Je crois avoir un virus... help Fermé

Question

Bonjour, 

Voila quand je démarre mon pc j'ai direct un message d'erreur en arrivant sur windows :
"impossible de charger ou d'executer 'c:\docume~1\alpha\locals~1	emp\csrss.exe' spécifié dans le registre. verifiez que le fichier existe sur votre ordinateur ou supprimez la référence dans le registre."
Depuis je ne peux plus acceder aux pages internet, je suis connectée mais les pages ne s'ouvrent plus...

Voici mon rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53:14, on 11/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
E:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:61717
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote	bVuz1.dll
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
F3 - REG:win.ini: load=C:\DOCUME~1\Alpha\LOCALS~1\Temp\csrss.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {19DF9C3A-F076-4DB8-9102-BFC1DC731E44} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O2 - BHO: (no name) - {37562885-B2F3-439E-994C-C3ACD92B1027} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {6CF27D33-A7EB-49E4-BCA7-0160CAD403E7} - (no file)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
O2 - BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote	bVuz1.dll
O2 - BHO: (no name) - {CF9267AF-EFBB-49D9-853A-D50754475903} - (no file)
O2 - BHO: (no name) - {DB35C569-5624-4CFC-8043-E5139F55A073} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E1696C59-5919-4910-92F1-1F41B3493635} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - (no file)
O2 - BHO: (no name) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)
O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote	bVuz1.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngin0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ClickPotatoLiteSA] "C:\Program Files\ClickPotatoLite\bin\10.0.625.0\ClickPotatoLiteSA.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [conhost] C:\Documents and Settings\Alpha\Application Data\Microsoft\conhost.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: Consulter les dictionnaires (SYSTRAN) - res://C:\GUIres.dll/lookup.js
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
O8 - Extra context menu item: Traduire (SYSTRAN) - res://C:\GUIres.dll/translate.js
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ClickPotato - {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} - C:\Program Files\ClickPotatoLite\bin\10.0.625.0\ClickPotatoLiteSABHO.dll (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.01net.com/telecharger/
O15 - Trusted Zone: https://www.perlesandco.com/
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} (Java Plug-in 1.6.0_13) - 
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} (Java Plug-in 1.6.0_14) - 
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - 
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Control) - https://plugins.valueactive.eu/flashax/iefax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C64F6EE2-B6B0-47D1-B348-29D32A44BFF3}: NameServer = 192.168.1.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: xxyvwXOg - C:\WINDOWS\
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

gen-hackman · Answer

salut /!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\ __________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<< ===================================================== ▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur Telecharge ici : Combofix Avant d'utiliser ComboFix : Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système. La simple désactivation du résident n'est pas suffisante. Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover Choisis la version adéquate (32 ou 64 bits)/!\ Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement : ▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau ▶ Lance le Une fenêtre apparait : clique sur "Disable" ▶ Fais redémarrer l'ordinateur si l'outil te le demande Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable" _________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° si tu as XP => double clique si tu as Vista ou windows 7 => clic droit "executer en tant que...." sur combofix renommé ¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤ ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. ▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

tamerofdragons · Answer

Bonjour,

Voici mon rapport combofix :ComboFix 11-03-10.04 - Alpha 11/03/2011  20:44:34.1.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.2046.1496 [GMT 1:00]
Lancé depuis: E:\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Kaspersky Anti-Virus *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\ClickPotatoLiteSA
c:\documents and settings\Alpha\Application Data\ClickPotatoLite
c:\documents and settings\Alpha\Application Data\Dealio
c:\documents and settings\Alpha\Application Data\Dealioes\widgets.xml
c:\documents and settings\Alpha\Application Data\Dealio	emp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\program files\ClickPotatoLite
c:\program files\Search Settings
c:\program files\Search Settings\SearchSettings.exe
c:\program files\Search Settings\SearchSettingsRes409.dll
.
.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_WINSVC
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2011-02-11 au 2011-03-11  ))))))))))))))))))))))))))))))))))))
.
.
2011-03-11 16:32 . 2011-03-11 16:32	4724	----a-w-	c:\windows\system32\PerfStringBackup.TMP
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-04 16:48 . 2004-08-10 19:00	456192	----a-w-	c:\windows\system32\encdec.dll
2011-02-04 16:48 . 2004-08-10 19:00	291840	------w-	c:\windows\system32\sbe.dll
2011-02-02 07:59 . 2006-10-26 15:36	2067456	----a-w-	c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2006-10-26 15:36	677888	----a-w-	c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-10 19:00	441344	----a-w-	c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2004-08-10 19:00	290048	----a-w-	c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2005-10-06 03:08	1855104	----a-w-	c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-10 19:00	301568	----a-w-	c:\windows\system32\kerberos.dll
2010-12-20 23:53 . 2004-08-10 19:00	916480	----a-w-	c:\windows\system32\wininet.dll
2010-12-20 23:53 . 2004-08-10 19:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2010-12-20 23:53 . 2004-08-10 19:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2010-12-20 17:26 . 2004-10-28 01:24	736768	----a-w-	c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-10 19:00	385024	----a-w-	c:\windows\system32\html.iec
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote	bVuz1.dll" [2011-02-23 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-02-23 22:06	3911776	----a-w-	c:\program files\ConduitEngine\ConduitEngin0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2011-02-23 22:06	3911776	----a-w-	c:\program files\Vuze_Remote	bVuz1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote	bVuz1.dll" [2011-02-23 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2011-02-23 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote	bVuz1.dll" [2011-02-23 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngin0.dll" [2011-02-23 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-14 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-11 13671016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-11 110696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe" [2009-03-30 198160]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SASWinLogon]
2007-04-19 11:41	294912	----a-w-	c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Alpha^Menu Démarrer^Programmes^Démarrage^Notification de cadeaux MSN.lnk]
backup=c:\windows\pss\Notification de cadeaux MSN.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CSmileys
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-04-11 11:23	13671016	----a-w-	c:\windows\system32
vcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-04-11 11:23	110696	----a-w-	c:\windows\system32
vmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 20:16	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-03-30 16:41	198160	----a-w-	c:\program files\Fichiers communs\Real\Update_OBealsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-disabled]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\SpellForce\SpellForce 2 - Shadow Wars\spellforce2.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\Vuze\Azureus.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"16759:TCP"= 16759:TCP:emule_TCP
"21172:UDP"= 21172:UDP:emule_UDP
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [28/05/2008 09:33 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [28/05/2008 09:33 55024]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [18/09/2009 22:21 108289]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [08/01/2010 00:51 380928]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14/01/2011 19:53 136176]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys --> c:\windows\system32\DRIVERS\klim5.sys [?]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys --> c:\windows\system32\DRIVERS\klmouflt.sys [?]
S3 MBAMCatchMe;MBAMCatchMe;c:\windows\system32\drivers\mbamcatchme.sys [17/06/2008 23:27 34296]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [28/05/2008 09:33 7408]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [31/05/2004 12:28 217088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx	REG_MULTI_SZ   	scan
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
2008-02-25 09:55	7680	----a-w-	c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contenu du dossier 'Tâches planifiées'
.
2011-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 09:50]
.
2011-03-11 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-04-19 15:02]
.
2011-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-14 18:52]
.
2011-03-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-14 18:52]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uStart Page = about:blank
uInternet Settings,ProxyServer = http=127.0.0.1:61717
IE: Consulter les dictionnaires (SYSTRAN) - c:\GUIres.dll/lookup.js
IE: E&xporter vers Microsoft Excel
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Traduire (SYSTRAN) - c:\GUIres.dll/translate.js
Trusted Zone: perlesandco.com\www
TCP: {C64F6EE2-B6B0-47D1-B348-29D32A44BFF3} = 192.168.1.1
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
.
- - - - ORPHELINS SUPPRIMES - - - -
.
BHO-{19DF9C3A-F076-4DB8-9102-BFC1DC731E44} - (no file)
BHO-{37562885-B2F3-439E-994C-C3ACD92B1027} - (no file)
BHO-{6CF27D33-A7EB-49E4-BCA7-0160CAD403E7} - (no file)
BHO-{CF9267AF-EFBB-49D9-853A-D50754475903} - (no file)
BHO-{DB35C569-5624-4CFC-8043-E5139F55A073} - (no file)
BHO-{E1696C59-5919-4910-92F1-1F41B3493635} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
HKLM-Run-ClickPotatoLiteSA - c:\program files\ClickPotatoLite\bin\10.0.625.0\ClickPotatoLiteSA.exe
HKLM-Run-conhost - c:\documents and settings\Alpha\Application Data\Microsoft\conhost.exe
Notify-xxyvwXOg - (no file)
MSConfigStartUp-ISUSPM - c:\program files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe
MSConfigStartUp-nwiz - nwiz.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-11 20:53
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  MsnMsgr = "c:\program files\Windows Live\Messenger\msnmsgr.exe" /background??s 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Msfs]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSIServer]
"ImagePath"="%systemroot%\system32\msiexec.exe /V"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSKSSRV]
"ImagePath"="system32\drivers\MSKSSRV.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSPCLOCK]
"ImagePath"="system32\drivers\MSPCLOCK.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\MSPQM]
"ImagePath"="system32\drivers\MSPQM.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\mssmbios]
"ImagePath"="system32\DRIVERS\mssmbios.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Mup]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services
apagent]
"ServiceDll"="%SystemRoot%\System32\qagentrt.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NDIS]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NdisTapi]
"ImagePath"="system32\DRIVERS
distapi.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ndisuio]
"ImagePath"="system32\DRIVERS
disuio.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NdisWan]
"ImagePath"="system32\DRIVERS
diswan.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NDProxy]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetBIOS]
"ImagePath"="system32\DRIVERS
etbios.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetBT]
"ImagePath"="system32\DRIVERS
etbt.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetDDE]
"ImagePath"="%SystemRoot%\system32
etdde.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetDDEdsdm]
"ImagePath"="%SystemRoot%\system32
etdde.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Netlogon]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Netman]
"ServiceDll"="%SystemRoot%\System32
etman.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NetTcpPortSharing]
"ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NIC1394]
"ImagePath"="system32\DRIVERS
ic1394.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Nla]
"ServiceDll"="%SystemRoot%\System32\mswsock.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NMIndexingService]
"ImagePath"="\"c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe\""
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services
mwcd]
"ImagePath"="system32\drivers\ccdcmb.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services
mwcdc]
"ImagePath"="system32\drivers\ccdcmbo.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Npfs]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ntfs]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NtLmSsp]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NtmsSvc]
"ServiceDll"="%SystemRoot%\system32
tmssvc.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Null]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services
v]
"ImagePath"="system32\DRIVERS
v4_mini.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NVSvc]
"ImagePath"="%SystemRoot%\system32
vsvc32.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NwlnkFlt]
"ImagePath"="system32\DRIVERS
wlnkflt.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\NwlnkFwd]
"ImagePath"="system32\DRIVERS
wlnkfwd.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ohci1394]
"ImagePath"="system32\DRIVERS\ohci1394.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ose]
"ImagePath"="\"c:\program files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE\""
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Outlook]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Parport]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PartMgr]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ParVdm]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PavProc]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCANDIS5]
"ImagePath"="\??\c:\windows\system32\PCANDIS5.SYS"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\pccsmcfd]
"ImagePath"="system32\DRIVERS\pccsmcfd.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCI]
"ImagePath"="system32\DRIVERS\pci.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCIDump]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PCIIde]
"ImagePath"="system32\DRIVERS\pciide.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Pcmcia]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDCOMP]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDFRAME]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDRELI]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PDRFRAME]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\perc2]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\perc2hib]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfDisk]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfNet]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfOS]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PerfProc]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PlugPlay]
"ImagePath"="%SystemRoot%\system32\services.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PolicyAgent]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PptpMiniport]
"ImagePath"="system32\DRIVERSaspptp.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ProtectedStorage]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PSched]
"ImagePath"="system32\DRIVERS\psched.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ptilink]
"ImagePath"="system32\DRIVERS\ptilink.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\PxHelp20]
"ImagePath"="System32\Drivers\PxHelp20.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql1080]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Ql10wnt]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql12160]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql1240]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ql1280]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasAcd]
"ImagePath"="system32\DRIVERSasacd.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasAuto]
"ServiceDll"="%SystemRoot%\System32asauto.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Rasl2tp]
"ImagePath"="system32\DRIVERSasl2tp.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasMan]
"ServiceDll"="%SystemRoot%\System32asmans.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RasPppoe]
"ImagePath"="system32\DRIVERSaspppoe.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Raspti]
"ImagePath"="system32\DRIVERSaspti.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Rdbss]
"ImagePath"="system32\DRIVERSdbss.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPCDD]
"ImagePath"="System32\DRIVERS\RDPCDD.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPDD]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Servicesdpdr]
"ImagePath"="system32\DRIVERSdpdr.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPNP]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDPWD]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RDSessMgr]
"ImagePath"="c:\windows\system32\sessmgr.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Servicesedbook]
"ImagePath"="system32\DRIVERSedbook.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RemoteAccess]
"ServiceDll"="%SystemRoot%\System32\mprdim.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RemoteRegistry]
"ServiceDll"="%SystemRoot%\system32egsvc.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RFCOMM]
"ImagePath"="system32\DRIVERSfcomm.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RpcLocator]
"ImagePath"="%SystemRoot%\system32\locator.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RpcSs]
"ServiceDll"="%SystemRoot%\System32pcss.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RSVP]
"ImagePath"="%SystemRoot%\system32svp.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\RTL8023xp]
"ImagePath"="system32\DRIVERS\Rtnicxp.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SamSs]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SASDIFSV]
"ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SASENUM]
"ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SASKUTIL]
"ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SCardSvr]
"ImagePath"="%SystemRoot%\System32\SCardSvr.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Schedule]
"ServiceDll"="%SystemRoot%\system32\schedsvc.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ScsiPort]
"ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Secdrv]
"ImagePath"="system32\DRIVERS\secdrv.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\seclogon]
"ServiceDll"="%SystemRoot%\System32\seclogon.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SENS]
"ServiceDll"="%SystemRoot%\system32\sens.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Serial]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceLayer]
"ImagePath"="\"c:\program files\PC Connectivity Solution\ServiceLayer.exe\""
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceModelEndpoint 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceModelOperation 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ServiceModelService 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sfdrv01]
"ImagePath"="System32\drivers\sfdrv01.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sfhlp02]
"ImagePath"="System32\drivers\sfhlp02.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Sfloppy]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sfsync04]
"ImagePath"="System32\drivers\sfsync04.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sfvfs02]
"ImagePath"="System32\drivers\sfvfs02.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SharedAccess]
"ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ShellHWDetection]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Simbad]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SIS163u]
"ImagePath"="system32\DRIVERS\sis163u.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\smserial]
"ImagePath"="system32\DRIVERS\smserial.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SMSvcHost 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SONYPVU1]
"ImagePath"="system32\DRIVERS\SONYPVU1.SYS"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Sparrow]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\splitter]
"ImagePath"="system32\drivers\splitter.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Spooler]
"ImagePath"="%SystemRoot%\system32\spoolsv.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sr]
"ImagePath"="system32\DRIVERS\sr.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\srservice]
"ServiceDll"="%SystemRoot%\system32\srsvc.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Srv]
"ImagePath"="system32\DRIVERS\srv.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SSDPSRV]
"ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ssmdrv]
"ImagePath"="system32\DRIVERS\ssmdrv.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\StillCam]
"ImagePath"="system32\DRIVERS\serscan.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\stisvc]
"ServiceDll"="%SystemRoot%\system32\wiaservc.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\swenum]
"ImagePath"="system32\DRIVERS\swenum.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\swmidi]
"ImagePath"="system32\drivers\swmidi.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SwPrv]
"ImagePath"="c:\windows\system32\dllhost.exe /Processid:{CA4AF084-5ECE-43D3-908F-6F75BFF4F408}"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\swwd]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\symc810]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\symc8xx]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SYMIDSCO]
"ImagePath"="\??\c:\progra~1\FICHIE~1\SYMANT~1\SymcData\IDS-DI~1\20080613.002\SymIDSCo.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sym_hi]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sym_u3]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SynTP]
"ImagePath"="system32\DRIVERS\SynTP.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\sysaudio]
"ImagePath"="system32\drivers\sysaudio.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\SysmonLog]
"ImagePath"="%SystemRoot%\system32\smlogsvc.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TapiSrv]
"ServiceDll"="%SystemRoot%\System32	apisrv.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services	bhsd]
"ImagePath"="system32\drivers	bhsd.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Tcpip]
"ImagePath"="system32\DRIVERS	cpip.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TDPIPE]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TDTCP]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TermDD]
"ImagePath"="system32\DRIVERS	ermdd.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TermService]
"ServiceDll"="%SystemRoot%\System32	ermsrv.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Themes]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TlntSvr]
"ImagePath"="c:\windows\system32	lntsvr.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TosIde]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Tosrfcom]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TrkWks]
"ServiceDll"="%SystemRoot%\system32	rkwks.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\TSDDD]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Udfs]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ultra]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Update]
"ImagePath"="system32\DRIVERS\update.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\upnphost]
"ServiceDll"="%SystemRoot%\System32\upnphost.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\upperdev]
"ImagePath"="system32\DRIVERS\usbser_lowerflt.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\UPS]
"ImagePath"="%SystemRoot%\System32\ups.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbaudio]
"ImagePath"="system32\drivers\usbaudio.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbccgp]
"ImagePath"="system32\DRIVERS\usbccgp.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbehci]
"ImagePath"="system32\DRIVERS\usbehci.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbhub]
"ImagePath"="system32\DRIVERS\usbhub.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbprint]
"ImagePath"="system32\DRIVERS\usbprint.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbscan]
"ImagePath"="system32\DRIVERS\usbscan.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbser]
"ImagePath"="system32\drivers\usbser.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\UsbserFilt]
"ImagePath"="system32\DRIVERS\usbser_lowerfltj.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\USBSTOR]
"ImagePath"="system32\DRIVERS\USBSTOR.SYS"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\usbuhci]
"ImagePath"="system32\DRIVERS\usbuhci.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VgaSave]
"ImagePath"="\SystemRoot\System32\drivers\vga.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\ViaIde]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\viamraid]
"ImagePath"="system32\DRIVERS\viamraid.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VolSnap]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VSS]
"ImagePath"="%SystemRoot%\System32\vssvc.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\VxD]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\W32Time]
"ServiceDll"="%systemroot%\system32\w32time.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\w39n51]
"ImagePath"="system32\DRIVERS\w39n51.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\W3SVC]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Wanarp]
"ImagePath"="system32\DRIVERS\wanarp.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Wdf01000]
"ImagePath"="System32\Drivers\wdf01000.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WDICA]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\wdmaud]
"ImagePath"="system32\drivers\wdmaud.sys"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WebClient]
"ServiceDll"="%SystemRoot%\System32\webclnt.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Windows Workflow Foundation 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\winmgmt]
"ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\Winsock]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WinSock2]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WinTrust]
.
[HKEY_LOCAL_MACHINE\System\ControlSet006\Services\WmdmPmSN]
"ServiceDll"="c:\windows\system32\mspmsnsv.dll"

gen-hackman · Answer

kaspersky tourne encore pendant combofix !
combofix n'a pas été renommé !

c'est quoi ce windows ?

Je crois avoir un virus... help

3 réponses

Discussions similaires