infection système care antivirus Résolu/Fermé

Question

Bonsoir, Bonjour, Voici mon problème, j'ai été infecté par un logiciel Système Care Antivirus et il bloque plusieurs programmes (firefoxe, avira etc ), j'ai scanné avace Roguekiller et voici le rapport, que dois-je faire maintenant , merci de vos réponses, je suis sous XP sp3 au cas où RogueKiller V8.5.4 [Mar 18 2013] par Tigzy mail : tigzyRKgmailcom Remontees : https://www.luanagames.com/index.fr.html Site Web : https://www.luanagames.com/index.fr.html Blog : http://tigzyrk.blogspot.com/ Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version Demarrage : Mode sans echec avec prise en charge reseau Utilisateur : lefebvre [Droits d'admin] Mode : Suppression -- Date : 06/05/2013 20:15:55 | ARK || FAK || MBR | ¤¤¤ Processus malicieux : 0 ¤¤¤ ¤¤¤ Entrees de registre : 1 ¤¤¤ [RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : 1847F94E34900BC800001847E10B1085 (C:\Documents and Settings\All Users\Application Data\1847F94E34900BC800001847E10B1085\1847F94E34900BC800001847E10B1085.exe) [-] -> SUPPRIMÉ ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver : [NON CHARGE] ¤¤¤ ¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ --> C:\WINDOWS\system32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Verif: ¤¤¤ +++++ PhysicalDrive0: ST3160813AS +++++ --- User --- [MBR] 92cc5c4f165d1a20fe648639ff3639c3 [BSP] 28ec9b8ada66d204f3f526e88c717d2a : Windows XP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152617 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: WDC WD6400AAKS-00A7B0 +++++ --- User --- [MBR] 7f46aa79fbeed298be756b114a84382d [BSP] f49dc970749b74b693c594bfe1137808 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 70001 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 143364060 | Size: 300002 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 757769985 | Size: 240472 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive2: ST3320620AS +++++ --- User --- [MBR] e8707090aca5ff21cfe8181d125b5396 [BSP] 2fa35e4753b022ede9414bae7e534b89 : Windows XP MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 131059 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 268410240 | Size: 174182 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive3: ST320DM000-1BC14C +++++ --- User --- [MBR] d5ab47618a776c2803c3b35490472361 [BSP] c8e893ab59810beb9d92f0503ad46ecb : Windows XP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 149997 Mo 1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 307194930 | Size: 155237 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[2]_D_06052013_201555.txt >> RKreport[1]_S_06052013_201505.txt ; RKreport[2]_D_06052013_201555.txt

Malekal_morte- · Answer

Salut,

Télécharge http://general-changelog-team.fr/telechargements/logiciels/viewdownload/75-outils-de-xplode/28-adwcleaner AdwCleaner ( d'Xplode ) sur ton bureau.  
Lance le, clique sur [Suppression] puis patiente le temps du scan (Pas besoin de faire de Recherche avant).  
Une fois le scan fini, un rapport s'ouvrira. Copie/colle le contenu du rapport dans ta prochaine réponse par un copier/coller.
Si cela ne fonctionne pas, utilise le site http://pjjoint.malekal.com pour héberger le rapport, donne le lien du rapport dans un nouveau message.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt  


puis :


Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections - Le programme va générer deux rapports OTL.txt et Extras.txt 
Fournir les deux rapports :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/    

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.    
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)    

Dans le cas d'Avast!, ne pas lancer le programme dans la Sandbox (voir lien d'aide ci-dessus).

* Lance OTL    
* En haut à droite de Analyse rapide, coche "tous les utilisateurs"
* Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :    



netsvcs   
msconfig   
safebootminimal   
safebootnetwork   
activex   
drivers32   
%ALLUSERSPROFILE%\Application Data\*.   
%ALLUSERSPROFILE%\Application Data\*.exe /s   
%APPDATA%\*.   
%APPDATA%\*.exe /s   
%temp%\.exe /s   
%SYSTEMDRIVE%\*.exe   
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles   
%systemroot%\Tasks\*.job /lockedfiles   
%systemroot%\system32\drivers\*.sys /lockedfiles   
%systemroot%\System32\config\*.sav   
/md5start   
explorer.exe   
winlogon.exe   
wininit.exe   
/md5stop
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
CREATERESTOREPOINT   
nslookup www.google.fr /c   
SAVEMBR:0   
hklm\software\clients\startmenuinternet|command /rs   
hklm\software\clients\startmenuinternet|command /64 /rs    



* Clique sur le bouton Analyse.

* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent).
Donne le ou les liens pjjoint qui pointent vers ces rapports ici dans un nouveau message.
Je répète : donne le lien du rapport pjjoint ici dans un nouveau message.

NE PAS COPIER/COLLER LE RAPPORT ICI - DONNER LE LIEN PJJOINT DANS UN NOUVEAU MESSAGE

bibidepourrieres · Answer

Bonsoir,  voici le rapport après scanne

merci de ton aide

cordialment


# AdwCleaner v2.300 - Rapport créé le 06/05/2013 à 20:28:03
# Mis à jour le 28/04/2013 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : lefebvre - BIBI
# Mode de démarrage : Mode sans échec avec prise en charge réseau
# Exécuté depuis : C:\Documents and Settings\lefebvre\Bureau\adwcleaner.exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****

Dossier Supprimé : C:\DOCUME~1\lefebvre\LOCALS~1\Temp\CT3281675
Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\Tarma Installer
Dossier Supprimé : C:\Documents and Settings\lefebvre\Application Data\Mozilla\Firefox\Profiles\l2h2rs4v.default\CT3281675
Dossier Supprimé : C:\Documents and Settings\lefebvre\Application Data\Mozilla\Firefox\Profiles\l2h2rs4v.default\extensions\{e44a1809-4d10-4ab8-b343-3326b64c7cdd}
Dossier Supprimé : C:\Documents and Settings\lefebvre\Application Data\Mozilla\Firefox\Profiles\l2h2rs4v.default\Smartbar
Dossier Supprimé : C:\Documents and Settings\lefebvre\Application Data\OpenCandy
Dossier Supprimé : C:\Documents and Settings\lefebvre\Application Data\pdfforge
Fichier Supprimé : C:\Documents and Settings\lefebvre\Application Data\Mozilla\Firefox\Profiles\l2h2rs4v.default\searchplugins\Conduit.xml
Fichier Supprimé : C:\END

***** [Registre] *****

Clé Supprimée : HKCU\Software\Conduit
Clé Supprimée : HKCU\Software\SmartBar
Clé Supprimée : HKCU\Software\StartSearch
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Clé Supprimée : HKLM\Software\Tarma Installer

***** [Navigateurs] *****

-\ Internet Explorer v8.0.6001.18702

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v20.0.1 (fr)

Fichier : C:\Documents and Settings\lefebvre\Application Data\Mozilla\Firefox\Profiles\l2h2rs4v.default\prefs.js

Supprimée : user_pref("CT3281675.1000082.isPlayDisplay", "true");
Supprimée : user_pref("CT3281675.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Supprimée : user_pref("CT3281675.1000234.TWC_TMP_city", "MONTPELLIER");
Supprimée : user_pref("CT3281675.1000234.TWC_TMP_country", "FR");
Supprimée : user_pref("CT3281675.1000234.TWC_country", "FRANCE");
Supprimée : user_pref("CT3281675.1000234.TWC_locId", "FRXX0068");
Supprimée : user_pref("CT3281675.1000234.TWC_location", "Montpellier, France");
Supprimée : user_pref("CT3281675.1000234.TWC_region", "FR");
Supprimée : user_pref("CT3281675.1000234.TWC_temp_dis", "c");
Supprimée : user_pref("CT3281675.1000234.TWC_wind_dis", "kmh");
Supprimée : user_pref("CT3281675.1000234.weatherData", "{\"icon\":\"33.png\",\"temperature\":\"9°C\",\"temperatu[...]
Supprimée : user_pref("CT3281675.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"false\"}");
Supprimée : user_pref("CT3281675.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Supprimée : user_pref("CT3281675.FF19Solved", "true");
Supprimée : user_pref("CT3281675.FirstTime", "true");
Supprimée : user_pref("CT3281675.FirstTimeFF3", "true");
Supprimée : user_pref("CT3281675.PG_ENABLE", "dHJ1ZQ==");
Supprimée : user_pref("CT3281675.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT328[...]
Supprimée : user_pref("CT3281675.UserID", "UN36199781801432018");
Supprimée : user_pref("CT3281675.addressBarTakeOverEnabledInHidden", "true");
Supprimée : user_pref("CT3281675.amazonNew_All.enc", "MzgzODgzMSwzODg3NTgxLDM4OTAyNjEsMzg5NDQ3MSwzODY2NTgxLDM3OT[...]
Supprimée : user_pref("CT3281675.appButtonDisablenull.enc", "MA==");
Supprimée : user_pref("CT3281675.autoDisableScopes", -1);
Supprimée : user_pref("CT3281675.browser.search.defaultthis.engineName", "true");
Supprimée : user_pref("CT3281675.defaultSearch", "true");
Supprimée : user_pref("CT3281675.embeddedsData", "[{\"appId\":\"130036105453116013\",\"apiPermissions\":{\"cross[...]
Supprimée : user_pref("CT3281675.enableAlerts", "true");
Supprimée : user_pref("CT3281675.enableFix404ByUser", "FALSE");
Supprimée : user_pref("CT3281675.enableSearchFromAddressBar", "true");
Supprimée : user_pref("CT3281675.firstTimeDialogOpened", "true");
Supprimée : user_pref("CT3281675.fixPageNotFoundError", "true");
Supprimée : user_pref("CT3281675.fixPageNotFoundErrorByUser", "true");
Supprimée : user_pref("CT3281675.fixPageNotFoundErrorInHidden", "true");
Supprimée : user_pref("CT3281675.fixUrls", true);
Supprimée : user_pref("CT3281675.homepageuserchanged", true);
Supprimée : user_pref("CT3281675.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");
Supprimée : user_pref("CT3281675.installDate", "20/3/2013 23:16:59");
Supprimée : user_pref("CT3281675.installId", "conduitinstaller.exe");
Supprimée : user_pref("CT3281675.installType", "conduitnsisintegration");
Supprimée : user_pref("CT3281675.installUsage", "2013-03-21T01:19:30.0408048+03:00");
Supprimée : user_pref("CT3281675.installUsageEarly", "2013-03-21T01:19:29.9937685+03:00");
Supprimée : user_pref("CT3281675.installerVersion", "1.3.6.5");
Supprimée : user_pref("CT3281675.isCheckedStartAsHidden", true);
Supprimée : user_pref("CT3281675.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"false\"}");
Supprimée : user_pref("CT3281675.isFirstTimeToolbarLoading", "false");
Supprimée : user_pref("CT3281675.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Supprimée : user_pref("CT3281675.keyword", "true");
Supprimée : user_pref("CT3281675.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.condui[...]
Supprimée : user_pref("CT3281675.lastVersion", "10.15.0.562");
Supprimée : user_pref("CT3281675.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Supprimée : user_pref("CT3281675.migrateAppsAndComponents", true);
Supprimée : user_pref("CT3281675.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...]
Supprimée : user_pref("CT3281675.openThankYouPage", "false");
Supprimée : user_pref("CT3281675.openUninstallPage", "true");
Supprimée : user_pref("CT3281675.price-gong.isManagedApp", "true");
Supprimée : user_pref("CT3281675.revertSettingsEnabled", "false");
Supprimée : user_pref("CT3281675.search.searchAppId", "130036105453116013");
Supprimée : user_pref("CT3281675.search.searchCount", "0");
Supprimée : user_pref("CT3281675.searchFromAddressBarEnabledByUser", "false");
Supprimée : user_pref("CT3281675.searchInNewTabEnabledByUser", "false");
Supprimée : user_pref("CT3281675.searchInNewTabEnabledInHidden", "true");
Supprimée : user_pref("CT3281675.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"false\"}")[...]
Supprimée : user_pref("CT3281675.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"false\"}");
Supprimée : user_pref("CT3281675.selectToSearchBoxEnabledByUser", "{\"dataType\":\"string\",\"data\":\"true\"}")[...]
Supprimée : user_pref("CT3281675.sendUsageEnabled", "false");
Supprimée : user_pref("CT3281675.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Supprimée : user_pref("CT3281675.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Supprimée : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Supprimée : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Supprimée : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Supprimée : user_pref("CT3281675.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Supprimée : user_pref("CT3281675.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1363817852227");
Supprimée : user_pref("CT3281675.serviceLayer_services_appsMetadata_lastUpdate", "1364152828039");
Supprimée : user_pref("CT3281675.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1363817851386");
Supprimée : user_pref("CT3281675.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1363817972[...]
Supprimée : user_pref("CT3281675.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1363817972330")[...]
Supprimée : user_pref("CT3281675.serviceLayer_services_location_lastUpdate", "1364148694643");
Supprimée : user_pref("CT3281675.serviceLayer_services_login_10.14.370.26_lastUpdate", "1363817852517");
Supprimée : user_pref("CT3281675.serviceLayer_services_login_10.15.0.562_lastUpdate", "1364148694803");
Supprimée : user_pref("CT3281675.serviceLayer_services_menu_bfd1c71334f926ecd0bf043e0f822c7e_lastUpdate", "13641[...]
Supprimée : user_pref("CT3281675.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1363817851562");
Supprimée : user_pref("CT3281675.serviceLayer_services_searchAPI_lastUpdate", "1364148694710");
Supprimée : user_pref("CT3281675.serviceLayer_services_serviceMap_lastUpdate", "1364148694354");
Supprimée : user_pref("CT3281675.serviceLayer_services_setupAPI_lastUpdate", "1363817848849");
Supprimée : user_pref("CT3281675.serviceLayer_services_toolbarContextMenu_lastUpdate", "1363817851775");
Supprimée : user_pref("CT3281675.serviceLayer_services_toolbarSettings_lastUpdate", "1364152827965");
Supprimée : user_pref("CT3281675.serviceLayer_services_translation_lastUpdate", "1364148694932");
Supprimée : user_pref("CT3281675.settingsINI", true);
Supprimée : user_pref("CT3281675.shouldFirstTimeDialog", "false");
Supprimée : user_pref("CT3281675.showToolbarPermission", "false");
Supprimée : user_pref("CT3281675.smartbar.CTID", "CT3281675");
Supprimée : user_pref("CT3281675.smartbar.Uninstall", "0");
Supprimée : user_pref("CT3281675.smartbar.homepage", true);
Supprimée : user_pref("CT3281675.smartbar.toolbarName", "entrusted ");
Supprimée : user_pref("CT3281675.startPage", "true");
Supprimée : user_pref("CT3281675.toolbarBornServerTime", "21-3-2013");
Supprimée : user_pref("CT3281675.toolbarCurrentServerTime", "24-3-2013");
Supprimée : user_pref("CT3281675.toolbarDisabled", "true");
Supprimée : user_pref("CT3281675.toolbarLoginClientTime", "Wed Mar 20 2013 23:17:32 GMT+0100");
Supprimée : user_pref("CT3281675.twitter_v1.8.0_twitter_app_open_t_f.enc", "ZmFsc2U=");
Supprimée : user_pref("CT3281675.url_history0001.enc", "aHR0cDovL3d3dy5wYWdlc2phdW5lcy5mci9wYWdlc2JsYW5jaGVzL1Jl[...]
Supprimée : user_pref("CT3281675_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Supprimée : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3281675&octid=CT328167[...]
Supprimée : user_pref("Smartbar.ConduitSearchEngineList", "");
Supprimée : user_pref("Smartbar.ConduitSearchUrlList", "");
Supprimée : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Supprimée : user_pref("Smartbar.keywordURLSelectedCTID", "");
Supprimée : user_pref("browser.search.defaultthis.engineName", "entrusted Customized Web Search");
Supprimée : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3281675&CUI[...]
Supprimée : user_pref("browser.search.selectedEngine", "entrusted Customized Web Search");
Supprimée : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3281675&CUI=UN361997818[...]
Supprimée : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Supprimée : user_pref("smartbar.machineId", "B7LAK25GJIHRF8+HAE2OJU990X3WINS3CZKCTLGVELTC6NDRNNFJWKFGOFUZBQXS1AK[...]
Supprimée : user_pref("smartbar.originalHomepage", "chrome://branding/locale/browserconfig.properties");
Supprimée : user_pref("smartbar.originalSearchAddressUrl", "");
Supprimée : user_pref("smartbar.originalSearchEngine", "");

*************************

AdwCleaner[R1].txt - [11987 octets] - [06/05/2013 20:27:32]
AdwCleaner[S1].txt - [12050 octets] - [06/05/2013 20:28:03]

########## EOF - C:\AdwCleaner[S1].txt - [12111 octets] ##########

Malekal_morte- · Answer

OK OTL maintenant.

bibidepourrieres · Answer

Bonjour, voici le rapport OTL, je l'ai aussi envoyé via le site pjjoint.malekal c'est gentil de passer du temps à aider les personnes qui comme moi galère avec des virus à la C.. OTL logfile created on: 07/05/2013 09:47:48 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\lefebvre\Mes documents\Téléchargements Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 3,50 Gb Total Physical Memory | 2,69 Gb Available Physical Memory | 76,81% Memory free 5,34 Gb Paging File | 4,62 Gb Available in Paging File | 86,63% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 95,03 Gb Free Space | 63,76% Space Free | Partition Type: NTFS Drive D: | 170,10 Gb Total Space | 103,02 Gb Free Space | 60,57% Space Free | Partition Type: NTFS Drive E: | 146,48 Gb Total Space | 9,13 Gb Free Space | 6,24% Space Free | Partition Type: NTFS Drive F: | 151,60 Gb Total Space | 111,96 Gb Free Space | 73,85% Space Free | Partition Type: NTFS Drive G: | 127,99 Gb Total Space | 15,82 Gb Free Space | 12,36% Space Free | Partition Type: NTFS Drive I: | 68,36 Gb Total Space | 16,69 Gb Free Space | 24,41% Space Free | Partition Type: NTFS Drive J: | 292,97 Gb Total Space | 27,06 Gb Free Space | 9,24% Space Free | Partition Type: NTFS Drive K: | 234,84 Gb Total Space | 35,01 Gb Free Space | 14,91% Space Free | Partition Type: NTFS Computer Name: BIBI | User Name: lefebvre | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========/color PRC - [2013/05/07 09:34:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\lefebvre\Mes documents\Téléchargements\OTL.exe PRC - [2013/04/11 21:02:27 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Mozilla Firefox\firefox.exe PRC - [2013/03/28 18:44:08 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\sched.exe PRC - [2013/03/28 18:43:52 | 000,565,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2013/03/28 18:43:51 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avshadow.exe PRC - [2013/03/28 18:43:50 | 000,374,496 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avmailc.exe PRC - [2013/03/28 18:43:49 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avgnt.exe PRC - [2013/03/28 18:43:49 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Avira\AntiVir Desktop\avguard.exe PRC - [2013/03/26 15:37:51 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe PRC - [2013/01/03 13:43:58 | 001,259,448 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012/12/21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2010/03/18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2008/04/13 20:34:14 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe PRC - [2008/04/13 20:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (No Company Name) ==========/color MOD - [2013/04/11 21:02:27 | 003,133,336 | ---- | M] () -- C:\Mozilla Firefox\mozjs.dll MOD - [2013/04/11 08:40:22 | 016,032,648 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll MOD - [2013/02/08 00:15:43 | 000,397,088 | ---- | M] () -- C:\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012/11/28 15:13:52 | 000,087,952 | ---- | M] () -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\zlib1.dll MOD - [2012/11/28 15:13:30 | 001,242,512 | ---- | M] () -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\libxml2.dll MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF MOD - [2008/04/13 20:33:32 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll [color=#E56717]========== Services (SafeList) ==========/color SRV - [2013/04/11 21:02:27 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013/04/11 08:40:27 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013/03/28 18:44:08 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013/03/28 18:43:52 | 000,565,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2013/03/28 18:43:50 | 000,374,496 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2013/03/28 18:43:49 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013/03/26 15:37:51 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2013/02/28 19:25:34 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2013/01/03 13:43:58 | 001,259,448 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012/12/21 17:27:46 | 000,057,008 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012/10/01 09:22:06 | 000,295,224 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2012/09/20 14:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2010/03/18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2010/01/09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2010/01/09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose) [color=#E56717]========== Driver Services (SafeList) ==========/color DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2013/05/06 20:13:43 | 000,015,616 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\TrueSight.sys -- (TrueSight) DRV - [2013/03/28 18:44:09 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2013/03/28 18:44:09 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013/03/28 18:44:09 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013/02/08 11:12:46 | 000,392,960 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService) DRV - [2013/02/08 00:15:54 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012/09/18 11:33:00 | 000,043,960 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2012/09/18 11:33:00 | 000,030,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt) DRV - [2012/09/18 11:32:56 | 000,012,216 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE) DRV - [2006/11/10 16:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc) DRV - [2006/11/02 08:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB) DRV - [2006/09/05 20:27:20 | 000,176,128 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8187.sys -- (RTLWUSB) DRV - [2006/07/31 07:44:00 | 000,580,992 | ---- | M] (Omnivision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ov550i.sys -- (APL531) DRV - [2006/03/22 08:24:02 | 000,018,944 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers vnetbus.sys -- (nvnetbus) DRV - [2006/03/22 08:24:00 | 000,052,736 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2005/01/20 00:30:52 | 000,067,200 | R--- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SI3132.sys -- (SI3132) DRV - [2004/11/01 21:21:32 | 000,010,368 | R--- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SiWinAcc.sys -- (SiFilter) DRV - [2004/08/13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) [color=#E56717]========== Standard Registry (All) ==========/color [color=#E56717]========== Internet Explorer ==========/color IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-1390067357-1960408961-725345543-1004\..\SearchScopes,DefaultScope = [color=#E56717]========== FireFox ==========/color FF - prefs.js..browser.startup.homepage: "www.google.fr" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Mozilla Plugins pitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32 pDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2 pjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0 pctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files\Research In Motion Limited\Plug-in du navigateur BlackBerry App World pappworld.dll () FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\VideoLAN\VLC pvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR ppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\Components: C:\Mozilla Firefox\components [2013/04/11 21:02:27 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\Plugins: C:\Mozilla Firefox\plugins [2013/02/08 00:24:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\lefebvre\Application Data\Mozilla\Extensions [2013/05/06 20:28:12 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\lefebvre\Application Data\Mozilla\Firefox\Profiles\l2h2rs4v.default\extensions O1 HOSTS File: ([2006/03/02 14:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\Toolbar\ShellBrowser: (&Adresse) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\Toolbar\WebBrowser: (&Adresse) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\..\Toolbar\WebBrowser: (&Liens) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKU\.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1390067357-1960408961-725345543-1003..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1390067357-1960408961-725345543-1004..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1390067357-1960408961-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1390067357-1960408961-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Envoyer à OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: E&xporter vers Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS etwork diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32 svpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32 svpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DDDC0A4-5B04-4B11-810D-15938C37ADAD}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler es {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Fichiers communs\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler v {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter ext/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O18 - Protocol\Filter ext/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify ermsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Pré-chargeur Browseui - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Démon de cache des catégories de composant - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O24 - Desktop Components:0 (Ma page d'accueil) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Colline verdoyante.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Colline verdoyante.bmp O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013/02/07 22:37:53 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========/color [2013/05/06 20:40:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\lefebvre\Bureau\Antivirus et autres [2013/05/06 19:25:33 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC [2013/05/06 18:50:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\1847F94E34900BC800001847E10B1085 [2013/05/01 11:08:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\VideoLAN [2013/04/18 18:08:37 | 000,000,000 | ---D | C] -- C:\FLV Media Player [2013/04/11 21:02:17 | 000,000,000 | ---D | C] -- C:\Mozilla Firefox [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========/color [2013/05/07 09:18:19 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013/05/07 09:18:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013/05/07 09:13:15 | 000,001,002 | ---- | M] () -- C:\WINDOWS asks\Adobe Flash Player Updater.job [2013/05/06 20:51:27 | 002,281,725 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau otice-duralis-thermor.pdf [2013/05/06 20:13:43 | 000,015,616 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys [2013/05/02 21:15:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS asks\AppleSoftwareUpdate.job [2013/05/02 17:43:34 | 000,702,507 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau\Convention de stage.pdf [2013/05/01 11:08:00 | 000,000,559 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\VLC media player.lnk [2013/04/25 23:54:48 | 000,165,199 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau\Assistant Mise à niveau de Windows 8.mht [2013/04/17 21:39:24 | 000,179,335 | ---- | M] () -- C:\Documents and Settings\lefebvre\Mes documents\114514.jpg [2013/04/17 21:23:59 | 003,063,355 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau\cv Theo.odt [2013/04/17 21:07:47 | 003,044,099 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau\IMG_1636.jpg [2013/04/17 21:06:28 | 000,015,226 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau\lettre de motiv-sport.odt [2013/04/17 21:02:13 | 000,014,448 | ---- | M] () -- C:\Documents and Settings\lefebvre\Bureau\lettre de motiv.odt [2013/04/13 19:13:46 | 001,072,544 | ---- | M] () -- C:\WINDOWS\System32 vdrsdb0.bin [2013/04/13 19:13:46 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32 vdrssel.bin [2013/04/13 19:13:37 | 001,072,544 | ---- | M] () -- C:\WINDOWS\System32 vdrsdb1.bin [2013/04/11 09:32:14 | 000,293,272 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013/04/11 08:45:20 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2013/04/11 08:40:26 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2013/04/11 08:40:25 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [13 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========/color [2013/05/06 20:51:27 | 002,281,725 | ---- | C] () -- C:\Documents and Settings\lefebvre\Bureau otice-duralis-thermor.pdf [2013/05/06 20:13:43 | 000,015,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys [2013/05/02 17:43:34 | 000,702,507 | ---- | C] () -- C:\Documents and Settings\lefebvre\Bureau\Convention de stage.pdf [2013/05/01 11:08:00 | 000,000,559 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\VLC media player.lnk [2013/04/25 23:54:47 | 000,165,199 | ---- | C] () -- C:\Documents and Settings\lefebvre\Bureau\Assistant Mise à niveau de Windows 8.mht [2013/04/17 21:39:24 | 000,179,335 | ---- | C] () -- C:\Documents and Settings\lefebvre\Mes documents\114514.jpg [2013/04/17 21:07:47 | 003,044,099 | ---- | C] () -- C:\Documents and Settings\lefebvre\Bureau\IMG_1636.jpg [2013/04/17 21:06:28 | 000,015,226 | ---- | C] () -- C:\Documents and Settings\lefebvre\Bureau\lettre de motiv-sport.odt [2013/03/24 00:05:50 | 000,605,949 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1390067357-1960408961-725345543-1003-0.dat [2013/03/24 00:05:49 | 000,332,874 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat [2013/02/10 13:57:29 | 000,178,688 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2013/02/09 21:38:36 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2013/02/07 23:23:24 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2013/02/07 23:22:45 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\lefebvre\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013/02/07 23:20:44 | 000,293,272 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013/02/07 23:00:25 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32 vdrsdb0.bin [2013/02/07 23:00:24 | 001,072,544 | ---- | C] () -- C:\WINDOWS\System32 vdrsdb1.bin [2013/02/07 23:00:24 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32 vdrssel.bin [2013/02/07 23:00:16 | 002,816,504 | ---- | C] () -- C:\WINDOWS\System32 vdata.data [2013/02/07 22:48:34 | 000,030,835 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2013/02/07 22:48:32 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2013/02/07 22:48:16 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2013/02/07 22:39:34 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2013/02/07 22:35:32 | 000,021,892 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2013/02/05 18:52:50 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll [2013/02/05 18:52:50 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll [2013/02/05 18:52:50 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll [2013/02/05 18:52:50 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll [color=#E56717]========== ZeroAccess Check ==========/color [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2012/10/31 13:33:21 | 001,510,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 12:53:55 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:33:50 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== Custom Scans ==========/color [color=#A23BEC]< >/color [color=#A23BEC]< >/color [color=#A23BEC]< >/color < End of report >

Malekal_morte- · Answer

ok c'est bon :)

Installe Malwarebyte's Anti-Malware : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Fais des scans réguliers avec, il est efficace.


Sécurise ton PC !

Important - ton infection est venue par un exploit sur site web :   

Un exploit sur site WEB permet l'infection de ton ordinateur de manière automatiquement à la visite d'un site WEB qui a été hacké, il tire partie du fait que tu as des logiciels (Java, Adobe Reader etc) qui sont pas à jour et possèdent des vulnérabilités qui permettent l'execution de code (malicieux dans notre cas) à ton insu.  
Le fait de ne pas avoir des logiciels à jour et qui ont potentiellement des vulnérabilités permettent donc d'infecter ton système.  
Exemple avec : Exploit Java  

Il faut donc impérativement maintenir tes logiciels à jour afin de ne pas voir ces portes d'entrée sur ton système.
Tant que ces logiciels ne seront pas à jour, ton PC est vulnérable et les infections peuvent s'installer facilement.

IMPORTANT : mettre à jour tes programmes notamment Java/Adobe Reader et Flash : 
/faq/13362-mettre-a-jour-son-pc-contre-les-failles-de-securite     
https://forum.malekal.com/viewtopic.php?t=15960&start=  

Désactive Java de tes navigateurs WEB  : https://www.commentcamarche.net/faq/35621-desactiver-java-sur-ses-navigateurs-web


Passe le mot à tes amis ! 

~~

Filtrer les PUPs/Adwares les plus fréquents avec HOSTS Anti-PUPs/Adwares : http://www.malekal.com/2012/01/10/hosts-anti-pupsadware/

~~

Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

Infection système care antivirus

5 réponses

Discussions similaires