Virus Antivra av- installation list_kill'em

merci pour l'info!
mais je n'y arrive toujours pas. je ne trouve pas le raccourci sur le bureau ou alors ce n'est pas le bon raccourci (à un moment j'avais 3 raccourci se rapportant à ce fichier)...en tout cas pas de petit "x"...

Et pour la suite? une fois que j'aurais résolu le problème de scan, que dois-je faire???

Merci beaucoup pour ton aide!

https://forums.commentcamarche.net/forum/affich-20841193-virus-antivra-av-installation-list-kill-em#3

Ok, pour le scan c'est bon...
ensuite, j'essaye de lancer rogueKiller mais il m'affiche ce message d'erreur
"RogueKiller.exe n'est pas une application Win32 valide", et ça ne marche pas non plus en mode sans échec...

tu as fais clique droit, lancer en tant qu'administrateur ?

Ok, pour le scan c'est bon...

as tu le rapport ?

j'ai fait clic droit en tant qu'administrateur, et aussi double cli gauche, sans résultat.

pour le scan, le programme s'est fermé directement, je n'ai pas eu de rapport...

regarde bien sur le bureau ou sur C

sinon relance le

Bonjour,
désolée j'ai du m'abstenter hier soir et aujourd'hui je travaillais... en tout cas encore merci pour ton aide.
voici le 1e rapport:
https://pjjoint.malekal.com/files.php?id=1bc63a1afb1014
et le 2e:
https://pjjoint.malekal.com/files.php?id=30f8f95fe61311

Entre temps j'ai essayé sur les conseils d'un ami de supprimer les clés correspondant au virus de la base de registre. mais je n'en trouve pas pour le moment. ceci dit je suis loin d'avoir fini :(
Est-ce que ça peut être une solution??

Ok je vais faire ce que tu me dis.
J'ai déjà téléchargé malwarebytes, il a détecté 3 menaces, que j'ai supprimé mais le problème subsiste toujours. Normal???

heu nouveau souci: 1/il faut a chaque fois que je re-télécharge list-kill'em car il n'apparaît plus sur mon ordi
2/ quand je relance list-kill'em (tools puis killproxy) rien ne se passe... Est-ce que c'est parce que j'ai copié-collé à partir d'une clé USB??

autre chose, comment faire la mise à jour de malewarebytes si l'ordi infecté ne peut aller sur internet??

j'ai réussi à mettre à jour malewayrebytes en passant par teamviewer. Mais je n'arrive pas à mener l'analyse jusqu'au bout parce que, nouveau pb, l'ordi infecté s'éteint tout seul n'importe quand!!!
grrrrrr!!!!!!!
Comment faire??

Bonsoir!

Non, chaque fois il faut que je réinstalle list_kill'em pour le relancer.
En plus, maintenant mon ordi s'éteint tout le temps...

tu as pas ceci ? :

C:\Program Files\List_kill'em .?

non je ne crois pas... quand je vais dans le dossier list kill'em, il est vide.
donc je réinstalle list-kill'em, je suis la procédure . mais rien ne se lance. a la place j'ai ce message:
"values changed successfully"

tu cliques sur quoi pour avoir ce resultat ?

tool puis killproxy... quelques secondes après, il me dit ça

oki!
C'est ce que je fais. mais comme dis plus haut, mon ordi s'éteint tout le temps. Impossible de mener une analyse au bout.... :(

ah? J'utilise pas malwarebytes alors??
ok je fais ça

pas de suite

aïe!! Il ne s'allume presque plus!!! il lance le démarrage et puis...plus rien
je commence à désespérer...

je précise, peut-être que ça a une importance: un ami m'a conseillé de supprimer ce qui se rapporte à ce virus dans la base de registre. et j'ai effectivement supprimé quelque chose... :s
ceci: HKCU/Software/Microsoft/InternetExplorer/PishingFilter"Enabled=0"?
Je donne l'info, peut-être que c'est ça qui fait que mon ordi s'éteint tout le temps ou bien est-ce le virus?

oui

non il t'a juste fait desactiver le filtre anti pishing ce qui veut dire que sur internet tu vas te ramasser toutes les merd** de la terr ^^

EDIT::: ah non tu as supprimé la clé ? pourquoi il te l a fait supprimer ? je l'aurais mise à 1 moi.....

oups... bon chaque chose en son temps...
est-ce que tu as une idée de pourquoi mon PC plante?? c'est le virus qui fait ça?

bon mon ordi m'a fait une petite fleur, il m'a laissé aller jusqu'au bout du nettoyage. Mais maintenant j'ai un écran noir (sauf inscription: "mode sans échec")... normal? :(
j'ai donc redémarré.
maintenant je lance malewarebytes? si toutefois l'ordi ne s'éteint pas...

fais l option reparer l'ordi

et restaurer le système ensuite c'est ça?

il a des liens bizarres ton ami :

regarde le site où tu m'envoie :

http://www.cijoint.fr/cjlink.php?file=cj201102/cijC9YbYmg.jpg

??? ah ok... moralité: ne pas toujours suivre les conseils d'ami. ^^

j'ai fais une restauration système. c'était ça?

s'il redemarre c'est bon sinon y a encore d'autre manips ;)

Merci pour ce lien!
Mais il ne s'execute pas (ni sur ordi infecté ni sur un autre) :(

Hourra!!!!!

J'ai finalement réussi à mener un scan malewarebytes jusqu'au bout. je t'écris là du PC qui déconnait! j'ai donc accès à internet, plus de fausses alertes virus, plus d'antivira av.

Mon ordi (a priori) ne s'éteint plus, ça devait être un virus en plus qui le faisait déconner non?
Alors peut-être que ce que tu m'as envoyé s'est exécuté aussi, si tu dis que ça ne se voit pas à l'oeil nu...et comme j'ai redémarré des milliers de fois...

maintenant, est-ce que ce que j'ai supprimé (la clé registre anti pishing) ne va pas me jouer des tours, notamment quand j'irai sur internet? est-ce qu'il y a un moyen de le remettre?

Merci encore une fois! j'espère que c'est vraiment résolu!! ;)

oki.
Heu par contre dans pjjoint.malekal.com, comment je fais pour retrouver le rapport quand je fais parcourir?? Ou je le copie colle ici?

copie-le ici

je crois que c'est celui-ci:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5764

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

15/02/2011 15:23:28
mbam-log-2011-02-15 (15-23-28).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 324574
Temps écoulé: 30 minute(s), 17 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\program files (x86)\list_kill'em\Upl.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

ou peut-être celui-ci?

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5764

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

15/02/2011 14:47:43
mbam-log-2011-02-15 (14-47-43).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 157702
Temps écoulé: 2 minute(s), 23 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Users\elenas\AppData\Local\Temp\FE02.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\elenas\AppData\Local\Temp\setup3201328392.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.

https://pjjoint.malekal.com/files.php?id=7258bd6b1e67

hello vous deux

je te laisse continuer gen

merci de ton aide moment de grâce ^^

le voilà ;)
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5764

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

14/02/2011 23:23:46
mbam-log-2011-02-14 (23-23-46).txt

Type d'examen: Examen complet (E:\|F:\|)
Elément(s) analysé(s): 150925
Temps écoulé: 26 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sovqbtpw (Trojan.Downloader) -> Value: sovqbtpw -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Users\elenas\AppData\Local\Temp\duvtarhmi\unbqfgdsika.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Que reste-t-il à faire maintenant? est-ce que ça va poser un souci le fait que j'ai supprimé une clé "pishingfilter"?

bon ben si ça pose pas de souci, je crois que j'ai eu assez d'informatique pour un moment! ;)
En tout cas merci!!!

heu... je lance search dans list-killem c'est ca?
C'est ce que j'ai fait. mais quel nom il a déjà ce rapport?

1e rapport:
¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.3.5 ¤¤¤¤¤¤¤¤¤¤

User : elenas (Administrateurs)
Update on 14/02/2011 by g3n-h@ckm@n ::::: 15.30
Start at: 22:26:16 | 15/02/2011

Intel(R) Core(TM)2 Duo CPU P7450 @ 2.13GHz
Microsoft Windows 7 Édition Familiale Premium (6.1.7600 64-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 452,6 Go (193,89 Go free) | NTFS
D:\ -> Disque fixe local | 12,97 Go (2,16 Go free) [RECOVERY] | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible | 1,86 Go (84,94 Mo free) | FAT

¤¤¤¤¤ Sessions ¤¤¤¤¤

C:\Users\elenas
C:\Users\Public
C:\Users\Default

Boot: Normal


¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer

C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe ---- 8132 Ko ---- Normal ---- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe ---- Avira GmbH
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe ---- 29068 Ko ---- Normal ---- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe ---- Avira GmbH
C:\Windows\SysWOW64\svchost.exe ---- 5132 Ko ---- Normal ---- C:\Windows\SysWOW64\svchost.exe -k netsvcs ----
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe ---- 3628 Ko ---- Normal ---- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe ---- Hewlett-Packard Company
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe ---- 4292 Ko ---- Normal ---- C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe ----
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe ---- 4500 Ko ---- Normal ---- C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe ---- CyberLink
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 7940 Ko ---- Normal ---- C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- Microsoft Corporation
C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe ---- 10140 Ko ---- Normal ---- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe ---- TeamViewer GmbH
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe ---- 47388 Ko ---- Normal ---- C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW ---- Hewlett-Packard Company
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe ---- 11372 Ko ---- Normal ---- C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden ----
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe ---- 36652 Ko ---- Normal ---- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background ---- Microsoft Corporation
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe ---- 9752 Ko ---- Normal ---- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe /Start ---- Hewlett-Packard Company
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe ---- 4552 Ko ---- Normal ---- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe ---- Adobe Systems, Incorporated
C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe ---- 4048 Ko ---- Normal ---- C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe ---- Hewlett-Packard Company
C:\Program Files (x86)\Java\jre6\bin\jusched.exe ---- 4128 Ko ---- Normal ---- C:\Program Files (x86)\Java\jre6\bin\jusched.exe ---- Sun Microsystems, Inc.
C:\Program Files (x86)\Logitech\Z-5 Speakers\Z-5 Speakers.exe ---- 12440 Ko ---- Normal ---- C:\Program Files (x86)\Logitech\Z-5 Speakers\Z-5 Speakers.exe ---- Logitech Inc
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe ---- 3112 Ko ---- Normal ---- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe /min ---- Avira GmbH
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe ---- 4832 Ko ---- Normal ---- C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe ----
C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe ---- 6168 Ko ---- Normal ---- C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe ---- Canon Inc.
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- 11036 Ko ---- Normal ---- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ---- Adobe Systems, Incorporated
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe ---- 6568 Ko ---- Normal ---- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe ---- Hewlett-Packard Company
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe ---- 3752 Ko ---- Normal ---- C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe ---- Broadcom Corporation
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe ---- 4984 Ko ---- Normal ---- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe ---- Hewlett-Packard Company
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe ---- 8600 Ko ---- Normal ---- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe -Embedding ---- Hewlett-Packard Company
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe ---- 18296 Ko ---- Below Normal ---- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe ---- CyberLink
c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe ---- 9508 Ko ---- Below Normal ---- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe ---- CyberLink
C:\Windows\SysWOW64\cmd.exe ---- 4072 Ko ---- Normal ---- cmd /c C:\Program Files (x86)\List_Kill'em\List'em.bat /High ----
C:\Program Files (x86)\List_Kill'em\pv.exe ---- 5704 Ko ---- Normal ---- pv.exe -o%f ---- %m Ko ---- %p ---- %l ---- %s ----


¤¤¤¤¤¤¤¤¤¤ Keys Run ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
HPADVISOR = C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW
LightScribe Control Panel = C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
swg = C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
msnmsgr = C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
StartCCC = C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun
HPCam_Menu = c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe c:\Program Files (x86)\Hewlett-Packard\Media\Webcam UpdateWithCreateOnce Software\Hewlett-Packard\Media\Webcam
QlbCtrl.exe = C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
NortonOnlineBackupReminder = C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe UNATTENDED
UpdatePRCShortCut = C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\Hewlett-Packard\Recovery UpdateWithCreateOnce Software\CyberLink\PowerRecover
Adobe Reader Speed Launcher = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
Easybits Recovery = C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HP Software Update = C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
@ =
WirelessAssistant = C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
SunJavaUpdateSched = C:\Program Files (x86)\Java\jre6\bin\jusched.exe
Z-5 Speakers = C:\Program Files (x86)\Logitech\Z-5 Speakers\Z-5 Speakers.exe
avgnt = C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe /min
IJNetworkScanUtility = C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
Adobe ARM = C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Policies\explorer

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
ForceActiveDesktopOn = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ AppInit_DLLS

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS =

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Winlogon

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell = 1 (0x1)
Shell = explorer.exe
Userinit = C:\Windows\SysWow64\userinit.exe,
System =

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Winlogon\Notify


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Explorer\ShellExecuteHooks

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{E54729E8-BB3D-4270-9D49-7389EA579090} = EasyBits Security Shield Hook - prevents launching insecure programs by kids

¤¤¤¤¤¤¤¤¤¤ ActivX

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}]


¤¤¤¤¤¤¤¤¤¤ Open Ports


¤¤¤¤¤¤¤¤¤¤ BHO

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4C4AD71D-52E1-4402-9E5B-CBFC295EC9BA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}]

¤¤¤¤¤¤¤¤¤¤ DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{95DD4EC3-34D3-4B4A-A9F7-57ACE19B5D94}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{95DD4EC3-34D3-4B4A-A9F7-57ACE19B5D94}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{95DD4EC3-34D3-4B4A-A9F7-57ACE19B5D94}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2


¤¤¤¤¤¤¤¤¤¤ Internet Explorer

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤ Proxy

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 1 (0x1)

¤¤¤¤¤¤¤¤¤¤ Safemode

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

¤¤¤¤¤¤¤¤¤¤ SVC | svchost

svchost.exe 668 DcomLaunch, PlugPlay, Power
svchost.exe 764 RpcEptMapper, RpcSs
svchost.exe 908 AudioSrv, Dhcp, eventlog,
HomeGroupProvider, lmhosts, wscsvc
svchost.exe 940 AudioEndpointBuilder, hidserv,
HomeGroupListener, Netman, PcaSvc, SysMain,
TrkWks, UxSms, WdiSystemHost, Wlansvc,
WPDBusEnum, wudfsvc
svchost.exe 984 AeLookupSvc, Appinfo, BITS, Browser,
EapHost, gpsvc, IKEEXT, iphlpsvc,
LanmanServer, MMCSS, ProfSvc, RasMan,
Schedule, SENS, ShellHWDetection, Themes,
Winmgmt
svchost.exe 1064 EventSystem, fdPHost, netprofm, nsi,
SstpSvc, WdiServiceHost, WinHttpAutoProxySv
svchost.exe 1348 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc, TapiSrv
svchost.exe 1520 BFE, DPS, MpsSvc
svchost.exe 1764 ezSharedSvc
svchost.exe 1800 FDResPub, FontCache, SSDPSRV, upnphost
svchost.exe 1248 stisvc
svchost.exe 2072 WinDefend
svchost.exe 2796 bthserv
svchost.exe 5024 p2pimsvc, p2psvc, PNRPsvc

¤¤¤¤¤¤¤¤¤¤ IFEO | debugger


¤¤¤¤¤¤¤¤¤¤ Mountpoints2

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f8a7533-a23d-11df-8ef3-00269e2fad2b}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f8a7533-a23d-11df-8ef3-00269e2fad2b}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f8a7550-a23d-11df-8ef3-00269e2fad2b}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f8a7550-a23d-11df-8ef3-00269e2fad2b}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3518777b-883b-11df-ab73-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3518777b-883b-11df-ab73-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3583dc4d-9ba4-11df-bc66-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3583dc4d-9ba4-11df-bc66-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c66f080-4e9c-11df-a5be-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c66f080-4e9c-11df-a5be-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5454780b-eb37-11de-8632-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5454780b-eb37-11de-8632-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a326941-a53f-11df-bed4-00269e2fad2b}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a326941-a53f-11df-bed4-00269e2fad2b}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a95717-e4b4-11de-8133-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a95717-e4b4-11de-8133-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a9571f-e4b4-11de-8133-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a9571f-e4b4-11de-8133-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a95727-e4b4-11de-8133-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68a95727-e4b4-11de-8133-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6cc3d17b-e3f3-11de-8118-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6cc3d17b-e3f3-11de-8118-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{888c4d34-71a9-11df-8af4-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{888c4d34-71a9-11df-8af4-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f221e8f-1dff-11df-abaf-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f221e8f-1dff-11df-abaf-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911c171d-9a72-11de-913c-806e6f6e6963}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{911c171d-9a72-11de-913c-806e6f6e6963}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9df35caa-a0b6-11df-a5d5-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9df35caa-a0b6-11df-a5d5-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b26ca3b5-6a34-11df-8c0a-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b26ca3b5-6a34-11df-8c0a-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd7d2bbb-e34f-11de-8900-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bd7d2bbb-e34f-11de-8900-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c85c7c5e-9d46-11df-82f8-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c85c7c5e-9d46-11df-82f8-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e418dff0-516e-11df-ad45-00269e2fad2b}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e418dff0-516e-11df-ad45-00269e2fad2b}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568c079-e6eb-11de-85d4-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e568c079-e6eb-11de-85d4-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5df8f1b-85c6-11df-ad3c-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5df8f1b-85c6-11df-ad3c-00247eb5c8eb}\shell\Autoplay
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f8cd9770-1d29-11df-a7aa-00247eb5c8eb}\shell
@ = None
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f8cd9770-1d29-11df-a7aa-00247eb5c8eb}\shell\Autoplay


¤¤¤¤¤¤¤¤¤¤ Services

¤ Ndisuio -> Start : 3 ( OK = 3 )
¤ EapHost -> Start : 2 ( OK = 2 )
¤ Wlansvc -> Start : 2 ( OK = 2 )
¤ SharedAccess -> Start : 2 ( OK = 2 )
¤ windefend -> Start : 2 ( OK = 2 )
¤ wuauserv -> Start : 2 ( OK = 2 )
¤ wscsvc -> Start : 2 ( OK = 2 )

¤¤¤¤¤¤¤¤¤¤ First Scan



¤¤¤¤¤¤¤¤¤¤ HKCU | HKLM

[HKEY_CURRENT_USER\software\Adobe]
[HKEY_CURRENT_USER\software\AOL]
[HKEY_CURRENT_USER\software\AppDataLow]
[HKEY_CURRENT_USER\software\ATI]
[HKEY_CURRENT_USER\software\Avira]
[HKEY_CURRENT_USER\software\Canon]
[HKEY_CURRENT_USER\software\Clients]
[HKEY_CURRENT_USER\software\CyberLink]
[HKEY_CURRENT_USER\software\DivX]
[HKEY_CURRENT_USER\software\freeTVRadio]
[HKEY_CURRENT_USER\software\Google]
[HKEY_CURRENT_USER\software\Hewlett-Packard]
[HKEY_CURRENT_USER\software\IM Providers]
[HKEY_CURRENT_USER\software\JavaSoft]
[HKEY_CURRENT_USER\software\LightScribe]
[HKEY_CURRENT_USER\software\Logitech]
[HKEY_CURRENT_USER\software\Macromedia]
[HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware]
[HKEY_CURRENT_USER\software\Microsoft]
[HKEY_CURRENT_USER\software\MozillaPlugins]
[HKEY_CURRENT_USER\software\Netscape]
[HKEY_CURRENT_USER\software\Norton]
[HKEY_CURRENT_USER\software\ODBC]
[HKEY_CURRENT_USER\software\OfferBox]
[HKEY_CURRENT_USER\software\Piriform]
[HKEY_CURRENT_USER\software\Policies]
[HKEY_CURRENT_USER\software\Spointer]
[HKEY_CURRENT_USER\software\Synaptics]
[HKEY_CURRENT_USER\software\TeamViewer]
[HKEY_CURRENT_USER\software\Trolltech]
[HKEY_CURRENT_USER\software\Widcomm]
[HKEY_CURRENT_USER\software\Wow6432Node]
[HKEY_CURRENT_USER\software\Yahoo]
[HKEY_CURRENT_USER\software\YahooPartnerToolbar]
[HKEY_CURRENT_USER\software\Classes]

[@ = ]
[HKEY_LOCAL_MACHINE\software\Adobe]
[HKEY_LOCAL_MACHINE\software\America Online]
[HKEY_LOCAL_MACHINE\software\ATI]
[HKEY_LOCAL_MACHINE\software\ATI Technologies]
[HKEY_LOCAL_MACHINE\software\Avira]
[HKEY_LOCAL_MACHINE\software\Canon]
[HKEY_LOCAL_MACHINE\software\Caphyon]
[HKEY_LOCAL_MACHINE\software\Cyberlink]
[HKEY_LOCAL_MACHINE\software\Digital River]
[HKEY_LOCAL_MACHINE\software\EasyBits]
[HKEY_LOCAL_MACHINE\software\freeTVRadio]
[HKEY_LOCAL_MACHINE\software\Google]
[HKEY_LOCAL_MACHINE\software\Hewlett-Packard]
[HKEY_LOCAL_MACHINE\software\HP]
[HKEY_LOCAL_MACHINE\software\HPQ]
[HKEY_LOCAL_MACHINE\software\HPQLOG]
[HKEY_LOCAL_MACHINE\software\IDT]
[HKEY_LOCAL_MACHINE\software\Intel]
[HKEY_LOCAL_MACHINE\software\JavaSoft]
[HKEY_LOCAL_MACHINE\software\JreMetrics]
[HKEY_LOCAL_MACHINE\software\LabelPrint_Upgrade]
[HKEY_LOCAL_MACHINE\software\LightScribe]
[HKEY_LOCAL_MACHINE\software\Logitech]
[HKEY_LOCAL_MACHINE\software\Macromedia]
[HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware]
[HKEY_LOCAL_MACHINE\software\Microsoft]
[HKEY_LOCAL_MACHINE\software\Mozilla]
[HKEY_LOCAL_MACHINE\software\MozillaPlugins]
[HKEY_LOCAL_MACHINE\software\Norton]
[HKEY_LOCAL_MACHINE\software\ODBC]
[HKEY_LOCAL_MACHINE\software\P2G_Upgrade]
[HKEY_LOCAL_MACHINE\software\PDR_Upgrade]
[HKEY_LOCAL_MACHINE\software\Product_Upgrade]
[HKEY_LOCAL_MACHINE\software\Realtek]
[HKEY_LOCAL_MACHINE\software\Symantec]
[HKEY_LOCAL_MACHINE\software\TeamViewer]
[HKEY_LOCAL_MACHINE\software\WildTangent]
[HKEY_LOCAL_MACHINE\software\Windows]
[HKEY_LOCAL_MACHINE\software\X-AVCSD]
[HKEY_LOCAL_MACHINE\software\Yahoo]
[HKEY_LOCAL_MACHINE\software\Classes]
[HKEY_LOCAL_MACHINE\software\Clients]
[HKEY_LOCAL_MACHINE\software\Policies]
[HKEY_LOCAL_MACHINE\software\RegisteredApplications]

¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤

Present !! : C:\Users\elenas\AppData\Local\GDIPFONTCACHEV1.DAT

¤¤¤¤¤¤¤¤¤¤ Keys :


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-15 22:30:10
Windows 6.1.7600 WOW64 FAT NTAPI

detected NTDLL code modification:
ZwEnumerateKey 0 != 47, ZwQueryKey 0 != 19, ZwOpenKey 0 != 15, ZwClose 0 != 12, ZwEnumerateValueKey 0 != 16, ZwQueryValueKey 0 != 20, ZwOpenFile 0 != 48, ZwQueryDirectoryFile 0 != 50, ZwQuerySystemInformation 0 != 51Initialization error


Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR

# Boot Size (MB) Type
1 Yes 199 7 NTFS or HPFS
2 463458 7 NTFS or HPFS
3 13281 7 NTFS or HPFS
4 0 0 None

\.\C: --> \.\PhysicalDrive0 at offset 0x00000000'0c800000 (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000071'32a00000 (NTFS)


Size Device Name MBR Status

--------------------------------------------

465 GB \.\PhysicalDrive0 Unknown MBR code

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 (0x1)
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)
InternetSettingsDisableNotify = 0 (0x0)
AutoUpdateDisableNotify = 0 (0x0)
UacDisableNotify = 0 (0x0)
AntispywareOverride = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 22:31:11


2e rapport:
¤¤¤¤¤¤¤¤¤¤ More informations ¤¤¤¤¤¤¤¤¤¤

15/02 - 22:30

¤¤¤¤¤¤¤¤¤¤¤ Firewall Rules ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
Netlogon-NamedPipe-In =Action=Allow | Active=FALSE | LPort=445 | App=System | Name=@netlogon.dll,-1003 | Desc=@netlogon.dll,-1006 | EmbedCtxt=@netlogon.dll,-1010|
{1B1E1807-19BC-4933-A75C-9D73C24FD341} =Action=Allow | Active=TRUE | Name=CyberLink PowerDirector | Desc=CyberLink PowerDirector | | |
{C4D36BE8-4A60-4651-A1CC-1250988C56B1} =Action=Allow | Active=TRUE | Name=HP TouchSmart Music | Desc=HP TouchSmart Music | | |
{DAD3E4CA-B277-40B1-A812-182B86DA578E} =Action=Allow | Active=TRUE | Name=HP TouchSmart Photo | Desc=HP TouchSmart Photo | | |
{E24C6248-A9D9-4776-B185-5F6423BF13D8} =Action=Allow | Active=TRUE | Name=HP TouchSmart Video | Desc=HP TouchSmart Video | | |
{32CB4652-90C0-488D-A236-9876C0807DFA} =Action=Allow | Active=TRUE | Name=HP TouchSmart Media Resident Program | Desc=HP TouchSmart Media Resident Program | | |
{72BA8D28-7FE9-4DBC-81B4-B61592998B85} =Action=Allow | Active=TRUE | Name=CyberLink Media Service | Desc=CyberLink Media Service | | |
{E96FE175-B298-4BA7-9888-DF2C4E96CAC4} =Action=Allow | Active=TRUE | Name=HP MediaSmart DVD | Desc=HP MediaSmart DVD | | |
{E675D94C-2B94-4D0B-BB0D-E812F290D405} =Action=Allow | Active=TRUE | Name=HP TouchSmart Music | Desc=HP TouchSmart Music | | |
{FC64F437-5C29-4E49-9A12-47AC11DA7DDE} =Action=Allow | Active=TRUE | Name=HP TouchSmart Photo | Desc=HP TouchSmart Photo | | |
{9FB8C892-F98E-4DAE-A4A6-0FD16948569E} =Action=Allow | Active=TRUE | Name=HP TouchSmart Video | Desc=HP TouchSmart Video | | |
{33F440CF-81E4-4075-A910-DF6A19F64084} =Action=Allow | Active=TRUE | Name=HP TouchSmart Media Resident Program | Desc=HP TouchSmart Media Resident Program | | |
{217BD3AF-AAFF-4540-B55A-5A0ADD0E9F3B} =Action=Allow | Active=TRUE | Name=CyberLink Media Service | Desc=CyberLink Media Service | | |

¤¤¤¤¤¤¤¤¤¤¤ firewallpolicy

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

¤¤¤¤¤

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

¤¤¤¤¤¤¤¤¤¤¤ DLLs ¤¤¤¤¤¤¤¤¤¤

------------------------------------------------------------------------------
explorer.exe pid: 2880
Command line: <no command line>

------------------------------------------------------------------------------
winlogon.exe pid: 860
Command line: <no command line>

------------------------------------------------------------------------------
wininit.exe pid: 468
Command line: <no command line>

------------------------------------------------------------------------------
svchost.exe pid: 668
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 764
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 908
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 940
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 984
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 1064
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 1348
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 1520
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 1764
Command line: C:\Windows\SysWOW64\svchost.exe -k netsvcs
Base Size Version Path
0x006a0000 0x8000 6.01.7600.16385 C:\Windows\SysWOW64\svchost.exe
0x77700000 0x180000 6.01.7600.16695 C:\Windows\SysWOW64\ntdll.dll
0x76600000 0x100000 6.01.7600.16385 C:\Windows\syswow64\kernel32.dll
0x76890000 0x46000 6.01.7600.16385 C:\Windows\syswow64\KERNELBASE.dll
0x76410000 0xac000 7.00.7600.16385 C:\Windows\syswow64\msvcrt.dll
0x768e0000 0x19000 6.01.7600.16385 C:\Windows\SysWOW64\sechost.dll
0x76ee0000 0xf0000 6.01.7600.16385 C:\Windows\syswow64\RPCRT4.dll
0x75270000 0x60000 6.01.7600.16484 C:\Windows\syswow64\SspiCli.dll
0x75260000 0xc000 6.01.7600.16385 C:\Windows\syswow64\CRYPTBASE.dll
0x77100000 0x15c000 6.01.7600.16624 C:\Windows\syswow64\ole32.dll
0x76fd0000 0x90000 6.01.7600.16385 C:\Windows\syswow64\GDI32.dll
0x76cb0000 0x100000 6.01.7600.16385 C:\Windows\syswow64\USER32.dll
0x77260000 0xa0000 6.01.7600.16385 C:\Windows\syswow64\ADVAPI32.dll
0x76c20000 0xa000 6.01.7600.16385 C:\Windows\syswow64\LPK.dll
0x77060000 0x9d000 1.626.7600.16385 C:\Windows\syswow64\USP10.dll
0x767a0000 0x60000 6.01.7600.16385 C:\Windows\system32\IMM32.DLL
0x75360000 0xcc000 6.01.7600.16385 C:\Windows\syswow64\MSCTF.dll
0x01b60000 0x23000 3.00.0000.0001 c:\windows\system32\ezsvc7.dll
0x76570000 0x8f000 6.01.7600.16567 C:\Windows\syswow64\oleaut32.dll
0x73770000 0x9000 6.01.7600.16385 c:\windows\system32\version.dll
0x73520000 0x21000 6.01.7600.16385 C:\Windows\SysWOW64\ntmarta.dll
0x764c0000 0x45000 6.01.7600.16385 C:\Windows\syswow64\WLDAP32.dll
0x01600000 0x95000 4.02.0002.0066 c:\windows\system32\ezsvc7x.dll
0x73440000 0x84000 5.82.7600.16661 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\comctl32.dll
0x76db0000 0xf5000 8.00.7600.16723 C:\Windows\syswow64\wininet.dll
0x75620000 0x57000 6.01.7600.16385 C:\Windows\syswow64\SHLWAPI.dll
0x75680000 0x136000 8.00.7600.16723 C:\Windows\syswow64\urlmon.dll
0x76b00000 0x11c000 6.01.7600.16385 C:\Windows\syswow64\CRYPT32.dll
0x75350000 0xc000 6.01.7600.16415 C:\Windows\syswow64\MSASN1.dll
0x76900000 0x1fa000 8.00.7600.16722 C:\Windows\syswow64\iertutil.dll
------------------------------------------------------------------------------
svchost.exe pid: 1800
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 1248
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 2072
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 2796
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 5024
Command line: <no command line>
------------------------------------------------------------------------------
svchost.exe pid: 4200
Command line: <no command line>

------------------------------------------------------------------------------
csrss.exe pid: 392
Command line: <no command line>
------------------------------------------------------------------------------
csrss.exe pid: 492
Command line: <no command line>

------------------------------------------------------------------------------
smss.exe pid: 268
Command line: <no command line>

No matching processes were found.

No matching processes were found.

------------------------------------------------------------------------------
services.exe pid: 516
Command line: <no command line>

------------------------------------------------------------------------------
iexplore.exe pid: 648
Command line: "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
Base Size Version Path
0x013c0000 0xa6000 8.00.7600.16722 C:\Program Files (x86)\Internet Explorer\iexplore.exe
0x77700000 0x180000 6.01.7600.16695 C:\Windows\SysWOW64\ntdll.dll
0x76600000 0x100000 6.01.7600.16385 C:\Windows\syswow64\kernel32.dll
0x76890000 0x46000 6.01.7600.16385 C:\Windows\syswow64\KERNELBASE.dll
0x77260000 0xa0000 6.01.7600.16385 C:\Windows\syswow64\ADVAPI32.dll
0x76410000 0xac000 7.00.7600.16385 C:\Windows\syswow64\msvcrt.dll
0x768e0000 0x19000 6.01.7600.16385 C:\Windows\SysWOW64\sechost.dll
0x76ee0000 0xf0000 6.01.7600.16385 C:\Windows\syswow64\RPCRT4.dll
0x75270000 0x60000 6.01.7600.16484 C:\Windows\syswow64\SspiCli.dll
0x75260000 0xc000 6.01.7600.16385 C:\Windows\syswow64\CRYPTBASE.dll
0x76cb0000 0x100000 6.01.7600.16385 C:\Windows\syswow64\USER32.dll
0x76fd0000 0x90000 6.01.7600.16385 C:\Windows\syswow64\GDI32.dll
0x76c20000 0xa000 6.01.7600.16385 C:\Windows\syswow64\LPK.dll
0x77060000 0x9d000 1.626.7600.16385 C:\Windows\syswow64\USP10.dll
0x75620000 0x57000 6.01.7600.16385 C:\Windows\syswow64\SHLWAPI.dll
0x757c0000 0xc49000 6.01.7600.16644 C:\Windows\syswow64\SHELL32.dll
0x77100000 0x15c000 6.01.7600.16624 C:\Windows\syswow64\ole32.dll
0x76900000 0x1fa000 8.00.7600.16722 C:\Windows\syswow64\iertutil.dll
0x75680000 0x136000 8.00.7600.16723 C:\Windows\syswow64\urlmon.dll
0x76db0000 0xf5000 8.00.7600.16723 C:\Windows\syswow64\WININET.dll
0x76570000 0x8f000 6.01.7600.16567 C:\Windows\syswow64\OLEAUT32.dll
0x76b00000 0x11c000 6.01.7600.16385 C:\Windows\syswow64\CRYPT32.dll
0x75350000 0xc000 6.01.7600.16415 C:\Windows\syswow64\MSASN1.dll
0x767a0000 0x60000 6.01.7600.16385 C:\Windows\system32\IMM32.DLL
0x75360000 0xcc000 6.01.7600.16385 C:\Windows\syswow64\MSCTF.dll
0x70ad0000 0xa7f000 8.00.7600.16723 C:\Windows\system32\IEFRAME.dll
0x752d0000 0x5000 6.01.7600.16385 C:\Windows\syswow64\PSAPI.DLL
0x72d70000 0x3c000 7.00.0000.0000 C:\Windows\system32\OLEACC.dll
0x74cf0000 0x19e000 6.10.7600.16661 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
0x731e0000 0xb000 6.01.7600.16385 C:\Windows\system32\profapi.dll
0x752e0000 0x35000 6.01.7600.16385 C:\Windows\syswow64\ws2_32.DLL
0x76700000 0x6000 6.01.7600.16385 C:\Windows\syswow64\NSI.dll
0x73550000 0x44000 6.01.7600.16385 C:\Windows\system32\dnsapi.DLL
0x738d0000 0x1c000 6.01.7600.16385 C:\Windows\system32\iphlpapi.DLL
0x738c0000 0x7000 6.01.7600.16385 C:\Windows\system32\WINNSI.DLL
0x76c30000 0x7b000 6.01.7600.16385 C:\Windows\syswow64\comdlg32.dll
0x72e60000 0x80000 6.01.7600.16385 C:\Windows\system32\uxtheme.dll
0x10100000 0xe000 4.80.0103.0000 C:\Program Files\Logitech\SetPoint\x86\lgscroll.dll
0x732e0000 0x9b000 8.00.50727.4927 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCR80.dll
0x73520000 0x21000 6.01.7600.16385 C:\Windows\system32\ntmarta.dll
0x764c0000 0x45000 6.01.7600.16385 C:\Windows\syswow64\WLDAP32.dll
0x72fa0000 0xe000 6.01.7600.16385 C:\Windows\system32\RpcRtRemote.dll
0x72f40000 0x13000 6.01.7600.16385 C:\Windows\system32\dwmapi.dll
0x73770000 0x9000 6.01.7600.16385 C:\Windows\system32\VERSION.dll
0x73200000 0x4b000 6.01.7600.16385 C:\Windows\system32\apphelp.dll
0x76800000 0x83000 2001.12.8530.16385 C:\Windows\syswow64\CLBCatQ.DLL
0x73700000 0x52000 6.01.7600.16385 C:\Windows\system32\RASAPI32.dll
0x736e0000 0x15000 6.01.7600.16385 C:\Windows\system32\rasman.dll
0x739b0000 0xd000 6.01.7600.16617 C:\Windows\system32\rtutils.dll
0x73110000 0x6000 6.01.7600.16385 C:\Windows\system32\sensapi.dll
0x735e0000 0x10000 6.01.7600.16385 C:\Windows\system32\NLAapi.dll
0x733f0000 0x6000 6.01.7600.16385 C:\Windows\system32\rasadhlp.dll
0x69990000 0x2d000 8.00.7600.16700 C:\Windows\system32\IEUI.dll
0x72f60000 0x5000 6.01.7600.16385 C:\Windows\system32\MSIMG32.dll
0x736b0000 0x16000 6.01.7600.16385 C:\Windows\system32\CRYPTSP.dll
0x73670000 0x3b000 6.01.7600.16385 C:\Windows\system32\rsaenh.dll
0x69960000 0x2b000 8.00.7600.16722 C:\Program Files (x86)\Internet Explorer\ieproxy.dll
0x69750000 0x2f000 1.03.1000.0000 C:\Windows\system32\xmllite.dll
0x723c0000 0xf5000 7.00.7600.16385 C:\Windows\system32\propsys.dll
0x75430000 0x19d000 6.01.7600.16385 C:\Windows\syswow64\SETUPAPI.dll
0x76eb0000 0x27000 6.01.7600.16385 C:\Windows\syswow64\CFGMGR32.dll
0x75600000 0x12000 6.01.7600.16385 C:\Windows\syswow64\DEVOBJ.dll
0x697f0000 0x16f000 6.01.7600.16623 C:\Windows\system32\explorerframe.dll
0x697c0000 0x2f000 6.01.7600.16385 C:\Windows\system32\DUser.dll
0x69690000 0xb2000 6.01.7600.16385 C:\Windows\system32\DUI70.dll
0x695f0000 0x95000 8.00.7600.16722 C:\Windows\system32\msfeeds.dll
0x6b140000 0x5f000 6.01.7600.16385 C:\Windows\system32\SXS.DLL
0x69790000 0x2e000 6.01.7600.16385 C:\Windows\system32\MLANG.dll
0x776d0000 0x3000 6.01.7600.16385 C:\Windows\syswow64\Normaliz.dll
0x6c5e0000 0x133000 8.110.7600.16723 C:\Windows\System32\msxml3.dll
------------------------------------------------------------------------------
iexplore.exe pid: 5524
Command line: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:648 CREDAT:71937
Base Size Version Path
0x013c0000 0xa6000 8.00.7600.16722 C:\Program Files (x86)\Internet Explorer\iexplore.exe
0x77700000 0x180000 6.01.7600.16695 C:\Windows\SysWOW64\ntdll.dll
0x76600000 0x100000 6.01.7600.16385 C:\Windows\syswow64\kernel32.dll
0x76890000 0x46000 6.01.7600.16385 C:\Windows\syswow64\KERNELBASE.dll
0x77260000 0xa0000 6.01.7600.16385 C:\Windows\syswow64\ADVAPI32.dll
0x76410000 0xac000 7.00.7600.16385 C:\Windows\syswow64\msvcrt.dll
0x768e0000 0x19000 6.01.7600.16385 C:\Windows\SysWOW64\sechost.dll
0x76ee0000 0xf0000 6.01.7600.16385 C:\Windows\syswow64\RPCRT4.dll
0x75270000 0x60000 6.01.7600.16484 C:\Windows\syswow64\SspiCli.dll
0x75260000 0xc000 6.01.7600.16385 C:\Windows\syswow64\CRYPTBASE.dll
0x76cb0000 0x100000 6.01.7600.16385 C:\Windows\syswow64\USER32.dll
0x76fd0000 0x90000 6.01.7600.16385 C:\Windows\syswow64\GDI32.dll
0x76c20000 0xa000 6.01.7600.16385 C:\Windows\syswow64\LPK.dll
0x77060000 0x9d000 1.626.7600.16385 C:\Windows\syswow64\USP10.dll
0x75620000 0x57000 6.01.7600.16385 C:\Windows\syswow64\SHLWAPI.dll
0x757c0000 0xc49000 6.01.7600.16644 C:\Windows\syswow64\SHELL32.dll
0x77100000 0x15c000 6.01.7600.16624 C:\Windows\syswow64\ole32.dll
0x76900000 0x1fa000 8.00.7600.16722 C:\Windows\syswow64\iertutil.dll
0x75680000 0x136000 8.00.7600.16723 C:\Windows\syswow64\urlmon.dll
0x76db0000 0xf5000 8.00.7600.16723 C:\Windows\syswow64\WININET.dll
0x76570000 0x8f000 6.01.7600.16567 C:\Windows\syswow64\OLEAUT32.dll
0x76b00000 0x11c000 6.01.7600.16385 C:\Windows\syswow64\CRYPT32.dll
0x75350000 0xc000 6.01.7600.16415 C:\Windows\syswow64\MSASN1.dll
0x767a0000 0x60000 6.01.7600.16385 C:\Windows\system32\IMM32.DLL
0x75360000 0xcc000 6.01.7600.16385 C:\Windows\syswow64\MSCTF.dll
0x70ad0000 0xa7f000 8.00.7600.16723 C:\Windows\system32\IEFRAME.dll
0x752d0000 0x5000 6.01.7600.16385 C:\Windows\syswow64\PSAPI.DLL
0x72d70000 0x3c000 7.00.0000.0000 C:\Windows\system32\OLEACC.dll
0x74cf0000 0x19e000 6.10.7600.16661 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
0x76c30000 0x7b000 6.01.7600.16385 C:\Windows\syswow64\comdlg32.dll
0x699c0000 0x35000 8.00.7600.16385 C:\Program Files (x86)\Internet Explorer\IEShims.dll
0x72e60000 0x80000 6.01.7600.16385 C:\Windows\system32\uxtheme.dll
0x10100000 0xe000 4.80.0103.0000 C:\Program Files\Logitech\SetPoint\x86\lgscroll.dll
0x732e0000 0x9b000 8.00.50727.4927 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCR80.dll
0x72fa0000 0xe000 6.01.7600.16385 C:\Windows\system32\RpcRtRemote.dll
0x72f40000 0x13000 6.01.7600.16385 C:\Windows\system32\dwmapi.dll
0x76800000 0x83000 2001.12.8530.16385 C:\Windows\syswow64\CLBCatQ.DLL
0x723c0000 0xf5000 7.00.7600.16385 C:\Windows\system32\propsys.dll
0x73520000 0x21000 6.01.7600.16385 C:\Windows\system32\ntmarta.dll
0x764c0000 0x45000 6.01.7600.16385 C:\Windows\syswow64\WLDAP32.dll
0x731e0000 0xb000 6.01.7600.16385 C:\Windows\system32\profapi.dll
0x75430000 0x19d000 6.01.7600.16385 C:\Windows\syswow64\SETUPAPI.dll
0x76eb0000 0x27000 6.01.7600.16385 C:\Windows\syswow64\CFGMGR32.dll
0x75600000 0x12000 6.01.7600.16385 C:\Windows\syswow64\DEVOBJ.dll
0x736b0000 0x16000 6.01.7600.16385 C:\Windows\system32\CRYPTSP.dll
0x73670000 0x3b000 6.01.7600.16385 C:\Windows\system32\rsaenh.dll
0x69960000 0x2b000 8.00.7600.16722 C:\Program Files (x86)\Internet Explorer\ieproxy.dll
0x752e0000 0x35000 6.01.7600.16385 C:\Windows\syswow64\ws2_32.DLL
0x76700000 0x6000 6.01.7600.16385 C:\Windows\syswow64\NSI.dll
0x73550000 0x44000 6.01.7600.16385 C:\Windows\system32\dnsapi.DLL
0x738d0000 0x1c000 6.01.7600.16385 C:\Windows\system32\iphlpapi.DLL
0x738c0000 0x7000 6.01.7600.16385 C:\Windows\system32\WINNSI.DLL
0x73200000 0x4b000 6.01.7600.16385 C:\Windows\system32\apphelp.dll
0x73770000 0x9000 6.01.7600.16385 C:\Windows\system32\VERSION.dll
0x73700000 0x52000 6.01.7600.16385 C:\Windows\system32\RASAPI32.dll
0x736e0000 0x15000 6.01.7600.16385 C:\Windows\system32\rasman.dll
0x739b0000 0xd000 6.01.7600.16617 C:\Windows\system32\rtutils.dll
0x73110000 0x6000 6.01.7600.16385 C:\Windows\system32\sensapi.dll
0x735a0000 0x3c000 6.01.7600.16385 C:\Windows\system32\mswsock.dll
0x72a50000 0x5000 6.01.7600.16385 C:\Windows\System32\wshtcpip.dll
0x776d0000 0x3000 6.01.7600.16385 C:\Windows\syswow64\Normaliz.dll
0x735e0000 0x10000 6.01.7600.16385 C:\Windows\system32\NLAapi.dll
0x733f0000 0x6000 6.01.7600.16385 C:\Windows\system32\rasadhlp.dll
0x69790000 0x2e000 6.01.7600.16385 C:\Windows\system32\MLANG.dll
0x733e0000 0x6000 6.01.7600.16385 C:\Windows\System32\wship6.dll
0x73400000 0x38000 6.01.7600.16385 C:\Windows\System32\fwpuclnt.dll
0x69590000 0x54000 6.06.1124.0846 C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
0x72f20000 0x17000 6.01.7600.16385 C:\Windows\system32\USERENV.dll
0x75320000 0x2d000 6.01.7600.16493 C:\Windows\syswow64\WINTRUST.dll
0x73440000 0x84000 5.82.7600.16661 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\Comctl32.dll
0x69570000 0x11000 9.01.0000.0163 C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
0x73250000 0x87000 8.00.50727.4927 C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCP80.dll
0x69780000 0x10000 9.01.0000.0163 C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x10000000 0x25000 3.04.1545.0153 C:\Program Files (x86)\freeTVRadio\spointer\extensions\freetvradio_air_ie.dll
0x6b140000 0x5f000 6.01.7600.16385 C:\Windows\system32\SXS.DLL
0x69540000 0x30000 3.00.0126.0000 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
0x72fb0000 0x157000 6.30.7600.16723 C:\Windows\System32\msxml6.dll
0x69500000 0x3f000 3.00.0126.0000 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll
0x731d0000 0x7000 6.01.7600.16385 C:\Windows\system32\WSOCK32.dll
0x694d0000 0x2f000 3.00.0126.0000 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Box Extension\srchbxex.dll
0x29500000 0x67000 5.00.0818.0005 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
0x27500000 0x11a000 5.00.0818.0005 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\msidcrl40.DLL
0x060e0000 0xd2000 5.06.5805.1910 C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
0x755d0000 0x2a000 6.01.7600.16385 C:\Windows\syswow64\imagehlp.dll
0x74fd0000 0x38000 6.01.7600.16385 C:\Windows\system32\ncrypt.dll
0x73650000 0x17000 6.01.7600.16385 C:\Windows\system32\bcrypt.dll
0x73610000 0x3d000 6.01.7600.16385 C:\Windows\SysWOW64\bcryptprimitives.dll
0x6d440000 0xc000 6.00.0170.0004 C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
0x7c340000 0x56000 7.10.3052.0004 C:\Program Files (x86)\Java\jre6\bin\MSVCR71.dll
0x74fb0000 0x16000 6.01.7600.16385 C:\Windows\system32\GPAPI.dll
0x74f60000 0xe000 6.01.7600.16385 C:\Windows\system32\DEVRTL.dll
0x74f90000 0x1c000 6.01.7600.16385 C:\Windows\system32\cryptnet.dll
0x74f70000 0x15000 6.01.7600.16385 C:\Windows\system32\Cabinet.dll
0x72f70000 0x12000 6.01.7600.16385 C:\Windows\system32\MPR.dll
0x6c5e0000 0x133000 8.110.7600.16723 C:\Windows\System32\msxml3.dll
0x65ab0000 0x408000 6.06.1124.0846 C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_62143F5971887053.dll
0x6e060000 0x240000 5.00.7600.16385 C:\Windows\system32\msi.dll
0x72f60000 0x5000 6.01.7600.16385 C:\Windows\system32\MSIMG32.dll
0x739c0000 0x190000 6.01.7600.16385 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
0x65950000 0x153000 6.01.7600.16385 C:\Windows\system32\query.dll
0x66ab0000 0x1c9000 6.06.1124.0846 C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll
0x65860000 0xeb000 6.01.7600.16385 C:\Windows\system32\dbghelp.dll
0x69490000 0x14000 6.01.7600.16544 C:\Windows\system32\asycfilt.dll
0x08b70000 0x123000 2.02.2613.0045 C:\Program Files (x86)\OfferBox\OfferBoxBHO.dll
0x65210000 0x5b7000 8.00.7600.16722 C:\Windows\SysWOW64\mshtml.dll
0x67710000 0x2a000 3.10.0349.0000 C:\Windows\SysWOW64\msls31.dll
0x67700000 0xb000 6.01.7600.16385 C:\Windows\system32\msimtf.dll
0x73510000 0x8000 6.01.7600.16385 C:\Windows\System32\winrnr.dll
0x73500000 0x10000 6.01.7600.16385 C:\Windows\system32\napinsp.dll
0x734e0000 0x12000 6.01.7600.16385 C:\Windows\system32\pnrpnsp.dll
0x734d0000 0xd000 6.01.7600.16385 C:\Windows\system32\wshbth.dll
0x65150000 0xb2000 5.08.7600.16732 C:\Windows\SysWOW64\jscript.dll
0x676f0000 0xb000 8.00.7600.16385 C:\Windows\system32\ImgUtil.dll
0x676e0000 0xe000 8.00.7600.16385 C:\Windows\SysWOW64\pngfilt.dll
0x69750000 0x2f000 1.03.1000.0000 C:\Windows\system32\XmlLite.dll
0x64fd0000 0x39000 8.00.7600.16385 C:\Windows\SysWOW64\Dxtrans.dll
0x64fb0000 0x14000 3.05.2284.0000 C:\Windows\SysWOW64\ATL.DLL
0x67640000 0xa000 6.01.7600.16385 C:\Windows\SysWOW64\ddrawex.dll
0x6fc00000 0xe7000 6.01.7600.16385 C:\Windows\SysWOW64\DDRAW.dll
0x72ca0000 0x6000 6.01.7600.16385 C:\Windows\SysWOW64\DCIMAN32.dll
0x6b5a0000 0x2fd000 8.14.0010.0678 C:\Windows\system32\atiumdag.dll
0x6b2c0000 0x2d4000 8.14.0010.0228 C:\Windows\system32\atiumdva.dll
0x64f50000 0x57000 8.00.7600.16385 C:\Windows\SysWOW64\Dxtmsft.dll
0x74650000 0x32000 6.01.7600.16385 C:\Windows\system32\WINMM.dll
0x6a470000 0x39000 6.01.7600.16385 C:\Windows\system32\MMDevAPI.DLL
0x6a400000 0x30000 6.01.7600.16385 C:\Windows\system32\wdmaud.drv
0x6a3f0000 0x4000 6.01.7600.16385 C:\Windows\system32\ksuser.dll
0x6a4c0000 0x7000 6.01.7600.16385 C:\Windows\system32\AVRT.dll
0x6a430000 0x36000 6.01.7600.16385 C:\Windows\system32\AUDIOSES.DLL
0x6a3e0000 0x8000 6.01.7600.16385 C:\Windows\system32\msacm32.drv
0x72d50000 0x14000 6.01.7600.16385 C:\Windows\system32\MSACM32.dll
0x6a3d0000 0x7000 6.01.7600.16385 C:\Windows\system32\midimap.dll
0x64f20000 0x30000 8.00.7600.16722 C:\Windows\SysWOW64\iepeers.dll
0x72ab0000 0x51000 6.01.7600.16385 C:\Windows\SysWOW64\WINSPOOL.DRV
0x64830000 0x5fb000 10.02.0152.0026 C:\Windows\SysWOW64\Macromed\Flash\Flash10m.ocx
0x6b040000 0x72000 6.01.7600.16385 C:\Windows\system32\DSOUND.dll
0x6b010000 0x25000 6.01.7600.16385 C:\Windows\system32\POWRPROF.dll
0x707c0000 0x79000 6.01.7600.16385 C:\Windows\system32\mscms.dll
0x69b70000 0xcc000 6.01.7600.16385 C:\Windows\system32\D3DIM700.DLL

No matching processes were found.

No matching processes were found.

No matching processes were found.

No matching processes were found.


¤¤¤¤¤¤¤¤¤¤ System32 ¤¤¤¤¤¤¤¤¤

22/08/2009 07:46 | 0 - C:\Windows\System32\040C
10/06/2009 22:16 | 2151 - C:\Windows\System32\12520437.cpx
10/06/2009 22:16 | 2233 - C:\Windows\System32\12520850.cpx
14/07/2009 02:14 | 130560 - C:\Windows\System32\aaclient.dll
14/07/2009 02:14 | 3727360 - C:\Windows\System32\accessibilitycpl.dll
14/07/2009 02:03 | 39424 - C:\Windows\System32\ACCTRES.dll
14/07/2009 02:14 | 7680 - C:\Windows\System32\acledit.dll
14/07/2009 02:14 | 125440 - C:\Windows\System32\aclui.dll
14/07/2009 02:14 | 45568 - C:\Windows\System32\acppage.dll
14/07/2009 02:14 | 744448 - C:\Windows\System32\ActionCenter.dll
14/07/2009 02:14 | 537600 - C:\Windows\System32\ActionCenterCPL.dll
14/07/2009 02:14 | 202752 - C:\Windows\System32\activeds.dll
14/07/2009 00:37 | 111616 - C:\Windows\System32\activeds.tlb
14/07/2009 02:14 | 309248 - C:\Windows\System32\actxprxy.dll
14/07/2009 02:14 | 38912 - C:\Windows\System32\AdapterTroubleshooter.exe
14/07/2009 02:14 | 73216 - C:\Windows\System32\admparse.dll
14/07/2009 02:14 | 49664 - C:\Windows\System32\adprovider.dll
14/07/2009 02:14 | 186880 - C:\Windows\System32\adsldp.dll
14/07/2009 02:14 | 202752 - C:\Windows\System32\adsldpc.dll
14/07/2009 02:14 | 77312 - C:\Windows\System32\adsmsext.dll
14/07/2009 02:14 | 260608 - C:\Windows\System32\adsnt.dll
14/07/2009 02:03 | 680448 - C:\Windows\System32\adtschema.dll
14/07/2009 04:20 | 0 - C:\Windows\System32\AdvancedInstallers
14/07/2009 02:14 | 640000 - C:\Windows\System32\advapi32.dll
14/07/2009 02:14 | 126464 - C:\Windows\System32\advpack.dll
14/07/2009 02:14 | 6656 - C:\Windows\System32\aecache.dll
14/07/2009 02:03 | 23040 - C:\Windows\System32\aeevts.dll
14/07/2009 02:14 | 46592 - C:\Windows\System32\AltTab.dll
13/07/2009 22:04 | 18432 - C:\Windows\System32\amcompat.tlb
02/07/2009 21:32 | 51712 - C:\Windows\System32\amdpcom32.dll
14/07/2009 02:14 | 70656 - C:\Windows\System32\amstream.dll
14/07/2009 02:14 | 24064 - C:\Windows\System32\amxread.dll
14/07/2009 02:14 | 1739776 - C:\Windows\System32\apds.dll
14/07/2009 02:14 | 15360 - C:\Windows\System32\apilogen.dll
14/07/2009 02:14 | 221184 - C:\Windows\System32\apircl.dll
14/07/2009 02:03 | 6656 - C:\Windows\System32\apisetschema.dll
14/07/2009 02:14 | 292352 - C:\Windows\System32\apphelp.dll
14/07/2009 02:14 | 29696 - C:\Windows\System32\Apphlpdm.dll
14/07/2009 02:14 | 50688 - C:\Windows\System32\appidapi.dll
14/07/2009 02:14 | 649216 - C:\Windows\System32\appwiz.cpl
14/07/2009 02:14 | 200192 - C:\Windows\System32\apss.dll
14/07/2009 04:20 | 4096 - C:\Windows\System32\ar-SA
14/07/2009 02:14 | 20992 - C:\Windows\System32\ARP.EXE
14/07/2009 02:03 | 2048 - C:\Windows\System32\asferror.dll
05/03/2010 08:42 | 67584 - C:\Windows\System32\asycfilt.dll
14/07/2009 02:14 | 24064 - C:\Windows\System32\at.exe
14/07/2009 02:14 | 29184 - C:\Windows\System32\AtBroker.exe
02/07/2009 22:14 | 43520 - C:\Windows\System32\ati2edxx.dll
02/07/2009 21:32 | 184320 - C:\Windows\System32\atiadlxy.dll
02/07/2009 21:28 | 53248 - C:\Windows\System32\aticalcl.dll
02/07/2009 21:27 | 3264512 - C:\Windows\System32\aticaldd.dll
02/07/2009 21:28 | 53248 - C:\Windows\System32\aticalrt.dll
02/07/2009 22:10 | 2469888 - C:\Windows\System32\atidxx32.dll
02/07/2009 21:32 | 51712 - C:\Windows\System32\atimpc32.dll
02/07/2009 21:51 | 11650560 - C:\Windows\System32\atioglxx.dll
02/07/2009 22:14 | 356352 - C:\Windows\System32\atipdlxx.dll
02/07/2009 21:59 | 3105280 - C:\Windows\System32\atiumdag.dll
02/07/2009 21:44 | 219120 - C:\Windows\System32\atiumdva.cap
02/07/2009 21:44 | 2868224 - C:\Windows\System32\atiumdva.dll
14/07/2009 02:14 | 70144 - C:\Windows\System32\atl.dll
23/07/2009 19:46 | 89088 - C:\Windows\System32\atl71.dll
07/01/2011 06:33 | 294400 - C:\Windows\System32\atmfd.dll
07/01/2011 08:27 | 34304 - C:\Windows\System32\atmlib.dll
14/07/2009 02:14 | 16384 - C:\Windows\System32\attrib.exe
14/07/2009 02:14 | 243712 - C:\Windows\System32\audiodev.dll
14/07/2009 02:14 | 374784 - C:\Windows\System32\AudioEng.dll
14/07/2009 02:16 | 442880 - C:\Windows\System32\AUDIOKSE.dll
14/07/2009 02:14 | 195584 - C:\Windows\System32\AudioSes.dll
14/07/2009 02:14 | 50176 - C:\Windows\System32\auditpol.exe
14/07/2009 02:14 | 334336 - C:\Windows\System32\authfwcfg.dll
14/07/2009 02:14 | 297472 - C:\Windows\System32\AuthFWGP.dll
14/07/2009 02:23 | 5070848 - C:\Windows\System32\AuthFWSnapin.dll
14/07/2009 02:20 | 126976 - C:\Windows\System32\AuthFWWizFwk.dll
14/07/2009 02:14 | 1792000 - C:\Windows\System32\authui.dll
14/07/2009 02:14 | 98816 - C:\Windows\System32\authz.dll
14/07/2009 02:14 | 668160 - C:\Windows\System32\autochk.exe
14/07/2009 02:14 | 679936 - C:\Windows\System32\autoconv.exe
14/07/2009 02:14 | 659456 - C:\Windows\System32\autofmt.exe
14/07/2009 02:14 | 146944 - C:\Windows\System32\autoplay.dll
14/07/2009 02:14 | 119808 - C:\Windows\System32\AuxiliaryDisplayApi.dll
14/07/2009 02:14 | 665600 - C:\Windows\System32\AuxiliaryDisplayCpl.dll
14/07/2009 02:14 |

comment ça? faut que je désactive le pare-feu puis que je lance une recherche avec list killem?

oui j'ai fait ça

voilà!

======= RAPPORT D'AD-REMOVER 2.0.0.2,E | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 16/02/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 18:32:54 le 16/02/2011, Mode normal

Microsoft Windows 7 Édition Familiale Premium (X64)
elenas@ELENAS-PC (Hewlett-Packard HP Pavilion dv6 Notebook PC)

============== ACTION(S) ==============


Fichier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navigateur OfferBox.lnk
Dossier supprimé: C:\Users\elenas\AppData\Roaming\FissaSearch
Dossier supprimé: C:\Users\elenas\AppData\Roaming\freeTVRadio
Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\freeTVRadio
Dossier supprimé: C:\Program Files (x86)\freeTVRadio
Dossier supprimé: C:\Users\elenas\AppData\Roaming\OfferBox
Dossier supprimé: C:\Program Files (x86)\OfferBox

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Classes\CLSID\{20B456BE-E93B-48C4-B8E8-876AC01E8A20}
Clé supprimée: HKLM\Software\Classes\Interface\{20B456BE-E93B-48C4-B8E8-876AC01E8A20}
Clé supprimée: HKLM\Software\Classes\CLSID\{40038D23-8356-413e-95B5-4070C5D042FF}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{40038D23-8356-413e-95B5-4070C5D042FF}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{40038D23-8356-413e-95B5-4070C5D042FF}
Clé supprimée: HKLM\Software\Classes\CLSID\{4C4AD71D-52E1-4402-9E5B-CBFC295EC9BA}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4C4AD71D-52E1-4402-9E5B-CBFC295EC9BA}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4C4AD71D-52E1-4402-9E5B-CBFC295EC9BA}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4C4AD71D-52E1-4402-9E5B-CBFC295EC9BA}
Clé supprimée: HKLM\Software\Classes\CLSID\{8297AC2F-3E7C-4fd3-B2C0-141BEDCD5531}
Clé supprimée: HKLM\Software\Classes\CLSID\{A1F3BAED-C4B1-4E7D-9AD4-3FEAC1ABB06C}
Clé supprimée: HKLM\Software\Classes\Interface\{A1F3BAED-C4B1-4E7D-9AD4-3FEAC1ABB06C}
Clé supprimée: HKLM\Software\Classes\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}
Clé supprimée: HKLM\Software\Classes\CLSID\{D5F775F6-8871-46a4-9521-68A9694B6830}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D5F775F6-8871-46a4-9521-68A9694B6830}
Clé supprimée: HKLM\Software\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Clé supprimée: HKLM\Software\Classes\Interface\{34F04421-91D1-4379-84C0-A3337B9B329C}
Clé supprimée: HKLM\Software\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}
Clé supprimée: HKLM\Software\Classes\Interface\{6FF5D94E-4D97-40ED-BCFE-972920872F8C}
Clé supprimée: HKLM\Software\Classes\Interface\{82A33B3E-AD1E-447C-B3DD-EA92A3B17900}
Clé supprimée: HKLM\Software\Classes\Interface\{9A180B16-B066-4A23-83F8-D8E1FA5955EC}
Clé supprimée: HKLM\Software\Classes\Interface\{D37AD704-A040-4624-BAEF-38099602BB77}
Clé supprimée: HKLM\Software\Classes\Interface\{F440E13E-5C6B-4BA1-B49C-54248679ECE7}
Clé supprimée: HKLM\Software\Classes\TypeLib\{668BB13D-ADB8-4ACD-8F00-1918A2F90DB2}
Clé supprimée: HKLM\Software\Classes\TypeLib\{9BDD9C6D-DA52-4BB3-9BA9-CA96ABA913D2}
Clé supprimée: HKLM\Software\Classes\TypeLib\{B35D2ED7-9F30-43B7-B32F-38E1AB1829CA}
Clé supprimée: HKLM\Software\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}
Clé supprimée: HKLM\Software\Classes\Freetvradio.Spointer
Clé supprimée: HKLM\Software\Classes\Freetvradio.Spointer.1
Clé supprimée: HKLM\Software\Classes\Freetvradio.SpointerCtrl
Clé supprimée: HKLM\Software\Classes\Freetvradio.SpointerCtrl.1
Clé supprimée: HKLM\Software\Classes\Freetvradio.SpointerWebDisp
Clé supprimée: HKLM\Software\Classes\Freetvradio.SpointerWebDisp.1
Clé supprimée: HKLM\Software\Classes\OfferBox.OfferBoxServer
Clé supprimée: HKLM\Software\Classes\OfferBox.OfferBoxServer.1
Clé supprimée: HKLM\Software\freeTVRadio
Clé supprimée: HKCU\Software\OfferBox
Clé supprimée: HKCU\Software\freeTVRadio
Clé supprimée: HKCU\Software\Spointer
Clé supprimée: HKLM\Software\Classes\Installer\Products\5B4758C25396ECF468E04F8E063287FF
Clé supprimée: HKLM\Software\Classes\Installer\Products\64B074831FB9EA045A886FDAD6C1D224
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{b41306c6-96d0-442a-bcc4-b0f621e82ce9}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B5312367-B3B5-4757-8247-B70184629B2B}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fissa
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2C8574B5-6935-4FCE-860E-F4E8602378FF}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{38470B46-9BF1-40AE-A588-F6AD6D1C2D42}
Clé supprimée: HKLM\Software\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom
Clé supprimée: HKLM\Software\Google\Chrome\Extensions\oohnlejpdjjmpndgdpcicjiajhmgeoma

Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|freetvradio@spointer.com
Valeur supprimée: HKLM\Software\Mozilla\Firefox\Extensions|offerboxffx@offerbox.com


============== SCAN ADDITIONNEL ==============

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{EF99BD32-C1FB-11D2-892F-0090271D4F88} - "Yahoo! Toolbar" (C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll)
HKCU_SearchScopes\{9EAC3C5C-DE66-4DC6-8F0F-8F6475D85F69} - "Kelkoo" (hxxp://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromfor...)
HKLM_SearchScopes\{9EAC3C5C-DE66-4DC6-8F0F-8F6475D85F69} - "Kelkoo" (hxxp://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromfor...)
HKCU_Toolbar\WebBrowser|{DE9C389F-3316-41A7-809B-AA305ED9D922} (C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll)
HKCU_Toolbar\WebBrowser|{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} (C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll)
HKLM_Toolbar|{DE9C389F-3316-41A7-809B-AA305ED9D922} (C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll)
HKLM_Toolbar|{EF99BD32-C1FB-11D2-892F-0090271D4F88} (C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll)
HKLM_Toolbar|{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} (C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll)
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{2211118d-417c-4791-8024-4d098a848551} - c:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.87-8876480SL\Program\register.exe (x)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{7fd136df-fe1b-4e9c-b3a9-3e20315f09c8} - c:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.87-8876480SL\Program\PrvCnt.exe (x)
HKLM_ElevationPolicy\{ADADAEE2-457A-4984-A57C-E01C3A2BA612} - c:\program files (x86)\aol\aol toolbar 5.0\AolTbServer.exe (AOL LLC)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
HKLM_Extensions\{CCA281CA-C863-46ef-9331-5C8D4460577F} - "Envoyer à Bluetooth" (C:\Program Files\WIDCOMM\Bluetooth Software\bt_cold_icon.ico)
BHO\{02478D38-C3F9-4efb-9B51-7695ECA05670} - "&Yahoo! Toolbar Helper" (C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - "AOL Toolbar BHO" (C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 64 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 14 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 16/02/2011 18:33:23 (9136 Octet(s))

Fin à: 18:34:16, 16/02/2011

============== E.O.F ==============