Mon ordinateur est plein de virus aidez moi p Fermé

Question

Bonjour, 

Je pense avoir un gros virus je n'ai pas danti virus et je ne peux pas en installer un quand essai ça marche pas petit a petit ça se dégradait la je n'ai plus accès a internet ni a Google bref j'ai un peu de mal a décrire tout les problèmes si quelqu un veut bien m'aider j'en serais ravie merciiiiiii

Configuration: iPhone / Mozilla Indeterminable

g3n-h@ckm@n · Accepted Answer

bonjour antivir installe par la meme occasion la ASKToolbar donc à eviter
malwarebytes ne s'utilise pas en debut de desinfection 
¤¤¤¤¤¤¤¤¤¤_g3n-h@ckm@n_developpement_¤¤¤¤¤¤¤¤¤¤ 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤_Pre_scan_¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

juju666 · Answer

Bonjour,

Pourquoi tu ne mettais pas d'antivirus ?

&#9654 Télécharge Reload_TDSSKiller 

&#9654 Lance le  

choisis : lancer le nettoyage 

l'outil va automatiquement télécharger la derniere version puis  

TDSSKiller va s'ouvrir , clique sur "Start Scan"  Clique ici pour l'aide en image 

Si TDSS.tdl2 est détecté l''option delete sera cochée par défaut.  
Si TDSS.tdl3 est détecté assure toi que Cure est bien cochée.  
Si TDSS.tdl4(\HardDisk0\MBR) est détecté assure toi que Cure est bien cochée.  
Si Suspicious file est indiqué, laisse l''option cochée sur Skip   
une fois qu'il a terminé , redemarre s'il te le demande pour finir de nettoyer 

sinon , ferme tdssKiller et le rapport s'affichera sur le bureau 

&#9654 Copie/Colle son contenu dans ta prochaine réponse.

++

-Helice- · Answer

Salut, pour voir si tu es infécté(e), commence a télécharger  
MalwareBytes' AntiMalwares 
a ce lien 

https://download.bleepingcomputer.com/malwarebytes/mbam-setup-1.51.1.1800.exe 

Ensuite, télécharge avira antiVir , un antivirus assez puissant et gratuit ici : 

http://ftp01net.telechargement.fr/avira_antivirus_personal_fr.exe 

Une fois installés, Installe les mises a jour si nésséssaires, ensuite, rends toi sur MalwareBytes, lance le  ensuite, tu fais Un scan complet du systeme, en séléctionnant tous les disques. 

Apres le scan, si des infections sont présentent, supprime les, 
et avira est la pour te protéger, antivirus performant. En éspérant de t'avoir aidé

Cordialement, -Helice- 

A bientot

Sofia94 · Answer

Merci de vos réponses le problème a tout ça c'est que je n'ai pas accès a internet je me suis dit que c'était ma connexion mais jarrive a me connecter sur MSN donc je pense que ma connexion est OK ! Sur ma page internet ça me met internet explorer ne peut afficher cette page web et dessous : "diagnostiquer les problèmes de connexion". Quand je diagnostic le problème trouvé est : le serveur proxy configuré ne répond pas

juju666 · Answer

Suis les instructions de ce lien : https://forums.commentcamarche.net/forum/affich-37640573-desactiver-son-proxy

g3n-h@ckm@n · Answer

demarrer/panneau de configuration/options internet/avancé => reinitialiser tout

Sofia94 · Answer

Juju ta méthode ne change rien ! Ha km@n je ne trouve pas ça dans panneau de configuration

Sofia94 · Answer

Si c bon hackman c'était dans outil jessaie la !

Sofia94 · Answer

Génial je peux me connecter merci a tout le monde merci hackman vous me conseillez de faire quoi maintenant pour mettre manto iris et nettoyer ces saloperies ??

juju666 · Answer

ben déjà tdss killer et la suite... une chose à la fois :)

Sofia94 · Answer

Ok juju je vais suivre tes conseils et je vous tiens au courant merci encore

sofia94 · Answer

jai fais ce que tu mas dit juju voila le rapport

2011/09/07 22:52:28.0714 5432	TDSS rootkit removing tool 2.5.19.0 Sep  6 2011 19:23:56
2011/09/07 22:52:29.0026 5432	================================================================================
2011/09/07 22:52:29.0026 5432	SystemInfo:
2011/09/07 22:52:29.0026 5432	
2011/09/07 22:52:29.0026 5432	OS Version: 6.1.7600 ServicePack: 0.0
2011/09/07 22:52:29.0026 5432	Product type: Workstation
2011/09/07 22:52:29.0026 5432	ComputerName: PBELL-PC
2011/09/07 22:52:29.0026 5432	UserName: PBELL
2011/09/07 22:52:29.0026 5432	Windows directory: C:\Windows
2011/09/07 22:52:29.0026 5432	System windows directory: C:\Windows
2011/09/07 22:52:29.0026 5432	Processor architecture: Intel x86
2011/09/07 22:52:29.0026 5432	Number of processors: 2
2011/09/07 22:52:29.0026 5432	Page size: 0x1000
2011/09/07 22:52:29.0026 5432	Boot type: Normal boot
2011/09/07 22:52:29.0026 5432	================================================================================
2011/09/07 22:52:30.0274 5432	Initialize success
2011/09/07 22:52:37.0593 5256	================================================================================
2011/09/07 22:52:37.0593 5256	Scan started
2011/09/07 22:52:37.0593 5256	Mode: Manual; 
2011/09/07 22:52:37.0593 5256	================================================================================
2011/09/07 22:52:38.0966 5256	1394ohci        (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/09/07 22:52:39.0029 5256	ACPI            (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
2011/09/07 22:52:39.0138 5256	AcpiPmi         (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/09/07 22:52:39.0200 5256	adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/09/07 22:52:39.0309 5256	adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/09/07 22:52:39.0356 5256	adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/09/07 22:52:39.0497 5256	AFD             (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys
2011/09/07 22:52:39.0559 5256	agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
2011/09/07 22:52:39.0684 5256	aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/09/07 22:52:39.0746 5256	aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
2011/09/07 22:52:39.0855 5256	amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
2011/09/07 22:52:39.0887 5256	amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
2011/09/07 22:52:39.0933 5256	AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/07 22:52:40.0027 5256	AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/09/07 22:52:40.0074 5256	amdsata         (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys
2011/09/07 22:52:40.0121 5256	amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/09/07 22:52:40.0199 5256	amdxata         (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys
2011/09/07 22:52:40.0245 5256	AppID           (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
2011/09/07 22:52:40.0417 5256	arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/09/07 22:52:40.0448 5256	arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/09/07 22:52:40.0745 5256	AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/07 22:52:40.0823 5256	atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
2011/09/07 22:52:41.0244 5256	b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/09/07 22:52:41.0369 5256	b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/09/07 22:52:41.0431 5256	Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/09/07 22:52:41.0493 5256	blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/09/07 22:52:41.0665 5256	bowser          (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/07 22:52:41.0696 5256	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/09/07 22:52:41.0743 5256	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/09/07 22:52:41.0868 5256	Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/09/07 22:52:41.0915 5256	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/09/07 22:52:41.0946 5256	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/09/07 22:52:41.0993 5256	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/09/07 22:52:42.0086 5256	BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/09/07 22:52:42.0164 5256	cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/07 22:52:42.0273 5256	cdrom           (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/07 22:52:42.0336 5256	circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/09/07 22:52:42.0429 5256	CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/09/07 22:52:42.0570 5256	CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/09/07 22:52:42.0601 5256	cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
2011/09/07 22:52:42.0648 5256	CNG             (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/09/07 22:52:42.0757 5256	Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/09/07 22:52:42.0804 5256	CompositeBus    (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/09/07 22:52:42.0851 5256	crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/09/07 22:52:42.0991 5256	CSC             (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys
2011/09/07 22:52:43.0116 5256	DfsC            (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys
2011/09/07 22:52:43.0225 5256	discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/09/07 22:52:43.0272 5256	Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/09/07 22:52:43.0428 5256	driverhardwarev2 (a694d8db6d360a3bbb0bd1517f1c1aee) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
2011/09/07 22:52:43.0537 5256	drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/09/07 22:52:43.0599 5256	DXGKrnl         (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/07 22:52:43.0818 5256	ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/09/07 22:52:44.0067 5256	elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/09/07 22:52:44.0114 5256	ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
2011/09/07 22:52:44.0255 5256	exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/09/07 22:52:44.0286 5256	fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/09/07 22:52:44.0348 5256	fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/07 22:52:44.0473 5256	FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/09/07 22:52:44.0535 5256	Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/09/07 22:52:44.0567 5256	flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/07 22:52:44.0676 5256	FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/09/07 22:52:44.0738 5256	FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/09/07 22:52:44.0801 5256	Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/07 22:52:44.0910 5256	fvevol          (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys
2011/09/07 22:52:44.0957 5256	gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/09/07 22:52:45.0081 5256	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/09/07 22:52:45.0253 5256	hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/09/07 22:52:45.0315 5256	HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2011/09/07 22:52:45.0425 5256	HDAudBus        (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/07 22:52:45.0456 5256	HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/09/07 22:52:45.0503 5256	HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/09/07 22:52:45.0627 5256	HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/09/07 22:52:45.0690 5256	HidUsb          (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/07 22:52:45.0846 5256	HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/09/07 22:52:45.0924 5256	HTTP            (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
2011/09/07 22:52:46.0033 5256	hwpolicy        (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
2011/09/07 22:52:46.0080 5256	i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/07 22:52:46.0127 5256	iaStorV         (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys
2011/09/07 22:52:46.0267 5256	iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/09/07 22:52:46.0345 5256	intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
2011/09/07 22:52:46.0376 5256	intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/07 22:52:46.0439 5256	IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/07 22:52:46.0548 5256	IPMIDRV         (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/09/07 22:52:46.0595 5256	IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/09/07 22:52:46.0751 5256	IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/09/07 22:52:46.0782 5256	isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
2011/09/07 22:52:46.0829 5256	iScsiPrt        (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/07 22:52:46.0953 5256	kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/07 22:52:46.0985 5256	kbdhid          (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/07 22:52:47.0031 5256	KSecDD          (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/07 22:52:47.0094 5256	KSecPkg         (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys
2011/09/07 22:52:47.0265 5256	lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/07 22:52:47.0343 5256	LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/09/07 22:52:47.0375 5256	LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/09/07 22:52:47.0484 5256	LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/09/07 22:52:47.0531 5256	LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/09/07 22:52:47.0609 5256	luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/09/07 22:52:47.0780 5256	megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/09/07 22:52:47.0811 5256	MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/09/07 22:52:47.0952 5256	Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/09/07 22:52:48.0014 5256	monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/07 22:52:48.0123 5256	mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/07 22:52:48.0186 5256	mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/07 22:52:48.0233 5256	mountmgr        (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
2011/09/07 22:52:48.0342 5256	mpio            (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
2011/09/07 22:52:48.0373 5256	mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/07 22:52:48.0435 5256	MRxDAV          (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
2011/09/07 22:52:48.0545 5256	mrxsmb          (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/07 22:52:48.0623 5256	mrxsmb10        (f965c3ab2b2ae5c378f4562486e35051) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/07 22:52:48.0685 5256	mrxsmb20        (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/07 22:52:48.0779 5256	msahci          (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
2011/09/07 22:52:48.0825 5256	msdsm           (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
2011/09/07 22:52:48.0903 5256	Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/09/07 22:52:48.0935 5256	mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/09/07 22:52:49.0044 5256	msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/09/07 22:52:49.0106 5256	MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/07 22:52:49.0200 5256	MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/07 22:52:49.0247 5256	MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/09/07 22:52:49.0278 5256	MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/09/07 22:52:49.0340 5256	mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/07 22:52:49.0449 5256	MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/09/07 22:52:49.0481 5256	MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/09/07 22:52:49.0527 5256	Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/09/07 22:52:49.0668 5256	NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS
wifi.sys
2011/09/07 22:52:49.0730 5256	NDIS            (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers
dis.sys
2011/09/07 22:52:49.0839 5256	NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS
discap.sys
2011/09/07 22:52:49.0886 5256	NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS
distapi.sys
2011/09/07 22:52:49.0933 5256	Ndisuio         (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS
disuio.sys
2011/09/07 22:52:49.0964 5256	NdisWan         (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS
diswan.sys
2011/09/07 22:52:50.0073 5256	NDProxy         (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
2011/09/07 22:52:50.0136 5256	Netaapl         (7afd0e39ab15cb355487b7cc19f4e2c5) C:\Windows\system32\DRIVERS
etaapl.sys
2011/09/07 22:52:50.0229 5256	NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS
etbios.sys
2011/09/07 22:52:50.0261 5256	NetBT           (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS
etbt.sys
2011/09/07 22:52:50.0526 5256	netw5v32        (58218ec6b61b1169cf54aab0d00f5fe2) C:\Windows\system32\DRIVERS
etw5v32.sys
2011/09/07 22:52:50.0760 5256	nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS
frd960.sys
2011/09/07 22:52:50.0807 5256	Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/09/07 22:52:50.0853 5256	nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers
siproxy.sys
2011/09/07 22:52:50.0994 5256	Ntfs            (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys
2011/09/07 22:52:51.0119 5256	Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/09/07 22:52:51.0540 5256	nvlddmkm        (377140a534d013bd661c69f1741de43c) C:\Windows\system32\DRIVERS
vlddmkm.sys
2011/09/07 22:52:52.0008 5256	nvraid          (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS
vraid.sys
2011/09/07 22:52:52.0039 5256	nvstor          (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS
vstor.sys
2011/09/07 22:52:52.0164 5256	nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS
v_agp.sys
2011/09/07 22:52:52.0211 5256	O2MDRDR         (634ff60f418792906887b3d6ceecb431) C:\Windows\system32\DRIVERS\o2media.sys
2011/09/07 22:52:52.0242 5256	ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/07 22:52:52.0429 5256	Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/09/07 22:52:52.0476 5256	partmgr         (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
2011/09/07 22:52:52.0523 5256	Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/09/07 22:52:52.0569 5256	pci             (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
2011/09/07 22:52:52.0663 5256	pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
2011/09/07 22:52:52.0710 5256	pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/09/07 22:52:52.0772 5256	pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/09/07 22:52:52.0835 5256	PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/09/07 22:52:53.0162 5256	PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERSaspptp.sys
2011/09/07 22:52:53.0209 5256	Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/09/07 22:52:53.0349 5256	Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/07 22:52:53.0427 5256	ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/09/07 22:52:53.0537 5256	ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/09/07 22:52:53.0599 5256	QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/07 22:52:53.0630 5256	RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERSasacd.sys
2011/09/07 22:52:53.0693 5256	RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/09/07 22:52:53.0786 5256	Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERSasl2tp.sys
2011/09/07 22:52:53.0833 5256	RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERSaspppoe.sys
2011/09/07 22:52:53.0880 5256	RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERSassstp.sys
2011/09/07 22:52:53.0989 5256	rdbss           (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERSdbss.sys
2011/09/07 22:52:54.0020 5256	rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERSdpbus.sys
2011/09/07 22:52:54.0051 5256	RDPCDD          (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/07 22:52:54.0129 5256	RDPDR           (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\driversdpdr.sys
2011/09/07 22:52:54.0239 5256	RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\driversdpencdd.sys
2011/09/07 22:52:54.0317 5256	RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\driversdprefmp.sys
2011/09/07 22:52:54.0348 5256	RDPWD           (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
2011/09/07 22:52:54.0473 5256	rdyboost        (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\driversdyboost.sys
2011/09/07 22:52:54.0597 5256	rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERSspndr.sys
2011/09/07 22:52:54.0660 5256	s3cap           (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys
2011/09/07 22:52:54.0785 5256	sbp2port        (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/09/07 22:52:54.0847 5256	scfilter        (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
2011/09/07 22:52:54.0987 5256	sdbus           (7b48cff3a475fe849dea65ec4d35c425) C:\Windows\system32\DRIVERS\sdbus.sys
2011/09/07 22:52:55.0050 5256	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/09/07 22:52:55.0175 5256	Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/07 22:52:55.0221 5256	Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/09/07 22:52:55.0268 5256	sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/09/07 22:52:55.0424 5256	sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/09/07 22:52:55.0455 5256	sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/09/07 22:52:55.0502 5256	sffp_sd         (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/09/07 22:52:55.0549 5256	sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/09/07 22:52:55.0674 5256	sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
2011/09/07 22:52:55.0721 5256	SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/09/07 22:52:55.0814 5256	SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/09/07 22:52:55.0861 5256	Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/09/07 22:52:56.0001 5256	spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/09/07 22:52:56.0095 5256	srv             (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys
2011/09/07 22:52:56.0220 5256	srv2            (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/07 22:52:56.0298 5256	SrvHsfHDA       (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/09/07 22:52:56.0423 5256	SrvHsfV92       (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/09/07 22:52:56.0547 5256	SrvHsfWinac     (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/09/07 22:52:56.0688 5256	srvnet          (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/07 22:52:56.0766 5256	sscdbus         (d5dffeaa1e15d4effabb9d9a3068ac5b) C:\Windows\system32\DRIVERS\sscdbus.sys
2011/09/07 22:52:56.0891 5256	stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/09/07 22:52:56.0953 5256	storflt         (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys
2011/09/07 22:52:57.0047 5256	storvsc         (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys
2011/09/07 22:52:57.0078 5256	swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/07 22:52:57.0249 5256	Tcpip           (c2daaeb48f3a47c410b041a0d2382ee1) C:\Windows\system32\drivers	cpip.sys
2011/09/07 22:52:57.0421 5256	TCPIP6          (c2daaeb48f3a47c410b041a0d2382ee1) C:\Windows\system32\DRIVERS	cpip.sys
2011/09/07 22:52:57.0546 5256	tcpipreg        (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers	cpipreg.sys
2011/09/07 22:52:57.0608 5256	TDPIPE          (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers	dpipe.sys
2011/09/07 22:52:57.0655 5256	TDTCP           (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers	dtcp.sys
2011/09/07 22:52:57.0702 5256	tdx             (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS	dx.sys
2011/09/07 22:52:57.0795 5256	TermDD          (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS	ermdd.sys
2011/09/07 22:52:57.0920 5256	tssecsrv        (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS	ssecsrv.sys
2011/09/07 22:52:58.0029 5256	tunnel          (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS	unnel.sys
2011/09/07 22:52:58.0045 5256	uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/09/07 22:52:58.0076 5256	udfs            (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/07 22:52:58.0170 5256	uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/09/07 22:52:58.0217 5256	umbus           (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/07 22:52:58.0248 5256	UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/09/07 22:52:58.0357 5256	USBAAPL         (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
2011/09/07 22:52:58.0404 5256	usbccgp         (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/07 22:52:58.0513 5256	usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
2011/09/07 22:52:58.0560 5256	usbehci         (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/07 22:52:58.0607 5256	usbhub          (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/07 22:52:58.0700 5256	usbohci         (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/07 22:52:58.0747 5256	usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/07 22:52:58.0794 5256	USBSTOR         (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/07 22:52:58.0841 5256	usbuhci         (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/07 22:52:58.0965 5256	usbvideo        (b5f6a992d996282b7fae7048e50af83a) C:\Windows\System32\Drivers\usbvideo.sys
2011/09/07 22:52:59.0168 5256	vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/09/07 22:52:59.0231 5256	vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/07 22:52:59.0324 5256	VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/09/07 22:52:59.0387 5256	vhdmp           (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/09/07 22:52:59.0433 5256	viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
2011/09/07 22:52:59.0527 5256	ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/09/07 22:52:59.0574 5256	viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
2011/09/07 22:52:59.0636 5256	vmbus           (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys
2011/09/07 22:52:59.0714 5256	VMBusHID        (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys
2011/09/07 22:52:59.0761 5256	volmgr          (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/09/07 22:52:59.0808 5256	volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/09/07 22:52:59.0917 5256	volsnap         (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
2011/09/07 22:52:59.0979 5256	vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/09/07 22:53:00.0089 5256	vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
2011/09/07 22:53:00.0182 5256	WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/09/07 22:53:00.0276 5256	WANARP          (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/07 22:53:00.0323 5256	Wanarpv6        (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/07 22:53:00.0432 5256	Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/09/07 22:53:00.0494 5256	Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/07 22:53:00.0681 5256	WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/09/07 22:53:00.0728 5256	WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/09/07 22:53:00.0869 5256	WinUsb          (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/09/07 22:53:00.0978 5256	WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/09/07 22:53:01.0103 5256	ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/07 22:53:01.0196 5256	WudfPf          (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
2011/09/07 22:53:01.0321 5256	WUDFRd          (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/07 22:53:01.0508 5256	yukonw7         (b07c5b7efdf936ff93d4f540938725be) C:\Windows\system32\DRIVERS\yk62x86.sys
2011/09/07 22:53:01.0586 5256	MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/09/07 22:53:01.0633 5256	Boot (0x1200)   (75ffca45c723932d72edcf96d8e9735a) \Device\Harddisk0\DR0\Partition0
2011/09/07 22:53:01.0680 5256	Boot (0x1200)   (a66821a796fbe84b2cc460b051b7b599) \Device\Harddisk0\DR0\Partition1
2011/09/07 22:53:01.0695 5256	================================================================================
2011/09/07 22:53:01.0695 5256	Scan finished
2011/09/07 22:53:01.0695 5256	================================================================================
2011/09/07 22:53:01.0789 4636	Detected object count: 0
2011/09/07 22:53:01.0789 4636	Actual detected object count: 0
2011/09/07 22:53:32.0664 3684	Deinitialize success

juju666 · Answer

Raté :o)


désactive ton antivirus
désactive Windows defender si présent
désactive ton pare-feu 

Télécharge Pre_scan (de gen-hackman)

Si le lien ne fonctionne pas, utilise celui-ci

&#9830 Enregistre le sur ton bureau  
s'il n'est pas sur ton bureau, coupe-le de ton dossier téléchargements et colle-le sur ton bureau 

&#9654 Exécute Pre_scan. 
Avertissement: Il y aura une courte extinction du bureau pendant que l'outil travaillera --> pas de panique. 
Si l'outil est bloqué, utilise cette version
Si l'outil détecte un proxy  et que tu n'en n'as pas installé  clique sur "supprimer le proxy"

&#9654 Une fois qu'il aura fini, un rapport s'ouvrira. 

&#9830 NE LE POSTE PAS SUR LE FORUM (il est trop long)

clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier Pre_Scan.txt qui se trouve sur ton bureau (une copie est aussi à la racine : C:\Pre_Scan.txt)

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

sofia94 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201109/cijRqpucOz.txt 

voila le lien par contre je ne sais plus ce que jai coché dans la question supprimer ou pas le proxy  dans la precipitation  du coup jai essayer de refaire la manipulation mais impossible quand le bureau disparait rien ne se passe enfin bref jespere que vous pourrez maider merciiiiiiiiiii

juju666 · Answer

c est le souk sur ton ordi !

Salut,

Tu as accepté d'installer l'adware via un autre logiciel : https://www.malekal.com/searchqu-bandoo-pup-hijacker-page-de-demarragerecherche/


Des logiciels additionnels sont proposés (barre d'outils, adwares) via l'installation de logiciel par éditeurs.
L'éditeur touche de l'argent à chaque installation réussie de ces additionnels tiers (un genre de sponsoring).
Seulement certains éditeurs, abusent, pour gagner plus d'argent, ils redistribuent des logiciels libres développés par des bénévoles en y ajoutant ces logiciels additionnels.
Des pubs trompeuses peuvent aussi être utilisés pour faire installer ces logiciels.

Outre le fait que les procédés sont discutables, l'accumulation de ces programmes additionnels non essentiels councourent à ralentir condésirablement l'ordinateur (peux aussi faire planter les navigateurs WEB).
Certains font aussi du tracking anonymes (récupérations des thématiques de sites visités).

Tu as la même chose avec les barres d'outils :
Les barres d'outils sont là pour t'affilier à un service (moteur de recherche de Yahoo! ou Google), ça rajoute des fonctionnalités mais en général les navigateurs les ont par défaut.
De plus, elles enregistrent les sites que tu visites pour les transmettre (tracking) à faire de la publicité ciblée, c'est pas super niveau protection de la vie privée.
Plusieurs toolbars ralentissent le PC et peuvent faire planter les navigateurs WEB.
Au final, il est pas conseillé d'en utiliser.

Lire :
Les PUPs/LPIs : https://www.malekal.com/adwares-pup-protection/

~~

Désinstalle tout ça via ton panneau de configuration :

Freeze.com
SweetIM
Windows iLivid Toolbar
PriceGong
Fluendo
ClickPotato
iLivid
Moovida 

~~~


fais glisser une icone n'importe laqueele sur Pre_scan , pre_script va apparaitre  

ouvre Pre_script et colle ce qui suit en gras, à l'interieur du texte qui s'ouvre ,  
sans les lignes , en une seule fois en le mettant en surbrillance :  
___________________________________________________   
Process::  
SweetIM.exe  
datamngrUI.exe   

Registry::  
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]   
"conhost"=-  
"Bvapewujo"=-  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]   
"SweetIM"=-  
"DATAMNGR"=-  
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]    
"{99079a25-328f-4bd4-be04-00955acaa0a7}"=-  
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}]  
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}]  
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]   
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}]  
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1}]   
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]   
"AppInit_DLLS"=-  
[-HKEY_CURRENT_USER\Software\3]    
[-HKEY_CURRENT_USER\Software\clickpotatolitesa]   
[-HKEY_CURRENT_USER\Software\DataMngr]  
[-HKEY_CURRENT_USER\Software\ilivid]   
[-HKEY_CURRENT_USER\Software\Moovida]    
[-HKEY_CURRENT_USER\Software\ShoppingReport2]    
[-HKEY_CURRENT_USER\Software\Spointer]   
[-HKEY_CURRENT_USER\Software\SweetIM]   
[-HKEY_LOCAL_MACHINE\Software\ClickPotatoLite]     
[-HKEY_LOCAL_MACHINE\Software\DataMngr]     
[-HKEY_LOCAL_MACHINE\Software\Freeze.com]   
[-HKEY_LOCAL_MACHINE\Software\ilivid]   
[-HKEY_LOCAL_MACHINE\Software\Moovida]  
[-HKEY_LOCAL_MACHINE\Software\QuestBrowse]   
[-HKEY_LOCAL_MACHINE\Software\SearchquMediabarTb]   
[-HKEY_LOCAL_MACHINE\Software\ShoppingReport2]    
[-HKEY_LOCAL_MACHINE\Software\SweetIM]    
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]        
"NetAssistant"=-      
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall  
"iLivid"=-  
"PriceGong"=-  
"Searchqu 406 MediaBar"=-  
"ShoppingReport2"=-  
"{6084C211-01A1-464E-97A0-09772E122B50}"=-  
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}"=-  

file::  
C:\Users\PBELL\AppData\Roaming\Microsoft\conhost.exe      
C:\Users\PBELL\AppData\Local\amsery.dll  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navigateur OfferBox.lnk   
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Moovida.lnk   
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk        

folder::  
C:\Program Files\Freeze.com  
C:\Program Files\SweetIM  
C:\Program Files\Windows iLivid Toolbar  
C:\Program Files\PriceGong  
C:\Program Files\Fluendo  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato      
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid      
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Moovida    
C:\Users\PBELL\AppData\Roaming\5EA4.075        
C:\Users\PBELL\AppData\Roaming\ClickPotatoLite      
C:\Users\PBELL\AppData\Roaming\moovida-1      
C:\ProgramData\9bbcc9      
C:\ProgramData\ClickPotatoLiteSA      
C:\ProgramData\ezsidmv.dat        
C:\ProgramData\SSJRJLTS        
C:\ProgramData\SweetIM      
C:\ProgramData\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE}      
C:\Users\PBELL\AppData\Local\moovida Air      
C:\Program Files\iLivid      

Attrib:: 
____________________________________________  

copie-le (ctrl+c ou clique droit sur la selection puis => copier)  

puis onglet fichier => enregistrer (pas enregistrer sous...) , puis ferme le texte  

poste Pre_Script.txt qui apparaitra sur le bureau en fin de travail   
 .::. Contributeur Sécurité .::.

sofia94 · Answer

fais glisser une icone n'importe laqueele sur Pre_scan , pre_script va apparaitre 


je ne sais pas comment faire ca  desolé je nai vraiment aucune connaissance en tout ca

juju666 · Answer

tu prends une icone de ton bureau comme internet explorer et tu la fais glisser sur pre_scan
y'a pre_script qui va apparaitre ;)

sofia94 · Answer

je  la fais glisser sur licone prescan qui est sur mon bureau??

sofia94 · Answer

as tu eu mon message privé?

juju666 · Answer

non :s

sofia94 · Answer

jai reussi          ya une fenetre prescan qui souvre avec un lecteur play pause avance retour jessai de cliquer dans la fenetre pour pouvoir coller ce qui tu ma di mais jy arrive pas ma souris ne met pas a la ligne

juju666 · Answer

heuuuuuu
normalement, une fois que pre script est apparu, tu l ouvres qui lui même t'ouvre un fichier "bloc note"
...

juju666 · Answer

suite: 

prends pre_script ici ça sera plus simple : 

http://dl.dropbox.com/u/21363431/Pre_script.exe

sofia94 · Answer

je tai demander si on pouvai se joindre par tel mais si c pa possible pas de souci

juju666 · Answer

mais je n'ai pas eu de MP :/

télécharge pre script ici : http://dl.dropbox.com/u/21363431/Pre_script.exe 

lance le, le bloc note va t'ouvrir et là tu suis les instructions décrites là : https://forums.commentcamarche.net/forum/affich-23102148-mon-ordinateur-est-plein-de-virus-aidez-moi-p#17

nos stress, no panic, on va y arriver :))))

je vais dodoter moi, bonne nuit ;)

sofia94 · Answer

jai essayer de suivre les instructions donc je te poste le prescript qui est sur mon bureau je cest pas si jai bien fait voila :

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 1.0.2.75 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | Seven - 32/64 bits ¤¤¤¤¤

Mise à jour : 06/09/2011 | 04.40 Par g3n-h@ckm@n
Utilisateur : PBELL (Administrateurs)
Ordinateur : PBELL-PC
Système d'exploitation : Windows 7 Ultimate (32 bits)
Internet Explorer : 9.0.8112.16421
Mozilla Firefox : 

Switchs possibles :

processes:: | file:: | folder:: | Registry::
Driver:: | replace:: | DNS:: | Command:: 
attrib:: | txt:: | Host:: | NsLook::
list:: | IP::

Script : 00:22:39

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Modification du registre effectuée

¤

Absent : C:\Users\PBELL\AppData\Roaming\Microsoft\conhost.exe 
Absent : C:\Users\PBELL\AppData\Local\amsery.dll 
Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navigateur OfferBox.lnk 
Absent : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Moovida.lnk 
Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

¤

Absent : C:\Program Files\Freeze.com 
Absent : C:\Program Files\SweetIM 
Absent : C:\Program Files\Windows iLivid Toolbar 
Absent : C:\Program Files\PriceGong 
Supprimé : C:\Program Files\Fluendo 
Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato 
Absent : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid 
Absent : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Moovida 
non Supprimé : C:\Users\PBELL\AppData\Roaming\5EA4.075 
Absent : C:\Users\PBELL\AppData\Roaming\ClickPotatoLite 
Supprimé : C:\Users\PBELL\AppData\Roaming\moovida-1 
Supprimé : C:\ProgramData\9bbcc9 
Absent : C:\ProgramData\ClickPotatoLiteSA 
Absent : C:\ProgramData\ezsidmv.dat 
Supprimé : C:\ProgramData\SSJRJLTS 
Absent : C:\ProgramData\SweetIM 
Absent : C:\ProgramData\{F01C14AE-F9C0-49DB-A28C-4C24EE6762FE} 
Supprimé : C:\Users\PBELL\AppData\Local\moovida Air 
Absent : C:\Program Files\iLivid 

¤

Disques externes : 0 Objets réattribués
Disque Local : 10 Objets réattribués
Utilisateurs : 1 Objets réattribués
ProgramFiles : 15 Objets réattribués
Music : 4 Objets réattribués
Pictures : 0 Objets réattribués
Videos : 0 Objets réattribués
Downloads : 2 Objets réattribués
Desktop : 0 Objets réattribués
Links : 0 Objets réattribués
Searches : 3 Objets réattribués
Contacts : 0 Objets réattribués
Saved Games : 0 Objets réattribués
Favorites : 7 Objets réattribués
Documents : 7 Objets réattribués
Windows : 128 Objets réattribués
StartMenu : 2 Objets réattribués
Librairies : 0 Objets réattribués
Quick Launch : 2 Objets réattribués
%AppData% : 45 Objets réattribués

¤


explorer.exe -> Processus redémarré

Fin : 00:24:22

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

sofia94 · Answer

par contretu ma dit de supprimer PriceGong Fluendo ClickPotato mais ils ne paraisse pas dans panneau de configuration par contre dans demarrer quand jai cherché clickpotato je lai trouvé

juju666 · Answer

Salut :)
Ben voilà parfait ! :D

&#9654 Télécharge MBAM et installe le selon l'emplacement par défaut
https://www.malwarebytes.com/mwb-download/
&#9654 Effectue la mise à jour et lance Malwarebytes' Anti-Malware

&#9654 &#9654 Si tu n''arrive pas à le mettre à jour, télécharge ce fichier , ferme MBAM, et exécute le

&#9654 Clique dans l'onglet du haut "Recherche"
&#9654 Coche l'option "Exécuter un examen complet" puis sur le bouton "Rechercher"
&#9654 Choisis de scanner tous tes disques durs, puis clique sur 'Lancer l'examen"

A la fin de l'analyse, si MBAM n'a rien trouvé :

&#9654 Clique sur OK, le rapport s'ouvre spontanément

Si des menaces ont été détectées :

&#9654 Clique sur OK puis "Afficher les résultats"
&#9654 Choisis l'option "Supprimer la sélection"
&#9654 Si MBAM demande le redémarrage de Windows : Clique sur "Oui"
&#9654 Une fois le PC redémarré, le rapport se trouve dans l'onglet "Rapports/Logs"
&#9654 Sinon le rapport s'ouvre automatiquement après la suppression

Quelque soit le résultat, copie/colle le rapport dans le prochain message

sofia94 · Answer

jai fais ce que tu mas dit voici le rapport 

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Version de la base de données: 7681

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

09/09/2011 12:39:16
mbam-log-2011-09-09 (12-39-16).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 345945
Temps écoulé: 1 heure(s), 4 minute(s), 35 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 385
Valeur(s) du Registre infectée(s): 27
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport2 (Adware.ShoppingReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.HbAx (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.HbAx.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.HbInfoBand (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.HbInfoBand.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.IEButton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.IEButton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.IEButtonA (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.IEButtonA.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.RprtCtrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShoppingReport2.RprtCtrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\ShoppingReport2 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport2 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aplica32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashAvast.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashChest.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimp2.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aupdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgsrmax.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltmain.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmcdlg.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpm.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwsc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxquar.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\backweb.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvwiz.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdmcon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beagle.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blss.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootwarn.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundle.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\c.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiaudit.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpconfg.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpupdat.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner3.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanpc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashrep.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssconfg.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\datemanager.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defalert.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllcache.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpps2.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwebupw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixfp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbn976rl.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hacktracersetup.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hotpatch.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htpatch.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hxdl.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamstats.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Identity.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedll.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEShow.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\infwin.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe  (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[3].exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[5].exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intren.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\istsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jdbgmrg.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JsRcGen.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kazza.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-pf-213-en-win.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldnetmon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\licmgr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lnetinfo.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\localnet.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lordpe.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mapisvc32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\md.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfw2en.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFSrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msa.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msccn32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdos.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mslaugh.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmsgri32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mu0311ad.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
32scanw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
avap.navapsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
avapw32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
avlu32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
avstub.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
avwnt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
cinst4.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
eomonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
etarmor.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
etinfo.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
etscanpro.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
etutils.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
isum.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
od32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
orton_internet_secu_3.0_407.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
pf40_tw_98_nt_me_2k.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
protect.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
pssvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
ssys32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
supdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
trtscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
txconfig.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
upgrade.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
vc95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
winst4.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
wtool16.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OAhlp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oasrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oaview.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLT.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\optimize.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\otfix.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostinstall.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pav.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PavFnSvr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavprsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsrv51.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pgmonitr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\poproxy.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prmt.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procdump.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrls.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PskSvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUNMain.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsav7.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsav8win32eng.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsb32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsealmon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsegedt32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsescue32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsscdwld.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionstvscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsulaunch.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionswg.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\savenow.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secureveteran.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupvameeval.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgssfw32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellspyinstall.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\signcheck.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smrtdefp.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soap.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftSafeness.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssgrate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stcloader.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\support.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	apinstall.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	aumon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	c.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	cm.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	ds2-98.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	eekids.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	fak5.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	itanin.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TPSrv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	rjscan.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	rojantrap3.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	sadbot.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	vmd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updat.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthUpd.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-bugsfix.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winav.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\window.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmain.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winssk32.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe (Security.Hijack) -> Quarantined and deleted successful

sofia94 · Answer

ca fait 2 fois que je copie colle tous le rapport il se met en ligne et quand jactualise la page le rapport nest plus la

?????????? COMMENT FAIRE

juju666 · Answer

enregistre-le sur ton bureau (le rapport) et héberge le sur cijoint.fr :)

sofia94 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201109/cijj9b2EDU.txt

sofia94 · Answer

voila

sofia94 · Answer

tu peux me dire dans quel état est mon ordi stp?? JAI VU KE YAVAIT UNE TONNE DE VIRUS

juju666 · Answer

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.
Lance le, clique sur [Recherche] puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[R1].txt

sofia94 · Answer

# AdwCleaner v1.305 - Rapport créé le 09/09/2011 à 14:58:07
# Mis à jour le 07/09/11 à 19h par Xplode
# Système d'exploitation : Windows 7 Ultimate  (32 bits)
# Nom d'utilisateur : PBELL - PBELL-PC (Administrateur)
# Exécuté depuis : C:\Users\PBELL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4SYEAG9\adwcleaner0.exe
# Option [Recherche]


***** [Processus] *****


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****

Clé Présente : HKCU\Software\DataMngr
Clé Présente : HKCU\Software\AppDataLow\Software\ShoppingReport2
Clé Présente : HKLM\SOFTWARE\SweetIM
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Clé Présente : HKLM\SOFTWARE\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Valeur Présente : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [offerboxffx@offerbox.com]

***** [Navigateurs] *****

-\ Internet Explorer v9.0.8112.16421

[OK] Le registre ne contient aucune entrée illégitime.

-\ Google Chrome v [Impossible d'obtenir la version]

Fichier : C:\Users\PBELL\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[R1].txt - [1877 octets] - [09/09/2011 14:58:07]

########## EOF - C:\AdwCleaner[R1].txt - [2005 octets] ##########

juju666 · Answer

Tu as accepté d'installer l'adware via un autre logiciel : https://www.malekal.com/searchqu-bandoo-pup-hijacker-page-de-demarragerecherche/ 


Des logiciels additionnels sont proposés (barre d'outils, adwares) via l'installation de logiciel par éditeurs. 
L'éditeur touche de l'argent à chaque installation réussie de ces additionnels tiers (un genre de sponsoring). 
Seulement certains éditeurs, abusent, pour gagner plus d'argent, ils redistribuent des logiciels libres développés par des bénévoles en y ajoutant ces logiciels additionnels. 
Des pubs trompeuses peuvent aussi être utilisés pour faire installer ces logiciels. 

Outre le fait que les procédés sont discutables, l'accumulation de ces programmes additionnels non essentiels councourent à ralentir condésirablement l'ordinateur (peux aussi faire planter les navigateurs WEB). 
Certains font aussi du tracking anonymes (récupérations des thématiques de sites visités). 

Tu as la même chose avec les barres d'outils : 
Les barres d'outils sont là pour t'affilier à un service (moteur de recherche de Yahoo! ou Google), ça rajoute des fonctionnalités mais en général les navigateurs les ont par défaut. 
De plus, elles enregistrent les sites que tu visites pour les transmettre (tracking) à faire de la publicité ciblée, c'est pas super niveau protection de la vie privée. 
Plusieurs toolbars ralentissent le PC et peuvent faire planter les navigateurs WEB. 
Au final, il est pas conseillé d'en utiliser. 

Lire : 
Les PUPs/LPIs : https://www.malekal.com/adwares-pup-protection/ 

~~ 

Relance AdwCleaner, clique cette fois sur [Suppression] puis patiente le temps du scan. 
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse. 

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt 
~~~ 

On enchaîne directement :  

&#9654  Télécharge AD-Remover sur ton Bureau : (TeamXScript)  

http://www.teamxscript.org/adremoverTelechargement.html ( Lien officiel )  
OU  
https://www.androidworld.fr/ ( Miroir )  

/!\ Ferme toutes applications en cours /!\  

&#9654 Double-clique sur l'icône Ad-remover située sur ton Bureau.  
&#9654 Sur la page, clique sur le bouton « Scanner »  
&#9654 Confirme le lancement du scan  
&#9654 Laisse travailler l'outil.  
&#9654 Quand il a fini, un rapport s'ouvrira : ferme le. 

&#9830 Pour me transmettre le rapport 

clique sur ce lien : http://www.cijoint.fr/ 

&#9654 Clique sur Parcourir et cherche le fichier C:\Ad-Report-SCAN[1].txt 

&#9654 Clique sur Ouvrir. 

&#9654 Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt 

est ajouté dans la page. 

&#9654 Copie ce lien dans ta réponse. 
 .::. Contributeur Sécurité .::.

sofia94 · Answer

# AdwCleaner v1.305 - Rapport créé le 09/09/2011 à 15:18:14
# Mis à jour le 07/09/11 à 19h par Xplode
# Système d'exploitation : Windows 7 Ultimate  (32 bits)
# Nom d'utilisateur : PBELL - PBELL-PC (Administrateur)
# Exécuté depuis : C:\Users\PBELL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4SYEAG9\adwcleaner0.exe
# Option [Suppression]


***** [KillNav] *****

# iexplore.exe [PID:3760] -> Tué

***** [Processus] *****


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****

Clé Supprimée : HKCU\Software\DataMngr
Clé Supprimée : HKCU\Software\AppDataLow\Software\ShoppingReport2
Clé Supprimée : HKLM\SOFTWARE\SweetIM
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [offerboxffx@offerbox.com]

***** [Navigateurs] *****

-\ Internet Explorer v9.0.8112.16421

[OK] Le registre ne contient aucune entrée illégitime.

-\ Google Chrome v [Impossible d'obtenir la version]

Fichier : C:\Users\PBELL\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[R1].txt - [2006 octets] - [09/09/2011 14:58:07]
AdwCleaner[S1].txt - [2012 octets] - [09/09/2011 15:18:14]

########## EOF - C:\AdwCleaner[S1].txt - [2140 octets] ##########

juju666 · Answer

en attente du scan ad-remover :)

sofia94 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201109/cijjQtVRui.txt

juju666 · Answer

&#9654 Relance AD-Remover, clique sur [ Nettoyer ]
&#9654 Laisse le pc redémarrer.
&#9654 Une fois revenu sur le bureau, le rapport devrait s'ouvrir : ferme-le

&#9830 Pour me transmettre le rapport

clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier C:\Ad-Report-CLEAN[1].txt

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

~~

Nous allons effectuer un diagnostic de ton PC: 
&#9654 Télécharge ZHPDiag 

&#9654 Laisse toi guider lors de l''installation,coche "Ajouter une icône sur le bureau" et  "Exécuter ZHPDiag" 

&#9654 Clique sur l''icône représentant une loupe (« Lancer le diagnostic ») 

&#9654 Une fois le scan aux 100%, ferme ZHPDiag. Héberge le rapport ZHPDiag.txt présent sur ton bureau :

Voici comment procéder

&#9654 Rends toi sur pjjoint.malekal.com 
&#9654 Clique sur le bouton Parcourir 
&#9654 Sélectionne le fichier que tu veux heberger et clique sur Ouvrir 
&#9654 Clique sur le bouton Envoyer 
&#9654 Un message de confirmation s''affiche (L''upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : https://pjjoint.malekal.com/files.php?id=df5ea299241015 Copie le lien dans ta prochaine réponse. 

A bientôt.

sofia94 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201109/cijSXPiM97.txt

juju666 · Answer

en attente de zhpdiag :)

sofia94 · Answer

ya pas de loupe

juju666 · Answer

t'es sur que t es dans zhpdiag et non zhpfix ? :)

sofia94 · Answer

si c bon je lavais telechargé 2 fois en fait et la 2ème fois yavai pas la loupe

juju666 · Answer

Sur ton bureau tu as ces 2 icônes : http://dl.dropbox.com/u/22950063/diag_fix.jpg

Ouvre le parchemin.

sofia94 · Answer

LE VOILA 

 https://pjjoint.malekal.com/files.php?id=ZHPDiag_13r10j13m8n9v8r9p8t6r6k8s9v10r5d15y11u15k14i9c8

juju666 · Answer

&#9654 Copie tout le texte en gras ci-dessous ( tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )     

O4 - HKCU\..\Run: [conhost] C:\Users\PBELL\AppData\Roaming\Microsoft\conhost.exe (.not file.)      
O4 - HKUS\S-1-5-21-2341819117-2716500083-4139753839-1000\..\Run: [conhost] C:\Users\PBELL\AppData\Roaming\Microsoft\conhost.exe (.not file.)     
[HKCU\Software\AppDataLow\Software\searchqutoolbar]      
[HKLM\Software\Classes\AppID\{d2083641-e57f-4eab-bb85-0582424f4a29}]     
[HKCU\Software\AppDataLow\Software\searchqutoolbar]     
C:\Users\PBELL\AppData\LocalLow\searchquband     
G2 - GCE: Preference [User Data\Default] [bjeikeheijdjdfjbmknpefojickbkmom] Offerbox v.2.1.3182.77 (Activé)     
[HKCU\Software\SweetIM]      
[MD5.895C4812245E244B2F81C71BAD0C4E55] [SPRF][12/09/2010] (.Conduit Ltd. - Conduit Toolbar.) -- C:\Users\PBELL\AppData\Local\Temp\GLFD69A.tmp.tbRadi.dll   [3863136] 
[HKCU\Software\SweetIM]    
G0 - GCSP: Preference [User Data\Default][HomePage] http://home.sweetim.com 
O41 - Driver: (uwmgltth) . (. - .) - C:\Windows\system32\drivers\uwmgltth.sys (.not file.)    
PROXYFIX 
FIREWALLRAZ 
EMPTYTEMP 
EMPTYFLASH 

&#9654 Puis Lance ZHPFix depuis le raccourci du bureau .    

&#9654 Une fois l'outil ZHPFix ouvert , clique sur le bouton [ H ] ( "coller les lignes Helper" ).    

&#9654 Dans l'encadré principal tu verras donc les lignes que tu as copié précédemment apparaitre.    

&#9654 Vérifie que toutes les lignes que je t''ai demandé de copier (et seulement elles) sont dans la fenêtre.    

&#9654 Clique sur le bouton « GO » pour lancer le nettoyage  

&#9654 Copie/Colle le rapport à l''écran dans ton prochain message    

Note : le rapport se trouve aussi dans C:\ZHP sous le nom de ZHPFix[Rx].txt (où X correspond au numéro du lancement de ZHPFix) 
 .::. Contributeur Sécurité .::.

sofia94 · Answer

c quoi la balise code??

sofia94 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201109/cijD2mDu9I.txt

juju666 · Answer

Bien bien :)

Comment se porte le PC ? 
:)

Lance une analyse complète avec ton antivirus et tiens moi au courant !

sofia94 · Answer

avec quel antivirus??

sofia94 · Answer

lool ca peut paraitre con mais jy connais rien

sofia94 · Answer

pour ce qui est de mon pc je narrive toujours pas a aller sur google ca me met 404 NOT FOUND et jai toujours des barres sur lécran qui aparaissent pour me dire de sauvegarder ou pas sauvegarder

juju666 · Answer

mdr :)

attends, d'abord, redémarre ton ordinateur.
une fois fait, prépare moi un nouveau rapport zhpdiag et envoie le rapport sur pjjoint. Poste le lien ici.
J'aimerai vérifier quelque chose ;)

sofia94 · Answer

et la configuration de mon internet est bizarre quand je clik sur le e dinternet jai aucune barre doutil jai qu'une seule barre ou je dois mettre ladresse c tout avant javais la barre ou je peux mettre page précédente le truc classic quoi

juju666 · Answer

fais ce que j'ai demandé au dessus (si tu ne l'as pas vu)

et pour internet explorer :

démarrer/panneau de configuration/options internet/avancé => réinitialiser tout

sofia94 · Answer

ok chef tu peux me dire comment je refais le rapport avec zhpdiag?? stp

juju666 · Answer

tu l'ouvres et tu cliques sur la loupe :))

sofia94 · Answer

jsuis en train de la faire par contre jai tout reinitialisé jai redémarré mais c toujours pareil ya peut etre des truc a cocher ou decocher !!

juju666 · Answer

réinstalle le : https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70

sofia94 · Answer

ok le rapport il est super long je le copie colle quand meme?

sofia94 · Answer

Rapport de ZHPDiag v1.28.1346 par Nicolas Coolman, Update du 29/08/2011
Run by PBELL at 09/09/2011 16:29:24
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html


---\ Web Browser
MSIE: Internet Explorer v9.0.8112.16421
OBIE: Safari v5.34.50.0

---\ Windows Product Information
Windows 7 Ultimate Edition, 32-bit  (Build 7600)
Windows Server License Manager Script : Absent (Not found)
Windows ID Activation : Inconnue (Unknown)
Windows Licence : Inconnue (Unknown)
Software Protection Service (Protection logicielle)  : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\ System Information
~ Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3066 MB (73% free)
System Restore: Activé (Enable)
System drive C: has 214 GB (71%) free of 298 GB

---\ Logged in mode
~ Computer Name: PBELL-PC
~ User Name: PBELL
~ All Users Names: PBELL, HomeGroupUser$, Administrateur, 
~ Unselected Option: O45,O61,O62,O65,O66,O82
Logged in as Administrator

---\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\PBELL\AppData\Roaming\
~ %Desktop% : C:\Users\PBELL\Desktop\
~ %Favorites% : C:\Users\PBELL\Favorites\
~ %LocalAppData% : C:\Users\PBELL\AppData\Local\
~ %StartMenu% : C:\Users\PBELL\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\system32\

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 214 Go of 298 Go)
D:\ CD-ROM drive (Free 0 Go of 2 Go)



---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoDesktop: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoStartMenuSubFolder: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoResolveSearch: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoClose: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] WarnOnHTTPSToHTTPRedirect: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SYSTEM\CurrentControlSet\Services] wscsvc :  OK
~ Scan Security Center in 00mn 00s



---\ Recherche particulière de fichiers génériques
[MD5.2626FC9755BE22F805D3CFA0CE3EE727] - (.Microsoft Corporation - Explorateur Windows.) (.28/08/2010 - 06:45:39.) -- C:\Windows\Explorer.exe [2614272]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (....) (.14/07/2009 - 02:14:31.) -- C:\Windows\system32undll32.exe [44544]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\system32\Wininit.exe [96256]
[MD5.2C7332C222D1FE1FC57D622699A8C001] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.11/08/2011 - 03:48:26.) -- C:\Windows\system32\wininet.dll [1126912]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.28/08/2010 - 07:17:59.) -- C:\Windows\system32\Winlogon.exe [285696]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\drivers\atapi.sys [21584]
[MD5.3795DCD21F740EE799FB7223234215AF] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.14/07/2009 - 02:20:44.) -- C:\Windows\system32\drivers
tfs.sys [1210432]
[MD5.58C94EAE54BF0C5E2B80B2E5E7744D4C] - (.Microsoft Corporation - Bibliothèque de licences.) (.14/07/2009 - 02:16:15.) -- C:\Windows\system32\sppcomapi.dll [193024]
[MD5.D8714A5FB3141F8226D16861F20C5AC4] - (....) (.14/07/2009 - 09:39:06.) -- C:\Windows\system32\fr-FR\user32.dll.mui [19968]
~ Scan Generic Processes in 00mn 00s



---\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 29/4447
~ Mes musiques (My Musics) : 2/287
~ Mes Favoris (My Favorites) : 6/174
~ Mes Documents (My Documents) : 4/63
~ Mon Bureau (My Desktop) : 1/27
~ Menu demarrer (Programs) : 6/20
~ Scan Hidden Files in 00mn 11s



---\ Processus lancés
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- C:\Windows\System32undll32.exe   [44544] [PID.2616]
[MD5.69169586EFAD19F53C2012FFD8FDCF45] - (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe   [37296] [PID.2860]
[MD5.1972FB0E62D1DAC37BE29C94E754D0F9] - (.KalityWeb - WebAdSystem.) -- C:\Program Files\WebAdSystem\WebAdSystem.exe   [777216] [PID.2912]
[MD5.6448BF2FEF484EF8B7787AE9EB2D5B5C] - (.www.IslamicFinder.org -  Automatic Athan (Azan)  five times a day f.) -- C:\Program Files\Athan\Athan.exe   [1114112] [PID.2920]
[MD5.879D74337173A6D630D3D06184D354C1] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe   [421736] [PID.2956]
[MD5.6FBBB73BE9FB38389AB73F38828A9CAC] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe   [13351304] [PID.2972]
[MD5.BFE1AEE6398E636D3A95995FE3A7BE77] - (.Siber Systems - RoboForm TaskBar Icon.) -- C:\Program Files\Siber Systems\AI RoboFormobotaskbaricon.exe   [107000] [PID.2988]
[MD5.2CE8F1C52F490875592166316C512B6F] - (.Skype Technologies - Skype Extras Manager.) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe   [80256] [PID.3452]
[MD5.904E13BA41AF2E353A32CF351CA53639] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe   [748336] [PID.1136]
[MD5.7914370AAC5CDE8DCAE1C674A6C90229] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [669696] [PID.1652]
~ Scan Processes Running in 00mn 01s



---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PBELL\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] None
G0 - GCSP: Preference [User Data\Default][HomePage] https://www.google.fr/?gws_rd=ssl
~ Scan Google Browser in 00mn 00s



---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (...) -- C:\Program Files\iTunes\Mozilla Plugins
pitunes.dll
P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_21 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll
P2 - FPN: [HKLM] [@ma-config.com/HardwareDetection] - (.Cybelsoft - Plugin NPAPI Ma-Config.com.) -- C:\Program Files\ma-config.com
phardwaredetection.dll
P2 - FPN: [HKLM] [@microsoft.com/GENUINE] - (.Microsoft Corporation - Windows Activation Technologies Plugin for Mozilla.) -- C:\Windows\system32\Wat
pWatWeb.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.60531.0.) -- c:\Program Files\Microsoft Silverlight\4.0.60531.0
pctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/OfficeAuthz,version=14.0] - (.Microsoft Corporation - Office Authorization plug-in for NPAPI browsers.) -- C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.dll
P2 - FPN: [HKLM] [@microsoft.com/SharePoint,version=14.0] - (.Microsoft Corporation - The plug-in allows you to open and edit files using Microsoft Office a.) -- C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3502.0922] - (...) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (.not file.)
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.65
pGoogleUpdate3.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.65
pGoogleUpdate3.dll
P2 - FPN: [HKLM] [@zylom.com/ZylomGamesPlayer] - (.Zylom - Zylom Plugin.) -- C:\ProgramData\Zylom\ZylomGamesPlayer
pzylomgamesplayer.dll
P2 - FPN: [HKLM] [Adobe Reader] - (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape "9.4.5".) -- C:\Program Files\Adobe\Reader 9.0\Reader\AIR
ppdf32.dll
~ Scan Firefox Browser in 00mn 00s



---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKUS\S-1-5-21-2341819117-2716500083-4139753839-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)) -- C:\Windows\System32\ieframe.dll
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2
~ Scan IE Browser in 00mn 00s



---\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Scan Proxy management in 00mn 00s



---\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=C:\Windows\system32\SystemPropertiesPerformance.exe
~ Scan Keys in 00mn 00s



---\ Redirection du fichier Hosts (O1)
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts:  
O1 - Hosts: 209.97.213.153 www.google.com.au
O1 - Hosts: 178.17.165.3 www.google.com.au
O1 - Hosts: 209.97.213.153 www.google.be
O1 - Hosts: 178.17.165.3 www.google.be
O1 - Hosts: 209.97.213.153 www.google.com.br
O1 - Hosts: 178.17.165.3 www.google.com.br
O1 - Hosts: 209.97.213.153 www.google.ca
O1 - Hosts: 178.17.165.3 www.google.ca
O1 - Hosts: 209.97.213.153 www.google.ch
O1 - Hosts: 178.17.165.3 www.google.ch
O1 - Hosts: 178.17.165.3 www.google.de
O1 - Hosts: 209.97.213.153 www.google.dk
O1 - Hosts: 178.17.165.3 www.google.dk
O1 - Hosts: 209.97.213.153 www.google.fr
O1 - Hosts: 178.17.165.3 www.google.fr
O1 - Hosts: 209.97.213.153 www.google.ie
O1 - Hosts: 178.17.165.3 www.google.ie
O1 - Hosts: 209.97.213.153 www.google.it
O1 - Hosts: 178.17.165.3 www.google.it
O1 - Hosts: 209.97.213.153 www.google.co.jp
O1 - Hosts: 178.17.165.3 www.google.co.jp
O1 - Hosts: 209.97.213.153 www.google.nl
O1 - Hosts: 178.17.165.3 www.google.nl
O1 - Hosts: 209.97.213.153 www.google.no
O1 - Hosts: 178.17.165.3 www.google.no
O1 - Hosts: 209.97.213.153 www.google.co.nz
O1 - Hosts: 178.17.165.3 www.google.co.nz
O1 - Hosts: 209.97.213.153 www.google.pl
O1 - Hosts: 178.17.165.3 www.google.pl
O1 - Hosts: 209.97.213.153 www.google.se
O1 - Hosts: 178.17.165.3 www.google.se
O1 - Hosts: 209.97.213.153 www.google.co.za
O1 - Hosts: 178.17.165.3 www.google.co.za
O1 - Hosts: 209.97.213.153 www.bing.com
O1 - Hosts: 178.17.165.3 www.bing.com
O1 - Hosts: 209.97.213.153 search.yahoo.com
O1 - Hosts: 178.17.165.3 search.yahoo.com
O1 - Hosts: 209.97.213.153 uk.search.yahoo.com
O1 - Hosts: 178.17.165.3 uk.search.yahoo.com
O1 - Hosts: 209.97.213.153 ca.search.yahoo.com
O1 - Hosts: 178.17.165.3 ca.search.yahoo.com
O1 - Hosts: 209.97.213.153 de.search.yahoo.com
O1 - Hosts: 178.17.165.3 de.search.yahoo.com
O1 - Hosts: 209.97.213.153 fr.search.yahoo.com
O1 - Hosts: 178.17.165.3 fr.search.yahoo.com
O1 - Hosts: 209.97.213.153 au.search.yahoo.com
O1 - Hosts: 178.17.165.3 au.search.yahoo.com
~ Scan Hosts File in 00mn 00s



---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} . (.Yahoo! Inc. - Yahoo! Toolbar.) -- C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} . (.SFR - Aide à la navigation SFR.) -- C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IE BHO Utility - {5AB7104A-B71F-49AD-9154-F7F8806AE848} . (.Surf Canyon Incorporated - Surf Canyon Search Engine Assistant for Int.) -- C:\Program Files\Surf Canyon\surfcanyon.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} . (.Microsoft Corporation - Microsoft SharePoint Workspace Extensions.) -- C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} . (.Microsoft Corporation - Microsoft Office Document Cache Handler.) -- C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: WebAdSystemBho - {EC8FCB46-9F27-476E-B26A-93989316D2FB} . (.KalityWeb - WebAdSystemBho.) -- C:\Program Files\WebAdSystem\BrowserExtensions\internetexplorer\WebAdSystemBho.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} . (.Yahoo! Inc - Yahoo! Single Instance for Mail.) -- C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
~ Scan BHO in 00mn 00s



---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} . (.Yahoo! Inc. - Yahoo! Toolbar.) -- C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
~ Scan Toolbar in 00mn 00s



---\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files\Microsoft Office\Office14\BCSSync.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 
O4 - HKLM\..\Run: [AppleSyncNotifier] . (.Apple Inc. - AppleSyncNotifier.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe 
O4 - HKLM\..\Run: [WebAdSystem] . (.KalityWeb - WebAdSystem.) -- C:\Program Files\WebAdSystem\WebAdSystem.exe 
O4 - HKLM\..\Run: [Athan] . (.www.IslamicFinder.org -  Automatic Athan (Azan)  five times a day f.) -- C:\Program Files\Athan\Athan.exe 
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe 
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe 
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe 
O4 - HKCU\..\Run: [RoboForm] . (.Siber Systems - RoboForm TaskBar Icon.) -- C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe 
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-21-2341819117-2716500083-4139753839-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
O4 - HKUS\S-1-5-21-2341819117-2716500083-4139753839-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe 
O4 - HKUS\S-1-5-21-2341819117-2716500083-4139753839-1000\..\Run: [RoboForm] . (.Siber Systems - RoboForm TaskBar Icon.) -- C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe 
O4 - HKUS\S-1-5-21-2341819117-2716500083-4139753839-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
~ Scan Application in 00mn 00s



---\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\PBELL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\PBELL\Desktop\AD-R.lnk . (...)  -- C:\Program Files\Ad-Remover\main.exe
O4 - Global Startup: C:\Users\PBELL\Desktop\Athan.lnk . (.www.IslamicFinder.org.)  -- C:\Program Files\Athan\Athan.exe
O4 - Global Startup: C:\Users\PBELL\Desktop\FinalTorrent.lnk . (.Bitberry Software.)  -- C:\Program Files\FinalTorrent\FinalTorrent.EXE
O4 - Global Startup: C:\Users\PBELL\Desktop\iPhone1,2_4.1_8B117_Restore - Raccourci (2).lnk . (...)  -- C:\Users\PBELL\Documents\Mes fichiers reçus\iphone jailbreak\iPhone1,2_4.1_8B117_Restore.zip
O4 - Global Startup: C:\Users\PBELL\Desktop\Microsoft Excel 2010.lnk . (...)  -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
O4 - Global Startup: C:\Users\PBELL\Desktop\Microsoft Word 2010.lnk . (...)  -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
O4 - Global Startup: C:\Users\PBELL\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk . (...)  -- C:\Windows\Installer\{735619D4-B42A-437A-958C-199BFCAEDB38}\SafariIco.exe
O4 - Global Startup: C:\Users\PBELL\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FinalTorrent.lnk . (.Bitberry Software.)  -- C:\Program Files\FinalTorrent\FinalTorrent.EXE
O4 - Global Startup: C:\Users\PBELL\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk . (.Google Inc..)  -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - Global Startup: C:\Users\PBELL\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\PBELL\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
~ Scan Global Startup in 00mn 01s



---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll
O9 - Extra button: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O9 - Extra button: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\PROGRA~1\MICROS~2\Office14\ONBTTN~1.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
~ Scan IE Extra Buttons in 00mn 00s



---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32
apinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files\Bonjour\mdnsNSP.dll
~ Scan Winsock in 00mn 00s



---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} () - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
~ Scan Objets ActiveX in 00mn 00s



---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{61CB117F-A443-4242-9242-AA1498248D4D}: DhcpNameServer = 172.20.2.10 172.20.2.39
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7BB70E1-8EC4-4CF0-BEF7-3C81F40FF5E6}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\..\{C036789B-DA96-4BEF-B79E-AB562611C6DB}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{61CB117F-A443-4242-9242-AA1498248D4D}: DhcpNameServer = 172.20.2.10 172.20.2.39
O17 - HKLM\System\CS1\Services\Tcpip\..\{B7BB70E1-8EC4-4CF0-BEF7-3C81F40FF5E6}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{C036789B-DA96-4BEF-B79E-AB562611C6DB}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{61CB117F-A443-4242-9242-AA1498248D4D}: DhcpNameServer = 172.20.2.10 172.20.2.39
O17 - HKLM\System\CS2\Services\Tcpip\..\{B7BB70E1-8EC4-4CF0-BEF7-3C81F40FF5E6}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{C036789B-DA96-4BEF-B79E-AB562611C6DB}: DhcpNameServer = 192.168.1.1
~ Scan Domain in 00mn 00s



---\ Protocole additionnel (O18)
O18 - Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} . (.Microsoft Corporation - Contrôle ActiveX pour le flux vidéo.) -- C:\Windows\System32\msvidctl.dll
O18 - Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\System32\itss.dll
O18 - Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
O18 - Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\Windows\system32\inetcomm.dll
O18 - Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\system32\urlmon.dll
O18 - Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} . (.Microsoft Corporation - Microsoft® Help Data Services Module.) -- C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Windows\System32\itss.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
O18 - Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} . (.Microsoft Corporation - Contrôle ActiveX pour le flux vidéo.) -- C:\Windows\System32\msvidctl.dll
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\system32\mscoree.dll
O18 - Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\system32\mscoree.dll
O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\system32\mscoree.dll
O18 - Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
~ Scan Protocole Additionnel in 00mn 00s



---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
~ Scan SSODL in 00mn 00s



---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Apple Mobile Device (Apple Mobile Device) . (.Apple Inc. - MobileDeviceService.) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 258.9.) - C:\Windows\system32
vvsvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) . (.Yahoo! Inc. - AutoUpater Service Module.) - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
~ Scan Services in 00mn 00s



---\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) -  (.not file.)
~ Scan Desktop Component in 00mn 00s



---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.BFE1AEE6398E636D3A95995FE3A7BE77] [APT] [Run RoboForm TaskBar Icon] (.Siber Systems.) -- C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
[MD5.92B476DD52794881A4B91A5529C2706B] [APT] [{043A9142-2E1F-4EF2-862D-EE554862EE3A}] (...) -- C:\Program Files\AVAST Software\Avast\aswRundll.exe
[MD5.A319F1A8D530901DB3E701AD5F2457DD] [APT] [{75A7D0AB-EC43-4DFE-B29B-6EDB9BC3354A}] (.Apple Inc..) -- C:\Program Files\iTunes\iTunes.exe
[MD5.6FBBB73BE9FB38389AB73F38828A9CAC] [APT] [{77234E79-E16C-4CA0-A7EA-DADFD2BDFD9C}] (.Skype Technologies S.A..) -- C:\Program Files\Skype\Phone\Skype.exe
[MD5.34EBD4FF6A24D86BB4716D6AFCC1A89B] [APT] [AppleSoftwareUpdate] (.Apple Inc..) -- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
~ Scan Scheduled Task in 00mn 06s



---\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\system32\DRIVERS\blbdrive.sys
O41 - Driver:  (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\system32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\cscsvc.dll (CSC) . (.Microsoft Corporation - Windows Client Side Caching Driver.) - C:\Windows\system32\drivers\csc.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\system32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\system32\drivers\discache.sys
O41 - Driver:  (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\system32\DRIVERS\mssmbios.sys
O41 - Driver:  (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\system32\DRIVERS
etbios.sys
O41 - Driver: C:\Windows\system32\drivers
etbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\system32\DRIVERS
etbt.sys
O41 - Driver: C:\Windows\system32\drivers
siproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\system32\drivers
siproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\system32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\system32\DRIVERSdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\system32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\system32\driversdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\system32\driversdprefmp.sys
O41 - Driver: C:\Windows\system32	cpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\system32\DRIVERS	dx.sys
O41 - Driver:  (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\system32\DRIVERS	ermdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: C:\Windows\system32ascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\system32\DRIVERS\wanarp.sys
O41 - Driver:  (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\system32\DRIVERS\wfplwf.sys
~ Scan Drivers in 00mn 00s



---\ Logiciels installés (O42)
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Athan Basic 3.8 - (.Pas de propriétaire.) [HKLM] -- Athan
O42 - Logiciel: Definition update for Microsoft Office 2010 (KB982726) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{06C723B9-ADF5-42BC-B949-D14D6C6628B9}
O42 - Logiciel: FinalTorrent 2010 - (.Bitberry Software.) [HKLM] -- FinalTorrent_is1
O42 - Logiciel: Google Chrome - (.Google Inc..) [HKLM] -- Google Chrome
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3
O42 - Logiciel: Macromedia Flash Player 8 - (.Macromedia.) [HKLM] -- ShockwaveFlash
O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.1.1800 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: McAfee Security Scan Plus - (.McAfee, Inc..) [HKLM] -- McAfee Security Scan
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft Office Professionnel Plus 2010 - (.Microsoft Corporation.) [HKLM] -- Office14.PROPLUS
O42 - Logiciel: Module linguistique Microsoft .NET Framework 4 Client Profile FRA - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile FRA Language Pack
O42 - Logiciel: NVIDIA Display Control Panel - (.NVIDIA Corporation.) [HKLM] -- NVIDIA Display Control Panel
O42 - Logiciel: NVIDIA Drivers - (.NVIDIA Corporation.) [HKLM] -- NVIDIA Drivers
O42 - Logiciel: RoboForm 7-2-5 (All Users) - (.Siber Systems.) [HKLM] -- AI RoboForm
O42 - Logiciel: SFR - Kit de connexion - (.SFR.) [HKLM] -- SFR_Kit
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2446708
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2478663
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2518870
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2539636
O42 - Logiciel: Security Update for Microsoft Excel 2010 (KB2523021) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{AA9E4C48-857D-4558-A4F4-343CA7680277}
O42 - Logiciel: Security Update for Microsoft InfoPath 2010 (KB2510065) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{3C6C6854-EB6B-455C-B0A6-9871F0538028}
O42 - Logiciel: Security Update for Microsoft Office 2010 (KB2289078) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{1D1A4F08-2F17-475B-BA72-476CE5992FEE}
O42 - Logiciel: Security Update for Microsoft Office 2010 (KB2289161) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F134C2C6-30B3-4169-A325-58482B4CE6FC}
O42 - Logiciel: Security Update for Microsoft PowerPoint 2010 (KB2519975) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{45D7C5CD-B967-44AF-9DAB-E5C8545558AD}
O42 - Logiciel: Security Update for Microsoft Publisher 2010 (KB2409055) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{C3C277D5-36E3-4B1A-926A-175B2BC019CF}
O42 - Logiciel: Security Update for Microsoft Word 2010 (KB2345000) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{A6D422EE-1196-45EE-B9AE-6B5B64975E8B}
O42 - Logiciel: Security Update for Module linguistique Microsoft .NET Framework 4 Client Profile FRA (KB2478663) - (.Microsoft Corporation.) [HKLM] -- {0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}.KB2478663
O42 - Logiciel: Security Update for Module linguistique Microsoft .NET Framework 4 Client Profile FRA (KB2518870) - (.Microsoft Corporation.) [HKLM] -- {0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}.KB2518870
O42 - Logiciel: Surf Canyon Search Engine Assistant - (.Surf Canyon.) [HKLM] -- Surf Canyon
O42 - Logiciel: Update for Microsoft Office 2010 (KB2202188) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{86B7A074-265D-420C-9E1E-7A920EF0ECA7}
O42 - Logiciel: Update for Microsoft Office 2010 (KB2413186) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{556146F7-74AE-4E0A-B64F-5B8B93469F61}
O42 - Logiciel: Update for Microsoft Office 2010 (KB2413186) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B5516874-E926-4BFD-B412-D0E70112F244}
O42 - Logiciel: Update for Microsoft Office 2010 (KB2413186) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{D6CE7280-6EE3-419A-8F47-DB111C040B1B}
O42 - Logiciel: Update for Microsoft Office 2010 (KB2494150) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}
O42 - Logiciel: Update for Microsoft Office 2010 (KB2523113) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{C0FF04BF-A05E-408B-81CA-B7FACDA508A3}
O42 - Logiciel: Update for Microsoft OneNote 2010 (KB2493983) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{309EEC22-83CE-4109-B019-BA9392FAA322}
O42 - Logiciel: Update for Microsoft Outlook Social Connector (KB2441641) - (.Microsoft.) [HKLM] -- {90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{A10DC2B7-6FDA-4C17-9DF0-6A834CAC4306}
O42 - Logiciel: VLC media player 1.1.7 - (.VideoLAN.) [HKLM] -- VLC media player
O42 - Logiciel: Yahoo! Software Update - (.Pas de propriétaire.) [HKLM] -- Yahoo! Software Update
O42 - Logiciel: Yahoo! Toolbar - (.Pas de propriétaire.) [HKLM] -- Yahoo! Companion
O42 - Logiciel: Zylom Games Player Plugin - (.Zylom Games.) [HKLM] -- Zylom Games Player Plugin
O42 - Logiciel: avast! Free Antivirus - (.AVAST Software.) [HKLM] -- avast

---\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\AVAST Software]
[HKCU\Software\Ad-Remover]
[HKCU\Software\Adobe]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software\Yahoo]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\Apple Computer, Inc.]
[HKCU\Software\Apple Inc.]
[HKCU\Software\Aurigma]
[HKCU\Software\Bitberry]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\EasyBits]
[HKCU\Software\GNU]
[HKCU\Software\Google]
[HKCU\Software\IM Providers]
[HKCU\Software\JavaSoft]
[HKCU\Software\KalityWeb]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Mozilla]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Netscape]
[HKCU\Software\ODBC]
[HKCU\Software\Policies]
[HKCU\Software\Siber Systems]
[HKCU\Software\Skype]
[HKCU\Software\Surf Canyon]
[HKCU\Software\Sysinternals]
[HKCU\Software\Trolltech]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\Yahoo]
[HKCU\Software\cybelsoft]
[HKCU\Software\g3n-h@ckm@n]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\ALWIL Software]
[HKLM\Software\ATI Technologies]
[HKLM\Software\AVAST Software]
[HKLM\Software\Adobe]
[HKLM\Software\AdwCleaner]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\BrowserChoice]
[HKLM\Software\CXT]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\DivX]
[HKLM\Software\GEAR Software]
[HKLM\Software\Google]
[HKLM\Software\Intel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\KalityWeb]
[HKLM\Software\Khronos]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MimarSinan]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Neuf]
[HKLM\Software\ODBC]
[HKLM\Software\Policies]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SecureDigitalServices]
[HKLM\Software\Siber Systems]
[HKLM\Software\Skype]
[HKLM\Software\Sonic]
[HKLM\Software\VideoLAN]
[HKLM\Software\W3i]
[HKLM\Software\Yahoo]
[HKLM\Software\cybelsoft]
[HKLM\Software\mcafeeupdater]
[HKLM\Software	dbg_trace]
~ Scan Softwares in 00mn 00s



---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 09/09/2011 - 15:20:08 - [81424711] ----D- C:\Program Files\Ad-Remover
O43 - CFD: 18/10/2010 - 22:04:22 - [162903726] ----D- C:\Program Files\Adobe
O43 - CFD: 28/08/2010 - 17:20:18 - [0] ----D- C:\Program Files\Alwil Software
O43 - CFD: 28/07/2011 - 14:41:16 - [2428606] ----D- C:\Program Files\Apple Software Update
O43 - CFD: 30/05/2011 - 03:35:28 - [17844631] ----D- C:\Program Files\Athan
O43 - CFD: 12/07/2011 - 14:59:54 - [158510307] ----D- C:\Program Files\AVAST Software
O43 - CFD: 28/07/2011 - 14:45:26 - [628535] ----D- C:\Program Files\Bonjour
O43 - CFD: 18/10/2010 - 22:04:22 - [504389470] ----D- C:\Program Files\Common Files
O43 - CFD: 14/07/2009 - 11:01:32 - [83226132] ----D- C:\Program Files\DVD Maker
O43 - CFD: 25/08/2010 - 21:24:06 - [0] -SH-D- C:\Program Files\Fichiers communs
O43 - CFD: 20/11/2010 - 20:36:48 - [6703872] ----D- C:\Program Files\FinalTorrent
O43 - CFD: 13/09/2010 - 00:46:50 - [304551735] ----D- C:\Program Files\Google
O43 - CFD: 07/09/2011 - 23:24:06 - [6798824] ----D- C:\Program Files\Internet Explorer
O43 - CFD: 09/09/2011 - 11:52:20 - [1868883] ----D- C:\Program Files\iPod
O43 - CFD: 09/09/2011 - 11:53:06 - [124246827] ----D- C:\Program Files\iTunes
O43 - CFD: 13/09/2010 - 00:45:00 - [89253383] ----D- C:\Program Files\Java
O43 - CFD: 25/08/2010 - 21:33:00 - [5504293] ----D- C:\Program Files\ma-config.com
O43 - CFD: 09/09/2011 - 09:42:08 - [6953186] ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD: 12/06/2011 - 02:09:42 - [9220463] ----D- C:\Program Files\McAfee Security Scan
O43 - CFD: 03/08/2011 - 00:39:28 - [226432] ----D- C:\Program Files\Microsoft
O43 - CFD: 25/08/2010 - 21:53:54 - [39848379] ----D- C:\Program Files\Microsoft Analysis Services
O43 - CFD: 14/07/2009 - 11:01:22 - [147812402] ----D- C:\Program Files\Microsoft Games
O43 - CFD: 25/08/2010 - 21:56:20 - [990167592] ----D- C:\Program Files\Microsoft Office
O43 - CFD: 08/09/2011 - 09:48:06 - [38411899] ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD: 13/01/2011 - 01:17:50 - [1805760] ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD: 25/08/2010 - 21:56:20 - [793991] ----D- C:\Program Files\Microsoft Sync Framework
O43 - CFD: 25/08/2010 - 21:56:36 - [326800] ----D- C:\Program Files\Microsoft Synchronization Services
O43 - CFD: 25/08/2010 - 21:54:46 - [1378033] ----D- C:\Program Files\Microsoft Visual Studio 8
O43 - CFD: 26/11/2010 - 04:17:22 - [8167779] ----D- C:\Program Files\Microsoft.NET
O43 - CFD: 25/08/2010 - 21:56:52 - [26521] ----D- C:\Program Files\MSBuild
O43 - CFD: 12/06/2011 - 02:10:10 - [138179798] ----D- C:\Program Files\NVIDIA Corporation
O43 - CFD: 11/01/2011 - 14:18:30 - [786432] ----D- C:\Program Files\Protector Suite
O43 - CFD: 09/09/2011 - 11:42:24 - [75697179] ----D- C:\Program Files\QuickTime
O43 - CFD: 14/07/2009 - 06:52:32 - [38597377] ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 28/07/2011 - 15:11:18 - [44366882] ----D- C:\Program Files\Safari
O43 - CFD: 06/03/2011 - 14:54:02 - [14895922] ----D- C:\Program Files\SFR
O43 - CFD: 01/03/2011 - 23:35:22 - [27789543] ----D- C:\Program Files\Siber Systems
O43 - CFD: 02/10/2010 - 00:13:06 - [25537323] R---D- C:\Program Files\Skype
O43 - CFD: 20/11/2010 - 20:36:40 - [305944] ----D- C:\Program Files\Surf Canyon
O43 - CFD: 14/07/2009 - 06:53:24 - [0] ----D- C:\Program Files\Uninstall Information
O43 - CFD: 12/02/2011 - 02:25:08 - [82388938] ----D- C:\Program Files\VideoLAN
O43 - CFD: 23/05/2011 - 01:47:32 - [951126] ----D- C:\Program Files\WebAdSystem
O43 - CFD: 14/07/2009 - 10:39:40 - [3049984] ----D- C:\Program Files\Windows Defender
O43 - CFD: 14/07/2009 - 11:01:30 - [7013496] ----D- C:\Program Files\Windows Journal
O43 - CFD: 13/01/2011 - 02:34:18 - [51658429] ----D- C:\Program Files\Windows Live
O43 - CFD: 13/01/2011 - 02:34:06 - [245112] ----D- C:\Program Files\Windows Live SkyDrive
O43 - CFD: 19/12/2010 - 04:57:04 - [6180864] ----D- C:\Program Files\Windows Mail
O43 - CFD: 14/10/2010 - 10:12:10 - [6607787] ----D- C:\Program Files\Windows Media Player
O43 - CFD: 25/08/2010 - 21:24:06 - [12197556] ----D- C:\Program Files\Windows NT
O43 - CFD: 14/07/2009 - 10:39:40 - [4417800] ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 06:52:34 - [189440] ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 14/07/2009 - 10:39:40 - [6830588] ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 20/11/2010 - 20:34:54 - [5133282] ----D- C:\Program Files\Yahoo!
O43 - CFD: 09/09/2011 - 16:29:40 - [4021157] ----D- C:\Program Files\ZHPDiag
O43 - CFD: 12/09/2010 - 23:57:22 - [510480] ----D- C:\Program Files\Zylom Games
O43 - CFD: 18/10/2010 - 22:04:24 - [6247934] ----D- C:\Program Files\Common Files\Adobe
O43 - CFD: 09/09/2011 - 11:52:18 - [114989651] ----D- C:\Program Files\Common Files\Apple
O43 - CFD: 25/08/2010 - 21:56:36 - [99136] ----D- C:\Program Files\Common Files\DESIGNER
O43 - CFD: 08/09/2011 - 09:31:52 - [247289673] ----D- C:\Program Files\Common Files\microsoft shared
O43 - CFD: 14/07/2009 - 04:37:06 - [2702] ----D- C:\Program Files\Common Files\Services
O43 - CFD: 02/10/2010 - 00:12:52 - [2135336] ----D- C:\Program Files\Common Files\Skype
O43 - CFD: 14/07/2009 - 04:37:06 - [41103783] ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 25/08/2010 - 21:54:08 - [14247378] ----D- C:\Program Files\Common Files\System
O43 - CFD: 28/08/2010 - 16:40:04 - [78273877] ----D- C:\Program Files\Common Files\Windows Live
O43 - CFD: 18/10/2010 - 22:04:24 - [763] ----D- C:\ProgramData\Adobe
O43 - CFD: 28/08/2010 - 17:20:18 - [9049536] ----D- C:\ProgramData\Alwil Software
O43 - CFD: 04/10/2010 - 17:56:18 - [145773136] ----D- C:\ProgramData\Apple
O43 - CFD: 04/10/2010 - 17:53:18 - [1469976786] ----D- C:\ProgramData\Apple Computer
O43 - CFD: 14/07/2009 - 06:53:56 - [0] -SH-D- C:\ProgramData\Application Data
O43 - CFD: 12/07/2011 - 14:59:54 - [638852] ----D- C:\ProgramData\AVAST Software
O43 - CFD: 25/08/2010 - 21:24:06 - [0] -SH-D- C:\ProgramData\Bureau
O43 - CFD: 14/07/2009 - 06:53:56 - [0] -SH-D- C:\ProgramData\Desktop
O43 - CFD: 12/02/2011 - 02:37:40 - [1435] ----D- C:\ProgramData\DivX
O43 - CFD: 14/07/2009 - 06:53:56 - [0] -SH-D- C:\ProgramData\Documents
O43 - CFD: 25/08/2010 - 21:24:06 - [0] -SH-D- C:\ProgramData\Favoris
O43 - CFD: 14/07/2009 - 06:53:56 - [0] -SH-D- C:\ProgramData\Favorites
O43 - CFD: 13/09/2010 - 00:46:56 - [539844] ----D- C:\ProgramData\Google
O43 - CFD: 25/08/2010 - 21:32:58 - [1132459] ----D- C:\ProgramData\ma-config.com
O43 - CFD: 09/09/2011 - 09:42:06 - [7337465] ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 27/09/2010 - 00:31:44 - [454489] ----D- C:\ProgramData\McAfee
O43 - CFD: 12/06/2011 - 02:10:10 - [852] ----D- C:\ProgramData\McAfee Security Scan
O43 - CFD: 25/08/2010 - 21:24:06 - [0] -SH-D- C:\ProgramData\Menu Démarrer
O43 - CFD: 22/08/2011 - 05:01:54 - [259624085] -S--D- C:\ProgramData\Microsoft
O43 - CFD: 11/08/2011 - 11:47:42 - [63858] ----D- C:\ProgramData\Microsoft Help
O43 - CFD: 25/08/2010 - 21:24:06 - [0] -SH-D- C:\ProgramData\Modèles
O43 - CFD: 12/06/2011 - 02:11:24 - [259] ----D- C:\ProgramData\NVIDIA
O43 - CFD: 25/08/2010 - 21:37:42 - [0] ----D- C:\ProgramData\NVIDIA Corporation
O43 - CFD: 22/09/2010 - 19:29:40 - [632] ----D- C:\ProgramData\Office Genuine Advantage
O43 - CFD: 01/03/2011 - 23:35:36 - [96] ----D- C:\ProgramData\RoboForm
O43 - CFD: 02/10/2010 - 00:12:50 - [28820152] ----D- C:\ProgramData\Skype
O43 - CFD: 14/07/2009 - 06:53:56 - [0] -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 14/07/2009 - 06:53:56 - [0] -SH-D- C:\ProgramData\Templates
O43 - CFD: 20/11/2010 - 20:34:54 - [4217] ----D- C:\ProgramData\Yahoo!
O43 - CFD: 20/11/2010 - 20:35:02 - [1802] ----D- C:\ProgramData\Yahoo! Companion
O43 - CFD: 12/09/2010 - 23:57:22 - [264516] ----D- C:\ProgramData\Zylom
O43 - CFD: 04/10/2010 - 17:53:54 - [541235] ----D- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
O43 - CFD: 08/09/2011 - 01:38:46 - [4230882] ----D- C:\Users\PBELL\AppData\Roaming\Adobe
O43 - CFD: 28/04/2011 - 14:59:10 - [26440227895] ----D- C:\Users\PBELL\AppData\Roaming\Apple Computer
O43 - CFD: 03/09/2011 - 00:45:02 - [199] ----D- C:\Users\PBELL\AppData\Roaming\dvdcss
O43 - CFD: 20/11/2010 - 22:51:02 - [456] ----D- C:\Users\PBELL\AppData\Roaming\FinalTorrent
O43 - CFD: 16/09/2010 - 01:47:46 - [28992] ----D- C:\Users\PBELL\AppData\Roaming\Google
O43 - CFD: 12/02/2011 - 02:46:02 - [83] ----D- C:\Users\PBELL\AppData\Roaming\gtk-2.0
O43 - CFD: 25/08/2010 - 21:24:38 - [0] ----D- C:\Users\PBELL\AppData\Roaming\Identities
O43 - CFD: 28/08/2010 - 17:24:22 - [16791] ----D- C:\Users\PBELL\AppData\Roaming\Macromedia
O43 - CFD: 09/09/2011 - 09:42:22 - [1021519] ----D- C:\Users\PBELL\AppData\Roaming\Malwarebytes
O43 - CFD: 14/07/2009 - 11:00:34 - [0] ----D- C:\Users\PBELL\AppData\Roaming\Media Center Programs
O43 - CFD: 07/09/2011 - 00:58:52 - [38971587] -S--D- C:\Users\PBELL\AppData\Roaming\Microsoft
O43 - CFD: 01/03/2011 - 23:36:44 - [2745] ----D- C:\Users\PBELL\AppData\Roaming\RoboForm
O43 - CFD: 09/09/2011 - 16:29:00 - [5053431] ----D- C:\Users\PBELL\AppData\Roaming\Skype
O43 - CFD: 09/09/2011 - 16:07:08 - [88288] ----D- C:\Users\PBELL\AppData\Roaming\skypePM
O43 - CFD: 03/09/2011 - 02:18:40 - [1479647] ----D- C:\Users\PBELL\AppData\Roaming\vlc
O43 - CFD: 20/11/2010 - 20:34:50 - [0] ----D- C:\Users\PBELL\AppData\Roaming\Yahoo!
O43 - CFD: 26/07/2011 - 23:25:00 - [161328393] ----D- C:\Users\PBELL\AppData\Local\Adobe
O43 - CFD: 04/10/2010 - 17:51:56 - [0] ----D- C:\Users\PBELL\AppData\Local\Apple
O43 - CFD: 09/09/2011 - 00:23:12 - [20068671] ----D- C:\Users\PBELL\AppData\Local\Apple Computer
O43 - CFD: 25/08/2010 - 21:24:14 - [0] -SH-D- C:\Users\PBELL\AppData\Local\Application Data
O43 - CFD: 07/09/2011 - 15:53:26 - [1631911] ----D- C:\Users\PBELL\AppData\Local\Diagnostics
O43 - CFD: 07/09/2011 - 15:42:46 - [231540] ----D- C:\Users\PBELL\AppData\Local\ElevatedDiagnostics
O43 - CFD: 29/06/2011 - 20:05:02 - [401797709] ----D- C:\Users\PBELL\AppData\Local\Google
O43 - CFD: 25/08/2010 - 21:24:14 - [0] -SH-D- C:\Users\PBELL\AppData\Local\Historique
O43 - CFD: 23/05/2011 - 01:43:56 - [14057] ----D- C:\Users\PBELL\AppData\Local\Ilivid Player
O43 - CFD: 23/05/2011 - 01:47:32 - [184329] ----D- C:\Users\PBELL\AppData\Local\KalityWeb
O43 - CFD: 13/01/2011 - 01:18:08 - [3714362471] ----D- C:\Users\PBELL\AppData\Local\Microsoft
O43 - CFD: 26/08/2010 - 21:21:24 - [167894] ----D- C:\Users\PBELL\AppData\Local\Microsoft Games
O43 - CFD: 23/09/2010 - 20:44:30 - [218584] ----D- C:\Users\PBELL\AppData\Local\Microsoft Help
O43 - CFD: 28/11/2010 - 16:43:28 - [168900] ----D- C:\Users\PBELL\AppData\Local\MigWiz
O43 - CFD: 23/05/2011 - 01:41:20 - [0] ----D- C:\Users\PBELL\AppData\Local\PackageAware
O43 - CFD: 09/09/2011 - 16:28:54 - [118222] ----D- C:\Users\PBELL\AppData\Local\Temp
O43 - CFD: 25/08/2010 - 21:24:14 - [0] -SH-D- C:\Users\PBELL\AppData\Local\Temporary Internet Files
O43 - CFD: 30/05/2011 - 04:12:30 - [5955765] ----D- C:\Users\PBELL\AppData\Local\VirtualStore
O43 - CFD: 12/01/2011 - 01:06:26 - [40960] ----D- C:\Users\PBELL\AppData\Local\Windows Live
O43 - CFD: 09/01/2011 - 03:50:50 - [0] ----D- C:\Users\PBELL\AppData\Local\{13168F1D-CEE1-4D6D-A6BB-E95BDA479334}
O43 - CFD: 12/01/2011 - 01:06:54 - [0] ----D- C:\Users\PBELL\AppData\Local\{44DC1233-FD14-40C6-84CD-9AC4D51D16AD}
O43 - CFD: 11/01/2011 - 02:32:22 - [0] ----D- C:\Users\PBELL\AppData\Local\{4BC50318-67D4-4A8F-9CA2-B1FDB9B02612}
O43 - CFD: 09/01/2011 - 22:44:12 - [0] ----D- C:\Users\PBELL\AppData\Local\{5A8DFC30-82BB-4FC2-98F5-8396516A734A}
O43 - CFD: 12/01/2011 - 14:17:10 - [0] ----D- C:\Users\PBELL\AppData\Local\{C147D69B-2AE8-4C7E-9E4E-D0DD5A52C66F}
O43 - CFD: 10/01/2011 - 13:18:58 - [0] ----D- C:\Users\PBELL\AppData\Local\{C7A200EE-3439-420F-BD12-E263B9D01EA6}
O43 - CFD: 11/01/2011 - 02:32:42 - [0] ----D- C:\Users\PBELL\AppD

juju666 · Answer

non tu l'envoies sur pjjoint :)

sofia94 · Answer

ok redis moi la manip a faire stp desoléééééééééééééééééé

juju666 · Answer

mdr 

c est écrit là ^^ https://forums.commentcamarche.net/forum/affich-23102148-mon-ordinateur-est-plein-de-virus-aidez-moi-p?page=3#49

sofia94 · Answer

http://www.cijoint.fr/cjlink.php?file=cj201109/cijTcGWcJJ.txt je crois ke c celui la pcke jen ai deja fai un taleur du coup je c pas si c celui la ou lautre

juju666 · Answer

- RstHosts - Option Restaurer

Télécharge RstHosts (d'Xplode) sur ton bureau.

Lance le et appuie sur Restaurer

Copie/colle le contenu du rapport qui s'ouvrira à l'écran dans ton prochain message.

Note : Le rapport est également sauvegardé à la racine du disque dur ( C:\RstHosts.txt )

sofia94 · Answer

Rapport RstHosts v1.7 - 09/09/2011 à 17:12
Mis à jour le 22/05/11 à 17h30 par Xplode
Système d'exploitation : Windows 7 Ultimate (32 bits) [version 6.1.7600] 
Nom d'utilisateur : PBELL - PBELL-PC (Administrateur)
Exécuté depuis : C:\Users\PBELL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N0C4I22Q\rsthosts.exe
Option : [Restaurer]

++++++++++ [Restauration du fichier hosts] ++++++++++ 

-> Suppression... OK !
-> BackUp sauvegardé sous C:\RstHostsBkp.bak ... OK !
-> Copie du fichier hosts sain vers C:\Windows\system32\drivers\etc\hosts ... OK !

-> Fichier Hosts restauré avec succès !

++++++++++ [Propriétés du fichier hosts] ++++++++++ 

Emplacement : C:\Windows\system32\drivers\etc\hosts
Attribut(s) : RASH
Taille : 89 octets
Date de création : 14/07/2009 - 04:04
Date de modification : 21/11/2010 - 15:59
Date de dernier accès : 09/09/2011 - 17:12

++++++++++ [Contenu du fichier hosts ( Avant restauration )] ++++++++++ 

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#	127.0.0.1       localhost
#	::1             localhost
 
 
 
 

+++++ [251 lignes supplémentaires] +++++

++++++++++ [Contenu du fichier hosts ( Après restauration )] ++++++++++ 

# Fichier Hosts créé par RstHosts

127.0.0.1       localhost
::1             localhost

########## EOF - "C:\RstHosts.txt" - [2144 octets] ##########

juju666 · Answer

Redémarre le pc

une fois le pc relancé ouvre RstHost et choisi "Listing" 
Poste le rapport

sofia94 · Answer

Rapport RstHosts v1.7 - 10/09/2011 à 01:52
Mis à jour le 22/05/11 à 17h30 par Xplode
Système d'exploitation : Windows 7 Ultimate (32 bits) [version 6.1.7600] 
Nom d'utilisateur : PBELL - PBELL-PC (Administrateur)
Exécuté depuis : C:\Users\PBELL\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EGNPG7SF\rsthosts.exe
Option : [Listing]

++++++++++ [Propriétés du fichier hosts] ++++++++++ 

Emplacement : C:\Windows\system32\drivers\etc\hosts
Attribut(s) : RASH
Taille : 89 octets
Date de création : 14/07/2009 - 04:04
Date de modification : 21/11/2010 - 15:59
Date de dernier accès : 09/09/2011 - 17:12

++++++++++ [Contenu du fichier hosts] ++++++++++ 

# Fichier Hosts créé par RstHosts

127.0.0.1       localhost
::1             localhost


########## EOF - "C:\RstHosts.txt" - [897 octets] ##########

sofia94 · Answer

voila assez tardivement je te poste le dernier rapport que tu mas demandé google  remarche cest cool par contre jai toujours pas ma barre doutil je pense que cest la configuration mais je trouve pas tiens moi au courant merci

juju666 · Answer

salut :)

c'est ok pour le fichier Hosts ! :D

Pour la barre je ne sais pas ! (en plus que je navigue avec Firefox moi ...)

Procédure d'optimisation/d'entretien/de prévention   

&#9654 Télécharge ici : PureRa (par l''editeur de JavaRa) 

&#9654 Lance-le (clic droit "executer en tant qu''administrateur" pour Vista/7) 

=> Configuration en vidéo ( merci gen-hackman ) 

&#9654 clique sur "Clean" 

&#9654 L''outil va faire son scan puis son nettoyage 

&#9654 à la fin du rapport tu auras une ligne comme ca : 

Total space cleaned: 8140878 bytes 

&#9654 transmets juste cette ligne , le reste importe peu  

------ 

&#9654 télécharge et installe Ccleaner 

&#9654 double-clique sur le fichier pour lancer l''installation  

/!\Utilisateur de Vista et windows 7 : Clique droit sur le logo de Ccleaner, « exécuter en tant qu''administrateur »  

&#9654 &#9654 une fois ouvert tu cliques sur option et puis avancé  
&#9654 tu décoches "effacer uniquement les fichiers du dossier temp de windows plus vieux que 24 heures " 
&#9654 &#9654 cliques sur nettoyeur  
&#9654 cliques sur windows et dans la colonne avancé  
&#9654 coches la première case "vieilles données du perfetch"  
&#9654 cliques sur analyse une fois l''analyse terminé  
&#9654 cliques sur "lancer le nettoyage" et sur la demande de confirmation "OK" &#9654 &#9654 cliques maintenant sur registre et puis sur "rechercher les erreurs " 
&#9654 laisses tout cochées et cliques sur "réparer les erreurs sélectionnées"  
&#9654 il te demande de sauvegarder ==> OUI  
&#9654 tu lui donnes un nom pour pouvoir la retrouver et enregistre  
&#9654 cliques sur "corriger toutes les erreurs sélectionnées" et sur la demande de confirmation ==> OK  
&#9654 Vérifie qu''il ne reste plus rien en relançant "rechercher les erreurs"  
&#9654 tu retournes dans option et tu recoches la case "effacer uniquement les fichiers du dossier temp de windows plus vieux que 24 heures" et sur nettoyeur  windows, sous avancé, tu décoches la première case "vieilles données du perfetch"  
&#9654 tu peux fermer Ccleaner  

------  

Fais une recherche des erreurs de disque : 
ouvre Ordinateur/Poste de travail => clic droit sur C: => propriétés => outils => Vérification des erreurs cliquez sur vérifier maintenant. Ensuite cochez les deux cases puis cliquez sur démarrer. Répondez oui pour le message d''avertissement et redémarrez votre système. 

------ 

Défragmente tes disques dur : 
Télécharge Deffragler, et défragmente tes disques.  

------ 

&#9654 Désactivation, puis Réactivation de la restauration système après désinfection :  

Il est nécessaire de désactiver puis réactiver la restauration système pour la purger car les points de restauration peuvent être infectés :  

XP/Vista : http://www.forum-fec.net/t97-purger-la-restauration-du-systeme 
Seven: http://www.forum-fec.net/faq-tutoriel-astuces-f10/purger-la-restauration-du-systeme-sous-windows-7-t142.htm 

------  

&#9654 Maintiens tes logiciels à jour c'est important, utilise ce programme : https://www.commentcamarche.net/faq/13362-mettre-a-jour-son-pc-contre-les-failles-de-securite
Absolument à faire.

&#9654 idem pour les Mises à jour Windows :  

Il est très important de maintenir son OS à jour car ceci comble les failles de sécurité par lesquelles les malwares ("virus") s'introduisent ... 

&#9654 Windows Update XP (uniquement avec Internet Explorer): http://update.microsoft.com/windowsupdate/v6/ 


&#9654 Windows Update Vista/Seven : cliquer sur le logo windows, dans la rechercher taper "Windows Update", cliquer sur le résultat. 

----- 

&#9654 Mets à jour Java : https://www.java.com/fr/download/uninstalltool.jsp   

&#9654 Désinstaller les anciennes versions de Java :   

&#9654 Télécharge JavaRa.zip   

&#9654 Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)   

&#9654 Double-clique sur le répertoire JavaRa obtenu.   

&#9654 Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s''afficher)   

&#9654 Clique sur Remove Older Versions.   

&#9654 Clique sur Oui pour confirmer. L''outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.   

&#9654 Un rapport va s''ouvrir, copie-colle le dans ta prochaine réponse.   

&#9654 Note : le rapport se trouve aussi là : ( C:\JavaRa.log )   

&#9654 Tu peux fermer l''application    

&#9654 &#9654 Met à jour les logiciels Adobe :  

&#9654 Reader : https://get2.adobe.com/fr/reader/otherversions/ 

&#9654 Flash Player: https://get.adobe.com/flashplayer/?loc=fr 

----- 

Si tu utilise FireFox, vérifie que tes plug in sont à jour : https://support.mozilla.org/en-US/kb/npapi-plugins 

----- 

&#9654 &#9654 pour supprimer les outils de désinfection : 

&#9654 Télécharge et exécute Delfix sur ton bureau

&#9654 Clique sur le bouton « Suppression » et poste son rapport sur ton prochain message  
&#9654 &#9654 Pour le désinstaller, il suffit de le relancer et cliquer sur le bouton de désinstallation.  

------  

Tu peux garder Malwarebytes pour un scan de temps à autres  

-----  

Les antivirus ne font pas tout en ce qui concerne la sécurité de ta machine (mettre à jour ses logiciels etc etc)
La meilleur protection reste de connaître les infections pour pouvoir les éviter et avoir de bonne habitude.
Donc faut se documenter. 

Tu peux lire ce sujet sur les logiciels recommandés, et les attitudes responsables sur le web  
Et celui ci, sur les logiciels gratuits à éviter  

Si tu utilises Avast! ou AVG - regle le pour détecter les LPIs - voir : https://www.malekal.com/adwares-pup-protection/

Un peu de lecture pour éviter les infections :
- connaitre et éviter les infections : https://www.malekal.com/fichiers/projetantimalwares/ProjetAntiMalware-courte.pdf
- sécuriser son PC : http://forum.malekal.com/comment-securiser-son-ordinateur.html
- lire : http://www.commentcamarche.net/faq/27128-malwares-quels-enjeux-version-synthese

Ce qu'il ne faut pas faire :
Je télécharge n'importe quoi - je m'infecte - evite les programmes par publicités ou sur les liens commerciaux des moteurs de recherche - ce sont des arnaques ::
Les PUPs/LPIs : https://www.malekal.com/adwares-pup-protection/
Exemple de ce qu'il ne faut pas faire :
https://forums.commentcamarche.net/forum/affich-19719198-onglets-pub-intempestifs#14
https://forums.commentcamarche.net/forum/affich-18347759-le-nouveau-avast-sonne-trop-souvent#9
Je télécharge depuis n'importe où - je m'infecte : https://forums.commentcamarche.net/forum/affich-19916973-clickpotato-vlc-virus#6
Recommandations sur la sécurité : https://forums.commentcamarche.net/forum/affich-18680013-windows-7-et-antispyware#1

Fonctionnement de quelques catégories de malwares :
https://forums.commentcamarche.net/forum/affich-17725521-virus-programme-troyen
https://forums.commentcamarche.net/forum/affich-17746390-concernant-la-propagation-des-virus 
------  

&#9654 &#9654 Pense à marquer le fil comme résolu   

------  

Si tu as d'autres questions,
Sur le fonctionnement des malwares
Ou comment tu t'es fait infecté
N'hésites pas.
On se quitte si le rapport DelFix est ok... 

@+

sofia94 · Answer

salut jessai de faire la 1ere manip mais  quand je telecharge purera jai pas loption clean.

sofia94 · Answer

le premier choix est next jai donc cliqué dessus et la jai trouvé clean par contre y'a plein de truc a cocher et je ne c pas koi cocher

sofia94 · Answer

bon ce que jai ffait c que jai regarder configuration en video que tu mas mis en lien et jai coché comme dans la vidéo voila

sofia94 · Answer

Total space cleaned: 1840308446 bytesTotal space cleaned: 1840308446 bytes

juju666 · Answer

ok c'est bon :)

sofia94 · Answer

salut merci bocou pour ton aide ca ma bien nettoyé lordi 
 jaimertais bien savoir comment je me suis fait infecter quelles sont les conseil que tu pe me donner pour eviter ca et di moi si tu ma fait installer un antivirus ou si je doi en telecharger un 

jai aussi une autre question mon ordi me demande dinstaller windows apparament il a expiré a chak fois je coche me redemander ulterieurement 

autre chose : dans ma barre doutil en bas a droite jai une icone , un drapeau  il me met resoudre les problemes dordinateur et apparament ya 2 problemes mon parfeu est desactivé ou mal installé et il me demande de mettre un antivirus bref du chinois koi

juju666 · Answer

Hello,

jaimertais bien savoir comment je me suis fait infecter quelles sont les conseil que tu pe me donner pour eviter ca et di moi si tu ma fait installer un antivirus ou si je doi en telecharger un 

Tu as téléchargé des logiciels piégés (comme expliqué dans les liens fournis) et tu les as installés. Ceux-ci ont installés les adwares (publiciels)

Bien sûr qu'il te faut un antivirus! Si tu n'en n'as pas d'installé, je te conseille avast 6 : http://ftp01net.telechargement.fr/setup_av_free.exe


jai aussi une autre question mon ordi me demande dinstaller windows apparament il a expiré a chak fois je coche me redemander ulterieurement 

oO tu peux expliquer? faire une capture d'écran du message ? 

autre chose : dans ma barre doutil en bas a droite jai une icone , un drapeau il me met resoudre les problemes dordinateur et apparament ya 2 problemes mon parfeu est desactivé ou mal installé et il me demande de mettre un antivirus bref du chinois koi

https://support.microsoft.com/en-us/windows?ui=en-US&rs=en-001&ad=US

sofia94 · Answer

comment je peut capturer lécran??

sofia94 · Answer

en fait je crois quil faut que je menregistre ca parle de rentrer une clé

juju666 · Answer

Ok ça va je crois avoir compris ce que tu veux dire ^^

Tu as un pc portable packard bell c'est bien ça ? 
Tu l'as acheté neuf ou d'occasion ?

Normalement, à l'arrière du pc, tu as un autocollant nommé "COA" (Certificate of Authenticité" et dessus la clé nommée "Product Key" : c'est cette clé, que Windows te demande d'introduire.

sofia94 · Answer

cest un ordi doccaz et oui c un packard bell ca f koi si je la rentre pas?

sofia94 · Answer

PCKE CEST UN ORDI KON MA VENDU MAIS JE C PAS DOU IL SORT donc ca fait koi pluto si je rentre la clé?

juju666 · Answer

bah ça va activer windows et tu seras tranquille.

sofia94 · Answer

le truc c ke cest un ordi kon ma vendu mais je c pas dou il sort je me demandais si ca allait pa me poser de souci 

dis mois si tu ty connais en produits dis moi cke tu pense de cet ordi

Mini PC EeePC 10 pouces (Diagonale écran 25,4 cm) 
Mémoire interne 160 Go extensible par USB et carte SD 
Système exploitation Windows XP 
Mémoire vive RAM 1 Go DDR2 
Résolution écran LCD 1024x600 
Processeur C7 Mobile 1.6G Hz 
Appareil photo intégré 1.3MP 
Lecteur carte SD/MMC pour tranférer directement les photos de votre appareil numérique

Mon ordinateur est plein de virus aidez moi p

88 réponses

Discussions similaires

Newsletters