Winload.exe manquant - Page 2

lequel fichier ? winload.exe ? et je fait un copier coller comment je fait je l'ouvre ven mode normale vista ?

mets le dvd dans le lecteur

et fais une recherche dedans de winload.exe

si il y en a un , il existe des manip pour le copier

de plus

Attention, avant de commencer, lit attentivement la procédure, et imprime la

Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Télécharge ComboFix de sUBs sur ton Bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

(clic droit sur le lien ...enregistrer la cible du lien sous )

/!\ Déconnecte-toi du net et <gras>DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ </gras>

---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

CONTRIBUTEUR SECURITE

En désinfection, c'est la fin le plus important !
"Restez" jusqu'au bout...merci

ComboFix 11-03-18.05 - loic 19/03/2011 17:10:08.1.1 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.767.299 [GMT 1:00]
Lancé depuis: c:\users\loic\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
[i] ADS - Windows: deleted 24 bytes in 1 streams. /i
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\emailingpro\EmailingPro.exe
c:\users\loic\AppData\Roaming\inst.exe
c:\users\loic\AppData\Roaming\Microsoft\Windows\Recent\Winsos.url
c:\users\loic\AppData\Roaming\win32
c:\windows\Downloaded Program Files\tbHElper.dll
D:\resycled
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-02-19 au 2011-03-19 ))))))))))))))))))))))))))))))))))))
.
.
2011-03-19 16:30 . 2011-03-19 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-12 16:36 . 2011-03-12 16:36 -------- d-----w- c:\users\loic\AppData\Roaming\SWiSH Max4
2011-03-12 16:34 . 2011-03-12 16:34 -------- d-----w- c:\program files\LameACM
2011-03-12 16:33 . 2011-03-12 16:33 -------- d-----w- c:\program files\Common Files\SWiSHzone.com
2011-03-12 16:33 . 2011-03-12 16:36 -------- d-----w- c:\program files\SWiSH Max4
2011-03-12 14:53 . 2010-12-29 18:28 429056 ----a-w- c:\windows\system32\EncDec.dll
2011-03-12 14:53 . 2010-12-29 18:28 322560 ----a-w- c:\windows\system32\sbe.dll
2011-03-12 14:53 . 2010-12-29 18:28 153088 ----a-w- c:\windows\system32\sbeio.dll
2011-03-12 14:53 . 2010-12-29 18:26 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-12 14:52 . 2010-12-17 15:45 2067968 ----a-w- c:\windows\system32\mstscax.dll
2011-03-12 14:52 . 2010-12-17 13:54 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-02-28 17:45 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2011-02-28 17:45 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2011-02-21 04:34 . 2011-01-20 16:04 98816 ----a-w- c:\windows\system32\mfps.dll
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-31 16:15 . 2011-01-31 16:15 53248 ----a-r- c:\users\loic\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-12-28 15:55 . 2011-01-12 09:11 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-20 17:09 . 2009-09-26 09:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2008-12-27 00:46 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58DE50D2-870E-4A8B-9865-B470494BD052}]
2010-07-02 15:37 2602496 ----a-w- c:\windows\Downloaded Program Files\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3061AEEE-DDA9-4301-947F-9AEDD54F6BB5}"= "c:\windows\Downloaded Program Files\tbcore3.dll" [2010-07-02 2602496]
.
[HKEY_CLASSES_ROOT\clsid\{3061aeee-dda9-4301-947f-9aedd54f6bb5}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3061AEEE-DDA9-4301-947F-9AEDD54F6BB5}"= "c:\windows\Downloaded Program Files\tbcore3.dll" [2010-07-02 2602496]
.
[HKEY_CLASSES_ROOT\clsid\{3061aeee-dda9-4301-947f-9aedd54f6bb5}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eyeBeam SIP Client"="c:\program files\CounterPath\eyeBeam 1.5\eyeBeam.exe" [2009-02-02 24096768]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Logitech Vid"="c:\program files\Logitech\Vid HD\Vid.exe" [2010-10-29 5915480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 4423680]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
.
c:\users\loic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-7-29 503808]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PCM Media Sharing.lnk]
backup=c:\windows\pss\PCM Media Sharing.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^loic^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\loic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^loic^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-02-15 16:39 151552 ----a-w- c:\acer\AcerTour\Reminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 01:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
2009-04-07 09:22 102400 ----a-w- c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2009-01-29 22:20 57344 ----a-w- c:\program files\SlySoft\CloneCD\CloneCDTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
2007-02-06 22:04 464168 ----a-w- c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-08-15 14:32 136176 ----atw- c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-04-17 11:41 196608 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-04-13 05:07 69632 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 09:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-29 21:13 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-02-21 04:58 1242448 ----a-w- c:\program files\Valve\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-02-19 11:56 2012912 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-03-18 00:03 251240 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
2006-11-05 20:48 57344 ----a-w- c:\acer\WR_PopUp\WarReg_PopUp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 08:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EPSON SX210 Series"=c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIFDE.EXE /FU "c:\windows\TEMP\E_S9EF3.tmp" /EF "HKCU"
"Google Update"="c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EEventManager"=c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 3CX PhoneSystem Media Server;3CX PhoneSystem Media Server;c:\program files\3CX PhoneSystem\Bin\3CXMediaServer.exe [2010-01-29 1215576]
R2 3CX PhoneSystem;3CX PhoneSystem;c:\program files\3CX PhoneSystem\Bin\3CXPhoneSystem.exe [2010-01-29 3755096]
R2 3CXAssistantServer;3CX Assistant Server;c:\program files\3CX PhoneSystem\Bin\Assistant\3CXAssistantServer.exe [2010-01-29 542296]
R2 3CXCallHistoryService;3CX PhoneSystem Call History;c:\program files\3CX PhoneSystem\Bin\3CXCallHistoryService.exe [2010-01-29 31832]
R2 3CXConferenceRoom;3CX PhoneSystem Conference Room;c:\program files\3CX PhoneSystem\Bin\3CXCP.exe [2010-01-29 2153560]
R2 3CXFAXSrv;3CX PhoneSystem FAX Server;c:\program files\3CX PhoneSystem\Bin\3CXFaxServer.exe [2010-01-29 2968664]
R2 3CXIvr;3CX PhoneSystem Digital Receptionist;c:\program files\3CX PhoneSystem\Bin\3CXIvrServer.exe [2010-01-29 3636312]
R2 3CXParkOrbit;3CX PhoneSystem Parking Orbit;c:\program files\3CX PhoneSystem\Bin\3CXPO.exe [2010-01-29 2100312]
R2 3CXVBoxMgr;3CX PhoneSystem Voicemail Manager;c:\program files\3CX PhoneSystem\Bin\3CXVoiceMailScanner.exe [2010-01-29 35928]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 LMBApache;Lundi Matin Business Apache;c:\xampplite\srvany.exe [1997-05-14 13312]
R2 LMBMySQL;Lundi Matin Business MySQL;c:\xampplite\srvany.exe [1997-05-14 13312]
R3 abxusb;Carte réseau virtuelle Alice Box USB (32 bits);c:\windows\system32\DRIVERS\abxusb32.sys [2009-03-16 24576]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-19 12872]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-16 691696]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-19 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2010-02-19 66632]
S2 3CX PhoneSystem Database Server;3CX PhoneSystem Database Server;C:/Program Files/3CX PhoneSystem/Bin/pgsql/bin/pg_ctl.exe runservice -N 3CX PhoneSystem Database Server -D C:/Program Files/3CX PhoneSystem/Data/DB [x]
S2 3CXCfgServ;3CX Configuration Service;c:\program files\3CX PhoneSystem\Bin\3CXSLDBServ.exe [2010-01-29 674904]
S2 3CXTunnel;3CX PhoneSystem SIP/RTP Tunneling Proxy;c:\program files\3CX PhoneSystem\Bin\3CXTunnel.exe [2010-01-29 1416280]
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-12-27 108289]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe [2009-10-06 65536]
S2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe [2009-10-06 1532000]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-04-07 233472]
S2 MSSQL$RADIONOMY536765;SQL Server (RADIONOMY536765);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-03-25 490280]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-16 50704]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-01-12 185640]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2009-03-18 92008]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2009-11-13 1021256]
S2 UltiDev Cassini Web Server for ASP.NET 2.0;UltiDev Cassini Web Server for ASP.NET 2.0;c:\program files\3CX PhoneSystem\Bin\Cassini\UltiDevCassinWebServer2a.exe [2009-06-18 49152]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-04-07 36608]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
.
2011-03-19 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-12-24 08:38]
.
2011-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1433826038-1283496846-2019924987-1000Core.job
- c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-15 14:32]
.
2011-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1433826038-1283496846-2019924987-1000UA.job
- c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-15 14:32]
.
2010-06-12 c:\windows\Tasks\User_Feed_Synchronization-{B48DC18F-7F5B-4AA9-9ED9-DEEDC8695DC5}.job
- c:\windows\system32\msfeedssync.exe [2011-02-21 04:47]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.aliceadsl.fr/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - f:\office11\EXCEL.EXE/3000
DPF: {3061AEEE-DDA9-4301-947F-9AEDD54F6BB5} - hxxp://carrefourinternet.carrefourinternet.com/toolbar/vers/v3/CIv3_webinstall/CIv3.cab
DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} - hxxp://www.zorap.com/zorap_2_1_3_1.cab
FF - ProfilePath - c:\users\loic\AppData\Roaming\Mozilla\Firefox\Profiles\hwy6ths3.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\xampplite\portableFirefox\firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\xampplite\portableFirefox\firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\xampplite\portableFirefox\firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-19 17:31
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3CX PhoneSystem Database Server]
"ImagePath"="C:/Program Files/3CX PhoneSystem/Bin/pgsql/bin/pg_ctl.exe runservice -N \"3CX PhoneSystem Database Server\" -D \"C:/Program Files/3CX PhoneSystem/Data/DB\""
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3CX PhoneSystem Database Server]
"ImagePath"="C:/Program Files/3CX PhoneSystem/Bin/pgsql/bin/pg_ctl.exe runservice -N \"3CX PhoneSystem Database Server\" -D \"C:/Program Files/3CX PhoneSystem/Data/DB\""
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1433826038-1283496846-2019924987-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{87BB0457-467B-9F92-8A5B-CC0A3E593599}*]
"haoimhclkpgeebmm"=hex:6b,61,65,6f,67,6b,6e,6d,62,6d,6c,6f,63,65,69,6e,61,65,
6a,6a,67,64,00,00
"iaeigfmeohdlkpngnc"=hex:63,61,6c,6f,61,65,00,7f
"iaijgfpckfnhodoael"=hex:6b,61,65,6f,67,6b,6e,6d,62,6d,6c,6f,63,65,69,6e,61,65,
6a,6a,67,64,00,00
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2011-03-19 17:39:14
ComboFix-quarantined-files.txt 2011-03-19 16:39
.
Avant-CF: 20 723 986 432 octets libres
Après-CF: 20 949 839 872 octets libres
.
- - End Of File - - 37176F9498A7E69D04D46D037CB7DAFD

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour cet utilisateur, il n'est pas transposable sur un autre ordinateur !

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScript
Copies y ce texte dedans et enregistres le

KillAll::

File::
c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll

* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant)
http://sd-2.archive-host.com/membres/images/135518691112296573/cfscriptop0.gif
* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt

Le problème c'est agravé je ne peut plus rien ouvrir sous vista ni le bloc note rien il me marque une erreur pour tout les fichier que j'ouvre il parle du registre bloquez ou supprimé je sais pas quoi j'ai pu copier et coller le rapport sur une clé et voir sa sur une autre pc :

ComboFix 11-03-18.05 - loic 19/03/2011 21:17:17.2.1 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.767.281 [GMT 1:00]
Lancé depuis: c:\users\loic\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\loic\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll"
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\start
c:\windows\Downloaded Program Files\update.exe
c:\windows\system32\ICON.ico
c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-02-19 au 2011-03-19 ))))))))))))))))))))))))))))))))))))
.
.
2011-03-19 20:40 . 2011-03-19 20:50 -------- d-----w- c:\users\loic\AppData\Local\temp
2011-03-12 16:36 . 2011-03-12 16:36 -------- d-----w- c:\users\loic\AppData\Roaming\SWiSH Max4
2011-03-12 16:34 . 2011-03-12 16:34 -------- d-----w- c:\program files\LameACM
2011-03-12 16:33 . 2011-03-12 16:33 -------- d-----w- c:\program files\Common Files\SWiSHzone.com
2011-03-12 16:33 . 2011-03-12 16:36 -------- d-----w- c:\program files\SWiSH Max4
2011-03-12 14:53 . 2010-12-29 18:28 429056 ----a-w- c:\windows\system32\EncDec.dll
2011-03-12 14:53 . 2010-12-29 18:28 322560 ----a-w- c:\windows\system32\sbe.dll
2011-03-12 14:53 . 2010-12-29 18:28 153088 ----a-w- c:\windows\system32\sbeio.dll
2011-03-12 14:53 . 2010-12-29 18:26 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-12 14:52 . 2010-12-17 15:45 2067968 ----a-w- c:\windows\system32\mstscax.dll
2011-03-12 14:52 . 2010-12-17 13:54 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-02-28 17:45 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2011-02-21 04:34 . 2011-01-20 16:04 98816 ----a-w- c:\windows\system32\mfps.dll
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-31 16:15 . 2011-01-31 16:15 53248 ----a-r- c:\users\loic\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-12-28 15:55 . 2011-01-12 09:11 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-20 17:09 . 2009-09-26 09:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2008-12-27 00:46 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58DE50D2-870E-4A8B-9865-B470494BD052}]
2010-07-02 15:37 2602496 ----a-w- c:\windows\Downloaded Program Files\tbcore3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3061AEEE-DDA9-4301-947F-9AEDD54F6BB5}"= "c:\windows\Downloaded Program Files\tbcore3.dll" [2010-07-02 2602496]
.
[HKEY_CLASSES_ROOT\clsid\{3061aeee-dda9-4301-947f-9aedd54f6bb5}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3061AEEE-DDA9-4301-947F-9AEDD54F6BB5}"= "c:\windows\Downloaded Program Files\tbcore3.dll" [2010-07-02 2602496]
.
[HKEY_CLASSES_ROOT\clsid\{3061aeee-dda9-4301-947f-9aedd54f6bb5}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB01359.TBSB01359]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eyeBeam SIP Client"="c:\program files\CounterPath\eyeBeam 1.5\eyeBeam.exe" [2009-02-02 24096768]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Logitech Vid"="c:\program files\Logitech\Vid HD\Vid.exe" [2010-10-29 5915480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 4423680]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
.
c:\users\loic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-7-29 503808]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PCM Media Sharing.lnk]
backup=c:\windows\pss\PCM Media Sharing.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^loic^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\loic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^loic^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
2007-01-24 08:27 319488 ----a-w- c:\acer\Empowering Technology\SysMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
2007-02-15 16:39 151552 ----a-w- c:\acer\AcerTour\Reminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 01:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoStartNPSAgent]
2009-04-07 09:22 102400 ----a-w- c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2009-01-29 22:20 57344 ----a-w- c:\program files\SlySoft\CloneCD\CloneCDTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
2007-02-06 22:04 464168 ----a-w- c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-08-15 14:32 136176 ----atw- c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-04-17 11:41 196608 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-04-13 05:07 69632 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 09:02 26100520 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-29 21:13 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-02-21 04:58 1242448 ----a-w- c:\program files\Valve\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 10:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-02-19 11:56 2012912 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-03-18 00:03 251240 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
2006-11-05 20:48 57344 ----a-w- c:\acer\WR_PopUp\WarReg_PopUp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]
2007-05-31 08:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EPSON SX210 Series"=c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIFDE.EXE /FU "c:\windows\TEMP\E_S9EF3.tmp" /EF "HKCU"
"Google Update"="c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"EEventManager"=c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 3CX PhoneSystem Media Server;3CX PhoneSystem Media Server;c:\program files\3CX PhoneSystem\Bin\3CXMediaServer.exe [2010-01-29 1215576]
R2 3CX PhoneSystem;3CX PhoneSystem;c:\program files\3CX PhoneSystem\Bin\3CXPhoneSystem.exe [2010-01-29 3755096]
R2 3CXAssistantServer;3CX Assistant Server;c:\program files\3CX PhoneSystem\Bin\Assistant\3CXAssistantServer.exe [2010-01-29 542296]
R2 3CXConferenceRoom;3CX PhoneSystem Conference Room;c:\program files\3CX PhoneSystem\Bin\3CXCP.exe [2010-01-29 2153560]
R2 3CXFAXSrv;3CX PhoneSystem FAX Server;c:\program files\3CX PhoneSystem\Bin\3CXFaxServer.exe [2010-01-29 2968664]
R2 3CXIvr;3CX PhoneSystem Digital Receptionist;c:\program files\3CX PhoneSystem\Bin\3CXIvrServer.exe [2010-01-29 3636312]
R2 3CXParkOrbit;3CX PhoneSystem Parking Orbit;c:\program files\3CX PhoneSystem\Bin\3CXPO.exe [2010-01-29 2100312]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 abxusb;Carte réseau virtuelle Alice Box USB (32 bits);c:\windows\system32\DRIVERS\abxusb32.sys [2009-03-16 24576]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-19 12872]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-16 691696]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-19 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2010-02-19 66632]
S2 3CX PhoneSystem Database Server;3CX PhoneSystem Database Server;C:/Program Files/3CX PhoneSystem/Bin/pgsql/bin/pg_ctl.exe runservice -N 3CX PhoneSystem Database Server -D C:/Program Files/3CX PhoneSystem/Data/DB [x]
S2 3CXCallHistoryService;3CX PhoneSystem Call History;c:\program files\3CX PhoneSystem\Bin\3CXCallHistoryService.exe [2010-01-29 31832]
S2 3CXCfgServ;3CX Configuration Service;c:\program files\3CX PhoneSystem\Bin\3CXSLDBServ.exe [2010-01-29 674904]
S2 3CXTunnel;3CX PhoneSystem SIP/RTP Tunneling Proxy;c:\program files\3CX PhoneSystem\Bin\3CXTunnel.exe [2010-01-29 1416280]
S2 3CXVBoxMgr;3CX PhoneSystem Voicemail Manager;c:\program files\3CX PhoneSystem\Bin\3CXVoiceMailScanner.exe [2010-01-29 35928]
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-12-27 108289]
S2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbguard.exe [2009-10-06 65536]
S2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fbserver.exe [2009-10-06 1532000]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-04-07 233472]
S2 LMBApache;Lundi Matin Business Apache;c:\xampplite\srvany.exe [1997-05-14 13312]
S2 LMBMySQL;Lundi Matin Business MySQL;c:\xampplite\srvany.exe [1997-05-14 13312]
S2 MSSQL$RADIONOMY536765;SQL Server (RADIONOMY536765);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-03-25 490280]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-16 50704]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-01-12 185640]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2009-03-18 92008]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2009-11-13 1021256]
S2 UltiDev Cassini Web Server for ASP.NET 2.0;UltiDev Cassini Web Server for ASP.NET 2.0;c:\program files\3CX PhoneSystem\Bin\Cassini\UltiDevCassinWebServer2a.exe [2009-06-18 49152]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-04-07 36608]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'
.
2011-03-19 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-12-24 08:38]
.
2011-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1433826038-1283496846-2019924987-1000Core.job
- c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-15 14:32]
.
2011-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1433826038-1283496846-2019924987-1000UA.job
- c:\users\loic\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-15 14:32]
.
2010-06-12 c:\windows\Tasks\User_Feed_Synchronization-{B48DC18F-7F5B-4AA9-9ED9-DEEDC8695DC5}.job
- c:\windows\system32\msfeedssync.exe [2011-02-21 04:47]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.aliceadsl.fr/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - f:\office11\EXCEL.EXE/3000
DPF: {3061AEEE-DDA9-4301-947F-9AEDD54F6BB5} - hxxp://carrefourinternet.carrefourinternet.com/toolbar/vers/v3/CIv3_webinstall/CIv3.cab
DPF: {74BDA0D0-1AD9-45C7-BDC6-7A1879CCBF06} - hxxp://www.zorap.com/zorap_2_1_3_1.cab
FF - ProfilePath - c:\users\loic\AppData\Roaming\Mozilla\Firefox\Profiles\hwy6ths3.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\xampplite\portableFirefox\firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\xampplite\portableFirefox\firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\xampplite\portableFirefox\firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-19 21:53
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3CX PhoneSystem Database Server]
"ImagePath"="C:/Program Files/3CX PhoneSystem/Bin/pgsql/bin/pg_ctl.exe runservice -N \"3CX PhoneSystem Database Server\" -D \"C:/Program Files/3CX PhoneSystem/Data/DB\""
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\3CX PhoneSystem Database Server]
"ImagePath"="C:/Program Files/3CX PhoneSystem/Bin/pgsql/bin/pg_ctl.exe runservice -N \"3CX PhoneSystem Database Server\" -D \"C:/Program Files/3CX PhoneSystem/Data/DB\""
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1433826038-1283496846-2019924987-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{87BB0457-467B-9F92-8A5B-CC0A3E593599}*]
"haoimhclkpgeebmm"=hex:6b,61,65,6f,67,6b,6e,6d,62,6d,6c,6f,63,65,69,6e,61,65,
6a,6a,67,64,00,00
"iaeigfmeohdlkpngnc"=hex:63,61,6c,6f,61,65,00,7f
"iaijgfpckfnhodoael"=hex:6b,61,65,6f,67,6b,6e,6d,62,6d,6c,6f,63,65,69,6e,61,65,
6a,6a,67,64,00,00
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:0000003d
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\LEXBCES.EXE
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\LEXPPS.EXE
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\pg_ctl.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\xampplite\Apache\bin\apache.exe
c:\xampplite\MySQL\bin\mysqld.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\WUDFHost.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\xampplite\Apache\bin\apache.exe
c:\program files\3CX PhoneSystem\Bin\pgsql\bin\postgres.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\ehome\ehmsas.exe
c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\RacAgent.exe
.
**************************************************************************
.
Heure de fin: 2011-03-19 22:04:22 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-03-19 21:03
ComboFix2.txt 2011-03-19 16:39
.
Avant-CF: 21 191 008 256 octets libres
Après-CF: 21 219 692 544 octets libres
.
- - End Of File - - E3140F35C260E95A5D8E9FB2B758A8BF

ca sent le chaud là...

tente une restauration systeme pour pouvoir avoir acces correctement à tes données à sauvegarder et réinstalle proprement tout ca

depuis cette manip décrite ici https://forums.commentcamarche.net/forum/affich-20456519-winload-exe-manquant#12, ton pc est instable

ok, et je fait comment pour le résoudre ? je le fait avec EASYUBCD et je coche quoi ? et je restore le pc à quand ?

aussi on vérra mon 2eme probleme après car le pc des fois me marque pas de signal ou au redémarrage bin il me marque pas de signal avec un écran noir et le pc faut l'étindre 2 ou 3 fois pour qu'il remarche

j'ai trouver le probleme c'est quand j'avais mit EASYUBCD je voulez que celui ci démarre sur windows vista et mettre windows 7 en 2 eme au démmarage et la je vien de le réouvrir les 2 fichiers boot winload.exe ne sont pas manquant mais démarre directe sur windows \ system32 \ winload.exe et hors que la nature du lecteur et pas présciser genre pour vista c'est le c: et pour windows 7, c'est le g: comprend tu mieu la comment fait ton pour résoudre le probleme stp

franchement, je ne vais pas pouvoir t'aider et surtout te guider correctement

puisque tu as cerné précisement le soucis, ouvre un nouveau sujet sur windows en expliquant bien ton truc, il y a des gars qui savent faire (moi c'est les virus)

et si la modo intervient pour un double sujet, réponds que c'est à ma demande

et pour le probleme materiel serai tu ou pas ?

probleme winload résolu ici : http://www.vista-xp.fr/forum/post73771.html#p73771

avec ce code :

bcdeditespace /setespace {default}espace pathespace \windows\system32\boot\winload.exe

si vous ne connaisez pas l'erreur sur quelle systeme elle aparait fait par exemple c: ou f: ou votre os et installer sir vista et instaler sur l mettez l: et tapez le code ci dessus