.exe /SHELLHLP_V9 Play /DataObject:NEFEPEHFBAAAAAAAOABAAAAAAAAAAAAAAMAAAAAAAAAAAAGEAAAAAAAAFAAAAAAAABDIBNPDPCMFNJCFHJGCNOGOKACPKMLBJBEDAAAAINFAELGBCJKNLMIOGGFMACOKAAAAAAAA ---- C:\PROGRA~1\AVG\AVG8\avgnsx.exe ---- 4616 Ko ---- Normal ---- avgnsx.exe ---- AVG Technologies C:\WINDOWS\system32 undll32.exe ---- 6804 Ko ---- Normal ---- C:\WINDOWS\system32 undll32.exe C:\WINDOWS\system32\shell32.dll,Control_RunDLL C:\WINDOWS\system32\wscui.cpl ---- C:\WINDOWS\system32\wscntfy.exe ---- 2604 Ko ---- Normal ---- C:\WINDOWS\system32\wscntfy.exe ---- C:\WINDOWS\system32\wscntfy.exe ---- 2620 Ko ---- Normal ---- C:\WINDOWS\system32\wscntfy.exe ---- C:\WINDOWS\system32\cmd.exe ---- 2980 Ko ---- Normal ---- C:\WINDOWS\system32\cmd.exe /K List'em.bat ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 7012 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- C:\Program Files\List_Kill'em\pv.L_K ---- 2916 Ko ---- Normal ---- pv.L_K -o%f ---- %m Ko ---- %p ---- %l ---- %s ---- ?????????? Keys Run ?????????? [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MsnMsgr = C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe /background H/PC Connection Agent = C:\Program Files\Microsoft ActiveSync\wcescomm.exe ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe DAEMON Tools Lite = C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun Jing = C:\Program Files\TechSmith\Jing\Jing.exe Skype = C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit Alcmtr = ALCMTR.EXE SSBkgdUpdate = C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot PaperPort PTD = C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe IndexSearch = C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe SetDefPrt = C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe ControlCenter2.0 = C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun AVG8_TRAY = C:\PROGRA~1\AVG\AVG8\avgtray.exe Sony Ericsson PC Suite = C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions Adobe Reader Speed Launcher = C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe Adobe ARM = C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe QuickTime Task = C:\Program Files\QuickTime\qttask.exe -atboottime UserFaultCheck = %systemroot%\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ?????????? Other System Keys ?????????? [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun = 0 (0x0) NoDriveAutoRun = 3 (0x3) ??????????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] HonorAutoRunSetting = 1 (0x1) NoDriveAutoRun = 3 (0x3) NoDriveTypeAutoRun = 0 (0x0) ??????????????? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLS = ??????????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell = Explorer.exe Userinit = C:\WINDOWS\system32\Userinit.exe, ??????????????? [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\avgrsstarter] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dimsntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wlballoon] ??????????????? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} = ??????????????? [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Grisoft\AVG7\avginet.exe = C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe = C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgcc.exe = C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe C:\Program Files\Messenger\msmsgs.exe = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger C:\Program Files\eMule\emule.exe = C:\Program Files\eMule\emule.exe:*:Enabled:eMule C:\PVSW\Bin\w3dbsmgr.exe = C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager C:\Program Files\AVG\AVG8\avgupd.exe = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe C:\Program Files\AVG\AVG8\avgemc.exe = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe C:\Program Files\ICQ6\ICQ.exe = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 C:\Program Files\Mozilla Firefox\firefox.exe = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox C:\Program Files\ICQ6.5\ICQ.exe = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\Skype\Plugin Manager\skypePM.exe = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager C:\Program Files\ICQ7.2\ICQ.exe = C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 C:\Program Files\ICQ7.2\aolload.exe = C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe C:\Program Files\Skype\Phone\Skype.exe = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\ICQ7.2\ICQ.exe = C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 C:\Program Files\ICQ7.2\aolload.exe = C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe ?????????? ActivX | COM ?????????? [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{02BCC737-B171-4746-94C9-0D8A0B2C0089}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7530BFB8-7293-4D34-9923-61A11451AFC5}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] ??????????????? [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2755948A-38EE-4B76-A42B-4A2BF463DD6F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ECD292A0-0347-4244-8C24-5DBCE990FB40}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}] ?????????? BHO ?????????? [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00e71626-0bef-11dc-8314-0800200c9a66}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] ?????????? DNS ?????????? Description: Gigabyte GN-WB01GS USB WLAN Card #3 - ????-????? ?? ????? ???? DNS Server Search Order: 10.0.0.138 Description: Gigabyte GN-WB01GS USB WLAN Card #3 - ????-????? ?? ????? ???? DNS Server Search Order: 10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 ?????????? Internet Explorer ?????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr Local Page = C:\windows\system32\blank.htm Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.inn.co.il/ Local Page = C:\windows\system32\blank.htm Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF ????? Proxy Internet Explorer [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] ProxyEnable = 0 (0x0) ?????????? Safemode ?????????? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !! ?????????? Atapi.sys ?????????? [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [MD5.9f3a2f5aa6875c72bf062c712cfa2674] - C:\WINDOWS\ServicePackFiles\i386\atapi.sys [MD5.9f3a2f5aa6875c72bf062c712cfa2674] - C:\WINDOWS\system32\drivers\atapi.sys [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys ????? Reference Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP3 : 7A62A6C8303C9D026DD926F397B2FB57 Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Win XP_64 : 72C77044943340964FA513B92D6D6874 Win XP_64_SP2 : 7A1814D0D112F50F828E25557A1ED29F Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 338c86357871c167a96ab976519bf59e Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ?????????? Explorer ?????????? [MD5.468d2a8b5f62e25f81c3150263d8e558] - C:\WINDOWS\explorer.exe [MD5.1fb3ee7c4d70aace3063a1e1e0ff7fcf] - C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [MD5.7c66ce267edd66607b2275fe44235a31] - C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [MD5.a275bb2b4cf43625b9f38ad312f5c5a6] - C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [MD5.468d2a8b5f62e25f81c3150263d8e558] - C:\WINDOWS\ServicePackFiles\i386\explorer.exe ?????????? Winlogon ?????????? [MD5.e589065c107815a4f5db393973a2b9b0] - C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [MD5.9dc7d2c3a0956a9ff82c4dd5596613a8] - C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [MD5.9dc7d2c3a0956a9ff82c4dd5596613a8] - C:\WINDOWS\system32\winlogon.exe ?????????? Wininit ?????????? ?????????? SVC | svchost ?????????? ?????????? IFEO | debugger ?????????? ?????????? Mountpoints2 ?????????? HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{178a50f2-0ce9-11e0-875a-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{178a50f2-0ce9-11e0-875a-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{366c862a-0894-11de-b287-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{366c862a-0894-11de-b287-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51843fb-2648-11dd-b206-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51843fb-2648-11dd-b206-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b742caec-fc51-11df-8753-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b742caec-fc51-11df-8753-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8910409-08bb-11df-86c8-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8910409-08bb-11df-86c8-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d50a1067-0c99-11dd-b1f9-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d50a1067-0c99-11dd-b1f9-001485379c1c}\shell\Autoplay ?????????? Services ?????????? ? Ndisuio => Start : 3 ( OK = 3 ) ? EapHost => Start : 2 ( OK = 2 ) ? Ip6Fw => Start : 2 ( OK = 2 ) ? SharedAccess => Start : 2 ( OK = 2 ) ? wuauserv => Start : 2 ( OK = 2 ) ? wscsvc => Start : 2 ( OK = 2 ) ?????????? First Scan ?????????? ?????????? Registry ?????????? [@ = ] [HKEY_CURRENT_USER\software\AC3filter] [HKEY_CURRENT_USER\software\Adobe] [HKEY_CURRENT_USER\software\Ahead] [HKEY_CURRENT_USER\software\America Online] [HKEY_CURRENT_USER\software\AppDataLow] [HKEY_CURRENT_USER\software\Avg] [HKEY_CURRENT_USER\software\BitDefender] [HKEY_CURRENT_USER\software\Brother] [HKEY_CURRENT_USER\software\Clients] [HKEY_CURRENT_USER\software\CoreVorbis] [HKEY_CURRENT_USER\software\Cyberlink] [HKEY_CURRENT_USER\software\Cygnus Solutions] [HKEY_CURRENT_USER\software\DivXNetworks] [HKEY_CURRENT_USER\software\DownloadCenter] [HKEY_CURRENT_USER\software\Druide informatique inc.] [HKEY_CURRENT_USER\software\DT Soft] [HKEY_CURRENT_USER\software\FUJIFILM] [HKEY_CURRENT_USER\software\Gabest] [HKEY_CURRENT_USER\software\GNU] [HKEY_CURRENT_USER\software\Google] [HKEY_CURRENT_USER\software\GSpot Appliance Corp] [HKEY_CURRENT_USER\software\Haali] [HKEY_CURRENT_USER\software\ICQToolbar] [HKEY_CURRENT_USER\software\IM Providers] [HKEY_CURRENT_USER\software\Intel] [HKEY_CURRENT_USER\software\JavaSoft] [HKEY_CURRENT_USER\software\Local AppWizard-Generated Applications] [HKEY_CURRENT_USER\software\Macromedia] [HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware] [HKEY_CURRENT_USER\software\Microsoft] [HKEY_CURRENT_USER\software\Mozilla] [HKEY_CURRENT_USER\software\MozillaPlugins] [HKEY_CURRENT_USER\software\Netscape] [HKEY_CURRENT_USER\software\NVIDIA Corporation] [HKEY_CURRENT_USER\software\ODBC] [HKEY_CURRENT_USER\software\Paint.NET] [HKEY_CURRENT_USER\software\Philipp Winterberg] [HKEY_CURRENT_USER\software\Piriform] [HKEY_CURRENT_USER\software\Policies] [HKEY_CURRENT_USER\software\Praxisoft] [HKEY_CURRENT_USER\software\Realtek] [HKEY_CURRENT_USER\software\Samsung] [HKEY_CURRENT_USER\software\Samsung PC Studio] [HKEY_CURRENT_USER\software\ScanSoft] [HKEY_CURRENT_USER\software\Skype] [HKEY_CURRENT_USER\software\SkypeApps] [HKEY_CURRENT_USER\software\smarttip] [HKEY_CURRENT_USER\software\Sony Ericsson] [HKEY_CURRENT_USER\software\Sysinternals] [HKEY_CURRENT_USER\software\TechSmith] [HKEY_CURRENT_USER\software\Teleca] [HKEY_CURRENT_USER\software\VB and VBA Program Settings] [HKEY_CURRENT_USER\software\Windows Live] [HKEY_CURRENT_USER\software\Windows Live Writer] [HKEY_CURRENT_USER\software\XTTB00001] [HKEY_CURRENT_USER\software\YahooPartnerToolbar] [HKEY_CURRENT_USER\software\?? ?? ???? ????? ??? ?? ????] [HKEY_CURRENT_USER\software\Classes] [HKEY_LOCAL_MACHINE\software\14919ea49a8f3b4aa3cf1058d9a64cec] [HKEY_LOCAL_MACHINE\software\781] [HKEY_LOCAL_MACHINE\software\Adobe] [HKEY_LOCAL_MACHINE\software\Ahead] [HKEY_LOCAL_MACHINE\software\AMD] [HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.] [HKEY_LOCAL_MACHINE\software\AVG] [HKEY_LOCAL_MACHINE\software\Brother] [HKEY_LOCAL_MACHINE\software\C07ft5Y] [HKEY_LOCAL_MACHINE\software\CDDB] [HKEY_LOCAL_MACHINE\software\Classes] [HKEY_LOCAL_MACHINE\software\Clever Age] [HKEY_LOCAL_MACHINE\software\Clients] [HKEY_LOCAL_MACHINE\software\Codec Tweak Tool] [HKEY_LOCAL_MACHINE\software\Creative Software] [HKEY_LOCAL_MACHINE\software\Cyberlink] [HKEY_LOCAL_MACHINE\software\Cygnus Solutions] [HKEY_LOCAL_MACHINE\software\DivXNetworks] [HKEY_LOCAL_MACHINE\software\Druide informatique inc.] [HKEY_LOCAL_MACHINE\software\DT Soft] [HKEY_LOCAL_MACHINE\software\Ericsson] [HKEY_LOCAL_MACHINE\software\fce] [HKEY_LOCAL_MACHINE\software\ffffffff] [HKEY_LOCAL_MACHINE\software\FolderIcon XP] [HKEY_LOCAL_MACHINE\software\FUJI PHOTO FILM CO.,LTD.] [HKEY_LOCAL_MACHINE\software\FullCircle] [HKEY_LOCAL_MACHINE\software\Gabest] [HKEY_LOCAL_MACHINE\software\Gemplus] [HKEY_LOCAL_MACHINE\software\GNU] [HKEY_LOCAL_MACHINE\software\Google] [HKEY_LOCAL_MACHINE\software\HaaliMkx] [HKEY_LOCAL_MACHINE\software\HmLmbd] [HKEY_LOCAL_MACHINE\software\ICQ] [HKEY_LOCAL_MACHINE\software\InstallShield] [HKEY_LOCAL_MACHINE\software\Intel] [HKEY_LOCAL_MACHINE\software\InterVideo] [HKEY_LOCAL_MACHINE\software\JavaSoft] [HKEY_LOCAL_MACHINE\software\KLCodecPack] [HKEY_LOCAL_MACHINE\software\Macromedia] [HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware] [HKEY_LOCAL_MACHINE\software\MCCI] [HKEY_LOCAL_MACHINE\software\MeaningData.com] [HKEY_LOCAL_MACHINE\software\Microsoft] [HKEY_LOCAL_MACHINE\software\MimarSinan] [HKEY_LOCAL_MACHINE\software\Mirabilis] [HKEY_LOCAL_MACHINE\software\MobiPocket.com] [HKEY_LOCAL_MACHINE\software\Mozilla] [HKEY_LOCAL_MACHINE\software\mozilla.org] [HKEY_LOCAL_MACHINE\software\MozillaPlugins] [HKEY_LOCAL_MACHINE\software\NVIDIA Corporation] [HKEY_LOCAL_MACHINE\software\ODBC] [HKEY_LOCAL_MACHINE\software\Paint.NET] [HKEY_LOCAL_MACHINE\software\Pervasive Software] [HKEY_LOCAL_MACHINE\software\Philipp Winterberg] [HKEY_LOCAL_MACHINE\software\Phonemonitor] [HKEY_LOCAL_MACHINE\software\Piriform] [HKEY_LOCAL_MACHINE\software\Policies] [HKEY_LOCAL_MACHINE\software\Program Groups] [HKEY_LOCAL_MACHINE\software\Realtek] [HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.] [HKEY_LOCAL_MACHINE\software\RegisteredApplications] [HKEY_LOCAL_MACHINE\software\S3R521] [HKEY_LOCAL_MACHINE\software\Safer Networking Limited] [HKEY_LOCAL_MACHINE\software\Samsung] [HKEY_LOCAL_MACHINE\software\Samsung Electronics Co., Ltd.] [HKEY_LOCAL_MACHINE\software\ScanSoft] [HKEY_LOCAL_MACHINE\software\Schlumberger] [HKEY_LOCAL_MACHINE\software\Secure] [HKEY_LOCAL_MACHINE\software\Skype] [HKEY_LOCAL_MACHINE\software\Sony Ericsson] [HKEY_LOCAL_MACHINE\software\TechSmith] [HKEY_LOCAL_MACHINE\software\Teleca] [HKEY_LOCAL_MACHINE\software\Visioneer] [HKEY_LOCAL_MACHINE\software\WebUpdate] [HKEY_LOCAL_MACHINE\software\Windows] [HKEY_LOCAL_MACHINE\software\Windows 3.1 Migration Status] [HKEY_LOCAL_MACHINE\software\Wise Solutions] [HKEY_LOCAL_MACHINE\software\Zeon] ?????????? Files/folders ?????????? Present !! : C:\Documents and Settings\Yael\Temp Present !! : \AUTOEXEC.BAT Present !! : \SFen-6.6.2r3(HDR).exe Present !! : C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache Present !! : C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache Present !! : C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache Present !! : C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache ?????????? Keys : Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6 Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59 FEATURE_BROWSER_EMULATION | svchost : ==================================== ??????????????? catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-12-23 22:18:23 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: WDC_WD2500JS-55NCB1 rev.10.02E01 -> Harddisk0\DR0 -> \Device\00000063 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8616D1F8]<< 1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x860B9AB8] 3 CLASSPNP[0xF759CFD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000064[0x8614FAF0] 5 ACPI[0xF7308620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000063[0x860B9030] \Driver vata[0x8610EA30] -> IRP_MJ_CREATE -> 0x8616D1F8 kernel: MBR read successfully user & kernel MBR OK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] FirstRunDisabled = 1 (0x1) AntiVirusDisableNotify = 0 (0x0) FirewallDisableNotify = 0 (0x0) UpdatesDisableNotify = 0 (0x0) AntiVirusOverride = 0 (0x0) FirewallOverride = 0 (0x0) ?????????????????( EOF )??????????????????????? End of scan : 22:21:24.21

ancri · Answer

Salut,

Il n'a pas généré de rapport sur le bureau. J'ai regardé dans C et j'ai rien vu là-bas non plus.

Que faire ?

ancri · Answer

Bonjour, Excuse-moi de réagir si longtemps après. J'étais occupée par des tonnes de boulot. Voici le rapport : ?????????? List'em by g3n-h@ckm@n 2.1.2.8 ?????????? User : Yael (Administrators) Update on 22/12/2010 by g3n-h@ckm@n ::::: 22.30 Start at: 20:57:57 | 03/01/2011 AMD Athlon(tm) 64 Processor 3500+ Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Enabled AV : AVG Anti-Virus Free 8.5 [ Enabled | Updated ] A:\ -> ???? ????????? ?3 1/2 ????' C:\ -> ???? ???? ????? | 78.13 Go (9.07 Go free) | NTFS D:\ -> ???? ???? ????? | 154.75 Go (116.84 Go free) | NTFS E:\ -> ??????? | 699.7 Mo (0 Mo free) [Nouveau] | CDFS K:\ -> ???? ????? ????? ????? Sessions ????? C:\Documents and settings\Yael Boot: Normal ?????? Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer C:\WINDOWS\System32\smss.exe ---- 200 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ---- C:\WINDOWS\system32\csrss.exe ---- 3352 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\WINDOWS\system32\winlogon.exe ---- 2584 Ko ---- High ---- winlogon.exe ---- C:\WINDOWS\system32\services.exe ---- 1648 Ko ---- Normal ---- C:\WINDOWS\system32\services.exe ---- C:\WINDOWS\system32\lsass.exe ---- 2788 Ko ---- Normal ---- C:\WINDOWS\system32\lsass.exe ---- C:\WINDOWS\system32\svchost.exe ---- 2088 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k DcomLaunch ---- C:\WINDOWS\system32\svchost.exe ---- 1768 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k rpcss ---- C:\WINDOWS\System32\svchost.exe ---- 18808 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k netsvcs ---- C:\WINDOWS\system32\svchost.exe ---- 1804 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k NetworkService ---- C:\WINDOWS\system32\svchost.exe ---- 876 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\WINDOWS\system32\brsvc01a.exe ---- 72 Ko ---- Normal ---- C:\WINDOWS\system32\brsvc01a.exe ---- C:\WINDOWS\system32\brss01a.exe ---- 700 Ko ---- Normal ---- brss01a.exe ---- C:\WINDOWS\system32\spoolsv.exe ---- 1892 Ko ---- Normal ---- C:\WINDOWS\system32\spoolsv.exe ---- C:\WINDOWS\system32\svchost.exe ---- 256 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---- 2632 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---- AVG Technologies C:\WINDOWS\System32\svchost.exe ---- 188 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k eapsvcs ---- C:\Program Files\Java\jre6\bin\jqs.exe ---- 1404 Ko ---- Idle ---- C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf ---- Sun Microsystems, Inc. C:\WINDOWS\system32 vsvc32.exe ---- 1888 Ko ---- Normal ---- C:\WINDOWS\system32 vsvc32.exe ---- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 200 Ko ---- Normal ---- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- Microsoft Corporation C:\WINDOWS\system32\svchost.exe ---- 964 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k imgsvc ---- C:\PROGRA~1\AVG\AVG8\avgrsx.exe ---- 24932 Ko ---- Normal ---- avgrsx.exe ---- AVG Technologies C:\PROGRA~1\AVG\AVG8\avgemc.exe ---- 500 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgemc.exe ---- AVG Technologies C:\Program Files\AVG\AVG8\avgcsrvx.exe ---- 3488 Ko ---- Normal ---- /pipeName=cca4b239-4140-4006-804d-2702ebb9e21d /coreSdkOptions=0 /binaryPath=C:\Program Files\AVG\AVG8\ ---- AVG Technologies C:\WINDOWS\System32\alg.exe ---- 152 Ko ---- Normal ---- C:\WINDOWS\System32\alg.exe ---- C:\WINDOWS\Explorer.EXE ---- 13796 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- C:\WINDOWS\system32\ctfmon.exe ---- 924 Ko ---- Normal ---- C:\WINDOWS\system32\ctfmon.exe ---- C:\Program Files\Common Files\Teleca Shared\Generic.exe ---- 1240 Ko ---- Normal ---- C:\Program Files\Common Files\Teleca Shared\Generic.exe -Embedding ---- C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe ---- 792 Ko ---- Normal ---- C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe -Embedding ---- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe ---- 748 Ko ---- Normal ---- C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe ---- Microsoft Corporation C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- 1412 Ko ---- Normal ---- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe /PRODUCT:Reader /VERSION:9.0 /MODE:2 ---- Adobe Systems, Incorporated C:\Program Files\Brother\Brmfcmon\brmfcwnd.exe ---- 1284 Ko ---- Normal ---- C:\Program Files\Brother\Brmfcmon\brmfcwnd.exe Brother MFC-425CN USB Printer on USB001 ---- C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe ---- 596 Ko ---- Normal ---- BrMfcmon.exe USB001 Brother MFC-425CN USB Printer ---- C:\Program Files\Skype\Phone\Skype.exe ---- 43392 Ko ---- Normal ---- C:\Program Files\Skype\Phone\Skype.exe ---- Skype Technologies SA C:\Program Files\Skype\Plugin Manager\skypePM.exe ---- 3012 Ko ---- Normal ---- C:\Program Files\Skype\Plugin Manager\skypePM.exe /SILENT ---- EasyBits Software AS C:\Program Files\Outlook Express\msimn.exe ---- 12676 Ko ---- Normal ---- C:\Program Files\Outlook Express\msimn.exe ---- C:\WINDOWS\system32\msfeedssync.exe ---- 200 Ko ---- Normal ---- C:\WINDOWS\system32\msfeedssync.exe sync ---- C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe ---- 6556 Ko ---- Normal ---- C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe F:\g?rer les situations d'urgence\cn-33-sms.pdf ---- Adobe Systems, Incorporated C:\WINDOWS\system32\csrss.exe ---- 388 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\WINDOWS\system32\winlogon.exe ---- 2156 Ko ---- High ---- winlogon.exe ---- C:\WINDOWS\Explorer.EXE ---- 4760 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- C:\WINDOWS\system32\RUNDLL32.EXE ---- 360 Ko ---- Normal ---- C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- 340 Ko ---- Normal ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe ---- 840 Ko ---- Normal ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun ---- C:\PROGRA~1\AVG\AVG8\avgtray.exe ---- 616 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgtray.exe ---- AVG Technologies C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe ---- 908 Ko ---- Normal ---- C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions ---- C:\Program Files\QuickTime\qttask.exe ---- 332 Ko ---- Normal ---- C:\Program Files\QuickTime\qttask.exe -atboottime ---- C:\WINDOWS\system32\ctfmon.exe ---- 560 Ko ---- Normal ---- C:\WINDOWS\system32\ctfmon.exe ---- C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- 836 Ko ---- Normal ---- C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe ---- 464 Ko ---- Normal ---- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe Brother MFC-425CN /STARTUP ---- C:\PROGRA~1\MICROS~3 apimgr.exe ---- 1676 Ko ---- Normal ---- C:\PROGRA~1\MICROS~3 apimgr.exe -Embedding ---- Microsoft Corporation C:\PROGRA~1\AVG\AVG8\avgnsx.exe ---- 1168 Ko ---- Normal ---- avgnsx.exe ---- AVG Technologies C:\Program Files\Mozilla Firefox\firefox.exe ---- 74180 Ko ---- Normal ---- C:\Program Files\Mozilla Firefox\firefox.exe ---- Mozilla Corporation C:\WINDOWS\system32\cmd.exe ---- 3000 Ko ---- Normal ---- C:\WINDOWS\system32\cmd.exe /K List'em.bat ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 7224 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- C:\Program Files\List_Kill'em\pv.L_K ---- 2904 Ko ---- Normal ---- pv.L_K -o%f ---- %m Ko ---- %p ---- %l ---- %s ---- ?????????? Keys Run ?????????? [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MsnMsgr = C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe /background H/PC Connection Agent = C:\Program Files\Microsoft ActiveSync\wcescomm.exe ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe DAEMON Tools Lite = C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun Jing = C:\Program Files\TechSmith\Jing\Jing.exe Skype = C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit Alcmtr = ALCMTR.EXE SSBkgdUpdate = C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot PaperPort PTD = C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe IndexSearch = C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe SetDefPrt = C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe ControlCenter2.0 = C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun AVG8_TRAY = C:\PROGRA~1\AVG\AVG8\avgtray.exe Sony Ericsson PC Suite = C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions Adobe Reader Speed Launcher = C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe Adobe ARM = C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe QuickTime Task = C:\Program Files\QuickTime\qttask.exe -atboottime UserFaultCheck = %systemroot%\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ?????????? Other System Keys ?????????? [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun = 0 (0x0) NoDriveAutoRun = 3 (0x3) ??????????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] HonorAutoRunSetting = 1 (0x1) NoDriveAutoRun = 3 (0x3) NoDriveTypeAutoRun = 0 (0x0) ??????????????? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLS = ??????????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell = explorer.exe Userinit = C:\WINDOWS\System32\userinit.exe, ??????????????? [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\avgrsstarter] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dimsntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wlballoon] ??????????????? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} = ??????????????? [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Grisoft\AVG7\avginet.exe = C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe = C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgcc.exe = C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe C:\Program Files\Messenger\msmsgs.exe = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger C:\Program Files\eMule\emule.exe = C:\Program Files\eMule\emule.exe:*:Enabled:eMule C:\PVSW\Bin\w3dbsmgr.exe = C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager C:\Program Files\AVG\AVG8\avgupd.exe = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe C:\Program Files\AVG\AVG8\avgemc.exe = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe C:\Program Files\ICQ6\ICQ.exe = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 C:\Program Files\Mozilla Firefox\firefox.exe = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox C:\Program Files\ICQ6.5\ICQ.exe = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\Skype\Plugin Manager\skypePM.exe = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager C:\Program Files\ICQ7.2\ICQ.exe = C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 C:\Program Files\ICQ7.2\aolload.exe = C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe C:\Program Files\Skype\Phone\Skype.exe = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\ICQ7.2\ICQ.exe = C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 C:\Program Files\ICQ7.2\aolload.exe = C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe ?????????? ActivX | COM ?????????? [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{02BCC737-B171-4746-94C9-0D8A0B2C0089}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7530BFB8-7293-4D34-9923-61A11451AFC5}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] ??????????????? [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2755948A-38EE-4B76-A42B-4A2BF463DD6F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ECD292A0-0347-4244-8C24-5DBCE990FB40}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}] ?????????? BHO ?????????? [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00e71626-0bef-11dc-8314-0800200c9a66}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] ?????????? DNS ?????????? Description: Gigabyte GN-WB01GS USB WLAN Card #3 - ????-????? ?? ????? ???? DNS Server Search Order: 10.0.0.138 Description: Gigabyte GN-WB01GS USB WLAN Card #3 - ????-????? ?? ????? ???? DNS Server Search Order: 10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 ?????????? Internet Explorer ?????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr/?ocid=iehp Local Page = C:\WINDOWS\system32\blank.htm Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.google.com/?gws_rd=ssl Local Page = C:\WINDOWS\system32\blank.htm Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ????? Proxy Internet Explorer [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] ProxyEnable = 0 (0x0) ?????????? Safemode ?????????? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !! ?????????? Atapi.sys ?????????? [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [MD5.9f3a2f5aa6875c72bf062c712cfa2674] - C:\WINDOWS\ServicePackFiles\i386\atapi.sys [MD5.9f3a2f5aa6875c72bf062c712cfa2674] - C:\WINDOWS\system32\drivers\atapi.sys [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys ????? Reference Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP3 : 7A62A6C8303C9D026DD926F397B2FB57 Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Win XP_64 : 72C77044943340964FA513B92D6D6874 Win XP_64_SP2 : 7A1814D0D112F50F828E25557A1ED29F Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 338c86357871c167a96ab976519bf59e Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ?????????? Explorer ?????????? [MD5.468d2a8b5f62e25f81c3150263d8e558] - C:\WINDOWS\explorer.exe [MD5.1fb3ee7c4d70aace3063a1e1e0ff7fcf] - C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [MD5.7c66ce267edd66607b2275fe44235a31] - C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [MD5.a275bb2b4cf43625b9f38ad312f5c5a6] - C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [MD5.468d2a8b5f62e25f81c3150263d8e558] - C:\WINDOWS\ServicePackFiles\i386\explorer.exe ?????????? Winlogon ?????????? [MD5.e589065c107815a4f5db393973a2b9b0] - C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [MD5.9dc7d2c3a0956a9ff82c4dd5596613a8] - C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [MD5.9dc7d2c3a0956a9ff82c4dd5596613a8] - C:\WINDOWS\system32\winlogon.exe ?????????? Wininit ?????????? ?????????? SVC | svchost ?????????? ?????????? IFEO | debugger ?????????? ?????????? Mountpoints2 ?????????? HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{366c862a-0894-11de-b287-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{366c862a-0894-11de-b287-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aebbb0d9-0659-11dd-b1f3-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aebbb0d9-0659-11dd-b1f3-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51843fb-2648-11dd-b206-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51843fb-2648-11dd-b206-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b742caec-fc51-11df-8753-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b742caec-fc51-11df-8753-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8910409-08bb-11df-86c8-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8910409-08bb-11df-86c8-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d50a1067-0c99-11dd-b1f9-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d50a1067-0c99-11dd-b1f9-001485379c1c}\shell\Autoplay ?????????? Services ?????????? ? Ndisuio => Start : 3 ( OK = 3 ) ? EapHost => Start : 2 ( OK = 2 ) ? Ip6Fw => Start : 2 ( OK = 2 ) ? SharedAccess => Start : 2 ( OK = 2 ) ? wuauserv => Start : 2 ( OK = 2 ) ? wscsvc => Start : 2 ( OK = 2 ) ?????????? First Scan ?????????? ?????????? Registry ?????????? [@ = ] [HKEY_CURRENT_USER\software\AC3filter] [HKEY_CURRENT_USER\software\Adobe] [HKEY_CURRENT_USER\software\Ahead] [HKEY_CURRENT_USER\software\America Online] [HKEY_CURRENT_USER\software\AppDataLow] [HKEY_CURRENT_USER\software\Avg] [HKEY_CURRENT_USER\software\BitDefender] [HKEY_CURRENT_USER\software\Brother] [HKEY_CURRENT_USER\software\Clients] [HKEY_CURRENT_USER\software\CoreVorbis] [HKEY_CURRENT_USER\software\Cyberlink] [HKEY_CURRENT_USER\software\Cygnus Solutions] [HKEY_CURRENT_USER\software\DivXNetworks] [HKEY_CURRENT_USER\software\DownloadCenter] [HKEY_CURRENT_USER\software\Druide informatique inc.] [HKEY_CURRENT_USER\software\DT Soft] [HKEY_CURRENT_USER\software\FUJIFILM] [HKEY_CURRENT_USER\software\Gabest] [HKEY_CURRENT_USER\software\GNU] [HKEY_CURRENT_USER\software\Google] [HKEY_CURRENT_USER\software\GSpot Appliance Corp] [HKEY_CURRENT_USER\software\Haali] [HKEY_CURRENT_USER\software\ICQToolbar] [HKEY_CURRENT_USER\software\IM Providers] [HKEY_CURRENT_USER\software\Intel] [HKEY_CURRENT_USER\software\JavaSoft] [HKEY_CURRENT_USER\software\Local AppWizard-Generated Applications] [HKEY_CURRENT_USER\software\Macromedia] [HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware] [HKEY_CURRENT_USER\software\Microsoft] [HKEY_CURRENT_USER\software\Mozilla] [HKEY_CURRENT_USER\software\MozillaPlugins] [HKEY_CURRENT_USER\software\Netscape] [HKEY_CURRENT_USER\software\NVIDIA Corporation] [HKEY_CURRENT_USER\software\ODBC] [HKEY_CURRENT_USER\software\Paint.NET] [HKEY_CURRENT_USER\software\Philipp Winterberg] [HKEY_CURRENT_USER\software\Piriform] [HKEY_CURRENT_USER\software\Policies] [HKEY_CURRENT_USER\software\Praxisoft] [HKEY_CURRENT_USER\software\Realtek] [HKEY_CURRENT_USER\software\Samsung] [HKEY_CURRENT_USER\software\Samsung PC Studio] [HKEY_CURRENT_USER\software\ScanSoft] [HKEY_CURRENT_USER\software\Skype] [HKEY_CURRENT_USER\software\SkypeApps] [HKEY_CURRENT_USER\software\smarttip] [HKEY_CURRENT_USER\software\Sony Ericsson] [HKEY_CURRENT_USER\software\Sysinternals] [HKEY_CURRENT_USER\software\TechSmith] [HKEY_CURRENT_USER\software\Teleca] [HKEY_CURRENT_USER\software\VB and VBA Program Settings] [HKEY_CURRENT_USER\software\Windows Live] [HKEY_CURRENT_USER\software\Windows Live Writer] [HKEY_CURRENT_USER\software\XTTB00001] [HKEY_CURRENT_USER\software\YahooPartnerToolbar] [HKEY_CURRENT_USER\software\?? ?? ???? ????? ??? ?? ????] [HKEY_CURRENT_USER\software\Classes] [HKEY_LOCAL_MACHINE\software\14919ea49a8f3b4aa3cf1058d9a64cec] [HKEY_LOCAL_MACHINE\software\781] [HKEY_LOCAL_MACHINE\software\Adobe] [HKEY_LOCAL_MACHINE\software\Ahead] [HKEY_LOCAL_MACHINE\software\AMD] [HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.] [HKEY_LOCAL_MACHINE\software\AVG] [HKEY_LOCAL_MACHINE\software\Brother] [HKEY_LOCAL_MACHINE\software\C07ft5Y] [HKEY_LOCAL_MACHINE\software\CDDB] [HKEY_LOCAL_MACHINE\software\Classes] [HKEY_LOCAL_MACHINE\software\Clever Age] [HKEY_LOCAL_MACHINE\software\Clients] [HKEY_LOCAL_MACHINE\software\Codec Tweak Tool] [HKEY_LOCAL_MACHINE\software\Creative Software] [HKEY_LOCAL_MACHINE\software\Cyberlink] [HKEY_LOCAL_MACHINE\software\Cygnus Solutions] [HKEY_LOCAL_MACHINE\software\DivXNetworks] [HKEY_LOCAL_MACHINE\software\Druide informatique inc.] [HKEY_LOCAL_MACHINE\software\DT Soft] [HKEY_LOCAL_MACHINE\software\Ericsson] [HKEY_LOCAL_MACHINE\software\fce] [HKEY_LOCAL_MACHINE\software\ffffffff] [HKEY_LOCAL_MACHINE\software\FolderIcon XP] [HKEY_LOCAL_MACHINE\software\FUJI PHOTO FILM CO.,LTD.] [HKEY_LOCAL_MACHINE\software\FullCircle] [HKEY_LOCAL_MACHINE\software\Gabest] [HKEY_LOCAL_MACHINE\software\Gemplus] [HKEY_LOCAL_MACHINE\software\GNU] [HKEY_LOCAL_MACHINE\software\Google] [HKEY_LOCAL_MACHINE\software\HaaliMkx] [HKEY_LOCAL_MACHINE\software\HmLmbd] [HKEY_LOCAL_MACHINE\software\ICQ] [HKEY_LOCAL_MACHINE\software\InstallShield] [HKEY_LOCAL_MACHINE\software\Intel] [HKEY_LOCAL_MACHINE\software\InterVideo] [HKEY_LOCAL_MACHINE\software\JavaSoft] [HKEY_LOCAL_MACHINE\software\KLCodecPack] [HKEY_LOCAL_MACHINE\software\Macromedia] [HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware] [HKEY_LOCAL_MACHINE\software\MCCI] [HKEY_LOCAL_MACHINE\software\MeaningData.com] [HKEY_LOCAL_MACHINE\software\Microsoft] [HKEY_LOCAL_MACHINE\software\MimarSinan] [HKEY_LOCAL_MACHINE\software\Mirabilis] [HKEY_LOCAL_MACHINE\software\MobiPocket.com] [HKEY_LOCAL_MACHINE\software\Mozilla] [HKEY_LOCAL_MACHINE\software\mozilla.org] [HKEY_LOCAL_MACHINE\software\MozillaPlugins] [HKEY_LOCAL_MACHINE\software\NVIDIA Corporation] [HKEY_LOCAL_MACHINE\software\ODBC] [HKEY_LOCAL_MACHINE\software\Paint.NET] [HKEY_LOCAL_MACHINE\software\Pervasive Software] [HKEY_LOCAL_MACHINE\software\Philipp Winterberg] [HKEY_LOCAL_MACHINE\software\Phonemonitor] [HKEY_LOCAL_MACHINE\software\Piriform] [HKEY_LOCAL_MACHINE\software\Policies] [HKEY_LOCAL_MACHINE\software\Program Groups] [HKEY_LOCAL_MACHINE\software\Realtek] [HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.] [HKEY_LOCAL_MACHINE\software\RegisteredApplications] [HKEY_LOCAL_MACHINE\software\S3R521] [HKEY_LOCAL_MACHINE\software\Safer Networking Limited] [HKEY_LOCAL_MACHINE\software\Samsung] [HKEY_LOCAL_MACHINE\software\Samsung Electronics Co., Ltd.] [HKEY_LOCAL_MACHINE\software\ScanSoft] [HKEY_LOCAL_MACHINE\software\Schlumberger] [HKEY_LOCAL_MACHINE\software\Secure] [HKEY_LOCAL_MACHINE\software\Skype] [HKEY_LOCAL_MACHINE\software\Sony Ericsson] [HKEY_LOCAL_MACHINE\software\TechSmith] [HKEY_LOCAL_MACHINE\software\Teleca] [HKEY_LOCAL_MACHINE\software\Visioneer] [HKEY_LOCAL_MACHINE\software\WebUpdate] [HKEY_LOCAL_MACHINE\software\Windows] [HKEY_LOCAL_MACHINE\software\Windows 3.1 Migration Status] [HKEY_LOCAL_MACHINE\software\Wise Solutions] [HKEY_LOCAL_MACHINE\software\Zeon] ?????????? Files/folders ?????????? ?????????? Keys : FEATURE_BROWSER_EMULATION | svchost : ==================================== ??????????????? catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-03 21:14:26 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: WDC_WD2500JS-55NCB1 rev.10.02E01 -> Harddisk0\DR0 -> \Device\00000063 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8616D1F8]<< 1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x860B9AB8] 3 CLASSPNP[0xF759CFD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000064[0x8614FAF0] 5 ACPI[0xF7308620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000063[0x860B9030] \Driver vata[0x8610EA30] -> IRP_MJ_CREATE -> 0x8616D1F8 kernel: MBR read successfully user & kernel MBR OK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] FirstRunDisabled = 1 (0x1) AntiVirusDisableNotify = 0 (0x0) FirewallDisableNotify = 0 (0x0) UpdatesDisableNotify = 0 (0x0) AntiVirusOverride = 0 (0x0) FirewallOverride = 0 (0x0) ?????????????????( EOF )??????????????????????? End of scan : 21:16:11.68

ancri · Answer

Je trouve qu'il rame encore un peu. Peut-être qu'il se fait vieux ?

gen-hackman · Answer

salut juste une question :

tu es sur de ne pas avoir Kill'em.txt (le ".txt" peut ne pas apparaitre ) quelque part ?

dans C:_ ou sur le bureau ?

ancri · Answer

Non, même après une recherche avec le toutou de windows je ne trouve rien.

gen-hackman · Answer

ok c'est normal en faite il a rien fait car tu n'as pas suivi la consigne de desactiver tes protections pendant son utilisation :)

ancri · Answer

Je croyais les avoir désactivées, je ne vois pas avg dans la barre des tâches. 

Faut que je recommence le Search ou le CLean ?

gen-hackman · Answer

si ne vois pas AVG dans la barre des taches , redemarre il va reapparaitre et tu pourras le stopper

le Clean

ancri · Answer

Salut Jacques et gen-hackman

J'avais effectivement pas du tout désactivé AVG la première fois, mais seulement fermé le Icon-tray ! C'est futé ça ! 

Voici donc le rapport tant convoité : 

########## DelFix - Nettoyeur d'outils de d?sinfection ##########
#
# DelFix v6.7 - Rapport cr?? le 21/12/2010 ? 08:01
# Mis ? jour le 28/11/10 ? 13h30 par Xplode
# Syst?me d'exploitation : Microsoft Windows XP (32 bits) [Version 5.1.2600] Service Pack 3
# Nom d'utilisateur : Yael - COMPUTER-XP (Administrateur)
# Ex?cut? depuis : C:\Documents and Settings\Yael\????? ??????\DelFix.exe
# Option [Suppression]


~~~~~~ Dossier(s) ~~~~~~

Supprim? : C:\USBFix
Supprim? : C:\RSIT
Supprim? : C:\Kill'em
Supprim? : C:\Program Files\Ad-Remover
Supprim? : C:\Program Files\List_Kill'em
Supprim? : C:\Program Files\ZHPDiag
Supprim? : C:\Program Files	rend micro

~~~~~~ Fichier(s) ~~~~~~

Supprim? : C:\List'em.txt
Supprim? : C:\UsbFix.txt
Supprim? : C:\UsbFix_Upload_Me_COMPUTER-XP.zip
Supprim? : C:\Ad-Report-CLEAN[1].txt
Supprim? : C:\Ad-Report-SCAN[1].txt
Supprim? : C:\TCleaner.txt
Supprim? : C:\WINDOWS\System32	mp.reg
Supprim? : C:\WINDOWS\System32	mp.txt
Supprim? : C:\Documents and Settings\Yael\????? ??????\List_Killem_Install.exe
Supprim? : C:\Documents and Settings\Yael\????? ??????\UsbFix.exe
Supprim? : C:\Documents and Settings\Yael\????? ??????\AD-R.lnk
Supprim? : C:\Documents and Settings\Yael\????? ??????\ZHPDiag.Txt
Supprim? : C:\Documents and Settings\Yael\????? ??????\List_Kill'em.lnk

~~~~~~ Registre ~~~~~~

Cl? Supprim?e : HKCU\SOFTWARE\Ad-Remover
Cl? Supprim?e : HKCU\SOFTWARE\USBFix
Cl? Supprim?e : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\List_Kill'em
Cl? Supprim?e : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ZHP
Cl? Supprim?e : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\HijackThis
Cl? Supprim?e : HKLM\Software\OldTimer Tools
Cl? Supprim?e : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Remover
Cl? Supprim?e : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\USBFix

~~~~~~ Autre ~~~~~~

-> ESET Online Scanner ... D?sinstall? avec succ?s
-> BitDefender Online Scanner ... D?sinstall? avec succ?s

########## EOF - "C:\DelFixSuppr.txt" - [2251 octets] ##########

ancri · Answer

Quel imbé... je fait. J'ai pas lancé Delfix, j'ai juste cru que c'était le rapport, tellement j'étais contente de voir un rapport .txt sur le bureau ! 

Mais en tout cas, y a toujours pas de rapport Killem. 

Il s'arrête subitement et disparaît sans laisser de rapport.

ancri · Answer

Je suis pas sûre que je t'ai compris là. 
J'ai pas lancé Delfix. J'ai seulement posté le rapport par erreur. Delfix, je l'ai lancé y a dix jours et son rapport était encore sur le bureau. Du coup, je l'ai posté par erreur. 
Donc Listkillem il est toujours installé. Et il est censé avoir fait son boulot de Clean. Mais il n'a pas généré de rapport.

ancri · Answer

Voilà, j'espère que c'est bon cette fois ?????????? List'em by g3n-h@ckm@n 2.1.2.8 ?????????? User : Yael (Administrators) Update on 22/12/2010 by g3n-h@ckm@n ::::: 22.30 Start at: 07:14:12 | 06/01/2011 AMD Athlon(tm) 64 Processor 3500+ Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Disabled AV : AVG Anti-Virus Free 8.5 [ (!) Disabled | Updated ] A:\ -> ???? ????????? ?3 1/2 ????' C:\ -> ???? ???? ????? | 78.13 Go (9.21 Go free) | NTFS D:\ -> ???? ???? ????? | 154.75 Go (116.84 Go free) | NTFS E:\ -> ??????? | 699.7 Mo (0 Mo free) [Nouveau] | CDFS ????? Sessions ????? C:\Documents and settings\Yael Boot: Normal ?????? Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer C:\WINDOWS\System32\smss.exe ---- 416 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ---- C:\WINDOWS\system32\csrss.exe ---- 5008 Ko ---- Normal ---- C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ---- C:\WINDOWS\system32\winlogon.exe ---- 1524 Ko ---- High ---- winlogon.exe ---- C:\WINDOWS\system32\services.exe ---- 3704 Ko ---- Normal ---- C:\WINDOWS\system32\services.exe ---- C:\WINDOWS\system32\lsass.exe ---- 1908 Ko ---- Normal ---- C:\WINDOWS\system32\lsass.exe ---- C:\WINDOWS\system32\svchost.exe ---- 5404 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k DcomLaunch ---- C:\WINDOWS\system32\svchost.exe ---- 4548 Ko ---- Normal ---- C:\WINDOWS\system32\svchost -k rpcss ---- C:\WINDOWS\System32\svchost.exe ---- 29296 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k netsvcs ---- C:\WINDOWS\system32\svchost.exe ---- 3960 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k NetworkService ---- C:\WINDOWS\system32\svchost.exe ---- 6128 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\WINDOWS\system32\brsvc01a.exe ---- 1480 Ko ---- Normal ---- C:\WINDOWS\system32\brsvc01a.exe ---- C:\WINDOWS\system32\brss01a.exe ---- 2228 Ko ---- Normal ---- brss01a.exe ---- C:\WINDOWS\system32\spoolsv.exe ---- 5292 Ko ---- Normal ---- C:\WINDOWS\system32\spoolsv.exe ---- C:\WINDOWS\system32\svchost.exe ---- 3912 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k LocalService ---- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---- 1972 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---- AVG Technologies C:\WINDOWS\System32\svchost.exe ---- 3892 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k eapsvcs ---- C:\Program Files\Java\jre6\bin\jqs.exe ---- 1552 Ko ---- Idle ---- C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf ---- Sun Microsystems, Inc. C:\WINDOWS\system32 vsvc32.exe ---- 3620 Ko ---- Normal ---- C:\WINDOWS\system32 vsvc32.exe ---- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 8276 Ko ---- Normal ---- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- Microsoft Corporation C:\WINDOWS\system32\svchost.exe ---- 4600 Ko ---- Normal ---- C:\WINDOWS\system32\svchost.exe -k imgsvc ---- C:\PROGRA~1\AVG\AVG8\avgemc.exe ---- 576 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgemc.exe ---- AVG Technologies C:\PROGRA~1\AVG\AVG8\avgrsx.exe ---- 220 Ko ---- Normal ---- avgrsx.exe ---- AVG Technologies C:\Program Files\AVG\AVG8\avgcsrvx.exe ---- 10532 Ko ---- Normal ---- /pipeName=8b7a6c07-d3c6-432c-9141-88de4ddd03c3 /coreSdkOptions=0 /binaryPath=C:\Program Files\AVG\AVG8\ ---- AVG Technologies C:\WINDOWS\System32\alg.exe ---- 3768 Ko ---- Normal ---- C:\WINDOWS\System32\alg.exe ---- C:\PROGRA~1\AVG\AVG8\avgnsx.exe ---- 3260 Ko ---- Normal ---- avgnsx.exe ---- AVG Technologies C:\WINDOWS\Explorer.EXE ---- 31136 Ko ---- Normal ---- C:\WINDOWS\Explorer.EXE ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- 2956 Ko ---- Normal ---- C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe ---- 7520 Ko ---- Normal ---- C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun ---- C:\PROGRA~1\AVG\AVG8\avgtray.exe ---- 1004 Ko ---- Normal ---- C:\PROGRA~1\AVG\AVG8\avgtray.exe ---- AVG Technologies C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe ---- 5624 Ko ---- Normal ---- C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions ---- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- 8600 Ko ---- Normal ---- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- Adobe Systems, Incorporated C:\Program Files\QuickTime\qttask.exe ---- 2580 Ko ---- Normal ---- C:\Program Files\QuickTime\qttask.exe -atboottime ---- C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe ---- 53180 Ko ---- Normal ---- C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe /background ---- Microsoft Corporation C:\Program Files\Microsoft ActiveSync\wcescomm.exe ---- 4904 Ko ---- Normal ---- C:\Program Files\Microsoft ActiveSync\wcescomm.exe ---- Microsoft Corporation C:\WINDOWS\system32\ctfmon.exe ---- 3504 Ko ---- Normal ---- C:\WINDOWS\system32\ctfmon.exe ---- C:\Program Files\DAEMON Tools Lite\DTLite.exe ---- 9236 Ko ---- Normal ---- C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun ---- DT Soft Ltd C:\Program Files\TechSmith\Jing\Jing.exe ---- 37336 Ko ---- Normal ---- C:\Program Files\TechSmith\Jing\Jing.exe ---- TechSmith Corporation C:\Program Files\Skype\Phone\Skype.exe ---- 96404 Ko ---- Normal ---- C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized ---- Skype Technologies SA C:\PROGRA~1\MICROS~3 apimgr.exe ---- 4836 Ko ---- Normal ---- C:\PROGRA~1\MICROS~3 apimgr.exe -Embedding ---- Microsoft Corporation C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- 4240 Ko ---- Normal ---- C:\Program Files\FinePixViewerS\QuickDCF2.exe ---- C:\PVSW\Bin\w3dbsmgr.exe ---- 11516 Ko ---- Normal ---- C:\PVSW\Bin\w3dbsmgr.exe -SRDE ---- C:\Program Files\Skype\Plugin Manager\skypePM.exe ---- 20492 Ko ---- Normal ---- C:\Program Files\Skype\Plugin Manager\skypePM.exe /SILENT ---- EasyBits Software AS C:\Program Files\Windows Live\Contacts\wlcomm.exe ---- 25340 Ko ---- Normal ---- C:\Program Files\Windows Live\Contacts\wlcomm.exe -Embedding ---- Microsoft Corporation C:\Program Files\Mozilla Firefox\firefox.exe ---- 226620 Ko ---- Normal ---- C:\Program Files\Mozilla Firefox\firefox.exe ---- Mozilla Corporation C:\Program Files\Outlook Express\msimn.exe ---- 12008 Ko ---- Normal ---- C:\Program Files\Outlook Express\msimn.exe ---- C:\Program Files\Common Files\Teleca Shared\Generic.exe ---- 9004 Ko ---- Normal ---- C:\Program Files\Common Files\Teleca Shared\Generic.exe -Embedding ---- C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe ---- 7080 Ko ---- Normal ---- C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe -Embedding ---- C:\Program Files\AVG\AVG8\avgui.exe ---- 4684 Ko ---- Normal ---- C:\Program Files\AVG\AVG8\avgui.exe ---- AVG Technologies C:\WINDOWS\system32\wscntfy.exe ---- 2820 Ko ---- Normal ---- C:\WINDOWS\system32\wscntfy.exe ---- C:\WINDOWS\system32 undll32.exe ---- 6700 Ko ---- Normal ---- C:\WINDOWS\system32 undll32.exe Shell32.dll,Control_RunDLL wscui.cpl ---- C:\WINDOWS\System32\svchost.exe ---- 3620 Ko ---- Normal ---- C:\WINDOWS\System32\svchost.exe -k HTTPFilter ---- C:\WINDOWS\system32\cmd.exe ---- 2992 Ko ---- Normal ---- C:\WINDOWS\system32\cmd.exe /K List'em.bat ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- 6964 Ko ---- Normal ---- C:\WINDOWS\system32\wbem\wmiprvse.exe ---- C:\Program Files\List_Kill'em\pv.L_K ---- 2896 Ko ---- Normal ---- pv.L_K -o%f ---- %m Ko ---- %p ---- %l ---- %s ---- ?????????? Keys Run ?????????? [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MsnMsgr = C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe /background H/PC Connection Agent = C:\Program Files\Microsoft ActiveSync\wcescomm.exe ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe DAEMON Tools Lite = C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun Jing = C:\Program Files\TechSmith\Jing\Jing.exe Skype = C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit Alcmtr = ALCMTR.EXE SSBkgdUpdate = C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot PaperPort PTD = C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe IndexSearch = C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe SetDefPrt = C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe ControlCenter2.0 = C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun AVG8_TRAY = C:\PROGRA~1\AVG\AVG8\avgtray.exe Sony Ericsson PC Suite = C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions Adobe Reader Speed Launcher = C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe Adobe ARM = C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe QuickTime Task = C:\Program Files\QuickTime\qttask.exe -atboottime UserFaultCheck = %systemroot%\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ?????????? Other System Keys ?????????? [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun = 0 (0x0) NoDriveAutoRun = 3 (0x3) ??????????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] HonorAutoRunSetting = 1 (0x1) NoDriveAutoRun = 3 (0x3) NoDriveTypeAutoRun = 0 (0x0) ??????????????? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLS = ??????????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell = explorer.exe Userinit = C:\WINDOWS\System32\userinit.exe, ??????????????? [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\avgrsstarter] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dimsntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wlballoon] ??????????????? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} = ??????????????? [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Messenger\msmsgs.exe = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger C:\Program Files\eMule\emule.exe = C:\Program Files\eMule\emule.exe:*:Enabled:eMule C:\PVSW\Bin\w3dbsmgr.exe = C:\PVSW\Bin\w3dbsmgr.exe:*:Enabled:Database Service Manager C:\Program Files\ICQ6\ICQ.exe = C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6 C:\Program Files\Mozilla Firefox\firefox.exe = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox C:\Program Files\ICQ6.5\ICQ.exe = C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\Skype\Plugin Manager\skypePM.exe = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager C:\Program Files\ICQ7.2\ICQ.exe = C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 C:\Program Files\ICQ7.2\aolload.exe = C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe C:\Program Files\Skype\Phone\Skype.exe = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype C:\Program Files\Grisoft\AVG7\avgamsvr.exe = C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgcc.exe = C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe C:\Program Files\AVG\AVG8\avgemc.exe = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe C:\Program Files\Grisoft\AVG7\avginet.exe = C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe C:\Program Files\AVG\AVG8\avgupd.exe = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\Windows Live\Messenger\wlcsdk.exe = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call C:\Program Files\Microsoft ActiveSync apimgr.exe = C:\Program Files\Microsoft ActiveSync apimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager C:\Program Files\Microsoft ActiveSync\wcescomm.exe = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager C:\Program Files\Microsoft ActiveSync\WCESMgr.exe = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application C:\Program Files\Windows Live\Messenger\msnmsgr.exe = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare C:\Program Files\ICQ7.2\ICQ.exe = C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 C:\Program Files\ICQ7.2\aolload.exe = C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe ?????????? ActivX | COM ?????????? [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{02BCC737-B171-4746-94C9-0D8A0B2C0089}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{7530BFB8-7293-4D34-9923-61A11451AFC5}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}] [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}] ??????????????? [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Base Smart Card Crypto Provider Package] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2755948A-38EE-4B76-A42B-4A2BF463DD6F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ECD292A0-0347-4244-8C24-5DBCE990FB40}] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EF289A85-8E57-408d-BE47-73B55609861A}] ?????????? BHO ?????????? [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{00e71626-0bef-11dc-8314-0800200c9a66}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] ?????????? DNS ?????????? Description: Gigabyte GN-WB01GS USB WLAN Card #3 - ????-????? ?? ????? ???? DNS Server Search Order: 10.0.0.138 Description: Gigabyte GN-WB01GS USB WLAN Card #3 - ????-????? ?? ????? ???? DNS Server Search Order: 10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{23F59AC1-5FAB-483F-9601-71D24BBE3611}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{88E04EEF-23FA-42FF-BB09-2E6A4C48B754}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\..\{B282434E-4BC0-4005-8464-046C9796A4F1}: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138 ?????????? Internet Explorer ?????????? [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.msn.com/fr-fr/?ocid=iehp Local Page = C:\WINDOWS\system32\blank.htm Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page = https://www.google.com/?gws_rd=ssl Local Page = C:\WINDOWS\system32\blank.htm Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ????? Proxy Internet Explorer [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] ProxyEnable = 0 (0x0) ?????????? Safemode ?????????? HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !! ?????????? Atapi.sys ?????????? [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [MD5.9f3a2f5aa6875c72bf062c712cfa2674] - C:\WINDOWS\ServicePackFiles\i386\atapi.sys [MD5.9f3a2f5aa6875c72bf062c712cfa2674] - C:\WINDOWS\system32\drivers\atapi.sys [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys [MD5.cdfe4411a69c224bd1d11b2da92dac51] - C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys ????? Reference Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe Win 2000_SP3 : 7A62A6C8303C9D026DD926F397B2FB57 Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867 Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Win XP_64 : 72C77044943340964FA513B92D6D6874 Win XP_64_SP2 : 7A1814D0D112F50F828E25557A1ED29F Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 338c86357871c167a96ab976519bf59e Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ?????????? Explorer ?????????? [MD5.468d2a8b5f62e25f81c3150263d8e558] - C:\WINDOWS\explorer.exe [MD5.1fb3ee7c4d70aace3063a1e1e0ff7fcf] - C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [MD5.7c66ce267edd66607b2275fe44235a31] - C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [MD5.a275bb2b4cf43625b9f38ad312f5c5a6] - C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [MD5.468d2a8b5f62e25f81c3150263d8e558] - C:\WINDOWS\ServicePackFiles\i386\explorer.exe ?????????? Winlogon ?????????? [MD5.e589065c107815a4f5db393973a2b9b0] - C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [MD5.9dc7d2c3a0956a9ff82c4dd5596613a8] - C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [MD5.9dc7d2c3a0956a9ff82c4dd5596613a8] - C:\WINDOWS\system32\winlogon.exe ?????????? Wininit ?????????? ?????????? SVC | svchost ?????????? ?????????? IFEO | debugger ?????????? ?????????? Mountpoints2 ?????????? HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{366c862a-0894-11de-b287-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{366c862a-0894-11de-b287-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{766a9a81-676a-11dd-b237-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{766a9a81-676a-11dd-b237-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aebbb0d9-0659-11dd-b1f3-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aebbb0d9-0659-11dd-b1f3-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51843fb-2648-11dd-b206-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b51843fb-2648-11dd-b206-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8910409-08bb-11df-86c8-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8910409-08bb-11df-86c8-001485379c1c}\shell\Autoplay HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d50a1067-0c99-11dd-b1f9-001485379c1c}\shell @ = None HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d50a1067-0c99-11dd-b1f9-001485379c1c}\shell\Autoplay ?????????? Services ?????????? ? Ndisuio => Start : 3 ( OK = 3 ) ? EapHost => Start : 2 ( OK = 2 ) ? Ip6Fw => Start : 2 ( OK = 2 ) ? SharedAccess => Start : 2 ( OK = 2 ) ? wuauserv => Start : 2 ( OK = 2 ) ? wscsvc => Start : 2 ( OK = 2 ) ?????????? First Scan ?????????? ?????????? Registry ?????????? [@ = ] [HKEY_CURRENT_USER\software\AC3filter] [HKEY_CURRENT_USER\software\Adobe] [HKEY_CURRENT_USER\software\Ahead] [HKEY_CURRENT_USER\software\America Online] [HKEY_CURRENT_USER\software\AppDataLow] [HKEY_CURRENT_USER\software\Avg] [HKEY_CURRENT_USER\software\BitDefender] [HKEY_CURRENT_USER\software\Brother] [HKEY_CURRENT_USER\software\Clients] [HKEY_CURRENT_USER\software\CoreVorbis] [HKEY_CURRENT_USER\software\Cyberlink] [HKEY_CURRENT_USER\software\Cygnus Solutions] [HKEY_CURRENT_USER\software\DivXNetworks] [HKEY_CURRENT_USER\software\DownloadCenter] [HKEY_CURRENT_USER\software\Druide informatique inc.] [HKEY_CURRENT_USER\software\DT Soft] [HKEY_CURRENT_USER\software\FUJIFILM] [HKEY_CURRENT_USER\software\Gabest] [HKEY_CURRENT_USER\software\GNU] [HKEY_CURRENT_USER\software\Google] [HKEY_CURRENT_USER\software\GSpot Appliance Corp] [HKEY_CURRENT_USER\software\Haali] [HKEY_CURRENT_USER\software\ICQToolbar] [HKEY_CURRENT_USER\software\IM Providers] [HKEY_CURRENT_USER\software\Intel] [HKEY_CURRENT_USER\software\JavaSoft] [HKEY_CURRENT_USER\software\Local AppWizard-Generated Applications] [HKEY_CURRENT_USER\software\Macromedia] [HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware] [HKEY_CURRENT_USER\software\Microsoft] [HKEY_CURRENT_USER\software\Mozilla] [HKEY_CURRENT_USER\software\MozillaPlugins] [HKEY_CURRENT_USER\software\Netscape] [HKEY_CURRENT_USER\software\NVIDIA Corporation] [HKEY_CURRENT_USER\software\ODBC] [HKEY_CURRENT_USER\software\Paint.NET] [HKEY_CURRENT_USER\software\Philipp Winterberg] [HKEY_CURRENT_USER\software\Piriform] [HKEY_CURRENT_USER\software\Policies] [HKEY_CURRENT_USER\software\Praxisoft] [HKEY_CURRENT_USER\software\Realtek] [HKEY_CURRENT_USER\software\Samsung] [HKEY_CURRENT_USER\software\Samsung PC Studio] [HKEY_CURRENT_USER\software\ScanSoft] [HKEY_CURRENT_USER\software\Skype] [HKEY_CURRENT_USER\software\SkypeApps] [HKEY_CURRENT_USER\software\smarttip] [HKEY_CURRENT_USER\software\Sony Ericsson] [HKEY_CURRENT_USER\software\Sysinternals] [HKEY_CURRENT_USER\software\TechSmith] [HKEY_CURRENT_USER\software\Teleca] [HKEY_CURRENT_USER\software\VB and VBA Program Settings] [HKEY_CURRENT_USER\software\Windows Live] [HKEY_CURRENT_USER\software\Windows Live Writer] [HKEY_CURRENT_USER\software\XTTB00001] [HKEY_CURRENT_USER\software\YahooPartnerToolbar] [HKEY_CURRENT_USER\software\?? ?? ???? ????? ??? ?? ????] [HKEY_CURRENT_USER\software\Classes] [HKEY_LOCAL_MACHINE\software\14919ea49a8f3b4aa3cf1058d9a64cec] [HKEY_LOCAL_MACHINE\software\781] [HKEY_LOCAL_MACHINE\software\Adobe] [HKEY_LOCAL_MACHINE\software\Ahead] [HKEY_LOCAL_MACHINE\software\AMD] [HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.] [HKEY_LOCAL_MACHINE\software\AVG] [HKEY_LOCAL_MACHINE\software\Brother] [HKEY_LOCAL_MACHINE\software\C07ft5Y] [HKEY_LOCAL_MACHINE\software\CDDB] [HKEY_LOCAL_MACHINE\software\Classes] [HKEY_LOCAL_MACHINE\software\Clever Age] [HKEY_LOCAL_MACHINE\software\Clients] [HKEY_LOCAL_MACHINE\software\Codec Tweak Tool] [HKEY_LOCAL_MACHINE\software\Creative Software] [HKEY_LOCAL_MACHINE\software\Cyberlink] [HKEY_LOCAL_MACHINE\software\Cygnus Solutions] [HKEY_LOCAL_MACHINE\software\DivXNetworks] [HKEY_LOCAL_MACHINE\software\Druide informatique inc.] [HKEY_LOCAL_MACHINE\software\DT Soft] [HKEY_LOCAL_MACHINE\software\Ericsson] [HKEY_LOCAL_MACHINE\software\fce] [HKEY_LOCAL_MACHINE\software\ffffffff] [HKEY_LOCAL_MACHINE\software\FolderIcon XP] [HKEY_LOCAL_MACHINE\software\FUJI PHOTO FILM CO.,LTD.] [HKEY_LOCAL_MACHINE\software\FullCircle] [HKEY_LOCAL_MACHINE\software\Gabest] [HKEY_LOCAL_MACHINE\software\Gemplus] [HKEY_LOCAL_MACHINE\software\GNU] [HKEY_LOCAL_MACHINE\software\Google] [HKEY_LOCAL_MACHINE\software\HaaliMkx] [HKEY_LOCAL_MACHINE\software\HmLmbd] [HKEY_LOCAL_MACHINE\software\ICQ] [HKEY_LOCAL_MACHINE\software\InstallShield] [HKEY_LOCAL_MACHINE\software\Intel] [HKEY_LOCAL_MACHINE\software\InterVideo] [HKEY_LOCAL_MACHINE\software\JavaSoft] [HKEY_LOCAL_MACHINE\software\KLCodecPack] [HKEY_LOCAL_MACHINE\software\Macromedia] [HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware] [HKEY_LOCAL_MACHINE\software\MCCI] [HKEY_LOCAL_MACHINE\software\MeaningData.com] [HKEY_LOCAL_MACHINE\software\Microsoft] [HKEY_LOCAL_MACHINE\software\MimarSinan] [HKEY_LOCAL_MACHINE\software\Mirabilis] [HKEY_LOCAL_MACHINE\software\MobiPocket.com] [HKEY_LOCAL_MACHINE\software\Mozilla] [HKEY_LOCAL_MACHINE\software\mozilla.org] [HKEY_LOCAL_MACHINE\software\MozillaPlugins] [HKEY_LOCAL_MACHINE\software\NVIDIA Corporation] [HKEY_LOCAL_MACHINE\software\ODBC] [HKEY_LOCAL_MACHINE\software\Paint.NET] [HKEY_LOCAL_MACHINE\software\Pervasive Software] [HKEY_LOCAL_MACHINE\software\Philipp Winterberg] [HKEY_LOCAL_MACHINE\software\Phonemonitor] [HKEY_LOCAL_MACHINE\software\Piriform] [HKEY_LOCAL_MACHINE\software\Policies] [HKEY_LOCAL_MACHINE\software\Program Groups] [HKEY_LOCAL_MACHINE\software\Realtek] [HKEY_LOCAL_MACHINE\software\Realtek Semiconductor Corp.] [HKEY_LOCAL_MACHINE\software\RegisteredApplications] [HKEY_LOCAL_MACHINE\software\S3R521] [HKEY_LOCAL_MACHINE\software\Safer Networking Limited] [HKEY_LOCAL_MACHINE\software\Samsung] [HKEY_LOCAL_MACHINE\software\Samsung Electronics Co., Ltd.] [HKEY_LOCAL_MACHINE\software\ScanSoft] [HKEY_LOCAL_MACHINE\software\Schlumberger] [HKEY_LOCAL_MACHINE\software\Secure] [HKEY_LOCAL_MACHINE\software\Skype] [HKEY_LOCAL_MACHINE\software\Sony Ericsson] [HKEY_LOCAL_MACHINE\software\TechSmith] [HKEY_LOCAL_MACHINE\software\Teleca] [HKEY_LOCAL_MACHINE\software\Visioneer] [HKEY_LOCAL_MACHINE\software\WebUpdate] [HKEY_LOCAL_MACHINE\software\Windows] [HKEY_LOCAL_MACHINE\software\Windows 3.1 Migration Status] [HKEY_LOCAL_MACHINE\software\Wise Solutions] [HKEY_LOCAL_MACHINE\software\Zeon] ?????????? Files/folders ?????????? ?????????? Keys : FEATURE_BROWSER_EMULATION | svchost : ==================================== ??????????????? catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-01-06 07:28:55 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: WDC_WD2500JS-55NCB1 rev.10.02E01 -> Harddisk0\DR0 -> \Device\00000063 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8616D1F8]<< 1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x860B9AB8] 3 CLASSPNP[0xF759CFD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000064[0x8614FAF0] 5 ACPI[0xF7308620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000063[0x860B9030] \Driver vata[0x8610EA30] -> IRP_MJ_CREATE -> 0x8616D1F8 kernel: MBR read successfully user & kernel MBR OK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] FirstRunDisabled = 1 (0x1) AntiVirusDisableNotify = 0 (0x0) FirewallDisableNotify = 0 (0x0) UpdatesDisableNotify = 0 (0x0) AntiVirusOverride = 0 (0x0) FirewallOverride = 0 (0x0) ?????????????????( EOF )??????????????????????? End of scan : 7:30:05.50

ancri · Answer

Bonsoir, 

Je trouve qu'il rame toujours. Mais peut-être qu'il se fait vieux.

En tout cas merci pour ton aide, même si on n'arrive pas à faire mieux.

ancri · Answer

Merci pour ton aide et @ +

Rapports Bitfender et Hijackthis à analyser

62 réponses

Votre réponse

Discussions similaires

Newsletters