Disque dur externe transformation fichier

bonjour

Téléchargez USBFIX de El Desaparecido, C_xx

http://eldesaparecido.com/usbfix.html

/!\ Utilisateur de vista et windows 7 :
exécuter en tant qu'administrateur

/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

Double clic sur le raccourci UsbFix présent sur le bureau .

Choisir l'option suppression
(d'autres options disponibles, voir le tutoriel).
Laissez travailler l'outil.
Le menu démarrer et les icônes vont disparaître.. c'est normal.

Si un message te demande de redémarrer l'ordinateur fais le ...

Au redémarrage, le fix se relance... laisses l'opération s'effectuer.

Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse

* Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

salut

je pense en effet que tu es infecté

tu peux essayer de changer l'extension d'un fichier pour voir ce que ça donne

tu vas dans panneau de config>options des dossiers >affichage tu coches

afficher les dossiers cachés puis tu vas sur un de tes fichier et tu changes l'extension

(le titre de ton film.avi ou .mkv selon l'extension que celui-ci avait)

après tu essayes de le lire

a la fin de l'opération n'oublies pas de faire l'opération inverse pour caché a nouveau

les extensions de fichiers

@+

Bonjour,

Voici le rapport en question

############################# | UsbFix V 7.094 | [Research]

User: x-60889j-coga (Administrator) # FR100WL00858
Updated 20/07/2012 by El Desaparecido
Started at 18:58:24 | 27/07/2012

Website: https://www.sosvirus.net/
Forum: http://forum.eldesaparecido.com
Suspicious file ? : http://eldesaparecido.com/upload.php
Contact: contact@eldesaparecido.com

PC: Dell Inc. (Latitude E6420) (X86-based PC) # Notebook
CPU: Intel Pentium III Xeon processor (2494)
RAM -> [Total : 3317 | Free : 2407]
BIOS: Default System BIOS
BOOT: Normal boot

OS: Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [(!) Disabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [(!) Disabled]

C:\ (%systemdrive%) -> Fixed drive # 233 Gb (175 Mb free - 75%) [FR100WL00858] # NTFS
D:\ -> CD-ROM
E:\ -> Fixed drive # 932 Gb (475 Mb free - 51%) [Film alex] # NTFS

################## | Active Processes |

C:\WINDOWS\System32\smss.exe (1184)
C:\WINDOWS\system32\winlogon.exe (1308)
C:\WINDOWS\system32\services.exe (1352)
C:\WINDOWS\system32\lsass.exe (1364)
C:\WINDOWS\system32\nvsvc32.exe (1536)
C:\WINDOWS\system32\svchost.exe (1560)
C:\WINDOWS\System32\svchost.exe (1692)
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (1792)
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (524)
C:\WINDOWS\system32\spoolsv.exe (632)
C:\Program Files\IDT\WDM\stacsv.exe (696)
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (824)
c:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe (848)
c:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe (924)
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe (1860)
C:\Program Files\Java\jre6\bin\jqs.exe (1992)
C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (1492)
C:\Program Files\IBM\Lotus\Notes\nsd.exe (348)
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (920)
C:\Program Files\IBM\Lotus\Notes\ntmulti.exe (1800)
C:\WINDOWS\system32\DRIVERS\o2flash.exe (1836)
c:\WINDOWS\system32\srvany.exe (1852)
c:\WINDOWS\system32\SDIOAssist.exe (1972)
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (2056)
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2224)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (2420)
C:\WINDOWS\system32\svchost.exe (2452)
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (2568)
C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (2732)
C:\WINDOWS\system32\wbem\wmiapsrv.exe (2852)
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (3384)
C:\WINDOWS\Explorer.EXE (1676)
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (2120)
C:\WINDOWS\system32\AESTFltr.exe (2684)
C:\Program Files\IDT\WDM\sttray.exe (3816)
C:\Program Files\STMicroelectronics\AccelerometerP11\FF_Protection.exe (3828)
C:\WINDOWS\system32\RUNDLL32.EXE (3836)
C:\WINDOWS\system32\rundll32.exe (3564)
C:\Program Files\Common Files\Symantec Shared\ccApp.exe (3112)
C:\Program Files\Aladdin\eToken\PKIClient\x32\PKIMonitor.exe (3932)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (324)
C:\WINDOWS\system32\ctfmon.exe (448)
C:\Program Files\Mozilla Firefox\firefox.exe (2640)
C:\Documents and Settings\x-60889j-coga\appinfo.exe (2656)
C:\Documents and Settings\x-60889j-coga\Application Data\Microsoft\Outil de notification de cadeaux MSN\msnotif.exe (2676)
C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (2888)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (3352)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (2780)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (4024)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (3892)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (3672)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (688)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (3912)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (3580)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (432)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (2432)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (2360)
C:\WINDOWS\Explorer.EXE (860)
C:\WIN32APP\INGR\SPLM\bin\pdlice.exe (2892)
C:\UsbFix\Go.exe (3328)

################## | Files # Infected Folders |

################## | Registry |

################## | Mountpoints2 |

################## | Vaccin |

(!) This computer is not vaccinated!

################## | E.O.F |

Merci

Télécharge ZHPDiag ( de Nicolas coolman ).
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html


(outil de diagnostic)

Double clique sur le fichier d'installation, puis installe le avec les paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )

Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista/Seven )

Clique sur la loupe en haut à gauche, puis laisse l'outil scanner.

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau.

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

Merci j'essaie ceci. et je vous envoie le rapport

Bonjour,

Vous trouverez le rapport ci dessous:
J'attends le retour d'analyse du site que vous m'avais donné et je reviens vers vous dès que j'ai les informations.

Merci d'avance
Rapport de ZHPDiag v1.31.11 par Nicolas Coolman, Update du 21/07/2012
Run by x-60889j-coga at 28/07/2012 08:24:18
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Web site : http://nicolascoolman.skyrock.com/
State : Version à jour.

---\\ Web Browser
MSIE: Internet Explorer v8.0.6001.18702 (Defaut)
MFIE: Mozilla Firefox 14.0.1 v14.0.1

---\\ Windows Product Information
~ Langage: Français
Windows XP Professional Service Pack 3 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ System Information
~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3316 MB (62% free)
System Restore: Désactivé (Disabled)
System drive C: has 175 GB (74%) free of 233 GB

---\\ Logged in mode
~ Computer Name: FR100WL00858
~ User Name: x-60889j-coga
~ All Users Names: x-60889j-coga, HelpAssistant, Guest, ASPNET, Administrator,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Documents and Settings\x-60889j-coga\Application Data\
~ %Desktop% : C:\Documents and Settings\x-60889j-coga\Desktop\
~ %Favorites% : C:\Documents and Settings\x-60889j-coga\Favorites\
~ %LocalAppData% : C:\Documents and Settings\x-60889j-coga\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\x-60889j-coga\Start Menu\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 175 Go of 233 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Hard drive, Flash drive, Thumb drive (Free 475 Go of 932 Go)
I:\ Floppy drive, Flash card reader, USB Key (Free 7 Go of 7 Go)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK
~ Scan Security Center in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.12896823FB95BFB3DC9B46BCAEDC9923] - (.Microsoft Corporation - Windows Explorer.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\Explorer.exe [1033728]
[MD5.6CE32F7778061CCC5814D5E0F282D369] - (.Microsoft Corporation - Internet Extensions for Win32.) (.08/03/2009 - 04:34:58.) -- C:\WINDOWS\system32\wininet.dll [914944]
[MD5.ED0EF0A136DEC83DF69F04118870003E] - (.Microsoft Corporation - Windows NT Logon Application.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [507904]
[MD5.7E775010EF291DA96AD17CA4B17137D7] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/08/2008 - 11:04:36.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.14/04/2008 - 00:10:32.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/04/2008 - 00:10:48.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.D45926117EB9FA946A6AF572FBE1CAA3] - (.Microsoft Corporation - FIPS Crypto Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44544]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384]
[MD5.4A0B06AA8943C1E332520F7440C0AA30] - (.Microsoft Corporation - i8042 Port Driver.) (.14/04/2008 - 00:48:02.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [52480]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.14/04/2008 - 00:11:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.421F7B922CEC5A5F340E7574A98F7B7C] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.04/12/2009 - 19:22:22.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [455424]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574976]
[MD5.5575FAF8F97CE5E713D108C2A58D7C7C] - (.Microsoft Corporation - Parallel Port Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80128]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 23:02:52.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196224]
[MD5.F828DD7E1419B6653894A8F97A0094C5] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.14/04/2008 - 00:10:28.) -- C:\WINDOWS\system32\Drivers\redbook.sys [57600]
[MD5.4C8FCB5CC53AAB716D810740FE59D025] - (.Microsoft Corporation - Volume Shadow Copy Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [52352]
~ Scan Generic Processes in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/4
~ Mes musiques (My Musics) : 1/5812
~ Mes Videos (My Video) : 0/0
~ Mes Favoris (My Favorites) : 1/27
~ Mes Documents (My Documents) : 2/5860
~ Mon Bureau (My Desktop) : 0/238
~ Menu demarrer (Programs) : 1/40
~ Scan Hidden Files in 00mn 04s

---\\ Processus lancés
[MD5.7BD5BE79A0B3E5219872D5A7928F9DF1] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 266.9.) -- C:\WINDOWS\system32\nvsvc32.exe [155752] [PID.]
[MD5.A58CFA1B9D223B1E13F756CFC3DD8F63] - (.Symantec Corporation - Symantec CMC Smc.) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe [1893840] [PID.]
[MD5.399A7DF138D2110A3EB9BD64D6327F62] - (.Symantec Corporation - Symantec Service Framework.) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108456] [PID.]
[MD5.A97FCA92BE4E62BC589371058CBC769E] - (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\stacsv.exe [274514] [PID.]
[MD5.67A95B9D129ED5399E7965CD09CF30E7] - (.Logitech Inc. - Logitech User mode UMVPF service.) -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848] [PID.]
[MD5.3DCB48EBDD33E4D0E1E07F1751D7F767] - (.Broadcom Corporation - Host Control Application.) -- c:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [826272] [PID.]
[MD5.13BB0029F5E24A63F2FB256E04DCF2D0] - (.Broadcom Corporation - Host Storage Application.) -- c:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [32160] [PID.]
[MD5.309B12C2F1790E6274BDC2B72CD21277] - (.Altiris, Inc. - Altiris Agent.) -- C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe [1523712] [PID.]
[MD5.0A5709543986843D37A92290B7838340] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe [153376] [PID.]
[MD5.DB083F1D27BA8A59CABB00F0A0FB6F84] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [325656] [PID.]
[MD5.1BFDCC17FD8B06F92B048C615C17BF9F] - (.IBM - wnsd.) -- C:\Program Files\IBM\Lotus\Notes\nsd.exe [3405192] [PID.]
[MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.]
[MD5.218D58976C01C60657818ED0EAC81602] - (.IBM Corp - IBM Lotus Notes/Domino.) -- C:\Program Files\IBM\Lotus\Notes\ntmulti.exe [58760] [PID.]
[MD5.4E37455DB16AEC75862B1D0BC35B589E] - (.O2Micro International - O2 Flash Memory Service.) -- C:\WINDOWS\system32\DRIVERS\o2flash.exe [72296] [PID.]
[MD5.4635935FC972C582632BF45C26BFCB0E] - (...) -- c:\WINDOWS\system32\srvany.exe [8192] [PID.]
[MD5.B3BBFEB98C4B7FC5E3084498A68DA433] - (.O2Micro. - SDIOAssist.) -- c:\WINDOWS\system32\SDIOAssist.exe [223848] [PID.]
[MD5.0F97E7A47A52F4A36969F0FC319654C2] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3048136] [PID.]
[MD5.04F9326005861DC0D31E056BD6EB8BF3] - (.Intergraph PPM - SmartPlant License Manager.) -- C:\WIN32APP\INGR\SPLM\bin\pdlice.exe [610387] [PID.]
[MD5.96900995907415FB4A8A18D97B3AA4A3] - (.Symantec Corporation - Symantec AntiVirus.) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe [1839888] [PID.]
[MD5.07AE0C9F64C4D83ABAA816EE23548D6D] - (.Intel Corporation - User Notification Service.) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2656280] [PID.]
[MD5.4B9E1A7798A80D075F53D1049FD4DAB0] - (.Broadcom Corporation. - Bluetooth Support Server.) -- C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [365912] [PID.]
[MD5.06224A61268B80B6AD8DC993839A0506] - (.Symantec Corporation - Symantec CMC SmcGui.) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe [1459616] [PID.]
[MD5.2EE2B4BD9407C19C8E3794F2A1B4A0D0] - (.Andrea Electronics Corporation - AEFltrs MFC Application.) -- C:\WINDOWS\system32\AESTFltr.exe [737280] [PID.]
[MD5.12C864E55D5ED1A4061FA18BCCD80AC5] - (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray.exe [536668] [PID.]
[MD5.676DAFC24883EDB9F54D7E45A615C4BA] - (.Pas de propriétaire - FF_Protection MFC Application.) -- C:\Program Files\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704] [PID.]
[MD5.037B1E7798960E0420003D05BB577EE6] - (...) -- ystem32\RUNDLL32.exe [0] [PID.]
[MD5.970C730748166E048162F5056F4CFA7D] - (.Symantec Corporation - Symantec User Session.) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115624] [PID.]
[MD5.35424FD09104B0512E3DC03A69D170C2] - (.Aladdin Knowledge Systems, Ltd. - PKIMonitor Application.) -- C:\Program Files\Aladdin\eToken\PKIClient\x32\PKIMonitor.exe [230752] [PID.]
[MD5.98A078F838A70F84E1BD490D7C7675F4] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696] [PID.]
[MD5.407FA94676AA5EC31D2F561AEBAF0238] - (...) -- C:\Documents and Settings\x-60889j-coga\appinfo.exe [718848] [PID.]
[MD5.83166BFFA8C4BBAC4413F47C865CC8EE] - (.Microsoft Corporation - Outil de notification de cadeaux MSN.) -- C:\Documents and Settings\x-60889j-coga\Application Data\Microsoft\Outil de notification de cadeaux MSN\msnotif.exe [183096] [PID.]
[MD5.3F677172F23FC17283D9BCE4B42E3F65] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [913888] [PID.]
[MD5.32A0C20023A856CA80A6D16E86113565] - (.Intel Corporation - Intel(R) Management and Security Status.) -- C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe [1923096] [PID.]
[MD5.A06AB1550658A19E871A6FD7FF1C2CDB] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [16864] [PID.]
[MD5.D2AE56CEAFD824CA022164A79FCB2F5C] - (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\java.exe [149280] [PID.]
[MD5.CBEC06E32D0AC9C3D0A9199EDC1FB959] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [17418928] [PID.]
[MD5.72AE847EB2B526CC0551C88B9A2970C1] - (...) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [3763200] [PID.]
[MD5.86D007E7A654B9A71D1D7D856B104353] - (.Microsoft Corporation - Smart Card Resource Management Server.) -- C:\WINDOWS\System32\SCardSvr.exe [95744] [PID.]
~ Scan Processes Running in 00mn 01s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Documents and Settings\x-60889j-coga\Application Data\Mozilla\Firefox\Profiles\1cqz8ceg.default\prefs.js
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Documents and Settings\x-60889j-coga\Application Data\Mozilla\Firefox\Profiles\1cqz8ceg.default\searchplugins\bing.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Documents and Settings\x-60889j-coga\Application Data\Mozilla\Firefox\Profiles\1cqz8ceg.default\searchplugins\jerecherche.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\amazon-france.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\bing.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay-france.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-fr.xml
M3 - MFPP: Plugins - [x-60889j-coga] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-france.xml
M0 - MFSP: prefs.js [x-60889j-coga - 1cqz8ceg.default] https://jerecherche.org/
M2 - MFEP: prefs.js [x-60889j-coga - 1cqz8ceg.default\newtaburl@sogame.cat] [] NewTabURL v2.2.3 (.Sogame.)
M2 - MFEP: prefs.js [x-60889j-coga - 1cqz8ceg.default\{e001c731-5e37-4538-a5cb-8168736a2360}] [] Bitdefender QuickScan v0.9.9.119 (.Echipa R&D Bitdefender.)
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll
P2 - FPN: [HKLM] [@adobe.com/ShockwavePlayer] - (.Adobe Systems, Inc. - Adobe Shockwave for Director Netscape plug-in, version 11.0.) -- C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_31 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.60129.0.) -- c:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
~ Scan Firefox Browser in 00mn 00s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://jerecherche.org/
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.microsoft.com/fr-fr/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = https://jerecherche.org/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=17DBE7D168544FA98200E890A8051984
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)) -- C:\WINDOWS\system32\ieframe.dll
~ Scan IE Browser in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy-france.tp.tpnet.intra:8080
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Scan Proxy management in 00mn 00s

---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Scan Keys in 00mn 00s

---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Scan Hosts File in 00mn 00s
~ Nombre de lignes (Lines number): 19

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} . (.Microsoft Corporation - Search Helper for Internet Explorer.) -- C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} Clé orpheline
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} . (.Skype Technologies S.A. - Skype Click to Call for Internet Explorer.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} . (.Microsoft Corporation - Bing Bar.) -- C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} . (.Sun Microsystems, Inc. - Java(TM) Quick Starter binary.) -- C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
~ Scan BHO in 00mn 00s

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - [HKLM]{47833539-D0C5-4125-9FA8-0819E2EAAC93} . (...) -- (.not file.)
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - [HKLM]{8dcb7100-df86-4384-8842-8fa844297b3f} . (.Microsoft Corporation - Bing Bar.) -- C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
~ Scan Toolbar in 00mn 00s

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [IMJPMIG8.1] . (.Microsoft Corporation - Microsoft IME.) -- C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
O4 - HKLM\..\Run: [PHIME2002ASync] . (.Microsoft Corporation - ???????? 2002a.) -- C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
O4 - HKLM\..\Run: [PHIME2002A] . (.Microsoft Corporation - ???????? 2002a.) -- C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
O4 - HKLM\..\Run: [IMSS] . (.Intel Corporation - PIcon startup utility.) -- C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
O4 - HKLM\..\Run: [AESTFltr] . (.Andrea Electronics Corporation - AEFltrs MFC Application.) -- C:\WINDOWS\system32\AESTFltr.exe
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [FreeFallProtection] . (.Pas de propriétaire - FF_Protection MFC Application.) -- C:\Program Files\STMicroelectronics\AccelerometerP11\FF_Protection.exe
O4 - HKLM\..\Run: [NvMediaCenter] . (.NVIDIA Corporation - NVIDIA Media Center Library.) -- C:\WINDOWS\system32\NvMcTray.dll
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll
O4 - HKLM\..\Run: [NVHotkey] nvHotkey.dll
O4 - HKLM\..\Run: [nwiz] . (...) -- C:\Program Files\NVIDIA Corporation\nView\nwiz.exe
O4 - HKLM\..\Run: [ccApp] . (.Symantec Corporation - Symantec User Session.) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [eTMonitor] . (.Aladdin Knowledge Systems, Ltd. - PKIMonitor Application.) -- c:\Program Files\Aladdin\eToken\PKIClient\x32\PKIMonitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [lan] . (...) -- C:\Documents and Settings\x-60889j-coga\chat-land\Chat-Landmessenger.jar
O4 - HKCU\..\Run: [tempHome] C:\DOCUME~1\X-6088~1\LOCALS~1\Temp\racourci.vbe (.not file.)
O4 - HKCU\..\Run: [appinfo] C:\Documents and Settings\x-60889j-cogaappinfo.exe (.not file.)
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-2506323827-2712427676-921043147-1076\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-2506323827-2712427676-921043147-1076\..\Run: [lan] . (...) -- C:\Documents and Settings\x-60889j-coga\chat-land\Chat-Landmessenger.jar
O4 - HKUS\S-1-5-21-2506323827-2712427676-921043147-1076\..\Run: [tempHome] C:\DOCUME~1\X-6088~1\LOCALS~1\Temp\racourci.vbe (.not file.)
O4 - HKUS\S-1-5-21-2506323827-2712427676-921043147-1076\..\Run: [appinfo] C:\Documents and Settings\x-60889j-cogaappinfo.exe (.not file.)
~ Scan Application in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\AutoCAD 2007.lnk . (.Autodesk, Inc..) -- C:\Program Files\AutoCAD 2007\acad.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\Lotus Notes (Advanced).lnk . (.IBM Corp.) -- C:\Program Files\IBM\Lotus\Notes\notes.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\MBRCheck.lnk . (...) -- C:\Program Files\ZHPDiag\mbrcheck.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\ZHPDiag.lnk . (...) -- C:\Program Files\ZHPDiag\ZHPDiag.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\ZHPFix.lnk . (...) -- C:\Program Files\ZHPDiag\ZHPFix.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - Global Startup: C:\Documents And Settings\x-60889j-coga\Desktop\annab.lnk - Clé orpheline
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\AutoCAD 2007.lnk . (.Autodesk, Inc..) -- C:\Program Files\AutoCAD 2007\acad.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\Lotus Notes (Advanced).lnk . (.IBM Corp.) -- C:\Program Files\IBM\Lotus\Notes\notes.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\MBRCheck.lnk . (...) -- C:\Program Files\ZHPDiag\mbrcheck.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\ZHPDiag.lnk . (...) -- C:\Program Files\ZHPDiag\ZHPDiag.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Desktop\ZHPFix.lnk . (...) -- C:\Program Files\ZHPDiag\ZHPFix.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - Global Startup: C:\Documents And Settings\x-60889j-coga\Desktop\annab.lnk - Clé orpheline
~ Scan Global Startup in 00mn 05s

---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Ajouter au fichier PDF existant . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir en Adobe PDF . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir la sélection en Adobe PDF . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O8 - Extra context menu item: E&xport to Microsoft Excel - (.not file.) - C:\Program Files\MICROS~2\OFFICE11\EXCEL.exe
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Envoyer à Bluetooth . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
~ Scan IE Menu Contextuel in 00mn 00s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Skype Click to Call - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
~ Scan IE Extra Buttons in 00mn 00s

---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Microsoft Windows Sockets 2.0 Service Provider.) -- C:\WINDOWS\system32\mswsock.dll
~ Scan Winsock in 00mn 00s

---\\ Piratage de l'Option 'Rétablir les paramètres Web' (O14)
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="ie.search.msn.com"
~ Scan IE Paramètres WEB in 00mn 00s

---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] *.chat-land.org
O15 - Trusted Zone: [HKCU\...\Domains\www] *.chat-land.org
~ Scan IE Zone Confiance in 00mn 00s

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} (IBM Lotus iNotes 8.5 Control) - https://mail13-fr.technip.com/dwa85W.cab
O16 - DPF: {36F17E17-AC00-42BC-A6D9-294AD4E7DCD6} () - http://fr900vm0182.corp.tpnet.intra/Altiris/NS/NSCap/Bin/Win32/x86/AeXClientBootstrap.cab
O16 - DPF: {51BB7DFD-A6F5-4FAC-B8C9-E71CF84D082C} (AeXNSConsoleContextHelp Class) - http://fr900vm0162/Altiris/NS/NSCap/Bin/Win32/x86/AltirisNSConsole.cab
O16 - DPF: {B44D252D-98FC-4D5C-948C-BE868392A004} (ConsoleUtilities Class) - http://fr900vm0180/DSWeb/utils/AltirisNSConsole.cab
~ Scan Objets ActiveX in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D8F63AC-23BC-4D67-AFAA-C8A9231FE7FE}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D8F63AC-23BC-4D67-AFAA-C8A9231FE7FE}: DhcpDomain = tp.tpnet.intra
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D8F63AC-23BC-4D67-AFAA-C8A9231FE7FE}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D8F63AC-23BC-4D67-AFAA-C8A9231FE7FE}: DhcpDomain = tp.tpnet.intra
O17 - HKLM\System\CS2\Services\Tcpip\..\{3D8F63AC-23BC-4D67-AFAA-C8A9231FE7FE}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3D8F63AC-23BC-4D67-AFAA-C8A9231FE7FE}: DhcpDomain = tp.tpnet.intra
~ Scan Domain in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} . (.Microsoft Corporation - ActiveX control for streaming video.) -- C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\WINDOWS\system32\itss.dll
O18 - Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll
O18 - Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll
O18 - Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (.Microsoft Corporation - Microsoft Internet Messaging API.) -- C:\WINDOWS\system32\inetcomm.dll
O18 - Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\WINDOWS\system32\itss.dll
O18 - Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.dll
O18 - Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} . (.Microsoft Corporation - Windows Live Messenger Protocol Handler Mod.) -- C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll
O18 - Handler: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} . (.Microsoft Corporation - Microsoft Office Web Components 2003.) -- C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.dll
O18 - Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll
O18 - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} . (.Skype Technologies S.A. - Skype Click to Call for Internet Explorer.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\Program Files\Common Files\Skype\Skype4COM.dll
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll
O18 - Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} . (.Microsoft Corporation - ActiveX control for streaming video.) -- C:\WINDOWS\system32\msvidctl.dll
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\WINDOWS\system32\mshtml.dll
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\WINDOWS\system32\mscoree.dll
O18 - Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\WINDOWS\system32\mscoree.dll
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\WINDOWS\system32\mscoree.dll
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} . (.Citrix Systems, Inc. - Citrix online plug-in ICAMimeFilter DLL.) -- C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - OLE32 Extensions for Win32.) -- C:\WINDOWS\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.dll
~ Scan Protocole Additionnel in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Offline Network Agent.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - Secondary Logon Service Notification DLL.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
~ Scan Winlogon in 00mn 00s

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Systray shell service object.) -- C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll
~ Scan SSODL in 00mn 00s

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Browseui preloader - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll
~ Scan STS/SSO in 00mn 00s

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Altiris Agent (AeXNSClient) . (.Altiris, Inc. - Altiris Agent.) - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: Bluetooth Service (btwdins) . (.Broadcom Corporation. - Bluetooth Support Server.) - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) . (.Symantec Corporation - Symantec Service Framework.) - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) . (.Symantec Corporation - Symantec Service Framework.) - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Credential Vault Host Control Service (Credential Vault Host Control Service) . (.Broadcom Corporation - Host Control Application.) - c:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
O23 - Service: Credential Vault Host Storage (Credential Vault Host Storage) . (.Broadcom Corporation - Host Storage Application.) - c:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) . (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) Management and Security Applica (LMS) . (.Intel Corporation - Local Manageability Service.) - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Lotus Notes Diagnostics (Lotus Notes Diagnostics) . (.IBM - wnsd.) - C:\Program Files\IBM\Lotus\Notes\nsd.exe
O23 - Service: Multi-user Cleanup Service (Multi-user Cleanup Service) . (.IBM Corp - IBM Lotus Notes/Domino.) - C:\Program Files\IBM\Lotus\Notes\ntmulti.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 266.9.) - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O2FLASH (O2FLASH) . (.O2Micro International - O2 Flash Memory Service.) - C:\WINDOWS\system32\DRIVERS\o2flash.exe
O23 - Service: O2SDIOAssist (O2SDIOAssist) . (...) - c:\WINDOWS\system32\srvany.exe
O23 - Service: Skype C2C Service (Skype C2C Service) . (.Skype Technologies S.A. - Skype C2C Service.) - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Symantec Management Client (SmcService) . (.Symantec Corporation - Symantec CMC Smc.) - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: SPLM - SmartPlant Licensing Manager (SPLM - SmartPlant Licensing Manager) . (.Intergraph PPM - SmartPlant License Manager.) - C:\WIN32APP\INGR\SPLM\bin\pdlice.exe
O23 - Service: Audio Service (STacSV) . (.IDT, Inc. - IDT PC Audio.) - C:\Program Files\IDT\WDM\stacsv.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) . (.Symantec Corporation - Symantec AntiVirus.) - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: (UMVPFSrv) . (.Logitech Inc. - Logitech User mode UMVPF service.) - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: Intel(R) Management and Security Applica (UNS) . (.Intel Corporation - User Notification Service.) - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
~ Scan Services in 00mn 00s

---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Desktop Component 0: My Current Home Page - file:About:Home
O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Office Word.) - c:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe
~ Scan Desktop Component in 00mn 00s

---\\ BootExecute (O34)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
~ Scan Keys in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\debutShakeIcon.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\prismShakeIcon.job
[MD5.1F31552C2C249275D13C47F94DD3BAED] [APT] [debutShakeIcon] (.NCH Software.) -- C:\Program Files\NCH Software\Debut\debut.exe
[MD5.7E6C671FC2A3250E817A68CFC8E4EBE4] [APT] [prismShakeIcon] (.NCH Software.) -- C:\Program Files\NCH Software\Prism\prism.exe
~ Scan Scheduled Task in 00mn 00s

---\\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Internet Explorer Version Update - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} . (.Microsoft Corporation - IE Per User Active Setup Uninstall Utility.) -- C:\WINDOWS\system32\ieudinit.exe
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Microsoft Windows Media Player Setup Utility.) -- C:\WINDOWS\inf\unregmp2.exe
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} . (.Microsoft Corporation - Windows NT User Data Migration Tool.) -- C:\WINDOWS\system32\shmgrate.exe
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\regutils.dll
O40 - ASIC: Microsoft Office Communicator 2007 R2 - {0EEB34F6-991D-4a1b-8EEB-772DA0EADB22} . (.Microsoft Corporation - Microsoft Office Communicator 2007 R2.) -- C:\Program Files\Microsoft Office Communicator\communicator.exe
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} . (.Microsoft Corporation - Windows Media 6.4 Player Shim.) -- C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media 6.4 Player Shim.) -- C:\WINDOWS\system32\wmpdxm.dll
O40 - ASIC: Adobe Shockwave Director 11.0 - {233C1507-6A77-46A4-9443-F871F945D258} . (.Adobe Systems, Inc. - Shockwave ActiveX Control.) -- C:\WINDOWS\system32\Adobe\Director\SwDir.dll
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - Windows Theme API.) -- C:\WINDOWS\system32\themeui.dll
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Outlook Express Setup Library.) -- C:\Program Files\Outlook Express\setup50.exe
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} . (...) -- C:\WINDOWS\INF\msnetmtg.inf
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} . (...) -- C:\WINDOWS\INF\msmsgs.inf
O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Microsoft Internet Explorer FTP Folder Shell Extension.) -- C:\WINDOWS\system32\msieftp.dll
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (...) -- C:\WINDOWS\INF\wmp.inf
O40 - ASIC: Address Book 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} . (.Microsoft Corporation - Outlook Express Setup Library.) -- C:\Program Files\Outlook Express\setup50.exe
O40 - ASIC: Windows Desktop Update - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - Windows Shell Common Dll.) -- C:\WINDOWS\system32\shell32.dll
O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\WINDOWS\system32\ie4uinit.exe.mui
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- c:\WINDOWS\system32\mscories.dll
O40 - ASIC: Fax - {8b15971b-5355-4c82-8c07-7e181ea07608} . (...) -- C:\WINDOWS\INF\fxsocm.inf
~ Scan Active Setup in 00mn 00s

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys
O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS\system32\DRIVERS\cdrom.sys
O41 - Driver: (ctxusbm) . (.Citrix Systems, Inc. - Citrix USB Filter Driver.) - C:\WINDOWS\system32\DRIVERS\ctxusbm.sys
O41 - Driver: (eeCtrl) . (.Symantec Corporation - Symantec Eraser Control Driver.) - C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
O41 - Driver: (i8042prt) . (.Microsoft Corporation - i8042 Port Driver.) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys
O41 - Driver: (Imapi) . (.Microsoft Corporation - IMAPI Kernel Driver.) - C:\WINDOWS\system32\DRIVERS\imapi.sys
O41 - Driver: (intelppm) . (.Microsoft Corporation - Processor Device Driver.) - C:\WINDOWS\system32\DRIVERS\intelppm.sys
O41 - Driver: (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS\system32\DRIVERS\ipsec.sys
O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Keyboard Class Driver.) - C:\WINDOWS\system32\DRIVERS\kbdclass.sys
O41 - Driver: (kbdhid) . (.Microsoft Corporation - HID Mouse Filter Driver.) - C:\WINDOWS\system32\DRIVERS\kbdhid.sys
O41 - Driver: (Mouclass) . (.Microsoft Corporation - Mouse Class Driver.) - C:\WINDOWS\system32\DRIVERS\mouclass.sys
O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\system32\DRIVERS\netbios.sys
O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\system32\DRIVERS\netbt.sys
O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS\system32\DRIVERS\rasacd.sys
O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS\system32\DRIVERS\rdbss.sys
O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
O41 - Driver: (redbook) . (.Microsoft Corporation - Redbook Audio Filter Driver.) - C:\WINDOWS\system32\DRIVERS\redbook.sys
O41 - Driver: (Serial) . (.Microsoft Corporation - Serial Device Driver.) - C:\WINDOWS\system32\DRIVERS\serial.sys
O41 - Driver: (SPBBCDrv) . (.Symantec Corporation - SPBBC Driver.) - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
O41 - Driver: (SRTSPX) . (.Symantec Corporation - Symantec AutoProtect.) - C:\WINDOWS\system32\Drivers\SRTSPX.sys
O41 - Driver: (SYMTDI) . (.Symantec Corporation - Network Dispatch Driver.) - C:\WINDOWS\system32\Drivers\SYMTDI.sys
O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS\system32\DRIVERS\tcpip.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS\system32\DRIVERS\termdd.sys
O41 - Driver: (truecrypt) . (.TrueCrypt Foundation - TrueCrypt Driver.) - C:\WINDOWS\system32\drivers\truecrypt.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS\system32\drivers\vga.sys
O41 - Driver: (WmiAcpi) . (.Microsoft Corporation - Windows Management Interface for ACPI.) - C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
O41 - Driver: (WPS) . (.Symantec Corporation - Symantec CMC Firewall WPS.) - C:\WINDOWS\system32\drivers\wpsdrvnt.sys
~ Scan Drivers in 00mn 00s

---\\ Logiciels installés (O42)
O42 - Logiciel: AccelerometerP11 - (.STMicroelectronics.) [HKLM] -- {87434D51-51DB-4109-B68F-A829ECDCF380}
O42 - Logiciel: Adobe Acrobat 8.1.3 Standard - (.Adobe Systems.) [HKLM] -- Adobe Acrobat 8 Standard - English, Français, Deutsch
O42 - Logiciel: Adobe Flash Player 11 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Reader X (10.0.1) - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1033-7B44-AA0000000001}
O42 - Logiciel: Adobe Shockwave Player - (.Adobe Systems Inc..) [HKLM] -- {54E4B63C-D252-454C-BE4F-468F102B331C}
O42 - Logiciel: Age of Empires III - (.Microsoft Game Studios.) [HKLM] -- InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}
O42 - Logiciel: Altiris Application Metering Agent - (.Altiris Inc..) [HKLM] -- {4A702DA1-9E48-4346-8030-26B399CCFA8C}
O42 - Logiciel: Altiris Software Delivery Solution Agent - (.Altiris Inc..) [HKLM] -- {A0A1EB01-A6FD-423A-8480-364055A7C961}
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
O42 - Logiciel: AutoCAD 2007 - English - (.Autodesk.) [HKLM] -- {5783F2D7-5001-0409-0002-0060B0CE6BBA}
O42 - Logiciel: Autodesk DWF Viewer - (.Autodesk, Inc..) [HKLM] -- Autodesk DWF Viewer
O42 - Logiciel: Barre d'outils Bing - (.Microsoft Corporation.) [HKLM] -- {08234a0d-cf39-4dca-99f0-0c5cb496da81}
O42 - Logiciel: Bentley View XM Edition 08.09.03.51 - (.Bentley Systems, Incorporated..) [HKLM] -- {4DDF1489-9335-42C2-A603-0C4E369A785F}
O42 - Logiciel: Bing Bar Platform - (.Microsoft Corporation.) [HKLM] -- {623B8278-8CAD-45C1-B844-58B687C07805}
O42 - Logiciel: Call of Juarez - Bound in Blood - (.Ubisoft.) [HKLM] -- InstallShield_{FEFAF112-4DA8-479C-89E2-7DE25091711A}
O42 - Logiciel: Citrix Online Plug-in (DV) - (.Citrix Systems, Inc..) [HKLM] -- {678094A1-6250-476B-9AFF-4376E48F135C}
O42 - Logiciel: Citrix Online Plug-in (HDX) - (.Citrix Systems, Inc..) [HKLM] -- {FA365307-1963-4D16-BD44-113C8F037AAD}
O42 - Logiciel: Citrix Online Plug-in (Web) - (.Citrix Systems, Inc..) [HKLM] -- {199C20D6-10D3-4210-B361-4760209F56AE}
O42 - Logiciel: Citrix Online Plug-in - Web - (.Citrix Systems, Inc..) [HKLM] -- CitrixOnlinePluginPackWeb
O42 - Logiciel: Citrix online plug-in (USB) - (.Citrix Systems, Inc..) [HKLM] -- {3ECCB578-504E-4F7A-A8B4-CF4F3B939B44}
O42 - Logiciel: Command & Conquer Generals - (.Electronic Arts.) [HKLM] -- InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}
O42 - Logiciel: Compatibility Pack for the 2007 Office system - (.Microsoft Corporation.) [HKLM] -- {90120000-0020-0409-0000-0000000FF1CE}
O42 - Logiciel: DGN to DWG Converter - (.Pas de propriétaire.) [HKLM] -- {A02F2188-4962-4E1A-BB0D-5982774361D7}
O42 - Logiciel: DWG TrueView 2011 - (.Autodesk.) [HKLM] -- DWG TrueView 2011
O42 - Logiciel: Debut Video Capture Software - (.NCH Software.) [HKLM] -- Debut
O42 - Logiciel: Dell ControlVault Host Components Installer - (.Broadcom Corporation.) [HKLM] -- {FFFE5DAD-27EF-40C8-9C13-546224F9A2D3}
O42 - Logiciel: Dell Touchpad - (.ALPS ELECTRIC CO., LTD..) [HKLM] -- {9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}
O42 - Logiciel: FileZilla Client 3.5.0 - (.Pas de propriétaire.) [HKLM] -- FileZilla Client
O42 - Logiciel: GIMP 2.6.11 - (.The GIMP Team.) [HKLM] -- WinGimp-2.0_is1
O42 - Logiciel: Grand Theft Auto Vice City - (.Pas de propriétaire.) [HKCU] -- {4B35F00C-E63D-40DC-9839-DF15A33EAC46}
O42 - Logiciel: HP Officejet Pro 8500 A910 Basic Device Software - (.Hewlett-Packard Co..) [HKLM] -- {3AE5A1B4-D6AE-48D4-A07F-46A806CD53E6}
O42 - Logiciel: HP Officejet Pro 8500 A910 Help - (.Hewlett Packard.) [HKLM] -- {871B2A9D-0F12-44B3-88C1-E0CB10A232E4}
O42 - Logiciel: Heroes of Might & Magic V: Hammers of Fate - (.Pas de propriétaire.) [HKLM] -- {66FF4C48-0083-4E60-8556-B883AB200091}
O42 - Logiciel: Heroes of Might and Magic V - (.Pas de propriétaire.) [HKLM] -- {20071984-5EB1-4881-8EDB-082532ACEC6D}
O42 - Logiciel: Heroes of Might and Magic V - Tribes of the East - (.Pas de propriétaire.) [HKLM] -- {66FF4C48-0083-4E60-8556-B883AB200092}
O42 - Logiciel: High Definition Audio Driver Package - KB835221 - (.Microsoft Corporation.) [HKLM] -- KB835221WXP
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
O42 - Logiciel: Hotfix for Windows XP (KB942288-v3) - (.Microsoft Corporation.) [HKLM] -- KB942288-v3
O42 - Logiciel: Hotfix for Windows XP (KB952287) - (.Microsoft Corporation.) [HKLM] -- KB952287
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5
O42 - Logiciel: Hotfix for Windows XP (KB961118) - (.Microsoft Corporation.) [HKLM] -- KB961118
O42 - Logiciel: Hotfix for Windows XP (KB970653-v3) - (.Microsoft Corporation.) [HKLM] -- KB970653-v3
O42 - Logiciel: I.R.I.S. OCR - (.HP.) [HKLM] -- {CA6BCA2F-EDEB-408F-850B-31404BE16A61}
O42 - Logiciel: IDT Audio - (.IDT.) [HKLM] -- {E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {133742BA-6F46-4D3E-85AF-78631D9AD8B8}
O42 - Logiciel: Intel(R) Management Engine Components - (.Intel Corporation.) [HKLM] -- {65153EA5-8B6E-43B6-857B-C6E4FC25798A}
O42 - Logiciel: Intel(R) Network Connections Drivers - (.Pas de propriétaire.) [HKLM] -- PROSet
O42 - Logiciel: Intergraph SmartPlant License Manager - (.Intergraph.) [HKLM] -- {FAFDB49F-64A4-49DF-A896-017275A2248D}
O42 - Logiciel: Intergraph SmartSketch - (.Intergraph.) [HKLM] -- {C87920C5-B7E9-4329-8176-77CC6CD6B09D}
O42 - Logiciel: J2SE Runtime Environment 5.0 Update 17 - (.Sun Microsystems, Inc..) [HKLM] -- {3248F0A8-6813-11D6-A77B-00B0D0150170}
O42 - Logiciel: Java(TM) 6 Update 31 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216031FF}
O42 - Logiciel: LiveUpdate 3.3 (Symantec Corporation) - (.Symantec Corporation.) [HKLM] -- LiveUpdate
O42 - Logiciel: Lotus Notes 8.5.1 - (.IBM.) [HKLM] -- {836670E9-61EB-4D47-9EF8-CFE936C3FE32}
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B77

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

Bonjour

Voici le lien en question

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20120729_u7m1510u13d5

Merci

ok

1)

relance usbfix
option suppression
poste le rapport stp

........

2)

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.

http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner

Lance le, clique sur SUPPRESSION puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleane.txt

............

3)

Téléchargez MalwareByte's Anti-Malware (que tu pourras garder ensuite)

https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen rapide
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. Rends toi dans l'onglet rapport/log
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller

Si tu as besoin d'aide regarde ces tutoriels :
Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

..................

4)

refais un nouveau rapport ZHPdiag stp

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

Rapport USB fixe

############################## | UsbFix V 7.094 | [Research]

User: x-60889j-coga (Administrator) # FR100WL00858
Updated 20/07/2012 by El Desaparecido
Started at 03:14:33 | 30/07/2012

Website: https://www.sosvirus.net/
Forum: http://forum.eldesaparecido.com
Suspicious file ? : http://eldesaparecido.com/upload.php
Contact: contact@eldesaparecido.com

PC: Dell Inc. (Latitude E6420) (X86-based PC) # Notebook
CPU: Intel Pentium III Xeon processor (2494)
RAM -> [Total : 3317 | Free : 2096]
BIOS: Default System BIOS
BOOT: Normal boot

OS: Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [(!) Disabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [(!) Disabled]

C:\ (%systemdrive%) -> Fixed drive # 233 Gb (174 Mb free - 75%) [FR100WL00858] # NTFS
D:\ -> CD-ROM
E:\ -> Fixed drive # 932 Gb (475 Mb free - 51%) [Film alex] # NTFS
I:\ -> Removable drive # 7 Gb (7 Mb free - 94%) [KINGSTON] # FAT32

################## | Active Processes |

C:\WINDOWS\System32\smss.exe (1184)
C:\WINDOWS\system32\winlogon.exe (1308)
C:\WINDOWS\system32\services.exe (1352)
C:\WINDOWS\system32\lsass.exe (1432)
C:\WINDOWS\system32\svchost.exe (1624)
C:\WINDOWS\System32\svchost.exe (1752)
C:\WINDOWS\system32\svchost.exe (2284)
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (3316)
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (3760)
C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (472)
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (2220)
C:\WINDOWS\system32\spoolsv.exe (484)
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (2592)
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (4020)
C:\WINDOWS\explorer.exe (2940)
C:\Program Files\Mozilla Firefox\firefox.exe (3492)
C:\Program Files\Mozilla Firefox\plugin-container.exe (2584)
C:\WINDOWS\explorer.exe (4016)
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (2824)
C:\WINDOWS\system32\ctfmon.exe (1040)
C:\WINDOWS\system32\msiexec.exe (3264)
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (2784)
C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\mswinext.exe (1276)
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe (1192)
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (3444)
C:\UsbFix\Go.exe (2504)

################## | Files # Infected Folders |

################## | Registry |

################## | Mountpoints2 |

################## | Vaccin |

(!) This computer is not vaccinated!

################## | E.O.F |

rapport malwarebytes j'ai fait la suppression

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Version de la base de données: v2012.07.30.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
x-60889j-coga :: FR100WL00858 [administrateur]

30/07/2012 04:04:26
mbam-log-2012-07-30 (04-04-26).txt

Type d'examen: Examen complet (C:\|E:\|I:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 328468
Temps écoulé: 1 heure(s), 2 minute(s), 57 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 2
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Mis en quarantaine et réparé avec succès
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Mauvais: (1) Bon: (0) -> Mis en quarantaine et réparé avec succès

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)

(fin)

usbfix en option suppression

J'ai refait la même chose en utilisant l'option supprimer.

As tu besoin du rapport?
Pour information le problème n'a lieu que sur mon disque dur et c'est vraiment étrange, cela continue a se propager.

Film (visible)--> film (invisible option encore accessible) --> film (invisible option non accessible) --> dossier inaccessible

oui poste le rapport suppression usbfix stp

Bonjour,

Je suis désolé, je n'ai pas eu le temps de le faire avant.
Cela n'a pas résolu mon soucis.

############################## | UsbFix V 7.094 | [Suppression]

Utilisateur: Pierre (Administrateur) # PIERRE-VAIO
Mis à jour le 20/07/2012 par El Desaparecido
Lancé à 11:42:59 | 01/08/2012

Site Web: https://www.sosvirus.net/
Forum: http://forum.eldesaparecido.com
Fichier suspect ? : http://eldesaparecido.com/upload.php
Contact: contact@eldesaparecido.com

PC: Sony Corporation (SVS1311F3EW) (x64-based PC) # Notebook
CPU: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz (2501)
RAM -> [Total : 3995 | Free : 2735]
BIOS: Default System BIOS
BOOT: Normal boot

OS: Microsoft Windows 7 Édition Familiale Premium (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 448 Go (384 Go libre(s) - 86%) [] # NTFS
D:\ -> CD-ROM
E:\ -> Disque fixe # 932 Go (475 Go libre(s) - 51%) [Film alex] # NTFS

################## | Processus Actif |

C:\Windows\system32\csrss.exe (500)
C:\Windows\system32\wininit.exe (660)
C:\Windows\system32\csrss.exe (684)
C:\Windows\system32\services.exe (728)
C:\Windows\system32\lsass.exe (744)
C:\Windows\system32\lsm.exe (752)
C:\Windows\system32\svchost.exe (856)
C:\Windows\system32\svchost.exe (936)
C:\Windows\System32\svchost.exe (996)
C:\Windows\System32\svchost.exe (164)
C:\Windows\system32\svchost.exe (396)
C:\Windows\system32\svchost.exe (480)
C:\Windows\system32\svchost.exe (800)
C:\Windows\system32\winlogon.exe (1096)
C:\Windows\System32\spoolsv.exe (1232)
C:\Windows\system32\svchost.exe (1276)
C:\Program Files (x86)\Sony\VAIO Boot Manager\ActiveDelayDeviceService.exe (1352)
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1444)
C:\Windows\system32\WLANExt.exe (1532)
C:\Windows\system32\conhost.exe (1548)
C:\Windows\system32\Dwm.exe (1780)
C:\Windows\Explorer.EXE (1820)
C:\Windows\system32\taskhost.exe (1856)
C:\Windows\system32\taskeng.exe (1960)
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (1996)
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (2008)
C:\Windows\System32\rundll32.exe (2016)
C:\Windows\System32\igfxtray.exe (2024)
C:\Windows\System32\hkcmd.exe (1328)
C:\Windows\System32\igfxpers.exe (1644)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (1684)
C:\Windows\system32\DllHost.exe (2216)
C:\Program Files\Microsoft IntelliPoint\ipoint.exe (2264)
C:\Windows\System32\StikyNot.exe (2272)
C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (2520)
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (2600)
C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (2648)
C:\Program Files\Bonjour\mDNSResponder.exe (2672)
C:\Windows\system32\svchost.exe (2692)
C:\Program Files\Intel\WiFi\bin\EvtEng.exe (2752)
C:\Program Files\Intel\iCLS Client\HeciServer.exe (2800)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (2856)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (2876)
c:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe (2976)
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (3040)
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (2164)
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (2144)
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (2372)
C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe (2492)
C:\Program Files (x86)\iTunes\iTunesHelper.exe (2564)
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2092)
C:\Windows\system32\svchost.exe (1184)
C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (3076)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (3124)
C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (3172)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (3224)
C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (3256)
C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (3280)
C:\Windows\SysWOW64\DllHost.exe (3336)
C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (3404)
C:\Windows\SysWOW64\DllHost.exe (3676)
C:\Windows\system32\SearchIndexer.exe (3864)
C:\Windows\system32\wbem\unsecapp.exe (4012)
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (4044)
C:\Windows\system32\wbem\wmiprvse.exe (1608)
C:\Windows\system32\svchost.exe (2540)
C:\Program Files\iPod\bin\iPodService.exe (4152)
C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (4336)
C:\Windows\system32\svchost.exe (4360)
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (4504)
C:\Windows\system32\taskeng.exe (4764)
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (4924)
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (4620)
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (5308)
C:\Program Files\Windows Media Player\wmpnetwk.exe (5252)
C:\Windows\System32\svchost.exe (3564)
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (5968)
C:\Windows\system32\DllHost.exe (5748)
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (3688)
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (5516)
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (3492)
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (5884)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (5020)
C:\Program Files\Sony\VAIO Care\VCPerfService.exe (1524)
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (6048)
C:\Program Files\Sony\VAIO Power Management\SPMService.exe (5164)
C:\Windows\System32\svchost.exe (3472)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (5144)
C:\Program Files\Sony\VAIO Care\VCSystemTray.exe (592)
C:\Program Files (x86)\Skype\Phone\Skype.exe (2684)
C:\Program Files\Sony\VAIO Care\VCService.exe (6980)
C:\Program Files\Sony\VAIO Care\VCAgent.exe (7016)
C:\Windows\System32\vds.exe (5040)
C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (2656)
C:\Program Files\Sony\VAIO Care\VCAdmin.exe (4168)
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (3892)
C:\Windows\splwow64.exe (3596)
C:\Program Files\Sony\VAIO Improvement\vim.exe (5064)
C:\Program Files\Sony\VAIO Improvement\vim.exe (7140)
C:\Program Files\Sony\VAIO Care\listener.exe (5376)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (1116)
C:\UsbFix\Go.exe (8008)
C:\Windows\system32\wbem\wmiprvse.exe (9388)

################## | Processus Stoppés |

Stoppé! C:\Windows\System32\spoolsv.exe (1232)
Stoppé! C:\Program Files (x86)\Sony\VAIO Boot Manager\ActiveDelayDeviceService.exe (1352)
Stoppé! C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1444)
Stoppé! C:\Windows\system32\WLANExt.exe (1532)
Stoppé! C:\Windows\system32\taskhost.exe (1856)
Stoppé! C:\Windows\system32\taskeng.exe (1960)
Stoppé! C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (1996)
Stoppé! C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (2008)
Stoppé! C:\Windows\System32\rundll32.exe (2016)
Stoppé! C:\Windows\System32\igfxtray.exe (2024)
Stoppé! C:\Windows\System32\hkcmd.exe (1328)
Stoppé! C:\Windows\System32\igfxpers.exe (1644)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (1684)
Stoppé! C:\Windows\system32\DllHost.exe (2216)
Stoppé! C:\Program Files\Microsoft IntelliPoint\ipoint.exe (2264)
Stoppé! C:\Windows\System32\StikyNot.exe (2272)
Stoppé! C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (2520)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (2600)
Stoppé! C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (2648)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (2672)
Stoppé! C:\Program Files\Intel\WiFi\bin\EvtEng.exe (2752)
Stoppé! C:\Program Files\Intel\iCLS Client\HeciServer.exe (2800)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (2856)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (2876)
Stoppé! c:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe (2976)
Stoppé! C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (3040)
Stoppé! C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (2164)
Stoppé! C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (2144)
Stoppé! C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (2372)
Stoppé! C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe (2492)
Stoppé! C:\Program Files (x86)\iTunes\iTunesHelper.exe (2564)
Stoppé! C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2092)
Stoppé! C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (3076)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (3124)
Stoppé! C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (3172)
Stoppé! C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (3256)
Stoppé! C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (3280)
Stoppé! C:\Windows\SysWOW64\DllHost.exe (3336)
Stoppé! C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (3404)
Stoppé! C:\Windows\SysWOW64\DllHost.exe (3676)
Stoppé! C:\Windows\system32\SearchIndexer.exe (3864)
Stoppé! C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (4044)
Stoppé! C:\Program Files\iPod\bin\iPodService.exe (4152)
Stoppé! C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (4336)
Stoppé! C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (4504)
Stoppé! C:\Windows\system32\taskeng.exe (4764)
Stoppé! C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (4924)
Stoppé! C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (4620)
Stoppé! C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (5308)
Stoppé! C:\Program Files\Windows Media Player\wmpnetwk.exe (5252)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (5968)
Stoppé! C:\Windows\system32\DllHost.exe (5748)
Stoppé! C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (3688)
Stoppé! C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (5516)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (3492)
Stoppé! C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (5884)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (5020)
Stoppé! C:\Program Files\Sony\VAIO Care\VCPerfService.exe (1524)
Stoppé! C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (6048)
Stoppé! C:\Program Files\Sony\VAIO Power Management\SPMService.exe (5164)
Stoppé! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (5144)
Stoppé! C:\Program Files\Sony\VAIO Care\VCSystemTray.exe (592)
Stoppé! C:\Program Files (x86)\Skype\Phone\Skype.exe (2684)
Stoppé! C:\Program Files\Sony\VAIO Care\VCService.exe (6980)
Stoppé! C:\Program Files\Sony\VAIO Care\VCAgent.exe (7016)
Stoppé! C:\Windows\System32\vds.exe (5040)
Stoppé! C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (2656)
Stoppé! C:\Program Files\Sony\VAIO Care\VCAdmin.exe (4168)
Stoppé! C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (3892)
Stoppé! C:\Windows\splwow64.exe (3596)
Stoppé! C:\Program Files\Sony\VAIO Improvement\vim.exe (5064)
Stoppé! C:\Program Files\Sony\VAIO Improvement\vim.exe (7140)
Stoppé! C:\Program Files\Sony\VAIO Care\listener.exe (5376)
Stoppé! C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (1116)

################## | Éléments infectieux |

Supprimé! C:\$RECYCLE.BIN\S-1-5-18
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-2273674645-769039312-4234110202-1000
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-2786137233-3513023083-2695230655-500
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-499726291-2252633572-1205762663-500
Supprimé! E:\Recycler\S-1-5-21-2506323827-2712427676-921043147-1076

(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKCU\Software\{B2CB09FF-2453-4f85-9F40-21C05BE4CBA8}

################## | Mountpoints2 |

################## | Listing |

[01/08/2012 - 11:43:50 | SHD ] C:\$Recycle.Bin
[22/04/2012 - 07:13:41 | D ] C:\Documentation
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[01/08/2012 - 07:52:51 | ASH | 3142012928] C:\hiberfil.sys
[22/04/2012 - 06:52:20 | D ] C:\Intel
[12/07/2012 - 00:12:00 | RHD ] C:\MSOCache
[01/08/2012 - 07:52:53 | ASH | 4189351936] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[24/07/2012 - 19:54:52 | D ] C:\Program Files
[30/07/2012 - 08:33:27 | D ] C:\Program Files (x86)
[25/07/2012 - 15:39:06 | HD ] C:\ProgramData
[22/04/2012 - 06:50:48 | N | 2587] C:\RHDSetup.log
[31/07/2012 - 08:10:59 | SHD ] C:\System Volume Information
[22/04/2012 - 07:16:42 | D ] C:\temp
[01/08/2012 - 11:43:50 | D ] C:\UsbFix
[01/08/2012 - 11:43:10 | A | 13300] C:\UsbFix.txt
[11/07/2012 - 22:48:14 | D ] C:\Users
[22/04/2012 - 07:36:55 | D ] C:\VAIO Sample Contents
[13/07/2012 - 12:32:00 | D ] C:\Windows
[01/08/2012 - 11:43:50 | SHD ] E:\$RECYCLE.BIN
[20/07/2012 - 15:28:29 | D ] E:\a trier
[19/06/2012 - 17:06:26 | D ] E:\manga (serie)
[30/07/2012 - 03:34:42 | D ] E:\ok
[31/07/2012 - 12:35:31 | SHD ] E:\RECYCLER
[02/04/2012 - 02:10:36 | SHD ] E:\System Volume Information
[19/06/2012 - 17:06:05 | D ] E:\série TV
[27/07/2012 - 19:58:00 | N | 1270976] E:\UsbFix.exe

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | Upload |

Veuillez envoyer le fichier: C:\UsbFix_Upload_Me_PIERRE-VAIO.zip
http://eldesaparecido.com/upload.php
Merci de votre contribution.

################## | E.O.F |

Attention, avant de commencer, lit attentivement la procédure, et imprime la

Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Télécharge ComboFix de sUBs que tu renommes ton prénom.exe sur ton Bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et <gras>DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\

---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt