encore MS removal tools Résolu

Question

Bonjour, 



Configuration: Windows Vista / Firefox 3.6.16

bonjour a tous,

Depuis hier j'ai ce fameu ms removal tools qui me pourri la vie.
J'ai tenté les procedures indiqué sur le forum mais la je n'y comprends plus rien, si quelqu un pouvait m'aider, ca serait le top! 
j'ai donc executer rogue killer qui n'a rien trouvé ainsi que malwaresbytes et là l'ordi redemarre et l'ecran est tout noir, donc je suis en mode sans echec!
si un expert dans le coin est motivé a m'aider, je l attends!
merci

Destrio5 · Answer

Bonjour, 

--> Désactive l'UAC le temps de la désinfection. 

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\ 

--> Télécharge ComboFix (de sUBs) sur ton Bureau. 

--> Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur afin de le lancer. 

--> Réponds Oui  au message d'avertissement pour que ComboFix commence l'analyse de ton PC. 

--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse. 

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

brie 16 · Answer

merci de ta reponse si rapide
qu est ce que l UAC?
je suis une bille en technique!

Destrio5 · Answer

Je t'ai mis un lien, je le remets en non caché :
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac

brie 16 · Answer

ok merci
si je redemarre comme il me demande j'aurai encore l ecran noir j'imagine?

Destrio5 · Answer

Peut-être pas.

brie 16 · Answer

bon debut, il s'est rallumé nickel, avec non plus le fond bleu mais mon ecran normal! plus d'alerte de ms removal tools, en revanche avast me dit que mon systeme n'est pas protéger, mais il ne veut pas se mettre en route!
et il y a aussi le centre de securité windows qui m alerte!
j'imagine qu il faut quand meme que je fasse le rapport combofix?

Destrio5 · Answer

Si tu as lancé ComboFix, il devrait te fournir un rapport.

brie 16 · Answer

tout m'a l'air en ordre, en apparence du moins!
voici le rapport
ComboFix 11-04-03.03 - Brieuc 04/04/2011  16:55:07.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.2939.1820 [GMT 2:00]
Lancé depuis: c:\users\Brieuc\Saved Games\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\hpe8D6F.dll
c:\users\Brieuc\AppData\Roaming\OfferBox
c:\users\Brieuc\AppData\Roaming\OfferBox\config.xml
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2011-03-04 au 2011-04-04  ))))))))))))))))))))))))))))))))))))
.
.
2011-04-04 15:02 . 2011-04-04 15:02	--------	d-----w-	c:\users\Brieuc\AppData\Local	emp
2011-04-04 15:02 . 2011-04-04 15:02	--------	d-----w-	c:\users\Invité\AppData\Local	emp
2011-04-04 15:02 . 2011-04-04 15:02	--------	d-----w-	c:\users\Default\AppData\Local	emp
2011-04-04 14:49 . 2011-02-23 13:56	371544	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2011-04-04 14:45 . 2011-03-15 04:05	6792528	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{871B77CA-57D6-4F87-A69B-2232B796BCA4}\mpengine.dll
2011-04-04 13:14 . 2011-04-04 13:14	--------	d-----w-	c:\users\Brieuc\AppData\Roaming\Malwarebytes
2011-04-04 13:14 . 2011-04-04 13:14	--------	d-----w-	c:\programdata\Malwarebytes
2011-04-04 13:14 . 2010-11-29 15:42	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-04 13:14 . 2011-04-04 13:14	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-04-04 13:14 . 2010-11-29 15:42	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-04-04 13:11 . 2011-04-04 13:11	--------	d-----w-	c:\windows\system32\RK_Quarantine
2011-04-04 10:28 . 2011-04-04 10:28	--------	d-----w-	C:\sh4ldr
2011-04-04 10:28 . 2011-04-04 10:28	--------	d-----w-	c:\program files\Enigma Software Group
2011-04-03 12:57 . 2011-04-04 12:49	--------	d-----w-	c:\program files\Emsisoft Anti-Malware
2011-04-03 11:39 . 2011-04-03 11:39	--------	d-----w-	c:\programdata\mMa31001nFkEe31001
2011-04-03 09:56 . 2011-04-03 09:56	--------	d-----w-	c:\users\Brieuc\AppData\Local\{EB18C6A5-E548-4175-82C4-88D262177B9F}
2011-04-02 10:31 . 2011-04-02 10:31	--------	d-----w-	c:\users\Brieuc\AppData\Local\{D6153F22-0C3C-4772-98D6-ACC5B72B62A4}
2011-04-01 22:30 . 2011-04-01 22:30	--------	d-----w-	c:\users\Brieuc\AppData\Local\{998EB4C4-C1A8-409D-A530-715FB894D0B7}
2011-04-01 18:35 . 2011-04-01 18:35	--------	d-----w-	c:\users\Brieuc\AppData\Local\{23F9F447-4D82-4E3E-AF02-53F65EF056A1}
2011-04-01 06:15 . 2011-04-01 06:16	--------	d-----w-	c:\users\Brieuc\AppData\Local\{16931DC8-57E5-41CC-B1D9-953D6487B42F}
2011-03-31 20:29 . 2011-03-31 20:29	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E7C518BD-822B-4C21-8FB0-AE55EFA53FB5}
2011-03-31 19:04 . 2011-03-31 19:04	--------	d-----w-	c:\users\Brieuc\AppData\Local\{A2C85F5A-285E-4C77-B162-16504B66A342}
2011-03-31 18:38 . 2011-03-31 18:38	--------	d-----w-	c:\users\Brieuc\AppData\Local\{0E7B11B2-096A-4DAA-A3ED-170FDFCCDF1F}
2011-03-31 06:10 . 2011-03-31 06:11	--------	d-----w-	c:\users\Brieuc\AppData\Local\{6C5BD253-FF76-4C9B-916A-1570A5AB34C4}
2011-03-30 14:36 . 2011-03-30 14:36	--------	d-----w-	c:\users\Brieuc\AppData\Local\{8E5EC7D9-0802-4B23-BC43-D482C816C313}
2011-03-29 18:22 . 2011-03-29 18:22	--------	d-----w-	c:\users\Brieuc\AppData\Local\{B4369F0E-58CF-4978-AEA4-30C214C92BC4}
2011-03-29 06:21 . 2011-03-29 06:22	--------	d-----w-	c:\users\Brieuc\AppData\Local\{F17EEA59-6666-4524-8B75-BABF6E6C0C4A}
2011-03-28 18:05 . 2011-03-28 18:06	--------	d-----w-	c:\users\Brieuc\AppData\Local\{89A590CA-B0A5-4D4D-BB52-8918A82A7842}
2011-03-28 06:05 . 2011-03-28 06:05	--------	d-----w-	c:\users\Brieuc\AppData\Local\{0745C1EA-BD13-4BC3-8035-800368975CEA}
2011-03-27 10:02 . 2011-03-27 10:02	--------	d-----w-	c:\users\Brieuc\AppData\Local\{83AC248E-2854-45DC-9DA1-84E035F4F59A}
2011-03-26 21:22 . 2011-03-26 21:22	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E910E06D-2515-4EF5-89A1-E393EABBB800}
2011-03-26 08:18 . 2011-03-26 08:18	--------	d-----w-	c:\users\Brieuc\AppData\Local\{D371895B-BD73-417F-B5F5-B1BB695926E0}
2011-03-26 07:44 . 2011-03-26 07:44	--------	d-----w-	c:\program files\Common Files\Software Update Utility
2011-03-26 07:43 . 2011-03-26 07:43	--------	d-----w-	c:\program files\Uniblue
2011-03-26 07:43 . 2011-03-27 09:31	--------	d-----w-	c:\users\Brieuc\AppData\Local\OpenCandy
2011-03-26 07:43 . 2011-03-26 07:43	--------	d-----w-	c:\users\Brieuc\AppData\Roaming\OpenCandy
2011-03-25 17:23 . 2011-03-25 17:24	--------	d-----w-	c:\users\Brieuc\AppData\Local\{DE8B71DF-A1F7-41BE-A5F6-C0DA1AF6CE3F}
2011-03-25 15:13 . 2011-03-25 15:13	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E925B1B8-F278-4B49-9FFB-E3228873C24B}
2011-03-24 16:05 . 2011-03-24 16:05	--------	d-----w-	c:\users\Brieuc\AppData\Local\{3775D93B-AD00-4F15-BE5B-72F3B8A39D6A}
2011-03-23 19:14 . 2011-03-23 19:15	--------	d-----w-	c:\users\Brieuc\AppData\Local\{37F6A9DF-94F4-405C-A833-0EE760FAD0BC}
2011-03-23 16:01 . 2011-02-22 14:13	288768	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-03-23 16:01 . 2011-02-22 13:33	1068544	----a-w-	c:\windows\system32\DWrite.dll
2011-03-23 16:01 . 2011-02-22 13:33	797696	----a-w-	c:\windows\system32\FntCache.dll
2011-03-23 07:14 . 2011-03-23 07:14	--------	d-----w-	c:\users\Brieuc\AppData\Local\{06FDEABD-46F9-4F9E-86A9-369E5E7604CB}
2011-03-22 18:38 . 2011-03-22 18:38	12800	----a-w-	c:\program files\Mozilla Firefox\plugins
pwachk.dll
2011-03-22 15:24 . 2011-03-22 15:25	--------	d-----w-	c:\users\Brieuc\AppData\Local\{421EC347-E591-412F-832E-32A3BDE24BB5}
2011-03-21 21:07 . 2011-03-21 21:07	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E7F17CC1-C1E7-4609-ACDC-47E2DA2E8221}
2011-03-21 07:01 . 2011-03-21 07:01	--------	d-----w-	c:\users\Brieuc\AppData\Local\{B6DD594B-76D8-49F3-9597-6C2CAA4DC46E}
2011-03-20 18:37 . 2011-03-20 18:38	--------	d-----w-	c:\users\Brieuc\AppData\Local\{7FC32A8E-4CCD-4F5E-8488-45D6B9ECF9C2}
2011-03-18 07:09 . 2011-03-18 07:09	--------	d-----w-	c:\users\Brieuc\AppData\Local\{6325CEDE-3B26-42E4-B139-B56D15DD5D9B}
2011-03-17 15:53 . 2011-03-17 15:53	--------	d-----w-	c:\users\Brieuc\AppData\Local\{0742C4FB-BDE9-4D1A-8234-C7BCA8CAAA56}
2011-03-16 18:46 . 2011-03-16 18:46	--------	d-----w-	c:\users\Brieuc\AppData\Local\{DA79BA87-C3F1-4282-BEAF-4861269FB40F}
2011-03-15 19:31 . 2011-03-15 19:31	--------	d-----w-	c:\users\Brieuc\AppData\Local\{406629E2-E545-42D6-8A88-967183DE3E13}
2011-03-15 18:16 . 2007-10-12 14:14	3734536	----a-w-	c:\windows\system32\d3dx9_36.dll
2011-03-15 07:30 . 2011-03-15 07:30	--------	d-----w-	c:\users\Brieuc\AppData\Local\{DA8F6226-7E8F-468B-9A5C-A68846D328BA}
2011-03-14 13:47 . 2011-03-14 13:47	--------	d-----w-	c:\users\Brieuc\AppData\Local\{2EC65AA0-D00A-4306-8D5F-20745914F013}
2011-03-14 07:23 . 2011-03-14 07:23	--------	d-----w-	c:\users\Brieuc\AppData\Local\{F33E9EEB-FE46-456F-806C-91E7FD1F72CF}
2011-03-13 11:50 . 2011-03-13 11:51	--------	d-----w-	c:\users\Brieuc\AppData\Local\{237B5E32-781B-4D9A-9FE5-718FB60EB529}
2011-03-13 09:24 . 2011-03-13 09:24	--------	d-----w-	c:\users\Brieuc\AppData\Local\{7302CD3A-3BC3-466B-9713-F375D402528E}
2011-03-12 09:33 . 2011-03-12 09:34	--------	d-----w-	c:\users\Brieuc\AppData\Local\{7B3EB2A7-438D-4B41-BD80-DC457D77A2F9}
2011-03-11 14:39 . 2011-03-11 14:40	--------	d-----w-	c:\users\Brieuc\AppData\Local\{4279C25A-857F-4B3F-8CC4-DAE066D0EFA4}
2011-03-10 07:27 . 2011-03-10 07:27	--------	d-----w-	c:\users\Brieuc\AppData\Local\{D6506FA9-323C-4F04-AB74-343690863F75}
2011-03-09 19:20 . 2011-03-09 19:20	--------	d-----w-	c:\users\Brieuc\AppData\Local\{2AB44624-AE7A-4B99-9E16-E3819C2E19D4}
2011-03-09 07:19 . 2011-03-09 07:20	--------	d-----w-	c:\users\Brieuc\AppData\Local\{8BDCAE20-2954-4E0C-958E-17EDA7B0449A}
2011-03-09 07:12 . 2010-12-17 15:45	2067968	----a-w-	c:\windows\system32\mstscax.dll
2011-03-09 07:12 . 2010-12-17 13:54	677888	----a-w-	c:\windows\system32\mstsc.exe
2011-03-09 07:12 . 2010-12-29 18:28	322560	----a-w-	c:\windows\system32\sbe.dll
2011-03-09 07:12 . 2010-12-29 18:28	153088	----a-w-	c:\windows\system32\sbeio.dll
2011-03-09 07:12 . 2010-12-29 18:28	429056	----a-w-	c:\windows\system32\EncDec.dll
2011-03-09 07:12 . 2010-12-29 18:26	177664	----a-w-	c:\windows\system32\mpg2splt.ax
2011-03-08 17:03 . 2011-03-08 17:03	--------	d-----w-	c:\users\Brieuc\AppData\Local\{69E9D5C3-0267-4778-A3F2-D0ABE96E8022}
2011-03-07 19:36 . 2011-03-07 19:36	--------	d-----w-	c:\users\Brieuc\AppData\Local\{541E7F11-2EDE-4DFA-BFF5-212C4B3E60E3}
2011-03-07 07:35 . 2011-03-07 07:36	--------	d-----w-	c:\users\Brieuc\AppData\Local\{40818545-1A1F-44E1-B1A3-14A45FAB3325}
2011-03-06 10:26 . 2011-03-06 10:27	--------	d-----w-	c:\users\Brieuc\AppData\Local\{9A5E0241-4795-489D-B8D7-E610225FDB18}
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-10 16:42 . 2010-06-24 09:33	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-04 19:44 . 2009-03-18 15:45	133616	------w-	c:\windows\system32\pxafs.dll
2011-03-04 19:44 . 2008-02-23 02:38	45648	------w-	c:\windows\system32\drivers\pxhelp20.sys
2011-02-23 14:04 . 2010-11-15 16:56	40648	----a-w-	c:\windows\avastSS.scr
2011-02-23 14:04 . 2010-11-15 16:56	190016	----a-w-	c:\windows\system32\aswBoot.exe
2011-02-23 13:56 . 2010-11-15 16:56	301528	----a-w-	c:\windows\system32\drivers\aswSP.sys
2011-02-23 13:55 . 2010-11-15 16:56	49240	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2011-02-23 13:55 . 2010-11-15 16:56	25432	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2011-02-23 13:55 . 2010-11-15 16:56	53592	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2011-02-23 13:54 . 2010-11-15 16:56	19544	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2011-02-02 17:11 . 2009-10-05 09:20	222080	------w-	c:\windows\system32\MpSigStub.exe
2011-01-20 16:37 . 2011-02-09 07:20	638336	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 16:08 . 2011-02-09 07:20	478720	----a-w-	c:\windows\system32\dxgi.dll
2011-01-20 16:08 . 2011-02-09 07:20	219648	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08 . 2011-02-09 07:20	160768	----a-w-	c:\windows\system32\d3d10_1.dll
2011-01-20 16:08 . 2011-02-09 07:20	1029120	----a-w-	c:\windows\system32\d3d10.dll
2011-01-20 16:08 . 2011-02-09 07:20	189952	----a-w-	c:\windows\system32\d3d10core.dll
2011-01-20 16:07 . 2011-02-09 07:20	37376	----a-w-	c:\windows\system32\cdd.dll
2011-01-20 16:07 . 2011-02-09 07:20	258048	----a-w-	c:\windows\system32\winspool.drv
2011-01-20 16:07 . 2011-02-09 07:20	586240	----a-w-	c:\windows\system32\stobject.dll
2011-01-20 16:06 . 2011-02-09 07:20	2873344	----a-w-	c:\windows\system32\mf.dll
2011-01-20 16:06 . 2011-02-09 07:20	26112	----a-w-	c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04 . 2011-02-09 07:20	209920	----a-w-	c:\windows\system32\mfplat.dll
2011-01-20 16:04 . 2011-02-09 07:20	98816	----a-w-	c:\windows\system32\mfps.dll
2011-01-20 14:28 . 2011-02-09 07:20	1554432	----a-w-	c:\windows\system32\xpsservices.dll
2011-01-20 14:27 . 2011-02-09 07:20	876032	----a-w-	c:\windows\system32\XpsPrint.dll
2011-01-20 14:26 . 2011-02-09 07:20	667648	----a-w-	c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25 . 2011-02-09 07:20	847360	----a-w-	c:\windows\system32\OpcServices.dll
2011-01-20 14:24 . 2011-02-09 07:20	135680	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15 . 2011-02-09 07:20	979456	----a-w-	c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14 . 2011-02-09 07:20	357376	----a-w-	c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14 . 2011-02-09 07:20	302592	----a-w-	c:\windows\system32\mfmp4src.dll
2011-01-20 14:14 . 2011-02-09 07:20	261632	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12 . 2011-02-09 07:20	1172480	----a-w-	c:\windows\system32\d3d10warp.dll
2011-01-20 14:11 . 2011-02-09 07:20	486400	----a-w-	c:\windows\system32\d3d10level9.dll
2011-01-20 13:47 . 2011-02-09 07:20	683008	----a-w-	c:\windows\system32\d2d1.dll
2011-01-08 08:47 . 2011-02-09 07:19	34304	----a-w-	c:\windows\system32\atmlib.dll
2011-01-08 06:28 . 2011-02-09 07:19	292352	----a-w-	c:\windows\system32\atmfd.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-01-13 08:47	120712	------w-	c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-03-29 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-01-13 3396624]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37	932288	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-22 05:05	40368	----a-w-	c:\program files\Adobe\Reader 8.0\Readereader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-05-20 20:01	177472	----a-w-	c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25	125952	----a-w-	c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]
2008-05-28 11:40	20480	----a-w-	c:\program files\Google\Google EULA\GoogleEULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-06-25 13:05	170520	----a-w-	c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-06-25 13:06	150040	----a-w-	c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MailNotifier]
2010-11-04 09:10	634368	----a-w-	c:\program files\Orange\MailNotifier\MailNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-06-25 13:06	145944	----a-w-	c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2009-09-24 13:41	434176	----a-w-	c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07	2260480	--sha-r-	c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2007-12-06 16:12	1029416	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg	opi]
2007-07-10 08:24	581632	----a-w-	c:\program files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba TEMPO]
2008-04-24 09:22	103824	----a-w-	c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-03-29 06:20	399736	----a-w-	c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2011-03-22 18:37	74752	----a-w-	c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R0 fvoyufun;fvoyufun;c:\windows\System32\drivers\urgbllen.sys [x]
R1 aswSnx;aswSnx; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 135664]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 Orange update Core Service;Orange update Core Service;c:\program files\Orange\OrangeUpdate\Service\OUCore.exe [2010-06-14 1053424]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2008-08-14 36512]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2009-08-24 28224]
R3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]
R3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]
R3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]
R3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]
R3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-04-03 717296]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-16 40960]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-02-06 126976]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Contenu du dossier 'Tâches planifiées'
.
2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 12:09]
.
2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 12:09]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851639
uDefault_Search_URL = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q={searchTerms}
mStart Page = hxxp://www.foozir.com/
IE: ajouter cette page à vos favoris Orange - c:\users\Brieuc\AppData\Local\Temp\cceE454.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: traduire la page - c:\users\Brieuc\AppData\Local\Temp\cceE442.html
IE: traduire le texte sélectionné - c:\users\Brieuc\AppData\Local\Temp\cceE443.html
Trusted Zone: chat-land.org
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_9418.cab
FF - ProfilePath - c:\users\Brieuc\AppData\Roaming\Mozilla\Firefox\Profiles\hzcrzhlv.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox 4.0 Beta 11\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: barred'outils Orange: {E6768F2A-D4C3-457D-A1A8-3472BF16267D} - c:\program files\Orange\ToolbarFR\FirefoxContainer
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
URLSearchHooks-{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} - (no file)
HKCU-Run-DMSN - (no file)
HKCU-Run-DialFlirt - (no file)
HKLM-Run-EoEngine - (no file)
MSConfigStartUp-00TCrdMain - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSConfigStartUp-cfFncEnabler - cfFncEnabler.exe
MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
MSConfigStartUp-Google Update - c:\users\Brieuc\AppData\Local\Google\Update\GoogleUpdate.exe
MSConfigStartUp-HSON - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
MSConfigStartUp-IP Network - c:\program files\InstallPedia\lnetworker.exe
MSConfigStartUp-NDSTray - NDSTray.exe
MSConfigStartUp-ORAHSSSessionManager - c:\program files\Orange\Connexion Internet Orange\SessionManager\SessionManager.exe
MSConfigStartUp-SmoothView - %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSConfigStartUp-TOSCDSPD - TOSCDSPD.EXE
MSConfigStartUp-TPwrMain - %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-04 17:02
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2011-04-04  17:06:12
ComboFix-quarantined-files.txt  2011-04-04 15:06
.
Avant-CF: 20 465 942 528 octets libres
Après-CF: 22 930 800 640 octets libres
.
- - End Of File - - 6DE89BD17BDE64A83B8C8C68F85D15E0








C bien long tout ca!
verdict?

Destrio5 · Answer

/!\ Seul brie 16 peut suivre cette procédure. /!\


1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

Driver::
fvoyufun

File::
c:\windows\System32\drivers\urgbllen.sys 

Folder::
c:\users\Brieuc\AppData\Local\OpenCandy
c:\users\Brieuc\AppData\Roaming\OpenCandy 






--> Colle la sélection dans le Bloc-notes.

--> Enregistre ce fichier sur le Bureau (Impératif).

--> Nom du fichier : CFScript
--> Type du fichier : tous les fichiers
--> Clique sur Enregistrer.
--> Quitte le Bloc-notes.


2/

--> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

--> Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

--> Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

--> Une fois le scan achevé, un rapport va s'afficher : poste-le.

--> Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt

brie 16 · Answer

il n'y a pas eu de fenetre bleu
je crois que le scan se lance pas mais j'ai un nouveau dossier dans c qui c créé

brie 16 · Answer

dans le dossier il y a un fichier nommé cmd

Destrio5 · Answer

Ça ne me dit rien.

Tu peux faire le scan avec Malwarebytes' Anti-Malware maintenant ?

brie 16 · Answer

que dois je faire, recommencé? j attend des news avant de touché a qqchose,

Destrio5 · Answer

Réessaie.

brie 16 · Answer

voila le rapport:
ComboFix 11-04-03.03 - Brieuc 04/04/2011  18:37:18.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.2939.1967 [GMT 2:00]
Lancé depuis: c:\users\Brieuc\Saved Games\Downloads\ComboFix.exe
Commutateurs utilisés :: c:\users\Brieuc\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\System32\drivers\urgbllen.sys"
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Brieuc\AppData\Local\OpenCandy
c:\users\Brieuc\AppData\Roaming\OpenCandy
c:\users\Brieuc\AppData\Roaming\OpenCandy\OpenCandy_525D8FB8687C4D3DB1C53CF79588B1E5\786.ico
c:\users\Brieuc\AppData\Roaming\OpenCandy\OpenCandy_525D8FB8687C4D3DB1C53CF79588B1E5\LatestDLMgr.exe
c:\users\Brieuc\AppData\Roaming\OpenCandy\OpenCandy_525D8FB8687C4D3DB1C53CF79588B1E5egistrybooster20.exe
c:\users\Brieuc\AppData\Roaming\OpenCandy\OpenCandy_525D8FB8687C4D3DB1C53CF79588B1E5egistrybooster20Wrapped.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_fvoyufun
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2011-03-04 au 2011-04-04  ))))))))))))))))))))))))))))))))))))
.
.
2011-04-04 16:43 . 2011-04-04 16:46	--------	d-----w-	c:\users\Brieuc\AppData\Local	emp
2011-04-04 16:43 . 2011-04-04 16:43	--------	d-----w-	c:\users\Invité\AppData\Local	emp
2011-04-04 16:43 . 2011-04-04 16:43	--------	d-----w-	c:\users\Default\AppData\Local	emp
2011-04-04 15:20 . 2011-04-04 15:21	--------	d-----w-	c:\users\Brieuc\AppData\Local\{92C2CB4C-3B1E-4022-A7BC-58BB4071A7B2}
2011-04-04 14:49 . 2011-02-23 13:56	371544	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2011-04-04 14:45 . 2011-03-15 04:05	6792528	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{871B77CA-57D6-4F87-A69B-2232B796BCA4}\mpengine.dll
2011-04-04 13:14 . 2011-04-04 13:14	--------	d-----w-	c:\users\Brieuc\AppData\Roaming\Malwarebytes
2011-04-04 13:14 . 2011-04-04 13:14	--------	d-----w-	c:\programdata\Malwarebytes
2011-04-04 13:14 . 2010-11-29 15:42	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-04 13:14 . 2011-04-04 13:14	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-04-04 13:14 . 2010-11-29 15:42	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-04-04 13:11 . 2011-04-04 13:11	--------	d-----w-	c:\windows\system32\RK_Quarantine
2011-04-04 10:28 . 2011-04-04 10:28	--------	d-----w-	C:\sh4ldr
2011-04-04 10:28 . 2011-04-04 10:28	--------	d-----w-	c:\program files\Enigma Software Group
2011-04-03 12:57 . 2011-04-04 12:49	--------	d-----w-	c:\program files\Emsisoft Anti-Malware
2011-04-03 11:39 . 2011-04-03 11:39	--------	d-----w-	c:\programdata\mMa31001nFkEe31001
2011-04-03 09:56 . 2011-04-03 09:56	--------	d-----w-	c:\users\Brieuc\AppData\Local\{EB18C6A5-E548-4175-82C4-88D262177B9F}
2011-04-02 10:31 . 2011-04-02 10:31	--------	d-----w-	c:\users\Brieuc\AppData\Local\{D6153F22-0C3C-4772-98D6-ACC5B72B62A4}
2011-04-01 22:30 . 2011-04-01 22:30	--------	d-----w-	c:\users\Brieuc\AppData\Local\{998EB4C4-C1A8-409D-A530-715FB894D0B7}
2011-04-01 18:35 . 2011-04-01 18:35	--------	d-----w-	c:\users\Brieuc\AppData\Local\{23F9F447-4D82-4E3E-AF02-53F65EF056A1}
2011-04-01 06:15 . 2011-04-01 06:16	--------	d-----w-	c:\users\Brieuc\AppData\Local\{16931DC8-57E5-41CC-B1D9-953D6487B42F}
2011-03-31 20:29 . 2011-03-31 20:29	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E7C518BD-822B-4C21-8FB0-AE55EFA53FB5}
2011-03-31 19:04 . 2011-03-31 19:04	--------	d-----w-	c:\users\Brieuc\AppData\Local\{A2C85F5A-285E-4C77-B162-16504B66A342}
2011-03-31 18:38 . 2011-03-31 18:38	--------	d-----w-	c:\users\Brieuc\AppData\Local\{0E7B11B2-096A-4DAA-A3ED-170FDFCCDF1F}
2011-03-31 06:10 . 2011-03-31 06:11	--------	d-----w-	c:\users\Brieuc\AppData\Local\{6C5BD253-FF76-4C9B-916A-1570A5AB34C4}
2011-03-30 14:36 . 2011-03-30 14:36	--------	d-----w-	c:\users\Brieuc\AppData\Local\{8E5EC7D9-0802-4B23-BC43-D482C816C313}
2011-03-29 18:22 . 2011-03-29 18:22	--------	d-----w-	c:\users\Brieuc\AppData\Local\{B4369F0E-58CF-4978-AEA4-30C214C92BC4}
2011-03-29 06:21 . 2011-03-29 06:22	--------	d-----w-	c:\users\Brieuc\AppData\Local\{F17EEA59-6666-4524-8B75-BABF6E6C0C4A}
2011-03-28 18:05 . 2011-03-28 18:06	--------	d-----w-	c:\users\Brieuc\AppData\Local\{89A590CA-B0A5-4D4D-BB52-8918A82A7842}
2011-03-28 06:05 . 2011-03-28 06:05	--------	d-----w-	c:\users\Brieuc\AppData\Local\{0745C1EA-BD13-4BC3-8035-800368975CEA}
2011-03-27 10:02 . 2011-03-27 10:02	--------	d-----w-	c:\users\Brieuc\AppData\Local\{83AC248E-2854-45DC-9DA1-84E035F4F59A}
2011-03-26 21:22 . 2011-03-26 21:22	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E910E06D-2515-4EF5-89A1-E393EABBB800}
2011-03-26 08:18 . 2011-03-26 08:18	--------	d-----w-	c:\users\Brieuc\AppData\Local\{D371895B-BD73-417F-B5F5-B1BB695926E0}
2011-03-26 07:44 . 2011-03-26 07:44	--------	d-----w-	c:\program files\Common Files\Software Update Utility
2011-03-26 07:43 . 2011-03-26 07:43	--------	d-----w-	c:\program files\Uniblue
2011-03-25 17:23 . 2011-03-25 17:24	--------	d-----w-	c:\users\Brieuc\AppData\Local\{DE8B71DF-A1F7-41BE-A5F6-C0DA1AF6CE3F}
2011-03-25 15:13 . 2011-03-25 15:13	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E925B1B8-F278-4B49-9FFB-E3228873C24B}
2011-03-24 16:05 . 2011-03-24 16:05	--------	d-----w-	c:\users\Brieuc\AppData\Local\{3775D93B-AD00-4F15-BE5B-72F3B8A39D6A}
2011-03-23 19:14 . 2011-03-23 19:15	--------	d-----w-	c:\users\Brieuc\AppData\Local\{37F6A9DF-94F4-405C-A833-0EE760FAD0BC}
2011-03-23 16:01 . 2011-02-22 14:13	288768	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-03-23 16:01 . 2011-02-22 13:33	1068544	----a-w-	c:\windows\system32\DWrite.dll
2011-03-23 16:01 . 2011-02-22 13:33	797696	----a-w-	c:\windows\system32\FntCache.dll
2011-03-23 07:14 . 2011-03-23 07:14	--------	d-----w-	c:\users\Brieuc\AppData\Local\{06FDEABD-46F9-4F9E-86A9-369E5E7604CB}
2011-03-22 18:38 . 2011-03-22 18:38	12800	----a-w-	c:\program files\Mozilla Firefox\plugins
pwachk.dll
2011-03-22 15:24 . 2011-03-22 15:25	--------	d-----w-	c:\users\Brieuc\AppData\Local\{421EC347-E591-412F-832E-32A3BDE24BB5}
2011-03-21 21:07 . 2011-03-21 21:07	--------	d-----w-	c:\users\Brieuc\AppData\Local\{E7F17CC1-C1E7-4609-ACDC-47E2DA2E8221}
2011-03-21 07:01 . 2011-03-21 07:01	--------	d-----w-	c:\users\Brieuc\AppData\Local\{B6DD594B-76D8-49F3-9597-6C2CAA4DC46E}
2011-03-20 18:37 . 2011-03-20 18:38	--------	d-----w-	c:\users\Brieuc\AppData\Local\{7FC32A8E-4CCD-4F5E-8488-45D6B9ECF9C2}
2011-03-18 07:09 . 2011-03-18 07:09	--------	d-----w-	c:\users\Brieuc\AppData\Local\{6325CEDE-3B26-42E4-B139-B56D15DD5D9B}
2011-03-17 15:53 . 2011-03-17 15:53	--------	d-----w-	c:\users\Brieuc\AppData\Local\{0742C4FB-BDE9-4D1A-8234-C7BCA8CAAA56}
2011-03-16 18:46 . 2011-03-16 18:46	--------	d-----w-	c:\users\Brieuc\AppData\Local\{DA79BA87-C3F1-4282-BEAF-4861269FB40F}
2011-03-15 19:31 . 2011-03-15 19:31	--------	d-----w-	c:\users\Brieuc\AppData\Local\{406629E2-E545-42D6-8A88-967183DE3E13}
2011-03-15 18:16 . 2007-10-12 14:14	3734536	----a-w-	c:\windows\system32\d3dx9_36.dll
2011-03-15 07:30 . 2011-03-15 07:30	--------	d-----w-	c:\users\Brieuc\AppData\Local\{DA8F6226-7E8F-468B-9A5C-A68846D328BA}
2011-03-14 13:47 . 2011-03-14 13:47	--------	d-----w-	c:\users\Brieuc\AppData\Local\{2EC65AA0-D00A-4306-8D5F-20745914F013}
2011-03-14 07:23 . 2011-03-14 07:23	--------	d-----w-	c:\users\Brieuc\AppData\Local\{F33E9EEB-FE46-456F-806C-91E7FD1F72CF}
2011-03-13 11:50 . 2011-03-13 11:51	--------	d-----w-	c:\users\Brieuc\AppData\Local\{237B5E32-781B-4D9A-9FE5-718FB60EB529}
2011-03-13 09:24 . 2011-03-13 09:24	--------	d-----w-	c:\users\Brieuc\AppData\Local\{7302CD3A-3BC3-466B-9713-F375D402528E}
2011-03-12 09:33 . 2011-03-12 09:34	--------	d-----w-	c:\users\Brieuc\AppData\Local\{7B3EB2A7-438D-4B41-BD80-DC457D77A2F9}
2011-03-11 14:39 . 2011-03-11 14:40	--------	d-----w-	c:\users\Brieuc\AppData\Local\{4279C25A-857F-4B3F-8CC4-DAE066D0EFA4}
2011-03-10 07:27 . 2011-03-10 07:27	--------	d-----w-	c:\users\Brieuc\AppData\Local\{D6506FA9-323C-4F04-AB74-343690863F75}
2011-03-09 19:20 . 2011-03-09 19:20	--------	d-----w-	c:\users\Brieuc\AppData\Local\{2AB44624-AE7A-4B99-9E16-E3819C2E19D4}
2011-03-09 07:19 . 2011-03-09 07:20	--------	d-----w-	c:\users\Brieuc\AppData\Local\{8BDCAE20-2954-4E0C-958E-17EDA7B0449A}
2011-03-09 07:12 . 2010-12-17 15:45	2067968	----a-w-	c:\windows\system32\mstscax.dll
2011-03-09 07:12 . 2010-12-17 13:54	677888	----a-w-	c:\windows\system32\mstsc.exe
2011-03-09 07:12 . 2010-12-29 18:28	322560	----a-w-	c:\windows\system32\sbe.dll
2011-03-09 07:12 . 2010-12-29 18:28	153088	----a-w-	c:\windows\system32\sbeio.dll
2011-03-09 07:12 . 2010-12-29 18:28	429056	----a-w-	c:\windows\system32\EncDec.dll
2011-03-09 07:12 . 2010-12-29 18:26	177664	----a-w-	c:\windows\system32\mpg2splt.ax
2011-03-08 17:03 . 2011-03-08 17:03	--------	d-----w-	c:\users\Brieuc\AppData\Local\{69E9D5C3-0267-4778-A3F2-D0ABE96E8022}
2011-03-07 19:36 . 2011-03-07 19:36	--------	d-----w-	c:\users\Brieuc\AppData\Local\{541E7F11-2EDE-4DFA-BFF5-212C4B3E60E3}
2011-03-07 07:35 . 2011-03-07 07:36	--------	d-----w-	c:\users\Brieuc\AppData\Local\{40818545-1A1F-44E1-B1A3-14A45FAB3325}
2011-03-06 10:26 . 2011-03-06 10:27	--------	d-----w-	c:\users\Brieuc\AppData\Local\{9A5E0241-4795-489D-B8D7-E610225FDB18}
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-10 16:42 . 2010-06-24 09:33	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-04 19:44 . 2009-03-18 15:45	133616	------w-	c:\windows\system32\pxafs.dll
2011-03-04 19:44 . 2008-02-23 02:38	45648	------w-	c:\windows\system32\drivers\pxhelp20.sys
2011-02-23 14:04 . 2010-11-15 16:56	40648	----a-w-	c:\windows\avastSS.scr
2011-02-23 14:04 . 2010-11-15 16:56	190016	----a-w-	c:\windows\system32\aswBoot.exe
2011-02-23 13:56 . 2010-11-15 16:56	301528	----a-w-	c:\windows\system32\drivers\aswSP.sys
2011-02-23 13:55 . 2010-11-15 16:56	49240	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2011-02-23 13:55 . 2010-11-15 16:56	25432	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2011-02-23 13:55 . 2010-11-15 16:56	53592	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2011-02-23 13:54 . 2010-11-15 16:56	19544	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2011-02-02 17:11 . 2009-10-05 09:20	222080	------w-	c:\windows\system32\MpSigStub.exe
2011-01-20 16:37 . 2011-02-09 07:20	638336	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 16:08 . 2011-02-09 07:20	478720	----a-w-	c:\windows\system32\dxgi.dll
2011-01-20 16:08 . 2011-02-09 07:20	219648	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08 . 2011-02-09 07:20	160768	----a-w-	c:\windows\system32\d3d10_1.dll
2011-01-20 16:08 . 2011-02-09 07:20	1029120	----a-w-	c:\windows\system32\d3d10.dll
2011-01-20 16:08 . 2011-02-09 07:20	189952	----a-w-	c:\windows\system32\d3d10core.dll
2011-01-20 16:07 . 2011-02-09 07:20	37376	----a-w-	c:\windows\system32\cdd.dll
2011-01-20 16:07 . 2011-02-09 07:20	258048	----a-w-	c:\windows\system32\winspool.drv
2011-01-20 16:07 . 2011-02-09 07:20	586240	----a-w-	c:\windows\system32\stobject.dll
2011-01-20 16:06 . 2011-02-09 07:20	2873344	----a-w-	c:\windows\system32\mf.dll
2011-01-20 16:06 . 2011-02-09 07:20	26112	----a-w-	c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04 . 2011-02-09 07:20	209920	----a-w-	c:\windows\system32\mfplat.dll
2011-01-20 16:04 . 2011-02-09 07:20	98816	----a-w-	c:\windows\system32\mfps.dll
2011-01-20 14:28 . 2011-02-09 07:20	1554432	----a-w-	c:\windows\system32\xpsservices.dll
2011-01-20 14:27 . 2011-02-09 07:20	876032	----a-w-	c:\windows\system32\XpsPrint.dll
2011-01-20 14:26 . 2011-02-09 07:20	667648	----a-w-	c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25 . 2011-02-09 07:20	847360	----a-w-	c:\windows\system32\OpcServices.dll
2011-01-20 14:24 . 2011-02-09 07:20	135680	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15 . 2011-02-09 07:20	979456	----a-w-	c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14 . 2011-02-09 07:20	357376	----a-w-	c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14 . 2011-02-09 07:20	302592	----a-w-	c:\windows\system32\mfmp4src.dll
2011-01-20 14:14 . 2011-02-09 07:20	261632	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12 . 2011-02-09 07:20	1172480	----a-w-	c:\windows\system32\d3d10warp.dll
2011-01-20 14:11 . 2011-02-09 07:20	486400	----a-w-	c:\windows\system32\d3d10level9.dll
2011-01-20 13:47 . 2011-02-09 07:20	683008	----a-w-	c:\windows\system32\d2d1.dll
2011-01-08 08:47 . 2011-02-09 07:19	34304	----a-w-	c:\windows\system32\atmlib.dll
2011-01-08 06:28 . 2011-02-09 07:19	292352	----a-w-	c:\windows\system32\atmfd.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04	122512	----a-w-	c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-03-29 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-02-23 3451496]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37	932288	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-22 05:05	40368	----a-w-	c:\program files\Adobe\Reader 8.0\Readereader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-05-20 20:01	177472	----a-w-	c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25	125952	----a-w-	c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]
2008-05-28 11:40	20480	----a-w-	c:\program files\Google\Google EULA\GoogleEULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-06-25 13:05	170520	----a-w-	c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-06-25 13:06	150040	----a-w-	c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MailNotifier]
2010-11-04 09:10	634368	----a-w-	c:\program files\Orange\MailNotifier\MailNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-06-25 13:06	145944	----a-w-	c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2009-09-24 13:41	434176	----a-w-	c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07	2260480	--sha-r-	c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2007-12-06 16:12	1029416	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg	opi]
2007-07-10 08:24	581632	----a-w-	c:\program files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba TEMPO]
2008-04-24 09:22	103824	----a-w-	c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-03-29 06:20	399736	----a-w-	c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2011-03-22 18:37	74752	----a-w-	c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 Orange update Core Service;Orange update Core Service;c:\program files\Orange\OrangeUpdate\Service\OUCore.exe [2010-06-14 1053424]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2008-08-14 36512]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2009-08-24 28224]
R3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]
R3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]
R3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]
R3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]
R3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-04-03 717296]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-16 40960]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 135664]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-02-06 126976]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2006-11-20 7168]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Contenu du dossier 'Tâches planifiées'
.
2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 12:09]
.
2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-11 12:09]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851639
uDefault_Search_URL = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.cherche.us/Result.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&cof=GIMP%3ACCCCCC%3BT%3A000000%3BALC%3A551a8b%3BGFNT%3AB7B7B7%3BLC%3A2200cc%3BBGC%3AFFFFFF%3BVLC%3A551a8b%3BGALT%3A008B45%3BFORID%3A10%3BDIV%3A%23FFFFF0%3B&q={searchTerms}
mStart Page = hxxp://www.foozir.com/
IE: ajouter cette page à vos favoris Orange - c:\users\Brieuc\AppData\Local\Temp\cceE454.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: traduire la page - c:\users\Brieuc\AppData\Local\Temp\cceE442.html
IE: traduire le texte sélectionné - c:\users\Brieuc\AppData\Local\Temp\cceE443.html
Trusted Zone: chat-land.org
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_9418.cab
FF - ProfilePath - c:\users\Brieuc\AppData\Roaming\Mozilla\Firefox\Profiles\hzcrzhlv.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox 4.0 Beta 11\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: barred'outils Orange: {E6768F2A-D4C3-457D-A1A8-3472BF16267D} - c:\program files\Orange\ToolbarFR\FirefoxContainer
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-04 18:48
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\conime.exe
c:\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Heure de fin: 2011-04-04  18:51:28 - La machine a redémarré
ComboFix-quarantined-files.txt  2011-04-04 16:51
ComboFix2.txt  2011-04-04 15:06
.
Avant-CF: 21 258 006 528 octets libres
Après-CF: 21 065 146 368 octets libres
.
- - End Of File - - 72FC939D150F9709F45715C82DC2D157
 


c grave docteur?

Destrio5 · Answer

On est sur la bonne voie.

Et pour Malwarebytes' Anti-Malware ?

brie 16 · Answer

c fait, rien trouvé d anormal

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 6266

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

04/04/2011 19:01:19
mbam-log-2011-04-04 (19-01-19).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 165152
Temps écoulé: 3 minute(s), 47 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Destrio5 · Answer

Plus de souci ?

Edit :

Supprime ce dossier : c:\programdata\mMa31001nFkEe31001

brie 16 · Answer

non tout a l air de marcher comme sur des roulettes si on peu dire,
merci bien, c'est vraiment cool!!!!
si t as un meuble a reparer ou un truc en bois je suis ton homme, je suis plus bricoleur que genie de l informatique!

merci

Destrio5 · Answer

Pour finir : 


1/ 

---> Télécharge DelFix sur ton Bureau. 
* Clique droit sur DelFix et choisis Exécuter en tant qu'administrateur. 
* Clique sur le bouton Suppression. 
* Poste le rapport (C:\DelFixSuppr.txt). 
* Supprime DelFix. 


2/ 

---> Télécharge et installe CCleaner. 
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc.... 
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.  


3/ 

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger. 


==Prévention== 

Voici un dossier sur la prévention et sécurité sur Internet (A lire avec Adobe Reader ou Foxit Reader) : Lien 


;)

brie 16 · Answer

# DelFix v7.6 - Rapport créé le 04/04/2011 à 19:42
# Mis à jour le 31/03/11 à 16h par Xplode
# Système d'exploitation : Windows Vista (TM) Home Premium (32 bits) [version 6.0.6002] Service Pack 2
# Nom d'utilisateur : Brieuc - PC-DE-BRIEUC (Administrateur)
# Exécuté depuis : C:\Users\Brieuc\Saved Games\Downloads\DelFix(2).exe
# Option [Suppression]


~~~~~~ Dossier(s) ~~~~~~


~~~~~~ Fichier(s) ~~~~~~


~~~~~~ Registre ~~~~~~


~~~~~~ Autre ~~~~~~


########## EOF - "C:\DelFixSuppr.txt" - [585 octets] ##########

brie 16 · Answer

c fait, tout est fait sauf que fausse manip j avai pas valider le msg du cou y a pas le raport, c grave? je refais?

Destrio5 · Answer

Pas grave.

brie 16 · Answer

bon ben t un chef!!!! merci bcp

Encore MS removal tools - Page 2

Votre réponse

Discussions similaires

Newsletters