pC tres lent au démarageFermé

Question

Bonjour, mon pc est lent au démarrage et avant hier il me disait que mon systeme étai en domager
merci



Configuration: Windows 7 / Firefox 13.0.1

g3n-h@ckm@n · Answer

salut quel etait le message exact ?

paulo67 · Answer

bonjour et merci mais je me rappelle plus

g3n-h@ckm@n · Answer

Attention : cet outil peut etre détecté à tort comme virus

Désactive toutes tes protections si possible , antivirus , sandbox , etc....

telecharge et enregistre Pre_Scan sur ton bureau :

http://forums-fec.be/gen-hackman/Pre_Scan.exe
http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan

Avertissement :Il y aura une extinction du bureau pendant le scan --> pas de panique.

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan_la_date_et_l'heure.txt" sur le bureau.

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Kill"

si l'outil est bloqué par l'infection utilise cette version avec extension .pif :

http://forums-fec.be/gen-hackman/Pre_Scan.pif

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan


NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider

paulo67 · Answer

voila le rapport

merci
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | 2.617 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Mis à jour le 17/06/2012 | 20.00 par g3n-h@ckm@n
~ Informations Evolution : https://gen-hackman.kanak.fr/
~ Informations sur les switchs Pre_Script : https://gen-hackman.kanak.fr/
~ Feedback Pre_scan : https://gen-hackman.kanak.fr/#505
~ Merci à Slyk & Saachaa pour leur apport à l'évolution de l'outil

~ Utilisateur : paulo (Administrateurs) | SID = S-1-5-21-2704204595-2640163272-54980813-1000
~ Ordinateur : PC-DE-PAULO

~ Système d'exploitation : Windows 7 Home Premium (64 bits) HomePremium Service Pack 1
~ Type d'installation : Client
~ Enregistré sous : paulo
~ Processeur : Pentium(R) Dual-Core  CPU      E5200  @ 2.50GHz
~ Identification : Intel64 Family 6 Model 23 Stepping 10

Pare-feu windows : Actif
Windows Defender : Actif

~ Mémoire RAM = Total (KB) : 4193520 | Used (%) : 40 | Free (KB) : 2504250
~ Pagefile = Total (KB) : 8385200 | Free (KB) : 6785960
~ Virtuelle = Total (KB) : 4194180 | Free (KB) : 3989380

¤¤¤¤¤¤¤¤¤¤ | Scripts de boot


¤¤¤¤¤¤¤¤¤¤ | Drives

c:\ -> [Fixed] | [OS] | Total : 469460 Mo | Free : 142790 Mo -> NTFS
d:\ -> [Fixed] | [DATA] | Total : 469410 Mo | Free : 469290 Mo -> NTFS

Scan : 22:51:50 | 17/06/2012

¤¤¤¤¤¤¤¤¤¤ | Navigateurs

Internet Explorer : 8.0.7601.17514
Mozilla Firefox : 13.0.1 (fr)

¤ Par défaut :

[HKCR\http | command] : "C:\Program Files (x86)\Mozilla Firefox 3.6 Beta 2\firefox.exe" -requestPending -osint -url "%1"


¤¤¤¤¤¤¤¤¤¤ | Frameworks

~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.0.3705
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.1.4322
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.0.3705
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.1.4322
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v2.0.50727
~ [14/07/2009 07:32:38] - C:\Windows\Microsoft.net\Framework\v3.0
~ [14/07/2009 07:32:38] - C:\Windows\Microsoft.net\Framework\v3.5
~ [25/06/2010 13:26:33] - C:\Windows\Microsoft.net\Framework\v4.0.30319

¤¤¤¤¤¤¤¤¤¤ | Windows Updates



¤¤¤¤¤¤¤¤¤¤ | Sessions | Profiles | Directories

~ [HKLM | ProfileList\S-1-5-21-2704204595-2640163272-54980813-1000] : ProfileImagePath -> C:\Users\paulo
~ [HKLM | ProfileList\S-1-5-21-2704204595-2640163272-54980813-1000] : RefCount -> 4
~ [HKLM | ProfileList\S-1-5-21-2704204595-2640163272-54980813-1000] : State -> 0

~ C:\Windows\system32\config\systemprofile
~ C:\Windows\ServiceProfiles\LocalService
~ C:\Windows\ServiceProfiles\NetworkService
~ C:\Users\paulo

[HKLM | ProfileLoader\{F5441CBB-AE7D-4495-905B-161047E58936}] : DllName -> userenv.dll

¤¤¤¤¤¤¤¤¤¤ | Contrôle MD5

[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2804.5 Ko] - (6.1.7601.17567) - C:\Windows\explorer.exe
[MD5.C235A51CB740E45FFA0EBFB9BAFCDA64] - [14/07/2009 01:56:52] - (.© Microsoft Corporation. - Explorateur Windows.) - [2801 Ko] -  (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[MD5.F170B4A061C9E026437B193B4D571799] - [12/11/2009 17:33:55] - (.© Microsoft Corporation. - Explorateur Windows.) - [2801 Ko] -  (6.1.7600.16404) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[MD5.9AAAEC8DAC27AA17B053E6352AD233AE] - [27/01/2010 15:03:00] - (.© Microsoft Corporation. - Explorateur Windows.) - [2803 Ko] -  (6.1.7600.16450) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[MD5.0862495E0C825893DB75EF44FAEA8E93] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2803 Ko] -  (6.1.7600.16768) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[MD5.700073016DAC1C3D2E7E2CE4223334B6] - [12/11/2009 17:33:55] - (.© Microsoft Corporation. - Explorateur Windows.) - [2801 Ko] -  (6.1.7600.20500) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[MD5.B8EC4BD49CE8F6FC457721BFC210B67F] - [27/01/2010 15:03:00] - (.© Microsoft Corporation. - Explorateur Windows.) - [2803 Ko] -  (6.1.7600.20563) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[MD5.E38899074D4951D31B4040E994DD7C8D] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2803.5 Ko] -  (6.1.7600.20910) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[MD5.AC4C51EB24AA95B77F705AB159189E24] - [02/07/2011 01:20:02] - (.© Microsoft Corporation. - Explorateur Windows.) - [2805 Ko] -  (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.17567) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[MD5.3B69712041F3D63605529BD66DC00C48] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.21669) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[MD5.15BC38A7492BEFE831966ADB477CF76F] - [14/07/2009 01:41:14] - (.© Microsoft Corporation. - Explorateur Windows.) - [2552 Ko] -  (6.1.7600.16385) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[MD5.B95EEB0F4E5EFBF1038A35B3351CF047] - [12/11/2009 17:33:55] - (.© Microsoft Corporation. - Explorateur Windows.) - [2552 Ko] -  (6.1.7600.16404) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[MD5.2626FC9755BE22F805D3CFA0CE3EE727] - [27/01/2010 15:03:00] - (.© Microsoft Corporation. - Explorateur Windows.) - [2553 Ko] -  (6.1.7600.16450) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[MD5.2AF58D15EDC06EC6FDACCE1F19482BBF] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2553.5 Ko] -  (6.1.7600.16768) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[MD5.9FF6C4C91A3711C0A3B18F87B08B518D] - [12/11/2009 17:33:55] - (.© Microsoft Corporation. - Explorateur Windows.) - [2552 Ko] -  (6.1.7600.20500) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[MD5.C76153C7ECA00FA852BB0C193378F917] - [27/01/2010 15:03:00] - (.© Microsoft Corporation. - Explorateur Windows.) - [2553 Ko] -  (6.1.7600.20563) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[MD5.255CF508D7CFB10E0794D6AC93280BD8] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2553.5 Ko] -  (6.1.7600.20910) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[MD5.40D777B7A95E00593EB1568C68514493] - [02/07/2011 01:19:50] - (.© Microsoft Corporation. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.17514) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.17567) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[MD5.0FB9C74046656D1579A64660AD67B746] - [27/04/2011 07:28:01] - (.© Microsoft Corporation. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.21669) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. - Processus d'exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) - C:\Windows\System32\csrss.exe
[MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. - Processus d'exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe -> 
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [14/07/2009 01:19:46] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\System32\services.exe
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [14/07/2009 01:19:46] - (.© Microsoft Corporation. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[MD5.1911A3356FA3F77CCC825CCBAC038C2A] - [14/07/2009 01:19:50] - (.© Microsoft Corporation. - Gestionnaire de sessions Windows.) - [110 Ko] - (6.1.7600.16385) - C:\Windows\System32\smss.exe
[MD5.1911A3356FA3F77CCC825CCBAC038C2A] - [14/07/2009 01:19:50] - (.© Microsoft Corporation. - Windows Session Manager.) - [110 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [02/07/2011 01:19:06] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\System32\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [02/07/2011 01:19:08] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\SysWOW64\userinit.exe
[MD5.6F8F1376A13114CC10C0E69274F5A4DE] - [14/07/2009 01:50:33] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [29.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [02/07/2011 01:19:06] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
[MD5.6DE80F60D7DE9CE6B8C2DDFDF79EF175] - [14/07/2009 01:34:20] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [25.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [02/07/2011 01:19:08] - (.© Microsoft Corporation. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\System32\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [14/07/2009 01:36:49] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\SysWOW64\wininit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [14/07/2009 01:36:49] - (.© Microsoft Corporation. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [02/07/2011 01:19:45] - (.© Microsoft Corporation. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\winlogon.exe
[MD5.132328DF455B0028F13BF0ABEE51A63A] - [14/07/2009 01:52:48] - (.© Microsoft Corporation. - Windows Logon Application.) - [380 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[MD5.DA3E2A6FA9660CC75B471530CE88453A] - [27/01/2010 15:03:00] - (.© Microsoft Corporation. - Windows Logon Application.) - [380.5 Ko] - (6.1.7600.16447) - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
[MD5.A93D41A4D4B0D91C072D11DD8AF266DE] - [27/01/2010 15:03:00] - (.© Microsoft Corporation. - Windows Logon Application.) - [380.5 Ko] - (6.1.7600.20560) - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [02/07/2011 01:19:45] - (.© Microsoft Corporation. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - [14/02/2012 22:59:09] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [487 Ko] - (6.1.7601.17752) - C:\Windows\System32\drivers\afd.sys
[MD5.B9384E03479D2506BC924C16A3DB87BC] - [14/07/2009 01:21:44] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [488.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys
[MD5.6EF20DDF3172E97D69F596FB90602F29] - [15/06/2011 23:18:21] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [488 Ko] - (6.1.7600.16802) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys
[MD5.DB9D6C6B2CD95A9CA414D045B627422E] - [14/02/2012 22:59:09] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7600.16937) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16937_none_34154fcd77f3bbda\afd.sys
[MD5.FBFF8B7C9D116229E9208A0D1CAEB49B] - [15/06/2011 23:18:21] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [488 Ko] - (6.1.7600.20951) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys
[MD5.CCA39961E76B491DDF44B1E90FC8971D] - [14/02/2012 22:59:09] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7600.21115) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.21115_none_34b263fe91032456\afd.sys
[MD5.D31DC7A16DEA4A9BAF179F3D6FBDB38C] - [02/07/2011 01:19:53] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [488 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[MD5.D5B031C308A409A0A576BFF4CF083D30] - [15/06/2011 23:18:21] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7601.17603) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - [14/02/2012 22:59:09] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [487 Ko] - (6.1.7601.17752) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys
[MD5.F4AD06143EAC303F55D0E86C40802976] - [15/06/2011 23:18:21] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7601.21712) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
[MD5.36A14FD1A23F57046361733B792CA8DB] - [14/02/2012 22:59:09] - (.© Microsoft Corporation. - Ancillary Function Driver for WinSock.) - [486.5 Ko] - (6.1.7601.21887) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\System32\drivers\atapi.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
[MD5.F036CE71586E93D94DAB220D7BDF4416] - [02/07/2011 01:18:35] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers\cdrom.sys
[MD5.83D2D75E1EFB81B3450C18131443F7DB] - [14/07/2009 01:19:54] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7600.16385_none_bb9e4d89bd7870f1\cdrom.sys
[MD5.F036CE71586E93D94DAB220D7BDF4416] - [02/07/2011 01:18:35] - (.© Microsoft Corporation. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_bdcf6151ba66f48b\cdrom.sys
[MD5.09594D1089C523423B32A4229263F068] - [02/07/2011 01:19:47] - (.© Microsoft Corporation. - MBT Transport driver.) - [255.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers
etbt.sys
[MD5.9162B273A44AB9DCE5B44362731D062A] - [14/07/2009 01:21:29] - (.© Microsoft Corporation. - MBT Transport driver.) - [253 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7600.16385_none_bc59ba0910f52e0c
etbt.sys
[MD5.09594D1089C523423B32A4229263F068] - [02/07/2011 01:19:47] - (.© Microsoft Corporation. - MBT Transport driver.) - [255.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6
etbt.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [02/07/2011 01:19:48] - (.© Microsoft Corporation. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers	dx.sys
[MD5.079125C4B17B01FCAEEBCE0BCB290C0F] - [14/07/2009 01:21:15] - (.© Microsoft Corporation. - TDI Translation Driver.) - [97.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.1.7600.16385_none_4632b9f2f5c6af5e	dx.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [02/07/2011 01:19:48] - (.© Microsoft Corporation. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.1.7601.17514_none_4863cdbaf2b532f8	dx.sys
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - [02/07/2011 01:19:36] - (.© Microsoft Corporation. - Pilote de cliché instantané du volume.) - [288.88 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers\volsnap.sys
[MD5.58F82EED8CA24B461441F9C3E4F0BF5C] - [14/07/2009 01:20:09] - (.© Microsoft Corporation. - Volume Shadow Copy Driver.) - [288.08 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_volume.inf_31bf3856ad364e35_6.1.7600.16385_none_71aba92815c60174\volsnap.sys
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - [02/07/2011 01:19:36] - (.© Microsoft Corporation. - Volume Shadow Copy Driver.) - [288.88 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_volume.inf_31bf3856ad364e35_6.1.7601.17514_none_73dcbcf012b4850e\volsnap.sys

22:53:09

¤¤¤¤¤¤¤¤¤¤ | Processus

nvvsvc.exe (776) -> Processus stoppé 
nvvsvc.exe (1048) -> Processus stoppé 
spoolsv.exe (1188) -> Processus stoppé 
taskhost.exe (1300) -> Processus stoppé 
PhotoshopElementsFileAgent.exe (1488) -> Processus stoppé 
armsvc.exe (1600) -> Processus stoppé 
explorer.exe (1652) -> Processus stoppé 
agr64svc.exe (1692) -> Processus stoppé 
AppleMobileDeviceService.exe (1732) -> Processus stoppé 
mDNSResponder.exe (1836) -> Processus stoppé 
HidService.exe (1900) -> Processus stoppé 
RAVCpl64.exe (700) -> Processus stoppé 
ABoard.exe (812) -> Processus stoppé 
SmpSys.exe (1912) -> Processus stoppé 
TomTomHOMERunner.exe (1960) -> Processus stoppé 
AOSD.exe (1248) -> Processus stoppé 
ISUSPM.exe (1976) -> Processus stoppé 
NBService.exe (2080) -> Processus stoppé 
ecbl-lbp.exe (2464) -> Processus stoppé 
NMSAccessU.exe (2740) -> Processus stoppé 
hpqtra08.exe (2816) -> Processus stoppé 
SPUVolumeWatcher.exe (2852) -> Processus stoppé 
TeamViewer_Service.exe (2984) -> Processus stoppé 
TomTomHOMEService.exe (3064) -> Processus stoppé 
WLIDSVC.EXE (2176) -> Processus stoppé 
FXSSVC.exe (1148) -> Processus stoppé 
TeamViewer.exe (2356) -> Processus stoppé 
WLIDSVCM.EXE (2612) -> Processus stoppé 
conhost.exe (3456) -> Processus stoppé 
SearchIndexer.exe (3664) -> Processus stoppé 
WUDFHost.exe (3948) -> Processus stoppé 
RIMBBLaunchAgent.exe (2116) -> Processus stoppé 
wmpnetwk.exe (4184) -> Processus stoppé 
hpqste08.exe (4236) -> Processus stoppé 
hpqbam08.exe (4312) -> Processus stoppé 
hpqgpc01.exe (4376) -> Processus stoppé 
ielowutil.exe (4856) -> Processus stoppé 
SeaPort.EXE (4256) -> Processus stoppé 
taskhost.exe (2344) -> Processus stoppé 
thunderbird.exe (4656) -> Processus stoppé 
taskeng.exe (7288) -> Processus stoppé 
firefox.exe (5168) -> Processus stoppé 
SearchProtocolHost.exe (9580) -> Processus stoppé 
SearchFilterHost.exe (8240) -> Processus stoppé 

¤¤¤¤¤¤¤¤¤¤ | Processus en cours

Demarrage : Normal  

1220 | C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe - Système - Normal - "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" - 536
1712 | C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe - Système - Normal - "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" - 536
1928 | C:\Windows\SysWOW64\svchost.exe - Système - Normal - C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt - 536
3216 | C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe - paulo - Normal - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min - 1668
8092 | C:\Users\paulo\Downloads\winlogon.exe - paulo - Normal - "C:\Users\paulo\Downloads\winlogon.exe"  - 5168
10908 | C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe - Système - Normal - "C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe" - 536
14072 | C:\Program Files (x86)\Mozilla Thunderbird	hunderbird.exe - paulo - Normal - "C:\Program Files (x86)\Mozilla Thunderbird	hunderbird.exe"  - 10116
16580 | C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe - Système - Normal - "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" - 536
13100 | C:\Pre_Scan\Pv.exe - paulo - Normal - C:\Pre_Scan\Pv.exe  -o"%i | %f - %u - %p - %l - %r" - 10440

¤¤¤¤¤¤¤¤¤¤ | Winlogon


¤

[HKLM | Winlogon] | Shell : Explorer.exe
[HKLM | Winlogon] | AutoRestartShell : 0
[HKLM | Winlogon] | userinit : Userinit.exe, -> C:\Windows\System32\userinit.exe,
[HKLM | Winlogon] | PowerDownAfterShutdown :  -> 1
[HKLM | Winlogon] | System : 
[HKLM | Winlogon] | Taskman : 
[HKLM | Winlogon] | VMApplet : systempropertiesperformance.exe

¤¤¤¤¤¤¤¤¤¤ | Winlogon\Notify 


¤¤¤¤¤¤¤¤¤¤ | Associations

[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : comfile
[comfile | command] : "%1" %*
[.reg] : regfile
[regfile | command] : regedit.exe "%1"
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
[.url] : InternetShortcut
[InternetShortcut | command] : "C:\Windows\system32undll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l
[Application.Manifest | command] : rundll32.exe dfshim.dll,ShOpenVerbApplication %1
[Application.Reference | command] : rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2
[Folder | command] : %SystemRoot%\Explorer.exe -> C:\Windows\explorer.exe

¤

[Firefox | Command] | @ : C:\Program Files (x86)\Mozilla Firefox 3.6 Beta 2\firefox.exe -> "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
[Firefox - Safemode | Command] | @ : "C:\Program Files (x86)\Mozilla Firefox 3.6 Beta 2\firefox.exe" -safe-mode -> "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" -safe-mode
[IE | Command] | @ : C:\Program Files (x86)\Internet Explorer\iexplore.exe -> "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ : "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" %1
[Assoc | Applications] | @ : http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s -> http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s

¤¤¤¤¤¤¤¤¤¤ | Corrections diverses

[HKLM | HideDesktopIcons\ClassicStartMenu] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {F02C1A0D-BE21-4350-88B0-7367FC96EF3C} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {208D2C60-3AEA-1069-A2D7-08002B30309D} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {871C5380-42A0-1069-A2EA-08002B30309D} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 1 -> 0
[HKLM | Advanced\Folder\Hidden\SHOWALL] | CheckedValue : 1
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Explorer\Advanced] |  Start_PowerButtonAction : 2
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Desktop] |  Wallpaper : C:\Users\paulo\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
[HKU\S-1-5-19 | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-20 | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000_Classes | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-18 | Policies\Explorer] |  NoDesktop :  -> 0
[HKLM | policies\Explorer] | NoDesktop :  -> 0
[HKU\S-1-5-19 | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-20 | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Explorer\Advanced] |  Hidden : 2 -> 0
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000_Classes | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-18 | Explorer\Advanced] |  Hidden : 2 -> 0
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Policies\Explorer] |  NoDriveTypeAutoRun : 0 -> 145
[HKU\S-1-5-18 | Policies\Explorer] |  NoDriveTypeAutoRun : 145
[HKLM | policies\Explorer] | NoDriveTypeAutoRun  : 0 -> 145
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Policies\Explorer] |  NoLogoff : 0
[HKLM | policies\Explorer] | NoActiveDesktopChanges : 0

22:53:10


¤¤¤¤¤¤¤¤¤¤ | Services

[RPCSS] | Start : 2 : Actif
[Cmbatt] | Start : 3 : Inactif
[Compbatt] | Start : 3 -> 0 : Inactif
[Ndisuio] | Start : 3 : Inactif
[Power] | Start : 2 : Actif
[Profsvc] | Start : 2 : Actif
[PlugPlay] | Start : 2 : Actif
[PEAUTH] | Start : 2 : Actif
[NVSvc] | Start : 2 : Inactif
[nsi] | Start : 2 : Actif
[NLASvc] | Start : 2 : Actif
[MPSsvc] | Start : 2 : Actif
[MMCSS] | Start : 2 : Actif
[luafv] | Start : 2 : Actif
[lltdio] | Start : 2 : Actif
[Iphlpsvc] | Start : 2 : Actif
[IKEEXT] | Start : 3 -> 2 : Inactif
[gpsvc] | Start : 2 : Actif
[lmhosts] | Start : 2 : Actif
[LanmanWorkstation] | Start : 2 : Actif
[LanmanServer] | Start : 2 : Actif
[agp440] | Start : 3 -> 2 : Inactif
[AudioEndpointBuilder] | Start : 2 : Actif
[Audiosrv] | Start : 2 : Actif
[BFE] | Start : 2 : Actif
[Bits] | Start : 3 -> 2 : Actif
[CryptSvc] | Start : 2 : Actif
[EapHost] | Start : 3 -> 2 : Inactif
[Wlansvc] | Start : 3 -> 2 : Inactif
[SharedAccess] | Start : 4 -> 2 : Inactif
[windefend] | Start : 2 : Actif
[wuauserv] | Start : 2 : Actif
[WerSvc] | Start : 3 -> 2 : Actif
[wscsvc] | Start : 2 : Actif

22:53:10


¤¤¤¤¤¤¤¤¤¤ | Internet Explorer

[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Main] | Start Page : http://search.babylon.com/?affID=111020&tt=100512_3_&babsrc=HP_ss&mntrId=1ec8d1550000000000000025112e24b0 -> https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-18 | Main] | Start Page : http://homepage.packardbell.com/rdr.aspx?b=ACPW&l=040c&s=1&o=vp64&d=0609&m=imedia_s1710 -> https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Main] | Local Page : C:\Windows\system32\blank.htm
[HKU\S-1-5-18 | Main] | Local Page : C:\Windows\system32\blank.htm
[HKU\S-1-5-18 | Main] | Search Page : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKLM | Search] | SearchAssistant  :  -> http://www.google.com/toolbar/ie8/sidebar.html
[HKLM | Main] | Start Page : https://www.msn.com/fr-fr -> https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Local Page : C:\Windows\SysWOW64\blank.htm
[HKLM | Main] | Default_Search_URL : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | Main] | Default_Page_URL : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF -> https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | AboutURLs] | Tabs : http://search.babylon.com/?affID=111020&tt=100512_3_&babsrc=NT_ss&mntrId=1ec8d1550000000000000025112e24b0 -> res://ieframe.dll/tabswelcome.htm

¤

[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Internet settings] | ProxyOverride : *.local
[HKU\S-1-5-19 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-20 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-18 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Internet settings] | MigrateProxy : 1
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Internet settings] | WarnonZoneCrossing : 0 -> 1
[HKU\S-1-5-18 | Internet settings] | WarnonZoneCrossing : 0 -> 1
[HKU\S-1-5-19 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-20 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-18 | Internet settings] | AutoConfigProxy : wininet.dll

¤

[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\${searchCLSID}] | (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] | (Bing) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src=IE-SearchBox&FORM=IE8SRC
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}] | (Search the web (Babylon)) -> http://search.babylon.com/?q={searchTerms}&affID=111020&tt=100512_3_&babsrc=SP_ss&mntrId=1ec8d1550000000000000025112e24b0
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{37451e14-920f-40dd-82e7-af44b850c719}] | (iadah) -> https://www.hugedomains.com/domain_profile.cfm?d=iadah&e=com{searchTerms}
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}] | (Google) -> https://www.google.com/webhp?sourceid=ie7&gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW_frFR341
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{f3b72d01-2629-481c-874d-02926e33dd7b}] | (Ibyscus) -> http://www.ibyscus.com/meteo?search&q={searchTerms}
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{F89A17C9-EC0A-4190-BBA6-A77DD0A2FC34}] | (Yahoo! Search) -> https://fr.search.yahoo.com/web?fr=chr-greentree_ie{searchTerms}
[HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{9BC2D5B2-938D-4996-966B-8EF26CB9E77F}] | (Google) -> https://www.google.com/webhp?gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACPW

[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] | (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}] | (Google) -> https://www.google.com/webhp?sourceid=ie7&gws_rd=ssl{searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW


[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{000209FF-0000-0000-C000-000000000046}] | (winword.exe) -> C:\Program Files (x86)\Microsoft Office\Office12
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046}] | (iexplore.exe) -> %ProgramFiles(x86)%\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{003B91A6-61E3-4591-891D-01E94C8CB11E}] | (Silverlight.Configuration.exe) -> C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{03288CB3-3893-46D1-8D58-B2F8BB6FF5BF}] | (MSACCESS.EXE) -> C:\Program Files (x86)\Microsoft Office\Office12
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{054aae20-4bea-4347-8a35-64a533254a9d}] | (tabtip.exe) -> %CommonProgramFiles(x86)%\Microsoft Shared\Ink
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a}] | (wpcer.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}] | (Acrobat Elements.exe) -> %ProgramFiles(x86)%\adobe\acrobat 6.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695}] | (winfxdocobj.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{10483e7e-0e8b-4e16-9e77-6be5d991683b}] | (mstsc.exe) -> %systemroot%\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1138506a-b949-46a7-b6c0-ee26499fdeaf}] | (wuapp.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{130c40f0-1bcb-4852-8b63-291cf90a600b}] | (msdt.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}] | (AcroBroker.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{186e0934-aee9-11da-961b-0014223d2a70}] | (dfsvc.exe) -> C:\Windows\microsoft.net\framework\v2.0.50727
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{186e0935-aee9-11da-961b-0014223d2a70}] | (dfsvc.exe) -> C:\Windows\microsoft.net\framework64\v2.0.50727
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1A972DAF-A7EC-4ce3-B6C9-7B523CD6685F}] | (GoogleToolbarUser_32.exe) -> C:\Program Files (x86)\Google\Google Toolbar
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1ec76a37-1762-46ff-9b14-765b3e6793be}] | (agcp.exe) -> C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1FAAC277-7F72-4204-9C4A-86A8F00926E8}] | (DefMgr.exe) -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2391d819-9d17-44ec-9ac1-f6aa07549469}] | (wermgr.exe) -> %systemroot%\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26fe7361-bd5a-4dcb-b309-c6f42dde661c}] | (ieinstal.exe) -> %ProgramFiles(x86)%\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2BBE903C-2776-4574-9855-EC1597ABE3D6}] | (EXCEL.EXE) -> C:\Program Files (x86)\Microsoft Office\Office12
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2e0567aa-b9a7-4311-9020-9812adbf64ff}] | (BingApp.exe) -> C:\Program Files (x86)\Microsoft\BingBar\7.1.364.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}] | (AcroRd32Info.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}] | (wlcomm.exe) -> C:\Program Files (x86)\Windows Live\Contacts\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}] | (unpack200.exe) -> C:\Program Files (x86)\Java\jre6\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{442E3CEB-D71B-11DA-8750-001185653D78}] | (googletoolbar1user.exe) -> c:\program files (x86)\google
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}] | (jp2launcher.exe) -> C:\Program Files (x86)\Java\jre6\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}] | (acrord32.exe) -> %ProgramFiles(x86)%\adobe\acrobat 7.0eader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{569591D2-F221-4115-9A89-762956BEB3C0}] | (SmartWebPrintExe.exe) -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}] | (javaws.exe) -> C:\Program Files (x86)\Java\jre6\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6354B1ED-3B82-405a-87F7-B278EF054B96}] | (pxplay.exe) -> C:\Program Files (x86)\Photodex Presenter
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}] | (wmplayer.exe) -> %ProgramFiles%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}-32] | (wmplayer.exe) -> %ProgramFiles(x86)%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999}] | (iedw.exe) -> %ProgramFiles(x86)%\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}] | (AdobeARM.exe) -> C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78c7b664-c9bf-4ce9-8b3a-b05d442e451e}] | (CertEnrollCtrl.exe) -> C:\Windows\SysWOW64\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7aaae723-5fb5-4b2d-9327-75519f336825}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7eb01fb2-f185-445a-94e4-ec4e1ba2202c}] | (verclsid.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}] | (GoogleToolbarNotifier.exe) -> C:\Program Files (x86)\Google\GoogleToolbarNotifier
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}] | (BabylonToolbarsrv.exe) -> C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85fc331e-bb64-4c53-ba25-3d8a956c02fd}] | (ctfmon.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}] | (helppane.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}] | (AdobeCollabSync.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}] | (wlstartup.exe) -> C:\Program Files (x86)\Windows Live\Installer\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}] | (acrobat.exe) -> %ProgramFiles(x86)%\adobe\acrobat 7.0\Acrobat
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}] | (AcroRd32.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}] | (Acrobat Elements.exe) -> %ProgramFiles(x86)%\adobe\acrobat 7.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a00068b1-1e4e-41c7-afa9-baeb9697e2b9}] | (Loader.exe) -> %CommonProgramFiles%\Research In Motion\AppLoader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a1ad1bbb-3b33-4260-a74c-5fd8bc1479fc}] | (splwow64.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a5a2d52a-4944-47c4-a3e0-8bd92e14d953}] | (xpsviewer.exe) -> C:\Windows\SysWOW64\xpsviewer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{aff735eb-cdf9-4894-aa69-3e3131128618}] | (cmd.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b169b8a3-b221-467e-8747-8dbdc6cf2257}] | (BingBar.exe) -> C:\Program Files (x86)\Microsoft\BingBar\7.1.364.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01}] | (TSWbPrxy.exe) -> %systemroot%\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BD18A03F-31CC-4CC0-B52D-9E199122923D}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}] | (GoogleUpdateBroker.exe) -> C:\Program Files (x86)\Google\Update\1.3.21.111
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C442AC41-9200-4770-8CC0-7CDB4F245C55}] | (GoogleUpdate.exe) -> C:\Program Files (x86)\Google\Update
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}] | (dfsvc.exe) -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}] | (dfsvc.exe) -> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}] | (ssvagent.exe) -> C:\Program Files (x86)\Java\jre6\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}] | (msnmsgr.exe) -> C:\Program Files (x86)\Windows Live\Messenger\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D66BBFCB-EF81-413a-B9F1-86312B6E459F}] | (hpswp_EditClips.exe) -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DB9524B3-24F4-48fa-91C5-B8EEF1C0A14F}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{dc6bf185-7ae4-444e-8c35-e447b0d2bd1e}] | (notepad.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E2C89180-0A05-4d6f-9124-717575FDAD80}] | (hpswp_clipbook.exe) -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}] | (acrord32.exe) -> %ProgramFiles(x86)%\adobe\acrobat 6.0eader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EE0B94B9-335F-4d2c-8B43-DACCD1EA6FF1}] | (GoogleToolbarUser_64.exe) -> C:\Program Files (x86)\Google\Google Toolbar
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eee261cc-4b3e-46e7-affb-61f297155bf2}] | (presentationhost.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F6A6CA96-B08E-4429-BA30-39232494F292}] | (MSPUB.EXE) -> C:\Program Files (x86)\Microsoft Office\Office12
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}] | (FlashUtil10a.exe) -> C:\Windows\SysWow64\Macromed\Flash
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}] | (acrobat.exe) -> %ProgramFiles(x86)%\adobe\acrobat 6.0\Acrobat
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FC88B53C-9B2A-1A25-5867-C8612E79DBF6}] | (POWERPNT.EXE) -> C:\Program Files (x86)\Microsoft Office\Office12

¤¤¤¤¤¤¤¤¤¤ | Firefox

Profile : 9sc5yr4m.default

user_pref("browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl");
user_pref("browser.startup.homepage_override.buildID", "20120614114901");
user_pref("browser.startup.homepage_override.mstone", "13.0.1");
user_pref("browser.download.lastDir", "C:\Users\paulo\Desktop");
Ligne supprimée : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Ligne supprimée : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Ligne supprimée : user_pref("browser.search.order.1", "Search the web (Babylon)");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.babExt", "");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111020&tt=100512_3_");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.hardId", "1ec8d1550000000000000025112e24b0");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.id", "1ec8d1550000000000000025112e24b0");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.instlDay", "15470");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.newTab", true);
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?affID=111020&tt=100512_3_&babsrc=NT_ss&mntrId=1ec8d1550000000000000025112e24b0");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:46:45");
Ligne supprimée : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Ligne supprimée : user_pref("keyword.URL", "http://search.babylon.com/?affID=111020&tt=100512_3_&babsrc=KW_ss&mntrId=1ec8d1550000000000000025112e24b0&q=");

¤¤¤¤¤¤¤¤¤¤ | Extensions

C:\Users\paulo\AppData\Roaming\Mozilla\Firefox\Profiles\9sc5yr4m.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
C:\Users\paulo\AppData\Roaming\Mozilla\Firefox\Profiles\9sc5yr4m.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}


¤¤¤¤¤¤¤¤¤¤ | Plugins

C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-france.xml
C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
C:\Program Files (x86)\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-france.xml
C:\Program Files (x86)\Mozilla Firefox\searchplugins\google.xml
C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-fr.xml
C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-france.xml



¤¤¤¤¤¤¤¤¤¤ | DNS

[HKLM\SYSTEM\CCS | Tcpip\Parameters] | DhcpNameServer : 192.168.0.254
[HKLM\SYSTEM\ControlSet001 | Interfaces\{1CDCC957-7A65-49B4-96BB-1636957A2978}] | DhcpNameServer : 192.168.0.254
[HKLM\SYSTEM\ControlSet002 | Interfaces\{1CDCC957-7A65-49B4-96BB-1636957A2978}] | DhcpNameServer : 192.168.0.254
[HKLM\SYSTEM\CurrentControlSet | Interfaces\{1CDCC957-7A65-49B4-96BB-1636957A2978}] | DhcpNameServer : 192.168.0.254

¤¤¤¤¤¤¤¤¤¤ | Hosts

::1             localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com

[.......]

11126 ligne(s)


¤¤¤¤¤¤¤¤¤¤ | Traitement Fichiers | Dossiers | Registre

Non supprimée : [HKU\S-1-5-21-2704204595-2640163272-54980813-1000_Classes\TypeLib]
Supprimée : [HKLM | Microsoft\RFC1156Agent]

22:56:11

Mise en quarantaine :  C:\Windows\ARJ.PIF
Mise en quarantaine :  C:\Windows\LHA.PIF
Mise en quarantaine :  C:\Windows\NOCLOSE.PIF
Mise en quarantaine :  C:\Windows\PKUNZIP.PIF
Mise en quarantaine :  C:\Windows\PKZIP.PIF
Mise en quarantaine :  C:\Windows\RAR.PIF
Mise en quarantaine :  C:\Windows\UC.PIF
Mise en quarantaine :  C:\Windows\hpoins36.dat
Mise en quarantaine :  C:\Windows\hpomdl36.dat
Mise en quarantaine :  C:\Windows\hpqins00.dat
Mise en quarantaine :  C:\Windows\hpqins15.dat
Supprimée : [HKU\S-1-5-21-2704204595-2640163272-54980813-1000 | Run] | TomTomHOME.exe -> "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"

22:57:18

Mise en quarantaine :  C:\Windows\System32\%APPDATA%
Mise en quarantaine :  C:\Users\paulo\AppData\Roaming\InstallShield
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\7za.exe
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\conduitinstaller.exe
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MyBabylonTB.exe
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\push.exe
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\Setup.exe
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\CFG3A40.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\CFG4136.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\CFG6FA2.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\CFGB910.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO10C4.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO1601.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO1C96.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO221F.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO2F0D.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO5FFC.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO6845.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO7659.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIO900D.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOA729.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOC68B.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOCA81.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOCEE8.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOD0D7.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOD5B8.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIODA48.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIODDC5.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIODE24.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIODFE4.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOE5AE.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOE9D3.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOEA16.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\DIOF365.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR114F.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR17D3.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR189E.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR1A73.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR1C95.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR205B.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR2156.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR29F.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR3AFC.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR3CF1.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR450A.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR492.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR4D1.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR4D17.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR54E2.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR557F.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5791.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5918.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5A9D.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5D7A.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5DF8.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5E16.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5F3F.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR5F8D.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR672B.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR6805.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR6A18.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR6A57.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR79E.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR79E0.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR7BF3.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR7CD.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MAR9C.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARA7D2.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARA978.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARAB6B.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARABE7.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARACB3.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARAD9C.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARADDC.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARAE1A.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB1A2.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB1F1.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB24D.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB28C.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB376.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB3C5.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB3E3.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB432.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB470.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB598.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB5F6.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB625.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB79B.tmp
Mise en quarantaine :  C:\Users\paulo\AppData\Local\Temp\MARB8D4.tmp
Mi

g3n-h@ckm@n · Answer

pourquoi t'as pas fait ce qui etait demmandé ?

je répète :

NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider

paulo67 · Answer

https://pjjoint.malekal.com/files.php?id=20120617_j14z14k8k14q12

g3n-h@ckm@n · Answer

ton ordi est une vrai poubelle numérique

==========

internet explorer à mettre à jour 8 => 9
iadah toolbar => à desinstaller
babylon => à desinstaller
tout java => à desinstaller
Ilivid => à desinstaller
spybot => à desinstaller il sert à rien

===========

ne télécharges plus sur Softonic ou 01Net , ils refourguent des Adwares dans les installeurs

===========

Selectionne tout le texte en gras ci-dessous sans les lignes de dessus-dessous, puis (clic droit/copier ou ctrl+c) :
___________________________________________________
Kill::

Registry::
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{37451e14-920f-40dd-82e7-af44b850c719}]
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\SearchScopes\{f3b72d01-2629-481c-874d-02926e33dd7b}]
[-HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
""=-
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Windows\CurrentVersion\Run] 
"ISUSPM"=-
[HKLM\Software\Microsoft\Internet Explorer\Toolbar] 
"{98889811-442D-49dd-99D7-DC866BE87DBC}"=-   
[HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Internet Explorer\Toolbar] 
"Locked"=-
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}]  
[-HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]   
[-HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}]
[-HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\BabylonToolbar]     
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Softonic]     
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\SweetIM]     
[-HKU\S-1-5-21-2704204595-2640163272-54980813-1000\Software\Microsoft\Babylon] 
[-HKU\S-1-5-18\Software\G DATA] 
[-HKLM\Software\Babylon]     
[-HKLM\Software\BabylonToolbar]     

info::
C:\Windows\OlUnInst.exe 

File::
C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml     
C:\Windows\4ùÌ 
C:\Windows\dd_ATL90SP1_KB973924MSI36F5.txt 
C:\Windows\dd_ATL90SP1_KB973924UI36F5.txt 
C:\Windows\dd_depcheck_NETFX_EXP_35.txt 
C:\Windows\dd_dotnetfx35error_lp.txt 
C:\Windows\dd_dotnetfx35install_lp.txt
C:\Windows\dd_NET_Framework35_LangPack_MSI3726.txt 
C:\Users\paulo\Downloads\cacaoweb.exe     
C:\ProgramData\~0 

Folder::
C:\Program Files (x86)\BabylonToolbar
C:\Users\paulo\AppData\Roaming\Babylon
C:\Users\paulo\AppData\Roaming\BabylonToolbar     
C:\ProgramData\Babylon     
C:\ProgramData\Spybot - Search & Destroy     
C:\Users\paulo\AppData\Local\Babylon     
C:\Users\paulo\AppData\Local\Ilivid Player     
 C:\Program Files (x86)\Spybot - Search & Destroy     

MBR::

clean::

Reboot:: 
___________________________________________________

Relance Pre_scan puis choisis l'option "Script"

une page va s'ouvrir

logiquement le texte que tu as sélectionné s'y trouve déjà , donc tu fermes et le programme va travailler.

sinon colle-le (clic droit/coller ou ctrl+V) dans la page vierge.

puis onglet fichier => enregistrer (pas enregistrer sous...) , puis ferme le texte

des fenetres noires risquent de clignoter , c'est normal , c'est le programme qui travaille 

poste Pre_Script.txt qui apparaitra sur le bureau en fin de travail

paulo67 · Answer

bonjour et merci
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 2.617 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

paulo : Windows 7 Home Premium (64 bits)

Switchs : https://gen-hackman.kanak.fr/

Script : 12:03:35

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ | Information(s) Fichier(s)


0x964C60D77763E8A19C7C68BDF2AFA93E - C:\Windows\OlUnInst.exe

ProductName = OLITEC OlUnInst
Version = 1.0.0.1
CompanyName = OLITEC
LegalCopyright = Copyright © 2001
LegalTrademarks = 
ProductVersion = 1, 0, 0, 1
FileDescription = OlUnInst
PrivateBuild = 
FileVersion = 1, 0, 0, 1
OriginalFilename = OlUnInst.exe
SpecialBuild = 
DefaultLangCodepage = 040C04B0
Size = 48 Ko
Date de création = 24/08/2009 13:57:17
Date de modification = 29/06/2006 12:35:06
Dernier accés = 24/08/2009 13:57:17


¤
Modification du registre effectuée

¤

Supprimé : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Supprimé : C:\Windows\4ùÌ
Supprimé : C:\Windows\dd_ATL90SP1_KB973924MSI36F5.txt
Supprimé : C:\Windows\dd_ATL90SP1_KB973924UI36F5.txt
Supprimé : C:\Windows\dd_depcheck_NETFX_EXP_35.txt
Supprimé : C:\Windows\dd_dotnetfx35error_lp.txt
Supprimé : C:\Windows\dd_dotnetfx35install_lp.txt
Supprimé : C:\Windows\dd_NET_Framework35_LangPack_MSI3726.txt
Supprimé : C:\Users\paulo\Downloads\cacaoweb.exe
Non Supprimé : C:\ProgramData\~0

¤

Absent : C:\Program Files (x86)\BabylonToolbar
Supprimé : C:\Users\paulo\AppData\Roaming\Babylon
Absent : C:\Users\paulo\AppData\Roaming\BabylonToolbar
Supprimé : C:\ProgramData\Babylon
Supprimé : C:\ProgramData\Spybot - Search & Destroy
Supprimé : C:\Users\paulo\AppData\Local\Babylon
Supprimé : C:\Users\paulo\AppData\Local\Ilivid Player
Supprimé : C:\Program Files (x86)\Spybot - Search & Destroy

¤

¤¤¤¤¤¤¤¤¤¤ | MBR

Windows Version:		Windows 7 Home Premium Edition
Windows Information:		Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer:	Packard Bell
BIOS Manufacturer:		AMI
System Manufacturer:		Packard Bell
System Product Name:		imedia S1710
Logical Drives Mask:		0x000001fc

Analysis of file "C:\Pre_Scan\MBR.bin":
Windows 7 MBR code detected
je ne sais ou se trouve spybot?illivid?iada toblar et je n'arrive pas a supprimé un java et pour
EXplorer j'utilise mozilla  

¤


¤¤¤¤¤¤¤¤¤¤ | Nettoyage disque

Nettoyage du disque effectué

¤


Fin : 12:04:31

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

g3n-h@ckm@n · Answer

si je te demande de mettre internet explorer à jour , tu mets internet explorer à jour meme si tu utilises mozilla , ton pc , lui utilise internet explorer pour mettre windows à jour et son protocole sert à windows live messenger !

spybot fallait le desinstaller avant le script , maintenant il est logique que ca te pose des soucis pour la desinstall

======

faut faire les choses dans l'ordre ou elles sont induquées !

======


fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

paulo67 · Answer

bonsoir,
rapport
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3089
Windows 6.0.6001 Service Pack 1

03/11/2009 00:34:23
mbam-log-2009-11-03 (00-34-23).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 284020
Temps écoulé: 37 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partner service (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\partner service (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partner service (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\ProgramData\Partner\partner.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\ProgramData\Partner\partner.exe (Trojan.BHO) -> Quarantined and deleted successfully.

g3n-h@ckm@n · Answer

Télécharge et enregistre ADWcleaner sur ton bureau :

ADWCleaner (Merci à Xplode)

Lance le,

clique sur suppression et poste son rapport.

paulo67 · Answer

bonjour et merci
avira as  trouver un gen mais je l'ai éffacé apres mise en quarantaine

# AdwCleaner v1.609 - Rapport créé le 19/06/2012 à 17:13:09
# Mis à jour le 10/06/2012 par Xplode
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)
# Nom d'utilisateur : paulo - PC-DE-PAULO
# Exécuté depuis : C:\Users\paulo\Downloads\adwcleaner.exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****

Dossier Supprimé : C:\Users\paulo\AppData\Local\Temp\BabylonToolbar
Dossier Supprimé : C:\Users\paulo\AppData\LocalLow\BabylonToolbar
Dossier Supprimé : C:\Users\paulo\AppData\LocalLow\Searchqutoolbar
Dossier Supprimé : C:\Users\paulo\AppData\Roaming\Mozilla\Firefox\Profiles\9sc5yr4m.default\Searchqutoolbar
Dossier Supprimé : C:\ProgramData\~0

***** [Registre] *****

Clé Supprimée : HKCU\Software\Softonic
Clé Supprimée : HKCU\Software\SweetIm
Clé Supprimée : HKLM\SOFTWARE\Babylon
Clé Supprimée : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Clé Supprimée : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Clé Supprimée : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Clé Supprimée : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Clé Supprimée : HKLM\SOFTWARE\Classes\sim-packages
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\escort.DLL

***** [Registre - GUID] *****

Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{703740C1-0F1A-4CEC-A4DF-D78DB0158477}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{703740C1-0F1A-4CEC-A4DF-D78DB0158477}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{2EECCC1A-4CA0-492F-838D-AC1FC26CB327}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}

***** [Navigateurs] *****

-\ Internet Explorer v8.0.7601.17514

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v13.0.1 (fr)

Nom du profil : default 
Fichier : C:\Users\paulo\AppData\Roaming\Mozilla\Firefox\Profiles\9sc5yr4m.default\prefs.js

C:\Users\paulo\AppData\Roaming\Mozilla\Firefox\Profiles\9sc5yr4m.default\user.js ... Supprimé !

Supprimée : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Supprimée : user_pref("extensions.BabylonToolbar_i.babExt", "");
Supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111020&tt=100512_3_");
Supprimée : user_pref("extensions.BabylonToolbar_i.hardId", "1ec8d1550000000000000025112e24b0");
Supprimée : user_pref("extensions.BabylonToolbar_i.id", "1ec8d1550000000000000025112e24b0");
Supprimée : user_pref("extensions.BabylonToolbar_i.instlDay", "15470");
Supprimée : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Supprimée : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Supprimée : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Supprimée : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:46:45");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

-\ Google Chrome v [Impossible d'obtenir la version]

Fichier : C:\Users\paulo\AppData\Local\Google\Chrome\User Data\Default\Preferences

Supprimée : 		"name" : "Search the web (Babylon)",
Supprimée : 		"search_url" : "hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=1ec8d15500000000000[...]
Supprimée : 	"homepage" : "hxxp://search.babylon.com/?babsrc=HP_ss&mntrId=1ec8d1550000000000000025112e24b0&tlver[...]

*************************

AdwCleaner[S1].txt - [6300 octets] - [19/06/2012 17:13:09]

########## EOF - C:\AdwCleaner[S1].txt - [6428 octets] ##########

g3n-h@ckm@n · Answer

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

paulo67 · Answer

bonsoir et encore merci
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Version de la base de données: v2012.06.19.05

Windows Vista x64 NTFS
Internet Explorer 8.0.7601.17514
paulo :: PC-DE-PAULO [administrateur]

19/06/2012 18:01:35
mbam-log-2012-06-19 (18-01-35).txt

Type d'examen: Examen complet
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 458208
Temps écoulé: 1 heure(s), 32 minute(s), 18 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)

(fin)

g3n-h@ckm@n · Answer

quels soucis persistent ?

paulo67 · Answer

non et merci pour ton aide mais peux m'aider à faire un tri complet et dire si mon anivirus est bien
merci

g3n-h@ckm@n · Answer

faire le menage d'abord ^^

https://gen-hackman.kanak.fr/

paulo67 · Answer

re,
merci
WhyIGotInfected v1.5.4(by Tigzy)
********************************

Run : 20/06/2012 22:15:44 [Normal Mode]
Machine : PC-DE-PAULO (2 CPUs) [paulo : ADMIN]
OS: Microsoft Windows 7 Édition Familiale Premium  Service Pack 1 (x64)

~~ Plugins check: ~~

UPTODATE [Microsoft Windows 7 Édition Familiale Premium ] Current : Service Pack 1 -- Latest : Service Pack 1
UPTODATE [Firefox (x86)] Current : 13.0.1 -- Latest : 13.0.1
OUTDATED [Internet Explorer] Current : 8.0.7601.17514 -- Latest : 9.0.8112.16421
OUTDATED [Internet Explorer (x86)] Current : 8.0.7601.17514 -- Latest : 9.0.8112.16421
OUTDATED [Java] Current : 1.6.0_25 -- Latest : 1.7.0_05
UPTODATE [Adobe Reader (x86)] Current : 10 -- Latest : 10
OUTDATED [Adobe Flash (x86)] Current : 10.0.12.36 -- Latest : 11.3.300.257
UPTODATE [Adobe Flash FF Plugin] Current : 11.3.300.257 -- Latest : 11.3.300.257
UPTODATE [Adobe Flash FF Plugin (x86)] Current : 11.3.300.257 -- Latest : 11.3.300.257


Finished
<C:\Users\paulo\Desktop\WIGIReport[0].txt>
WIGIReport[0].txt 


l'autre
RaProducts' PureRa v1.7
Log created at 22:17 on 20/06/2012 (paulo)

C:\Config.MSI emptied.
C:\Users\paulo\AppData\LocalLow\Microsoft\CryptNetURLCache\Content emptied.
C:\Users\paulo\AppData\LocalLow\Microsoft\CryptNetURLCache\MetaData emptied.
C:\Windows\system32\FNTCACHE.DAT <- Le fichier spécifié est introuvable. 
Recycle bin emptied.
C:\Windows\SoftwareDistribution\DataStore\Logs emptied.
C:\Windows\SoftwareDistribution\Download emptied.
C:\Windows\SoftwareDistribution\SelfUpdate\Default emptied.
C:\Windows\SoftwareDistribution\WuRedir emptied.
C:\Windows\SoftwareDistribution\ReportingEvents.log <- Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus. 
C:\Users\paulo\AppData\Local\Temp emptied.
C:\Windows\TEMP emptied.
C:\ACER\Preload\Autorun\AutorunX\HowToUse\Images\Thumbs.db <- Successfully deleted.
C:\ACER\Preload\Autorun\AutorunX\PB Logo\Thumbs.db <- Successfully deleted.
C:\ACER\Preload\Autorun\SET\Wallpaper\Thumbs.db <- Successfully deleted.
C:\Program Files\PACKARD BELL\EBAY\CMD\Thumbs.db <- Successfully deleted.
C:\Program Files\PACKARD BELL\metaboli\Thumbs.db <- Successfully deleted.
C:\Program Files\PACKARD BELL\metaboli\img\Thumbs.db <- Successfully deleted.
C:\Program Files (x86)\HP\Digital Imaging\skins\oov1	j\Thumbs.db <- Successfully deleted.
C:\Program Files (x86)\Packard Bell\Identity Card\PIC\Thumbs.db <- Successfully deleted.
C:\Program Files (x86)\Packard Bell\SetUpMyPC\pbcare\images\Thumbs.db <- Successfully deleted.
C:\Program Files (x86)\Packard Bell\SetUpMyPC\pic\Thumbs.db <- Successfully deleted.
C:\ProgramData\Microsoft\eHome\logs\eHomeLog00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\IconCache.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows\Explorer	humbcache_1024.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows\Explorer	humbcache_256.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows\Explorer	humbcache_32.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows\Explorer	humbcache_96.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows\Explorer	humbcache_idx.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows\Explorer	humbcache_sr.db <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici12_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici12_01.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici12_02.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici3_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici3_01.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici3_02.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici3_03.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici4_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici4_01.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici4_02.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici4_03.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici4_04.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\Bici\Bici5_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData18_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData20_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData21_00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live\SqmApi\SqmData21_01.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Client Album Viewer\SqmApi\SqmSessionData-WindowsLivePhotoViewer-00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Mail\sqmdata00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Mail\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Movie Maker\SqmApi\SqmSessionData-MovieMaker-00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Movie Maker\SqmApi\SqmSessionData-NoOptIn-MovieMaker-00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Movie Maker\SqmApi\SqmSessionData-NoOptIn-MovieMaker-01.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Microsoft\Windows Live Photo Gallery\SqmApi\SqmSessionData-WLXPhotoGallery-00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\VirtualStore\sqmnoopt00.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw0.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw1.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw2.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw3.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw4.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw5.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw6.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw7.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw8.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Local\Windows Live Writer\Inst\wlw9.sqm <- Successfully deleted.
C:\Users\paulo\AppData\Roaming\Image Zone Express	humbnail.db <- Successfully deleted.
C:\Users\paulo\AppData\Roaming\Sony\DVD Architect Pro\5.0\Themes\album1.thm\Thumbs.db <- Successfully deleted.
C:\Users\paulo\Pictures\Thumbs.db <- Successfully deleted.

Total space cleaned: 352.97 MB

-=E.O.F=-

paulo67 · Answer

re,
# DelFix v8.8 - Rapport créé le 20/06/2012 à 22:22:21
# Mis à jour le 12/02/12 par Xplode
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)
# Nom d'utilisateur : paulo - PC-DE-PAULO (Administrateur)
# Exécuté depuis : C:\Users\paulo\Downloads\delfix.exe
# Option [Suppression]


~~~~~~ Dossiers(s) ~~~~~~

Supprimé : C:\_OTL
Supprimé : C:\pre_scan
Supprimé : C:\Program Files (x86)\Ad-Remover

~~~~~~ Fichier(s) ~~~~~~

Supprimé : C:\AdwCleaner[S1].txt
Supprimé : C:\Users\paulo\Desktop\Pre_Scan_17_06_2012_22_51_50.txt
Supprimé : C:\Users\paulo\Downloads\adwcleaner.exe
Supprimé : C:\Users\paulo\Downloads\WhyIGotInfected.exe
Supprimé : C:\Users\paulo\Mes documents\Téléchargements\esetsmartinstaller_enu.exe
Supprimé : C:\Users\paulo\Mes documents\Téléchargements\JavaRa.zip
Supprimé : C:\Users\paulo\Mes documents\Téléchargements\OTL.exe
Supprimé : C:\Users\paulo\Mes documents\Téléchargements\ZHPDiag2(1).exe
Supprimé : C:\Users\paulo\Mes documents\Téléchargements\ZHPDiag2.exe

~~~~~~ Registre ~~~~~~

Clé Supprimée : HKCU\Software\Ad-Remover
Clé Supprimée : HKCU\Software\g3n-h@ckm@n
Clé Supprimée : HKLM\SOFTWARE\OldTimer Tools
Clé Supprimée : HKLM\SOFTWARE\AdwCleaner
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Remover
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

~~~~~~ Autres ~~~~~~

Désinstallé : ESET Online Scanner
-> Prefetch Vidé

*************************

DelFix[S1].txt - [1514 octets] - [20/06/2012 22:22:21]

########## EOF - C:\DelFix[S1].txt - [1638 octets] ##########

g3n-h@ckm@n · Answer

magnifique

PC tres lent au démarage

20 réponses

Newsletters