Trojan - Page 4
Résolu
Précédent
- 1
- 2
- 3
- 4
- 5
- 6
- 7
Suivant
Voilà le rapport après supression :
RogueKiller V7.5.4 [07/06/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode normal
Utilisateur: Ehoarn [Droits d'admin]
Mode: Suppression -- Date: 10/06/2012 21:44:36
¤¤¤ Processus malicieux: 0 ¤¤¤
¤¤¤ Entrees de registre: 7 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : Megakey (C:\Users\Ehoarn\AppData\Local\Megamedia\Megakey\Megakey.exe /Tray) -> DELETED
[SUSP PATH] HKCU\[...]\Run : NXSSP Monitoring Service (C:\Users\Ehoarn\AppData\Roaming\nxssp.exe) -> DELETED
[SUSP PATH] HKCU\[...]\Run : cacaoweb ("C:\Users\Ehoarn\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer) -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [NON CHARGE] ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: ST9500325AS +++++
--- User ---
[MBR] 9f4a7a2e7373335b538a61828c888d62
[BSP] f2784853074f1725937a6a2142d7998d : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 63 | Size: 22003 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 45062325 | Size: 119240 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 289267712 | Size: 335695 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: ST9500325AS +++++
--- User ---
[MBR] 75b990b5013ef6cf2c907f705fd86a12
[BSP] 8e2ccfdddeecdd8f0ccd1b6ce07bff6c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 238469 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 488386560 | Size: 238469 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
RogueKiller V7.5.4 [07/06/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode normal
Utilisateur: Ehoarn [Droits d'admin]
Mode: Suppression -- Date: 10/06/2012 21:44:36
¤¤¤ Processus malicieux: 0 ¤¤¤
¤¤¤ Entrees de registre: 7 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : Megakey (C:\Users\Ehoarn\AppData\Local\Megamedia\Megakey\Megakey.exe /Tray) -> DELETED
[SUSP PATH] HKCU\[...]\Run : NXSSP Monitoring Service (C:\Users\Ehoarn\AppData\Roaming\nxssp.exe) -> DELETED
[SUSP PATH] HKCU\[...]\Run : cacaoweb ("C:\Users\Ehoarn\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer) -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [NON CHARGE] ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: ST9500325AS +++++
--- User ---
[MBR] 9f4a7a2e7373335b538a61828c888d62
[BSP] f2784853074f1725937a6a2142d7998d : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 63 | Size: 22003 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 45062325 | Size: 119240 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 289267712 | Size: 335695 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: ST9500325AS +++++
--- User ---
[MBR] 75b990b5013ef6cf2c907f705fd86a12
[BSP] 8e2ccfdddeecdd8f0ccd1b6ce07bff6c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 238469 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 488386560 | Size: 238469 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt
Voilà le rapport après un examen rapide de Malewarebytes :
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Version de la base de données: v2012.06.10.08
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Ehoarn :: EHOARN-PC [administrateur]
10/06/2012 21:52:12
mbam-log-2012-06-10 (21-55-48).txt
Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 223604
Temps écoulé: 3 minute(s), 8 seconde(s)
Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Elément(s) de données du Registre détecté(s): 4
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel|HomePage (PUM.Hijack.HomePageControl) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
Dossier(s) détecté(s): 6
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Aucune action effectuée.
C:\Program Files (x86)\RelevantKnowledge (PUP.Spyware.MarketScore) -> Aucune action effectuée.
C:\Program Files (x86)\RelevantKnowledge\components (PUP.Spyware.MarketScore) -> Aucune action effectuée.
C:\Program Files (x86)\BrightBreeze\bin (Adware.HotBar.BB) -> Aucune action effectuée.
C:\Program Files (x86)\BrightBreeze\bin\2.0.5.0 (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA (Adware.HotBar.BB) -> Aucune action effectuée.
Fichier(s) détecté(s): 8
C:\Users\Ehoarn\AppData\Roaming\cacaoweb\cacaoweb.exe (Trojan.Agent) -> Aucune action effectuée.
C:\Users\Ehoarn\Desktop\cacaoweb.exe (Trojan.Agent) -> Aucune action effectuée.
C:\Windows\System32\AUTOICLI.DLL.VIR (Trojan.Vundo) -> Aucune action effectuée.
C:\Windows\SysWOW64\AUTOICLI.DLL.VIR (Trojan.Vundo) -> Aucune action effectuée.
C:\Program Files (x86)\BrightBreeze\bin\2.0.5.0\copyright.txt (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA\BrightBreezeSA.dat (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA\BrightBreezeSAau.dat (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA\BrightBreezeSA_kyf.dat (Adware.HotBar.BB) -> Aucune action effectuée.
(fin)
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Version de la base de données: v2012.06.10.08
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Ehoarn :: EHOARN-PC [administrateur]
10/06/2012 21:52:12
mbam-log-2012-06-10 (21-55-48).txt
Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 223604
Temps écoulé: 3 minute(s), 8 seconde(s)
Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Elément(s) de données du Registre détecté(s): 4
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel|HomePage (PUM.Hijack.HomePageControl) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Aucune action effectuée.
Dossier(s) détecté(s): 6
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Aucune action effectuée.
C:\Program Files (x86)\RelevantKnowledge (PUP.Spyware.MarketScore) -> Aucune action effectuée.
C:\Program Files (x86)\RelevantKnowledge\components (PUP.Spyware.MarketScore) -> Aucune action effectuée.
C:\Program Files (x86)\BrightBreeze\bin (Adware.HotBar.BB) -> Aucune action effectuée.
C:\Program Files (x86)\BrightBreeze\bin\2.0.5.0 (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA (Adware.HotBar.BB) -> Aucune action effectuée.
Fichier(s) détecté(s): 8
C:\Users\Ehoarn\AppData\Roaming\cacaoweb\cacaoweb.exe (Trojan.Agent) -> Aucune action effectuée.
C:\Users\Ehoarn\Desktop\cacaoweb.exe (Trojan.Agent) -> Aucune action effectuée.
C:\Windows\System32\AUTOICLI.DLL.VIR (Trojan.Vundo) -> Aucune action effectuée.
C:\Windows\SysWOW64\AUTOICLI.DLL.VIR (Trojan.Vundo) -> Aucune action effectuée.
C:\Program Files (x86)\BrightBreeze\bin\2.0.5.0\copyright.txt (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA\BrightBreezeSA.dat (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA\BrightBreezeSAau.dat (Adware.HotBar.BB) -> Aucune action effectuée.
C:\ProgramData\BrightBreezeSA\BrightBreezeSA_kyf.dat (Adware.HotBar.BB) -> Aucune action effectuée.
(fin)
Sélectionne "Supprimer la sélection" et redémarre ton PC si demandé.
Ton PC fonctionne correctement ?
Ton PC fonctionne correctement ?
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Ca semble marcher normalement. J'ai maintenant un fichier RK_Quarantine et des rapports. Fautil que je fasse d'autres scan ? Et que me conseillez vous pour la suite et pour éviter un maximum ce genre de problême ?
Hello,
Je serais d'avis pour passer le combofix comme proposé ICI par destrio5 car sirefef n'est pas le truc qui se laisse faire facilement.
Je serais d'avis pour passer le combofix comme proposé ICI par destrio5 car sirefef n'est pas le truc qui se laisse faire facilement.
Ok, merci beaucoup mais j'attends peut etre la confirmation de distrio 5 non ?
Non pas que je ne te fasse pas confiance mais c'est distiro 5 qui m'expliquait la marche à suivre alors je veux etre sur que vous soyez d'accord... Sinon si tu pense que c'est ce qu'il faut faire alors je vais suivre ta suggestion.
Merci en tout cas.
Non pas que je ne te fasse pas confiance mais c'est distiro 5 qui m'expliquait la marche à suivre alors je veux etre sur que vous soyez d'accord... Sinon si tu pense que c'est ce qu'il faut faire alors je vais suivre ta suggestion.
Merci en tout cas.
Bon moi aussi j'ai des révisions en plus mais je voulais pas laisser trainer ça... heureusement que je commence vachement tard demain.
Le rapport arrive...
Le rapport arrive...
Ah ouais pas cool... non moi c'est moins de stress c'est entrainement à l'oral de français...
Bon je trouve pas le rapport meme en cherchant %System%...........
Merci de ton aide
Bon je trouve pas le rapport meme en cherchant %System%...........
Merci de ton aide
J'ai un fichier combofix mais quand je double clic dessus ça me renvoit à ordinateur ou s'affiche mes quatre disques durs (j'en ai quatre, c'est mon pc portable qui est comme ça). J'ai aussi deux trucs je sais pas ce que c'est : un fichier qoobox et bootsqm.dat
Ouf j'ai eu peur. Heureusement quej'ai pensé à redémarrer l'ordi parce que il voulait rien me lancer après le scan. Bon voilà le fameux rapport si t'es pas encore couché, ce que j'aurais déjà fais dans ton cas :)
ComboFix 12-06-10.01 - Ehoarn 10/06/2012 23:05:10.1.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.3884.2128 [GMT 2:00]
Lancé depuis: c:\users\Ehoarn\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\esupport\eDriver\Software\ASUS\MultiFrame\XP32_Vista32_Vista64_Win7_32_Win7_64_1.0.0021\Desktop_.ini
c:\program files (x86)\RelevantKnowledge
c:\programdata\FullRemove.exe
c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
c:\users\Ehoarn\AppData\Roaming\cacaoweb
c:\users\Ehoarn\AppData\Roaming\cacaoweb\npdfile.dat
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating25D365A5293593584ED1636DB3EE8DAD.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating40FA0F8A0EA1D39A7163B98283DF82EC.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating6305CE187C5E3F84564DE358CB6A1127.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating7E54B6665C51E8803453D18EF4DEDE45.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicatingBE52440FD325E2EAFACC136ABD33A69B.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicatingD4EE3D9EB38035DB9711BA3E5E3068CF.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicatingE4F5FE957EFC0072032E35564E008A2A.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\storage.db
.
-- Exécution préalable --
.
Infected copy of c:\windows\system32\services.exe was found and disinfected
Restored copy from - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
.
--------
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-05-10 au 2012-06-10 ))))))))))))))))))))))))))))))))))))
.
.
2012-06-10 21:15 . 2012-06-10 21:15 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-06-10 21:15 . 2012-06-10 21:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-10 19:51 . 2012-06-10 19:51 -------- d-----w- c:\users\Ehoarn\AppData\Roaming\Malwarebytes
2012-06-10 19:50 . 2012-06-10 19:50 -------- d-----w- c:\programdata\Malwarebytes
2012-06-10 19:50 . 2012-06-10 19:50 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-10 19:50 . 2012-04-04 13:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-10 18:30 . 2012-06-10 18:30 -------- d-----w- C:\found.001
2012-06-09 07:48 . 2012-06-09 07:48 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-09 07:44 . 2012-06-09 07:44 62976 ---ha-w- c:\windows\system32\autoicli64.dll
2012-06-09 07:44 . 2012-06-09 08:30 -------- d-----w- c:\programdata\B7E8588600040D91001FB951B4EB2367
2012-06-02 15:22 . 2012-06-02 15:22 -------- d-----w- c:\programdata\Babylon
2012-05-31 15:41 . 2012-05-31 15:41 -------- d-----w- C:\Kreapixel
2012-05-31 14:15 . 2012-05-31 14:15 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-10 21:18 . 2011-03-12 16:22 45056 ----a-w- c:\windows\system32\acovcnt.exe
2012-05-12 14:10 . 2011-08-06 14:18 280976 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-05-12 14:10 . 2011-08-06 08:58 280976 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-05-07 00:19 . 2012-04-07 11:30 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-07 00:19 . 2011-05-25 09:43 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 20:21 . 2012-04-07 12:30 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-03-31 06:05 . 2012-05-11 19:16 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-31 04:39 . 2012-05-11 19:16 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-31 04:39 . 2012-05-11 19:16 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-31 03:10 . 2012-05-11 19:16 3146240 ----a-w- c:\windows\system32\win32k.sys
2012-03-30 21:30 . 2012-03-30 21:30 0 ------w- c:\windows\SysWow64\shoB227.tmp
2012-03-30 11:35 . 2012-05-11 19:14 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-22 21:37 . 2012-03-22 21:37 0 ------w- c:\windows\SysWow64\sho58D0.tmp
2012-03-17 07:58 . 2012-05-11 19:15 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2011-11-17 06:41 27136 --sh--w- c:\windows\Installer\{9c5dea40-a09e-25a7-bbb2-65ebfe124d37}\n.vir
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Steam"="d:\jeux\Steam\Steam.exe" [2011-12-25 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-06-25 6806144]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-05-03 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"SonicMasterTray"="c:\program files (x86)\ASUS\SonicMaster\SonicMasterTray.exe" [2010-07-10 984400]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-04-26 1597440]
"UpdatePSTShortCut"="c:\program files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2010-06-24 210216]
"VAWinAgent"="c:\expressgateutil\VAWinAgent.exe" [2010-08-13 21504]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"RemoteControl11"="c:\program files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe" [2011-08-24 230696]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-12 1083680]
FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2010-12-3 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/12/03 10:17];c:\program files (x86)\Cyberlink\PowerDVD9\000.fcl [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-07 257696]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-07-02 16640]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-07-09 421376]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-03-05 340240]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2011/12/11 16:42];c:\program files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [2011-09-02 11:08 148976]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;c:\program files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [2011-08-24 83240]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;c:\program files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [2011-09-02 75048]
S2 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;c:\program files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [2011-09-02 292136]
S2 ntk_PowerDVD;ntk_PowerDVD;c:\program files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [2011-08-24 75248]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S2 VideAceWindowsService;VideAceWindowsService;c:\expressgateutil\VAWinService.exe [2010-08-21 77312]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2012-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 00:19]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-05-03 324096]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-08-17 2120808]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-10 167256]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-10 391512]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-10 415064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.babylon.com/?affID=111020&babsrc=HP_ss&mntrId=c694ede10000000000000026c7b0e60b
mStart Page = hxxp://asus.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.254
FF - ProfilePath - c:\users\Ehoarn\AppData\Roaming\Mozilla\Firefox\Profiles\gaq7xxg5.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://portail.free.fr/
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111020
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - c694ede10000000000000026c7b0e60b
FF - user.js: extensions.BabylonToolbar_i.hardId - c694ede10000000000000026c7b0e60b
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15447
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1723:05
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHELINS SUPPRIMES - - - -
.
BHO-{77F4E711-789B-447F-9614-96759B2F83C6} - c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\MegaIeHelper.dll
Toolbar-Locked - (no file)
Toolbar-{09B445AE-2345-4FCA-85AE-FB3626ECEBDD} - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-MegakeyUpdater - c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
Wow6432Node-HKCU-Run-SDATimer - (no file)
Wow6432Node-HKLM-Run-BDRegion - c:\program files (x86)\Cyberlink\Shared files\brs.exe
BHO-{77F4E711-789B-447F-9614-96759B2F83C6} - c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\x64\MegaIeHelper64.dll
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
AddRemove-Google Chrome - c:\program files (x86)\Google\Chrome\Application\18.0.1025.168\Installer\setup.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe
AddRemove-PhotoFiltre - c:\program files (x86)\PhotoFiltre\Uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files (x86)\Cyberlink\PowerDVD9\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1650379126-1646432353-3909254661-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:f0,1e,86,ef,f5,55,61,ca,e4,34,59,4c,cf,ec,3b,0b,0e,1c,da,b9,ee,28,ae,
d9,22,ae,9b,26,a7,05,43,eb,82,0a,d8,4c,68,cb,29,d1,63,ad,a2,09,a5,dc,0b,b0,\
"??"=hex:f8,7a,de,66,62,a3,76,a9,b7,88,56,9e,5b,54,0e,64
.
[HKEY_USERS\S-1-5-21-1650379126-1646432353-3909254661-1001\Software\SecuROM\License information*]
"datasecu"=hex:5f,d9,f5,8b,76,25,3c,0a,ee,34,6b,5f,f0,0e,4f,06,8b,0b,71,61,a7,
83,61,dc,37,25,45,2b,0d,8a,ac,20,be,75,26,c9,8f,8c,b4,4a,5f,87,27,ac,6a,ad,\
"rkeysecu"=hex:e9,2b,e1,3e,d7,6c,43,eb,94,25,7f,3e,ce,25,bf,04
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\windows\AsScrPro.exe
.
**************************************************************************
.
Heure de fin: 2012-06-10 23:23:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-06-10 21:23
.
Avant-CF: 7 112 331 264 octets libres
Après-CF: 6 793 605 120 octets libres
.
- - End Of File - - 66C13BC7A976DD3A64555D74907BE669
C'est un peu indigeste comme truc (enfin pour moi en tout cas).
ComboFix 12-06-10.01 - Ehoarn 10/06/2012 23:05:10.1.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.3884.2128 [GMT 2:00]
Lancé depuis: c:\users\Ehoarn\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\esupport\eDriver\Software\ASUS\MultiFrame\XP32_Vista32_Vista64_Win7_32_Win7_64_1.0.0021\Desktop_.ini
c:\program files (x86)\RelevantKnowledge
c:\programdata\FullRemove.exe
c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
c:\users\Ehoarn\AppData\Roaming\cacaoweb
c:\users\Ehoarn\AppData\Roaming\cacaoweb\npdfile.dat
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating25D365A5293593584ED1636DB3EE8DAD.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating40FA0F8A0EA1D39A7163B98283DF82EC.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating6305CE187C5E3F84564DE358CB6A1127.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicating7E54B6665C51E8803453D18EF4DEDE45.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicatingBE52440FD325E2EAFACC136ABD33A69B.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicatingD4EE3D9EB38035DB9711BA3E5E3068CF.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\replicatingE4F5FE957EFC0072032E35564E008A2A.cacao
c:\users\Ehoarn\AppData\Roaming\cacaoweb\storage.db
.
-- Exécution préalable --
.
Infected copy of c:\windows\system32\services.exe was found and disinfected
Restored copy from - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
.
--------
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-05-10 au 2012-06-10 ))))))))))))))))))))))))))))))))))))
.
.
2012-06-10 21:15 . 2012-06-10 21:15 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-06-10 21:15 . 2012-06-10 21:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-10 19:51 . 2012-06-10 19:51 -------- d-----w- c:\users\Ehoarn\AppData\Roaming\Malwarebytes
2012-06-10 19:50 . 2012-06-10 19:50 -------- d-----w- c:\programdata\Malwarebytes
2012-06-10 19:50 . 2012-06-10 19:50 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-10 19:50 . 2012-04-04 13:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-10 18:30 . 2012-06-10 18:30 -------- d-----w- C:\found.001
2012-06-09 07:48 . 2012-06-09 07:48 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-09 07:44 . 2012-06-09 07:44 62976 ---ha-w- c:\windows\system32\autoicli64.dll
2012-06-09 07:44 . 2012-06-09 08:30 -------- d-----w- c:\programdata\B7E8588600040D91001FB951B4EB2367
2012-06-02 15:22 . 2012-06-02 15:22 -------- d-----w- c:\programdata\Babylon
2012-05-31 15:41 . 2012-05-31 15:41 -------- d-----w- C:\Kreapixel
2012-05-31 14:15 . 2012-05-31 14:15 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-10 21:18 . 2011-03-12 16:22 45056 ----a-w- c:\windows\system32\acovcnt.exe
2012-05-12 14:10 . 2011-08-06 14:18 280976 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-05-12 14:10 . 2011-08-06 08:58 280976 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-05-07 00:19 . 2012-04-07 11:30 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-07 00:19 . 2011-05-25 09:43 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 20:21 . 2012-04-07 12:30 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-03-31 06:05 . 2012-05-11 19:16 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-31 04:39 . 2012-05-11 19:16 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-31 04:39 . 2012-05-11 19:16 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-31 03:10 . 2012-05-11 19:16 3146240 ----a-w- c:\windows\system32\win32k.sys
2012-03-30 21:30 . 2012-03-30 21:30 0 ------w- c:\windows\SysWow64\shoB227.tmp
2012-03-30 11:35 . 2012-05-11 19:14 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-22 21:37 . 2012-03-22 21:37 0 ------w- c:\windows\SysWow64\sho58D0.tmp
2012-03-17 07:58 . 2012-05-11 19:15 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2011-11-17 06:41 27136 --sh--w- c:\windows\Installer\{9c5dea40-a09e-25a7-bbb2-65ebfe124d37}\n.vir
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Steam"="d:\jeux\Steam\Steam.exe" [2011-12-25 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-06-25 6806144]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-05-03 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"SonicMasterTray"="c:\program files (x86)\ASUS\SonicMaster\SonicMasterTray.exe" [2010-07-10 984400]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-04-26 1597440]
"UpdatePSTShortCut"="c:\program files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2010-06-24 210216]
"VAWinAgent"="c:\expressgateutil\VAWinAgent.exe" [2010-08-13 21504]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"RemoteControl11"="c:\program files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe" [2011-08-24 230696]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-12 1083680]
FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2010-12-3 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/12/03 10:17];c:\program files (x86)\Cyberlink\PowerDVD9\000.fcl [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-07 257696]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-07-02 16640]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-07-09 421376]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-03-05 340240]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2011/12/11 16:42];c:\program files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [2011-09-02 11:08 148976]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;c:\program files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [2011-08-24 83240]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;c:\program files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [2011-09-02 75048]
S2 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;c:\program files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [2011-09-02 292136]
S2 ntk_PowerDVD;ntk_PowerDVD;c:\program files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [2011-08-24 75248]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-20 378472]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S2 VideAceWindowsService;VideAceWindowsService;c:\expressgateutil\VAWinService.exe [2010-08-21 77312]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2012-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 00:19]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-05-03 324096]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-08-17 2120808]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-03-05 1928976]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-10 167256]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-10 391512]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-10 415064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.babylon.com/?affID=111020&babsrc=HP_ss&mntrId=c694ede10000000000000026c7b0e60b
mStart Page = hxxp://asus.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.254
FF - ProfilePath - c:\users\Ehoarn\AppData\Roaming\Mozilla\Firefox\Profiles\gaq7xxg5.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://portail.free.fr/
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=111020
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - c694ede10000000000000026c7b0e60b
FF - user.js: extensions.BabylonToolbar_i.hardId - c694ede10000000000000026c7b0e60b
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15447
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1723:05
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHELINS SUPPRIMES - - - -
.
BHO-{77F4E711-789B-447F-9614-96759B2F83C6} - c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\MegaIeHelper.dll
Toolbar-Locked - (no file)
Toolbar-{09B445AE-2345-4FCA-85AE-FB3626ECEBDD} - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-MegakeyUpdater - c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
Wow6432Node-HKCU-Run-SDATimer - (no file)
Wow6432Node-HKLM-Run-BDRegion - c:\program files (x86)\Cyberlink\Shared files\brs.exe
BHO-{77F4E711-789B-447F-9614-96759B2F83C6} - c:\users\Ehoarn\AppData\Local\Megamedia\Megakey\x64\MegaIeHelper64.dll
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
AddRemove-Google Chrome - c:\program files (x86)\Google\Chrome\Application\18.0.1025.168\Installer\setup.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe
AddRemove-PhotoFiltre - c:\program files (x86)\PhotoFiltre\Uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files (x86)\Cyberlink\PowerDVD9\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1650379126-1646432353-3909254661-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:f0,1e,86,ef,f5,55,61,ca,e4,34,59,4c,cf,ec,3b,0b,0e,1c,da,b9,ee,28,ae,
d9,22,ae,9b,26,a7,05,43,eb,82,0a,d8,4c,68,cb,29,d1,63,ad,a2,09,a5,dc,0b,b0,\
"??"=hex:f8,7a,de,66,62,a3,76,a9,b7,88,56,9e,5b,54,0e,64
.
[HKEY_USERS\S-1-5-21-1650379126-1646432353-3909254661-1001\Software\SecuROM\License information*]
"datasecu"=hex:5f,d9,f5,8b,76,25,3c,0a,ee,34,6b,5f,f0,0e,4f,06,8b,0b,71,61,a7,
83,61,dc,37,25,45,2b,0d,8a,ac,20,be,75,26,c9,8f,8c,b4,4a,5f,87,27,ac,6a,ad,\
"rkeysecu"=hex:e9,2b,e1,3e,d7,6c,43,eb,94,25,7f,3e,ce,25,bf,04
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\windows\AsScrPro.exe
.
**************************************************************************
.
Heure de fin: 2012-06-10 23:23:32 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-06-10 21:23
.
Avant-CF: 7 112 331 264 octets libres
Après-CF: 6 793 605 120 octets libres
.
- - End Of File - - 66C13BC7A976DD3A64555D74907BE669
C'est un peu indigeste comme truc (enfin pour moi en tout cas).
Précédent
- 1
- 2
- 3
- 4
- 5
- 6
- 7
Suivant
