Etude du RAPPORT Blue Screen View SVP... - Page 2

Est ce que c'est bon comme ça? (encore désolé!)

ComboFix 13-02-15.01 - HP_Propriétaire 15/02/2013 19:55:07.3.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1527.954 [GMT 1:00]
Lancé depuis: c:\documents and settings\HP_Propriétaire\Mes documents\Downloads\Cosmocat.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2013-01-15 au 2013-02-15 ))))))))))))))))))))))))))))))))))))
.
.
2013-02-15 18:01 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F4880A10-F6EB-47FB-AE36-B2AF7E992820}\mpengine.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2013-02-14 23:36 . 2013-02-14 23:37 -------- d-----w- c:\program files\QuickTime
2013-02-14 23:35 . 2013-02-14 23:35 -------- d-----w- c:\program files\Fichiers communs\Apple
2013-02-14 23:35 . 2013-02-14 23:35 -------- d-----w- c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\Apple
2013-02-14 23:34 . 2013-02-14 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2013-02-14 02:32 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-10 01:24 . 2013-02-12 11:47 -------- d-----w- c:\documents and settings\HP_Propriétaire\Application Data\uTorrent
2013-02-09 17:40 . 2013-02-12 11:48 -------- d-----w- C:\Pre_Scan
2013-02-05 15:45 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2013-02-05 15:45 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\dllcache\mouhid.sys
2013-02-05 15:45 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2013-02-05 15:45 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\dllcache\hidusb.sys
2013-02-05 15:43 . 2013-02-05 15:43 -------- d-----w- c:\windows\system32\wbem\Repository
2013-01-23 15:28 . 2013-01-23 15:28 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-07 22:10 . 2012-12-12 00:38 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-07 22:10 . 2012-12-12 00:38 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-30 10:53 . 2012-12-12 00:47 232336 ------w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2004-08-05 18:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-11 10:39 . 2013-01-04 22:47 88576 ----a-w- c:\windows\system32\pdfcmon.dll
2013-01-09 13:52 . 2005-01-02 22:13 1070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2013-01-07 07:24 . 2004-08-05 18:00 2071808 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-07 07:24 . 2004-08-05 18:00 2195072 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 10:09 . 2004-08-05 18:00 1867392 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2004-08-05 18:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2013-01-02 06:49 . 2004-08-05 18:00 1298432 ----a-w- c:\windows\system32\quartz.dll
2012-12-26 20:06 . 2004-08-05 18:00 916480 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:06 . 2004-08-05 18:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-12-26 20:06 . 2004-08-05 18:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-12-25 18:25 . 2007-03-22 19:27 47360 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\pcouffin.sys
2012-12-24 06:41 . 2004-08-05 18:00 385024 ------w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2004-08-05 18:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-12-11 22:31 . 2012-12-11 22:31 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-17 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-08 77824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-08 94208]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=c:\windows\pss\Logiciel Kodak EasyShare.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^MediaServerTray.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\MediaServerTray.lnk
backup=c:\windows\pss\MediaServerTray.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NETGEAR WG111v2 Smart Wizard.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\NETGEAR WG111v2 Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2005-02-02 15:44 61440 ----a-w- c:\hp\KBD\kbd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2007-10-18 10:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 13:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
2005-01-07 23:07 61952 ----a-w- c:\windows\system32\HdAShCut.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2004-04-14 20:43 233472 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-12-22 23:24 7880664 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-12-22 23:24 1199576 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-03-17 18:46 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\HP_Propriétaire\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\media center Bouygues Telecom\\MediaServer.exe"=
"c:\\Documents and Settings\\HP_Propriétaire\\Application Data\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9070:TCP"= 9070:TCP:*:Disabled:BitComet 9070 TCP
"9070:UDP"= 9070:UDP:*:Disabled:BitComet 9070 UDP
.
R2 BytelMediaServer;media center Bouygues Telecom;c:\program files\media center Bouygues Telecom\MediaServer.exe [06/05/2012 11:19 1593128]
S3 M1000Srv;Trek 320R Driver;c:\windows\system32\drivers\M1000KNT.sys [07/12/2006 20:16 276926]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [23/01/2013 16:28 40776]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [22/03/2007 20:27 47360]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [25/12/2012 19:07 194304]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [24/10/2006 22:56 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [24/09/2006 01:19 85696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-31 14:01 1607120 ----a-w- c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Contenu du dossier 'Tâches planifiées'
.
2013-02-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-12 22:10]
.
2013-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2013-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-12 00:55]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-12 00:55]
.
2013-02-14 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 16:25]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
TCP: DhcpNameServer = 192.168.1.254
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-15 20:01
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(3212)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2013-02-15 20:03:53
ComboFix-quarantined-files.txt 2013-02-15 19:03
ComboFix2.txt 2013-02-15 17:57
ComboFix3.txt 2012-12-25 23:14
.
Avant-CF: 113 385 844 736 octets libres
Après-CF: 113 370 628 096 octets libres
.
- - End Of File - - 4DBB4944A853A2BF7FD759FBF852C35F

je comprends pas....refais un diag avec pre_scan ?

Voici le lien=> http://cjoint.com/?CBpxqvhd3IZ

re


__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
KillAll::

ClearJavaCache::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]


------------------------------------------------------------------

▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes

▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix comme sur cette : illustration

▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

RE-salut!

Voila le rapport demandé:

ComboFix 13-02-15.01 - HP_Propriétaire 16/02/2013 16:34:48.4.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1527.992 [GMT 1:00]
Lancé depuis: c:\documents and settings\HP_Propriétaire\Bureau\Cosmocat.exe
Commutateurs utilisés :: c:\documents and settings\HP_Propriétaire\Bureau\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2013-01-16 au 2013-02-16 ))))))))))))))))))))))))))))))))))))
.
.
2013-02-16 02:32 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C852DD54-6B08-4EF1-B114-BD1F6C654D8A}\mpengine.dll
2013-02-15 19:45 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2013-02-14 23:36 . 2013-02-14 23:37 -------- d-----w- c:\program files\QuickTime
2013-02-14 23:35 . 2013-02-14 23:35 -------- d-----w- c:\program files\Fichiers communs\Apple
2013-02-14 23:35 . 2013-02-14 23:35 -------- d-----w- c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\Apple
2013-02-14 23:34 . 2013-02-14 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2013-02-10 01:24 . 2013-02-12 11:47 -------- d-----w- c:\documents and settings\HP_Propriétaire\Application Data\uTorrent
2013-02-09 17:40 . 2013-02-15 21:59 -------- d-----w- C:\Pre_Scan
2013-02-05 15:45 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2013-02-05 15:45 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\dllcache\mouhid.sys
2013-02-05 15:45 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2013-02-05 15:45 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\dllcache\hidusb.sys
2013-02-05 15:43 . 2013-02-05 15:43 -------- d-----w- c:\windows\system32\wbem\Repository
2013-01-23 15:28 . 2013-01-23 15:28 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-07 22:10 . 2012-12-12 00:38 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-07 22:10 . 2012-12-12 00:38 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-30 10:53 . 2012-12-12 00:47 232336 ------w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2004-08-05 18:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-11 10:39 . 2013-01-04 22:47 88576 ----a-w- c:\windows\system32\pdfcmon.dll
2013-01-09 13:52 . 2005-01-02 22:13 1070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2013-01-07 07:24 . 2004-08-05 18:00 2071808 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-07 07:24 . 2004-08-05 18:00 2195072 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 10:09 . 2004-08-05 18:00 1867392 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2004-08-05 18:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2013-01-02 06:49 . 2004-08-05 18:00 1298432 ----a-w- c:\windows\system32\quartz.dll
2012-12-26 20:06 . 2004-08-05 18:00 916480 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:06 . 2004-08-05 18:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-12-26 20:06 . 2004-08-05 18:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-12-25 18:25 . 2007-03-22 19:27 47360 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\pcouffin.sys
2012-12-24 06:41 . 2004-08-05 18:00 385024 ------w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2004-08-05 18:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-12-11 22:31 . 2012-12-11 22:31 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-17 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-08 77824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-08 94208]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=c:\windows\pss\Logiciel Kodak EasyShare.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^MediaServerTray.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\MediaServerTray.lnk
backup=c:\windows\pss\MediaServerTray.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NETGEAR WG111v2 Smart Wizard.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\NETGEAR WG111v2 Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2005-02-02 15:44 61440 ----a-w- c:\hp\KBD\kbd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2007-10-18 10:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 13:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
2005-01-07 23:07 61952 ----a-w- c:\windows\system32\HdAShCut.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2004-04-14 20:43 233472 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-12-22 23:24 7880664 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-12-22 23:24 1199576 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-03-17 18:46 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\HP_Propriétaire\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\media center Bouygues Telecom\\MediaServer.exe"=
"c:\\Documents and Settings\\HP_Propriétaire\\Application Data\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9070:TCP"= 9070:TCP:*:Disabled:BitComet 9070 TCP
"9070:UDP"= 9070:UDP:*:Disabled:BitComet 9070 UDP
.
R2 BytelMediaServer;media center Bouygues Telecom;c:\program files\media center Bouygues Telecom\MediaServer.exe [06/05/2012 11:19 1593128]
S3 M1000Srv;Trek 320R Driver;c:\windows\system32\drivers\M1000KNT.sys [07/12/2006 20:16 276926]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [23/01/2013 16:28 40776]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [22/03/2007 20:27 47360]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [25/12/2012 19:07 194304]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [24/10/2006 22:56 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [24/09/2006 01:19 85696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-31 14:01 1607120 ----a-w- c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Contenu du dossier 'Tâches planifiées'
.
2013-02-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-12 22:10]
.
2013-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-12 00:55]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-12 00:55]
.
2013-02-14 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 16:25]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
TCP: DhcpNameServer = 192.168.1.254
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-16 16:44
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(900)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2013-02-16 16:49:28 - La machine a redémarré
ComboFix-quarantined-files.txt 2013-02-16 15:49
ComboFix2.txt 2013-02-15 19:03
ComboFix3.txt 2013-02-15 17:57
ComboFix4.txt 2012-12-25 23:14
.
Avant-CF: 113 232 465 920 octets libres
Après-CF: 113 237 577 728 octets libres
.
- - End Of File - - 4631E2A595B33D0992E18B47AD3B0D00

sélectionne ce texte , puis CTRL + C

Kill::

Key::
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}]
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}]
[HKU\S-1-5-21-3356692217-1419506053-1123339469-1008\Software\Regs Funk Bin]
[HKLM\Software\SP Global]
[HKLM\Software\SProtector]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[9070:TCP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[9070:UDP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[1900:UDP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[2869:TCP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[139:TCP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[445:TCP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[137:UDP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]|[138:UDP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]|[139:TCP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]|[445:TCP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]|[137:UDP]
[HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]|[138:UDP]
[HKCR\AppId\NCTAudioCompress3.DLL]
[HKCR\AppId\NCTAudioFormatSettings3.DLL]

txt::
C:\WINDOWS\system32\98NT.bat
C:\WINDOWS\system32\Log.txt

File|Fold::
C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\nxz63rmf.default\extensions\50e75c7d0c060@50e75c7d0c099.com
C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\nxz63rmf.default\extensions\50f5600df2881@50f5600df28ba.com
C:\bbab0e51334927b190e97162
C:\bf041d901deedbc8271b522c181d1f0c
C:\WINDOWS\B6D5E63DEFF546169DB706D08F10B0C0.TMP
C:\WINDOWS\*.gif
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Spyware Doctor
C:\Documents and Settings\HP_Propriétaire\Application Data\pdfforge
C:\Documents and Settings\All Users\Application Data\SaveByclick
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Kiwee Toolbar2

Driver::
59548876
ASWMON2
ASWRDR
ASWTDI
Avg7Alrt
AVG7CORE
AVG7RSW
AVG7RSXP
AVG7UPDSVC
AVGASCLN
AVGCLEAN
AVGEMS
AVGLDX86
AVGTDI
AVGTDIX
AVG_ANTI-SPYWARE_DRIVER
SYMDNS
SYMEVENT>
SYMIDS
SYMIDSCO
SYMNDIS
SYMREDRV
SYMTDI

Clean::

MBR::

Reboot::

Relance Pre_scan puis choisis l'option "Script"

une page va s'ouvrir

logiquement le texte que tu as sélectionné s'y trouve déjà , donc tu fermes et le programme va travailler.

sinon colle-le (clic droit/coller ou ctrl+V) dans la page vierge.

puis onglet fichier => enregistrer (pas enregistrer sous...) , puis ferme le texte

des fenetres noires risquent de clignoter , c'est normal , c'est le programme qui travaille

poste Pre_Script.txt qui apparaitra sur le bureau en fin de travail

Voilà le rapport=>

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 3.0207 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

HP_Propriétaire : Microsoft Windows XP (32 bits)

Switchs : https://gen-hackman.kanak.fr/

New restorepoint created

Script : 19:47:05

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ | Stopped Processes

(1968) -- MediaServer.exe
(2284) -- explorer.exe
(1724) -- MsMpEng.exe
(3924) -- wuauclt.exe
(2868) -- OSE.EXE
(3944) -- msseces.exe
(3804) -- wscntfy.exe

¤¤¤¤¤¤¤¤¤¤ | Deletion | Drivers | Services

Service : 59548876 Not actif
Service : ASWMON2 Not actif
Service : ASWRDR Not actif
Service : ASWTDI Not actif
Service : Avg7Alrt Not actif
Service : AVG7CORE Not actif
Service : AVG7RSW Not actif
Service : AVG7RSXP Not actif
Service : AVG7UPDSVC Not actif
Service : AVGASCLN Not actif
Service : AVGCLEAN Not actif
Service : AVGEMS Not actif
Service : AVGLDX86 Not actif
Service : AVGTDI Not actif
Service : AVGTDIX Not actif
Service : AVG_ANTI-SPYWARE_DRIVER Not actif
Service : SYMDNS Not actif
Service : SYMEVENT> Not actif
Service : SYMIDS Not actif
Service : SYMIDSCO Not actif
Service : SYMNDIS Not actif
Service : SYMREDRV Not actif
Service : SYMTDI Not actif

¤

¤¤¤¤¤¤¤¤¤¤ | Registry Deletions

Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}
Key Deleted : HKU\S-1-5-21-3356692217-1419506053-1123339469-1008\Software\Regs Funk Bin
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:9070:TCP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:9070:UDP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:1900:UDP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:2869:TCP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:139:TCP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:445:TCP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:137:UDP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]:138:UDP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]:139:TCP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]:445:TCP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]:137:UDP
Value Deleted : [HKLM\System\CurrentControlSet\services\sharedaccess\parameters\firewallpolicy\domainprofile\GloballyOpenPorts\List]:138:UDP
Key Deleted : HKCR\AppId\NCTAudioCompress3.DLL
Key Deleted : HKCR\AppId\NCTAudioFormatSettings3.DLL

¤

C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\nxz63rmf.default\extensions\50e75c7d0c060@50e75c7d0c099.com : Not Found !
C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\nxz63rmf.default\extensions\50f5600df2881@50f5600df28ba.com : Not Found !
C:\bbab0e51334927b190e97162 : Not Found !
C:\bf041d901deedbc8271b522c181d1f0c : Not Found !
C:\WINDOWS\B6D5E63DEFF546169DB706D08F10B0C0.TMP : Not Found !
C:\WINDOWS\*.gif : Not Found !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Spyware Doctor : Not Found !
C:\Documents and Settings\HP_Propriétaire\Application Data\pdfforge : Not Found !
C:\Documents and Settings\All Users\Application Data\SaveByclick : Not Found !
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Kiwee Toolbar2 : Not Found !

¤¤¤¤¤¤¤¤¤¤ | Edition : C:\WINDOWS\system32\98NT.bat

@echo off
echo Registering RM-X Player...
MMREGOCX.EXE MMToolsX2.ocx MMTypesX2.ocx
echo Finished Registering Filters...
¤¤¤¤¤¤¤¤¤¤ | Edition : C:\WINDOWS\system32\Log.txt

[Fri Dec 28 03:17:48 2012]
Tag install requested...
Get Mac User address...
Sending ARP request for IP address: 192.168.1.10

00-13-D3-DD-A4-1D
Mac User address (encrypted) = AA-BE-4E-44-09-B4

Send Tag Install ...
SendRequest https://serverside280.tagcommander.com/3/?s=495684&s2=100&p=instDesinst::installation&macSTB=NotDefined&macUser=AA-BE-4E-44-09-B4 returned -20800

Send Tag Install failed

¤

¤¤¤¤¤¤¤¤¤¤ | MBR

Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000007fc

Analysis of file "C:\Pre_Scan\MBR.bin":
Legit MBR code detected

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3160023AS rev.3.43 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS
1 ntkrnlpa!IofCallDriver[0x804EE190] -> \Device\Harddisk0\DR0[0x8A33CAB8]
3 CLASSPNP[0xBA108FD7] -> ntkrnlpa!IofCallDriver[0x804EE190] -> \Device\00000063[0x8A396D38]
5 ACPI[0xB9F7E620] -> ntkrnlpa!IofCallDriver[0x804EE190] -> \Device\Ide\IdeDeviceP0T0L0-4[0x8A2F2D98]
kernel: MBR read successfully
_asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x5c; }
user & kernel MBR OK

¤

¤¤¤¤¤¤¤¤¤¤ | Disk cleaning

Disk cleaned

¤

End : 19:48:55

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\

Desactive tes protections : https://forum.pcastuces.com/default.asp

clique droit sur ce lien : Combofix =>enregistrer la cible sous....=> sur ton bureau => du nom que tu veux

Avant d'utiliser ComboFix :

Utilise Defogger pour désactiver temporairement les logiciels d'emulation :

▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau

▶ Lance le : clique sur "Disable" et fais redémarrer l'ordinateur si l'outil te le demande

Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur combofix renommé

¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

▶▶▶ Si, après le redémarrage de votre pc par combofix, vous avez des erreurs "Clé marquée pour suppression" ou des soucis de connexion internet, redémarrez à nouveau votre ordinateur

Re!!

Voici le rapport combofix=>

ComboFix 13-02-15.01 - HP_Propriétaire 16/02/2013 22:40:51.5.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1527.1083 [GMT 1:00]
Lancé depuis: c:\documents and settings\HP_Propriétaire\Bureau\Cosmocat.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2013-01-16 au 2013-02-16 ))))))))))))))))))))))))))))))))))))
.
.
2013-02-16 18:51 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{38784FB3-588A-4BF4-A5FB-E42D8B9DDD12}\mpengine.dll
2013-02-15 19:45 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2013-02-14 23:37 . 2013-02-14 23:37 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2013-02-14 23:36 . 2013-02-14 23:37 -------- d-----w- c:\program files\QuickTime
2013-02-14 23:35 . 2013-02-14 23:35 -------- d-----w- c:\program files\Fichiers communs\Apple
2013-02-14 23:35 . 2013-02-14 23:35 -------- d-----w- c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\Apple
2013-02-14 23:34 . 2013-02-14 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2013-02-10 01:24 . 2013-02-12 11:47 -------- d-----w- c:\documents and settings\HP_Propriétaire\Application Data\uTorrent
2013-02-09 17:40 . 2013-02-16 18:48 -------- d-----w- C:\Pre_Scan
2013-02-05 15:45 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2013-02-05 15:45 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\dllcache\mouhid.sys
2013-02-05 15:45 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2013-02-05 15:45 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\dllcache\hidusb.sys
2013-02-05 15:43 . 2013-02-05 15:43 -------- d-----w- c:\windows\system32\wbem\Repository
2013-01-23 15:28 . 2013-01-23 15:28 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-07 22:10 . 2012-12-12 00:38 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-07 22:10 . 2012-12-12 00:38 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-30 10:53 . 2012-12-12 00:47 232336 ------w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2004-08-05 18:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-11 10:39 . 2013-01-04 22:47 88576 ----a-w- c:\windows\system32\pdfcmon.dll
2013-01-09 13:52 . 2005-01-02 22:13 1070152 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2013-01-07 07:24 . 2004-08-05 18:00 2071808 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-07 07:24 . 2004-08-05 18:00 2195072 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 10:09 . 2004-08-05 18:00 1867392 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2004-08-05 18:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2013-01-02 06:49 . 2004-08-05 18:00 1298432 ----a-w- c:\windows\system32\quartz.dll
2012-12-26 20:06 . 2004-08-05 18:00 916480 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:06 . 2004-08-05 18:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-12-26 20:06 . 2004-08-05 18:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-12-25 18:25 . 2007-03-22 19:27 47360 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\pcouffin.sys
2012-12-24 06:41 . 2004-08-05 18:00 385024 ------w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2004-08-05 18:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-12-11 22:31 . 2012-12-11 22:31 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-17 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-08 77824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-08 94208]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"APSDaemon"="c:\program files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Kodak software updater.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Kodak software updater.lnk
backup=c:\windows\pss\Kodak software updater.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logiciel Kodak EasyShare.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk
backup=c:\windows\pss\Logiciel Kodak EasyShare.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^MediaServerTray.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\MediaServerTray.lnk
backup=c:\windows\pss\MediaServerTray.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^NETGEAR WG111v2 Smart Wizard.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\NETGEAR WG111v2 Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2005-02-02 15:44 61440 ----a-w- c:\hp\KBD\kbd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2007-10-18 10:34 5724184 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 13:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
2005-01-07 23:07 61952 ----a-w- c:\windows\system32\HdAShCut.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2004-04-14 20:43 233472 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-12-22 23:24 7880664 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-12-22 23:24 1199576 ----a-w- c:\documents and settings\HP_Propriétaire\Application Data\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-03-17 18:46 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\HP_Propriétaire\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\media center Bouygues Telecom\\MediaServer.exe"=
"c:\\Documents and Settings\\HP_Propriétaire\\Application Data\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Fichiers communs\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9070:TCP"= 9070:TCP:*:Disabled:BitComet 9070 TCP
"9070:UDP"= 9070:UDP:*:Disabled:BitComet 9070 UDP
.
R2 BytelMediaServer;media center Bouygues Telecom;c:\program files\media center Bouygues Telecom\MediaServer.exe [06/05/2012 11:19 1593128]
S3 M1000Srv;Trek 320R Driver;c:\windows\system32\drivers\M1000KNT.sys [07/12/2006 20:16 276926]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [23/01/2013 16:28 40776]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [22/03/2007 20:27 47360]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [25/12/2012 19:07 194304]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [24/10/2006 22:56 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [24/09/2006 01:19 85696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-31 14:01 1607120 ----a-w- c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Contenu du dossier 'Tâches planifiées'
.
2013-02-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-12 22:10]
.
2013-02-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2013-02-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 16:34]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-12 00:55]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-12 00:55]
.
2013-02-16 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 16:25]
.
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
TCP: DhcpNameServer = 192.168.1.254
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-16 22:48
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'explorer.exe'(2532)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2013-02-16 22:50:42
ComboFix-quarantined-files.txt 2013-02-16 21:50
ComboFix2.txt 2013-02-16 15:49
ComboFix3.txt 2013-02-15 19:03
ComboFix4.txt 2013-02-15 17:57
ComboFix5.txt 2013-02-16 21:39
.
Avant-CF: 113 178 075 136 octets libres
Après-CF: 113 170 575 360 octets libres
.
- - End Of File - - D0B9FCEBA2D000D82C05B1DFA1F957B5

re

oué ben je comprends pas pourquoi ils sautent pas ces services orphelins....

Télécharge ici :OTL

▶ enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.

▶ => Clique ici pour voir la Configuration

▶ Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"

/md5start
explorer.exe
winlogon.exe
wininit.exe
volsnap.sys
atapi.sys
ndisuio.sys
ndis.sys
cdrom.sys
i8042prt.sys
iastor.sys
net.exe
tdx.sys
netbt.sys
afd.sys
net1.exe
Rundll32.exe
/md5stop
netsvcs
safebootminimal
safebootnetwork
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\*.ini
%systemroot%\Tasks\*.*
%systemroot%\system32\Tasks\*.*
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\config\*.exe /s
%systemroot%\system32\*.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
CREATERESTOREPOINT

▶ Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\<Bureau ou Desktop>\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM (il est trop long)

heberge OTL.txt et extra.txt sur https://www.cjoint.com/ et donne les liens

Voilà les rapports===>

http://cjoint.com/?CBsoyd9Kdyz

http://cjoint.com/?CBsozkBMS8T

re

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.order.1,S: S", ""
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
SafeBootMin: sdauxservice - Reg Error: Value error.
SafeBootMin: sdcoreservice - Reg Error: Value error.
SafeBootNet: sdauxservice - Reg Error: Value error.
SafeBootNet: sdcoreservice - Reg Error: Value error.
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Files
C:\f7d33d74f4ce8891b482342864ffb862
C:\Documents and Settings\All Users\Application Data\32drivewebblah

:commands
[CLEARALLRESTOREPOINTS]
[emptytemp]
[start explorer]
[reboot]

▶ Clique sur "Correction" pour lancer la suppression.

▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

Hello!

Voici le rapport:

ll processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E : value set successfully!
Prefs.js: "" removed from browser.search.defaultenginename
Prefs.js: S", "" removed from browser.search.defaultenginename,S
Prefs.js: "" removed from browser.search.defaultthis.engineName
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "" removed from browser.search.order.1
Prefs.js: S", "" removed from browser.search.order.1,S
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sdauxservice\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sdcoreservice\ deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== FILES ==========
File\Folder C:\f7d33d74f4ce8891b482342864ffb862 not found.
C:\Documents and Settings\All Users\Application Data\32drivewebblah folder moved successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 18150 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: HP_Propriétaire
->Temp folder emptied: 1033657 bytes
->Temporary Internet Files folder emptied: 10355103 bytes
->FireFox cache emptied: 152909799 bytes
->Google Chrome cache emptied: 31371812 bytes
->Flash cache emptied: 2585 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 348 bytes

User: NetworkService
->Temp folder emptied: 39124 bytes
->Temporary Internet Files folder emptied: 739615 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5102117 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 192,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 02192013_162948

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\TMP000000012F68AA5F9CC295E9 not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

________________________________________________________

A noter que ce matin j'ai eu un ecran bleu avec le code erreur: IRQL_NOT_LESS_EQUAL...

depuis les dernieres manip, mon PC s'arrete quand je demarre chrome, et affiche l'ecran bleu ( plusieurs messages d'erreur: soit le probleme semble etre causé par le fichier ialmrnt5,
soit win3k.sys - address BF8A7758 base at BF800000
Soit IRQL-NOT-LESS-EQUAL...

Sauf maintenant où j'ai pu poster ce comm..

faudrait controler tes batettes de RAM

https://www.commentcamarche.net/informatique/composants/25371-tester-des-composants-de-pc-les-meilleurs-outils-gratuits/