Erreur 404 bad request sous firefox (un seul site)
Résolu/Fermé
culturelles2
Messages postés
100
Date d'inscription
vendredi 26 décembre 2008
Statut
Membre
Dernière intervention
29 octobre 2019
-
Modifié par culturelles2 le 7/07/2013 à 17:08
culturelles2 Messages postés 100 Date d'inscription vendredi 26 décembre 2008 Statut Membre Dernière intervention 29 octobre 2019 - 11 juil. 2013 à 21:05
culturelles2 Messages postés 100 Date d'inscription vendredi 26 décembre 2008 Statut Membre Dernière intervention 29 octobre 2019 - 11 juil. 2013 à 21:05
A voir également:
- Erreur 404 bad request sous firefox (un seul site)
- Erreur 0x80070643 - Guide
- Site de telechargement - Guide
- Site inaccessible - Guide
- Site de vente entre particulier - Guide
- Erreur vidéo freebox ✓ - Forum TV & Vidéo
8 réponses
Utilisateur anonyme
7 juil. 2013 à 20:17
7 juil. 2013 à 20:17
Salut,
As tu essayé de faire un nouveau profil?
Sauvegarder les marques-pages:
Sous le format JSON:
Aller dans Marque-pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "Importation et sauvegarde".
Cliquer sur "Sauvegarder".
Enregistrer le fichier dans un endroit choisi.
Sous le format HTML:
Aller dans Marque-Pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "importation et sauvegarde".
Cliquer sur "Exporter au Format HTML"
Enregistrer le fichier dans un endroit choisi.
Ou par cette méthode si Firefox ne démarre plus:
Cliquer sur le bouton Démarrer de Windows et saisir
%APPDATA%\Mozilla\Firefox\Profiles\
dans le champ recherche en bas du menu Démarrer sans appuyer sur Entrée.
Une liste des profils apparaît en haut du menu "Démarrer".
Cliquer sur n'importe quel profil (p.ex. xxxxxxxx.default) afin de l'ouvrir avec l'explorateur Windows.
Repérer le dossier bookmarkbackups et l'ouvrir
Copier le fichier JSON (le plus récent s'il y en a plusieurs)
Coller le sur le Bureau
Sauvegarder vos données importantes:
Les fichiers places.sqlite, key3.db,signons.sqlite, permissions.sqlite, etc.....
==> https://support.mozilla.org/fr/kb/recuperer-donnees-importantes-ancien-profil?esab=a&s=profil&r=2&as=s#w_vos-donnaees-importantes-et-leurs-fichiers
Supprimer le profil firefox:
Fermer firefox
Appuyez sur Windows + R
Dans le champ "Ouvrir", saisir :
firefox.exe -p
Cliquer sur OK.
Si la fenêtre du gestionnaire de profils n'apparaît pas, saisir:
Sous Windows 32 bits :
"C:\Program Files\Mozilla Firefox\firefox.exe" -p
Cliquer sur OK
Sous Windows 64 bits :
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -p
Cliquer sur OK
Dans le gestionnaire de profils, sélectionner le profil à supprimer
Cliquer sur Supprimer un profil....
/!\ L'option Ne pas supprimer les fichiers retire le profil du gestionnaire de profils tout en conservant les données du profil sur votre ordinateur dans le dossier, de sorte que vos informations sont conservées. « Ne pas supprimer les fichiers » est l'option à privilégier car cela n'efface pas le dossier de l'ancien profil et vous permet de récupérer ses fichiers pour un nouveau profil. /!\
/!\ L'option Supprimer les fichiers supprime le profil et ses fichiers, y-compris les marques-pages du profil, les réglages, les mots de passe... /!\
/!\ Si vous utilisez l'option Supprimer les fichiers, le dossier profil et les fichiers s'y trouvant seront supprimés. Cette action ne peut être annulée./!\
L'option Annuler interrompt la suppression du profil.
Fermer les fenêtres.
Redémarrer firefox.
Pour restaurer les Marques-pages:
Le format JSON:
Aller dans Marque-Pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "importation et sauvegarde".
Cliquer sur "restaurer"
Cliquer sur "Choisir le fichier".
Sélectionner le fichier de sauvegarde JSON créé.
Valider par OK.
Le format HTML:
Aller dans Marque-Pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "importation et sauvegarde".
Cliquer sur "importer au format HTML"
Sélectionner "à partir d'un fichier"
Sélectionner le fichier de sauvegarde HTML créé.
Valider par OK.
Ou par cette méthode:
Aller remettre le fichier JSON se trouvant sur le bureau dans le dossier bookmarkbackups du nouveau profil créé par firefox.
Pour récupérer vos données importantes:
Aller replacer les différents fichiers sauvegardés dans le nouveau profil créer par firefox.
Cliquer sur le bouton Démarrer de Windows et saisir
%APPDATA%\Mozilla\Firefox\Profiles\
dans le champ recherche en bas du menu Démarrer sans appuyer sur Entrée.
Une liste des profils apparaît en haut du menu "Démarrer".
Ouvrir le profil concerné
Redémarrer Firefox.
As tu essayé de faire un nouveau profil?
Sauvegarder les marques-pages:
Sous le format JSON:
Aller dans Marque-pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "Importation et sauvegarde".
Cliquer sur "Sauvegarder".
Enregistrer le fichier dans un endroit choisi.
Sous le format HTML:
Aller dans Marque-Pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "importation et sauvegarde".
Cliquer sur "Exporter au Format HTML"
Enregistrer le fichier dans un endroit choisi.
Ou par cette méthode si Firefox ne démarre plus:
Cliquer sur le bouton Démarrer de Windows et saisir
%APPDATA%\Mozilla\Firefox\Profiles\
dans le champ recherche en bas du menu Démarrer sans appuyer sur Entrée.
Une liste des profils apparaît en haut du menu "Démarrer".
Cliquer sur n'importe quel profil (p.ex. xxxxxxxx.default) afin de l'ouvrir avec l'explorateur Windows.
Repérer le dossier bookmarkbackups et l'ouvrir
Copier le fichier JSON (le plus récent s'il y en a plusieurs)
Coller le sur le Bureau
Sauvegarder vos données importantes:
Les fichiers places.sqlite, key3.db,signons.sqlite, permissions.sqlite, etc.....
==> https://support.mozilla.org/fr/kb/recuperer-donnees-importantes-ancien-profil?esab=a&s=profil&r=2&as=s#w_vos-donnaees-importantes-et-leurs-fichiers
Supprimer le profil firefox:
Fermer firefox
Appuyez sur Windows + R
Dans le champ "Ouvrir", saisir :
firefox.exe -p
Cliquer sur OK.
Si la fenêtre du gestionnaire de profils n'apparaît pas, saisir:
Sous Windows 32 bits :
"C:\Program Files\Mozilla Firefox\firefox.exe" -p
Cliquer sur OK
Sous Windows 64 bits :
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -p
Cliquer sur OK
Dans le gestionnaire de profils, sélectionner le profil à supprimer
Cliquer sur Supprimer un profil....
/!\ L'option Ne pas supprimer les fichiers retire le profil du gestionnaire de profils tout en conservant les données du profil sur votre ordinateur dans le dossier, de sorte que vos informations sont conservées. « Ne pas supprimer les fichiers » est l'option à privilégier car cela n'efface pas le dossier de l'ancien profil et vous permet de récupérer ses fichiers pour un nouveau profil. /!\
/!\ L'option Supprimer les fichiers supprime le profil et ses fichiers, y-compris les marques-pages du profil, les réglages, les mots de passe... /!\
/!\ Si vous utilisez l'option Supprimer les fichiers, le dossier profil et les fichiers s'y trouvant seront supprimés. Cette action ne peut être annulée./!\
L'option Annuler interrompt la suppression du profil.
Fermer les fenêtres.
Redémarrer firefox.
Pour restaurer les Marques-pages:
Le format JSON:
Aller dans Marque-Pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "importation et sauvegarde".
Cliquer sur "restaurer"
Cliquer sur "Choisir le fichier".
Sélectionner le fichier de sauvegarde JSON créé.
Valider par OK.
Le format HTML:
Aller dans Marque-Pages.
Cliquer sur "Afficher tous les marque-pages".
Cliquer sur "importation et sauvegarde".
Cliquer sur "importer au format HTML"
Sélectionner "à partir d'un fichier"
Sélectionner le fichier de sauvegarde HTML créé.
Valider par OK.
Ou par cette méthode:
Aller remettre le fichier JSON se trouvant sur le bureau dans le dossier bookmarkbackups du nouveau profil créé par firefox.
Pour récupérer vos données importantes:
Aller replacer les différents fichiers sauvegardés dans le nouveau profil créer par firefox.
Cliquer sur le bouton Démarrer de Windows et saisir
%APPDATA%\Mozilla\Firefox\Profiles\
dans le champ recherche en bas du menu Démarrer sans appuyer sur Entrée.
Une liste des profils apparaît en haut du menu "Démarrer".
Ouvrir le profil concerné
Redémarrer Firefox.
culturelles2
Messages postés
100
Date d'inscription
vendredi 26 décembre 2008
Statut
Membre
Dernière intervention
29 octobre 2019
15
7 juil. 2013 à 22:54
7 juil. 2013 à 22:54
Oui mais sans aucun résultat.
Utilisateur anonyme
7 juil. 2013 à 22:56
7 juil. 2013 à 22:56
Télécharges cet utilitaire sur ton bureau--> AdwCleaner (d'Xplode)
Clic droit dessus et lances-le "en tant qu'administrateur"
Cliques sur "suppression".
Postes le rapport dans ton prochain message.
Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt
Clic droit dessus et lances-le "en tant qu'administrateur"
Cliques sur "suppression".
Postes le rapport dans ton prochain message.
Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt
culturelles2
Messages postés
100
Date d'inscription
vendredi 26 décembre 2008
Statut
Membre
Dernière intervention
29 octobre 2019
15
7 juil. 2013 à 23:06
7 juil. 2013 à 23:06
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\Users\rene\AppData\Local\PackageAware
Folder Deleted : C:\Users\rene\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\rene\AppData\Roaming\vghd
***** [Registry] *****
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Giant Savings Extension
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\59578cdce13bef46
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASMANCS
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
***** [Internet Browsers] *****
-\\ Internet Explorer v10.0.9200.16611
[OK] Registry is clean.
-\\ Mozilla Firefox v23.0 (en-US)
File : C:\Users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\6z4jsbc9.rene\prefs.js
[OK] File is clean.
File : C:\Users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\prefs.js
[OK] File is clean.
-\\ Google Chrome v28.0.1500.71
File : C:\Users\rene\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [3702 octets] - [07/07/2013 16:58:33]
AdwCleaner[S1].txt - [3562 octets] - [07/07/2013 16:59:23]
########## EOF - C:\AdwCleaner[S1].txt - [3622 octets] ##########
C'est des fichiers et registres obsolètes qui ne fonctionnais plus.Donc avec aucun effet avec mon problème mais y a eu un ménage qui valais la peine.
***** [Files / Folders] *****
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\Users\rene\AppData\Local\PackageAware
Folder Deleted : C:\Users\rene\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\rene\AppData\Roaming\vghd
***** [Registry] *****
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Giant Savings Extension
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\59578cdce13bef46
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASMANCS
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
***** [Internet Browsers] *****
-\\ Internet Explorer v10.0.9200.16611
[OK] Registry is clean.
-\\ Mozilla Firefox v23.0 (en-US)
File : C:\Users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\6z4jsbc9.rene\prefs.js
[OK] File is clean.
File : C:\Users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\prefs.js
[OK] File is clean.
-\\ Google Chrome v28.0.1500.71
File : C:\Users\rene\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [3702 octets] - [07/07/2013 16:58:33]
AdwCleaner[S1].txt - [3562 octets] - [07/07/2013 16:59:23]
########## EOF - C:\AdwCleaner[S1].txt - [3622 octets] ##########
C'est des fichiers et registres obsolètes qui ne fonctionnais plus.Donc avec aucun effet avec mon problème mais y a eu un ménage qui valais la peine.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
culturelles2
Messages postés
100
Date d'inscription
vendredi 26 décembre 2008
Statut
Membre
Dernière intervention
29 octobre 2019
15
8 juil. 2013 à 02:04
8 juil. 2013 à 02:04
# AdwCleaner v2.304 - Logfile created 07/07/2013 at 20:01:01
# Updated 03/07/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : rene - RENE-PC
# Boot Mode : Normal
# Running from : C:\Users\rene\Downloads\Programs\adwcleaner.exe
# Option [Delete]
# Updated 03/07/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : rene - RENE-PC
# Boot Mode : Normal
# Running from : C:\Users\rene\Downloads\Programs\adwcleaner.exe
# Option [Delete]
culturelles2
Messages postés
100
Date d'inscription
vendredi 26 décembre 2008
Statut
Membre
Dernière intervention
29 octobre 2019
15
8 juil. 2013 à 02:43
8 juil. 2013 à 02:43
J'ai essayé combofix et le problème a été réglé.Par contre je ne sais pas exactement ce qui causait le problème dans ce qui a été effacé.
Voici le rapport:
ComboFix 13-07-08.02 - rene 07/07/2013 20:18:53.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6056.4122 [GMT -4:00]
Running from: c:\users\rene\Downloads\Programs\ComboFix.exe
AV: ESET Smart Security 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\ESET\MiNODLogin
c:\users\rene\AppData\Roaming\inst.exe
c:\users\rene\AppData\Roaming\vso_ts_preview.xml
c:\windows\InstallDir
c:\windows\SysWow64\drivers\hwinterface.sys
c:\windows\SysWow64\regobj.dll
c:\windows\SysWow64\rpCHtttp.dll
c:\windows\TEMP\jna7271995608355205024.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-06-08 to 2013-07-08 )))))))))))))))))))))))))))))))
.
.
2013-07-08 00:28 . 2013-07-08 00:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-07 16:21 . 2013-07-07 16:21 -------- d-----w- C:\ToolBar SD
2013-07-07 16:18 . 2013-07-07 16:18 -------- d-----w- C:\rsit
2013-07-07 16:18 . 2013-07-07 16:18 -------- d-----w- c:\program files (x86)\trend micro
2013-07-07 14:30 . 2013-07-07 14:30 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2013-07-07 02:53 . 2013-07-07 02:53 3243520 ----a-w- C:\ezcddax.exe
2013-07-07 02:08 . 2013-07-07 13:32 -------- d-----w- c:\users\rene\AppData\Roaming\LavasoftStatistics
2013-07-07 02:06 . 2013-07-07 02:06 -------- d-----w- c:\programdata\Lavasoft
2013-07-07 02:05 . 2013-07-07 02:05 -------- d-----w- c:\programdata\Downloaded Installations
2013-07-07 02:04 . 2013-07-07 02:04 14456 ----a-w- c:\windows\system32\drivers\gfibto.sys
2013-07-07 02:03 . 2013-07-07 02:03 -------- d-----w- c:\program files\CCleaner
2013-07-05 17:16 . 2013-07-05 17:16 -------- d-----w- c:\programdata\Package Cache
2013-07-05 12:07 . 2009-03-13 17:13 8118488 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\RoboForm\roboform-x64.dll
2013-07-05 12:07 . 2009-03-13 17:13 5085696 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\RoboForm\roboform.dll
2013-07-05 11:34 . 2013-07-05 11:34 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2013-07-05 11:16 . 2009-01-25 17:14 17272 ----a-w- c:\windows\system32\sdnclean64.exe
2013-07-05 11:16 . 2013-07-05 11:17 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2013-07-05 10:47 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{486800A9-5ED8-4E63-AF8C-5F07A8EB557A}\mpengine.dll
2013-07-04 11:21 . 2013-07-04 11:21 -------- d-----w- c:\users\rene\AppData\Roaming\DiskDefrag
2013-07-02 15:17 . 2013-06-25 08:20 117024 ----a-w- c:\windows\SysWow64\BootDefrag.exe
2013-07-02 15:17 . 2013-06-25 08:20 117024 ----a-w- c:\windows\system32\BootDefrag.exe
2013-07-02 15:17 . 2013-04-24 06:52 16640 ----a-w- c:\windows\SysWow64\drivers\BootDefragDriver.sys
2013-07-02 15:10 . 2013-07-07 14:29 -------- d-----w- c:\program files (x86)\Glary Utilities 3
2013-07-02 14:58 . 2013-07-02 14:58 -------- d-----w- c:\users\rene\AppData\Roaming\Absolute Uninstaller
2013-07-02 14:54 . 2013-07-02 15:10 -------- d-----w- c:\users\rene\AppData\Roaming\GlarySoft
2013-06-30 21:37 . 2013-06-30 21:37 -------- d-----w- c:\users\rene\AppData\Roaming\CrystalIdea Software
2013-06-28 04:31 . 2013-06-27 09:57 172920 ----a-w- c:\windows\system32\drivers\idmwfp.sys
2013-06-27 22:26 . 2013-06-28 00:55 -------- d-----r- c:\users\rene\YandexDisk
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\users\rene\AppData\Roaming\Yandex
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\users\rene\AppData\Local\Yandex
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\program files (x86)\Yandex
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\programdata\Yandex
2013-06-22 15:29 . 2013-06-22 15:29 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 23:59 . 2010-07-26 02:23 56496 ----a-w- c:\windows\SysWow64\wbhelp2.dll
2013-06-21 23:59 . 2010-07-26 02:23 544768 ----a-w- c:\windows\SysWow64\wbocx.ocx
2013-06-21 23:59 . 2010-07-26 02:23 33968 ----a-w- c:\windows\SysWow64\anim.dll
2013-06-21 23:59 . 2010-07-26 02:23 258352 ----a-w- c:\windows\SysWow64\unicows.dll
2013-06-21 23:59 . 2010-07-26 02:23 4608 ----a-w- c:\windows\SysWow64\W95INF32.DLL
2013-06-21 23:59 . 2010-07-26 02:23 2272 ----a-w- c:\windows\SysWow64\W95INF16.DLL
2013-06-21 23:22 . 2010-09-23 17:29 511328 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\CAPICOM\CAPICOM.DLL
2013-06-21 23:18 . 2013-06-21 23:18 74703 ----a-w- c:\windows\SysWow64\mfc45.dll
2013-06-21 23:18 . 2013-06-22 13:11 -------- d-----w- c:\programdata\iolo
2013-06-21 23:18 . 2013-06-21 23:32 -------- d-----w- c:\users\rene\AppData\Roaming\iolo
2013-06-21 22:46 . 2013-06-21 22:46 -------- d-----w- c:\users\rene\AppData\Roaming\AVG
2013-06-21 22:46 . 2013-06-21 23:03 -------- d-----w- c:\program files (x86)\AVG
2013-06-21 22:46 . 2013-06-21 22:46 -------- d-----w- c:\programdata\AVG
2013-06-21 22:46 . 2013-06-21 22:46 -------- d-sh--w- c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-16 14:19 . 2013-06-18 22:31 -------- d-----w- c:\program files (x86)\MAGIX
2013-06-12 19:41 . 2013-06-08 14:08 279040 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2013-06-12 11:45 . 2013-05-08 06:39 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-08 00:31 . 2013-01-02 23:02 151552 ----a-w- c:\windows\KMSEmulator.exe
2013-06-25 22:12 . 2012-12-19 23:44 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2013-06-22 15:29 . 2012-06-06 15:07 867240 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-06-22 15:29 . 2011-12-13 02:01 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-18 22:16 . 2012-04-02 14:22 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-18 22:16 . 2011-12-13 01:16 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-16 14:20 . 2007-04-27 13:43 120200 ----a-w- c:\windows\SysWow64\DLLDEV32i.dll
2013-06-12 19:42 . 2011-12-13 01:16 75825640 ----a-w- c:\windows\system32\MRT.exe
2013-06-07 20:51 . 2013-06-07 20:51 53248 ----a-r- c:\users\rene\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-05-17 11:33 . 2010-06-24 19:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-02 06:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-13 05:49 . 2013-05-15 14:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 14:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 14:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 14:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 14:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 14:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 23:19 . 2013-05-09 14:44 2431792 ----a-w- c:\windows\system32\drivers\netr28x.sys
2013-04-12 14:45 . 2013-04-24 01:54 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 16:31 . 2013-04-10 16:31 2140160 ----a-w- c:\windows\SysWow64\python26.dll
2013-04-10 15:09 . 2013-06-07 20:52 849992 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2013-04-10 15:09 . 2013-06-07 20:52 73800 ----a-w- c:\windows\system32\RtNicProp64.dll
2013-04-10 15:09 . 2011-05-12 07:11 108104 ----a-w- c:\windows\system32\RTNUninst64.dll
2013-04-10 14:25 . 2013-04-10 14:25 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-10 14:25 . 2013-04-10 14:25 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-10 14:25 . 2013-04-10 14:25 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-10 14:25 . 2013-04-10 14:25 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-10 14:25 . 2013-04-10 14:25 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-10 14:25 . 2013-04-10 14:25 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-10 14:25 . 2013-04-10 14:25 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-10 14:25 . 2013-04-10 14:25 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-10 14:25 . 2013-04-10 14:25 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-10 14:25 . 2013-04-10 14:25 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-10 14:25 . 2013-04-10 14:25 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-10 14:25 . 2013-04-10 14:25 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-10 14:25 . 2013-04-10 14:25 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-10 14:25 . 2013-04-10 14:25 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-10 14:25 . 2013-04-10 14:25 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-10 14:25 . 2013-04-10 14:25 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-10 14:25 . 2013-04-10 14:25 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-10 14:25 . 2013-04-10 14:25 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-10 14:25 . 2013-04-10 14:25 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-10 14:25 . 2013-04-10 14:25 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-10 14:25 . 2013-04-10 14:25 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-10 14:25 . 2013-04-10 14:25 441856 ----a-w- c:\windows\system32\html.iec
2013-04-10 14:25 . 2013-04-10 14:25 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-10 14:25 . 2013-04-10 14:25 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-10 14:25 . 2013-04-10 14:25 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-10 14:25 . 2013-04-10 14:25 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-10 14:25 . 2013-04-10 14:25 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-10 14:25 . 2013-04-10 14:25 235008 ----a-w- c:\windows\system32\url.dll
2013-04-10 14:25 . 2013-04-10 14:25 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-10 14:25 . 2013-04-10 14:25 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-10 14:25 . 2013-04-10 14:25 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-10 14:25 . 2013-04-10 14:25 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-10 14:25 . 2013-04-10 14:25 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-10 14:25 . 2013-04-10 14:25 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-10 14:25 . 2013-04-10 14:25 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-10 14:25 . 2013-04-10 14:25 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-10 14:25 . 2013-04-10 14:25 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-10 14:25 . 2013-04-10 14:25 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-10 14:25 . 2013-04-10 14:25 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-10 14:25 . 2013-04-10 14:25 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-10 14:25 . 2013-04-10 14:25 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-10 14:25 . 2013-04-10 14:25 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-10 14:25 . 2013-04-10 14:25 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-10 14:25 . 2013-04-10 14:25 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-10 14:25 . 2013-04-10 14:25 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-10 14:25 . 2013-04-10 14:25 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-10 14:25 . 2013-04-10 14:25 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-10 14:25 . 2013-04-10 14:25 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-10 14:25 . 2013-04-10 14:25 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-10 06:01 . 2013-05-15 14:36 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-15 14:36 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:46 . 2013-07-08 00:31 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB7EF53F-303C-439B-AD22-6B6B69428DDC}\mpengine.dll
2013-04-10 03:30 . 2013-05-15 14:36 3153920 ----a-w- c:\windows\system32\win32k.sys
2012-10-27 06:17 . 2012-10-27 06:17 2174976 ----a-w- c:\program files (x86)\Common Files\atimpenc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="c:\program files (x86)\DU Meter\DUMeter.exe" [2009-03-13 1188752]
"googletalk"="c:\users\rene\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2013-07-05 108624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk * \0BootDefrag.exe\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"TrueImageMonitor.exe"=c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
"RunAIShell"=c:\program files (x86)\ASUS\AI Manager\AsShellApplication.exe
"LWS"=c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"hpqSRMon"=c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
.
R0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 DIRECTIO;DIRECTIO;c:\program files\PerformanceTest\DirectIo64.sys;c:\program files\PerformanceTest\DirectIo64.sys [x]
R3 DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver;c:\program files (x86)\DU Meter\DUMETR64.SYS;c:\program files (x86)\DU Meter\DUMETR64.SYS [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan60.sys [x]
R3 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R3 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R3 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 asahci64;asahci64;c:\windows\system32\drivers\asahci64.sys;c:\windows\SYSNATIVE\drivers\asahci64.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\DRIVERS\tdrpm251.sys;c:\windows\SYSNATIVE\DRIVERS\tdrpm251.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [x]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [x]
S2 Device Handle Service;Device Handle Service;c:\windows\SysWOW64\AsHookDevice.exe;c:\windows\SysWOW64\AsHookDevice.exe [x]
S2 DUMeterSvc;DU Meter Service;c:\program files (x86)\DU Meter\DUMeterSvc.exe;c:\program files (x86)\DU Meter\DUMeterSvc.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys;c:\windows\SYSNATIVE\DRIVERS\idmwfp.sys [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 Nakido;Nakido;c:\program files (x86)\Nakido\nakido.exe;c:\program files (x86)\Nakido\nakido.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 PS3 Media Server;PS3 Media Server;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-03 21:32 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.71\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 22:16]
.
2013-07-08 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2013-01-02 23:03]
.
2013-07-08 c:\windows\Tasks\GlaryInitialize 3.job
- c:\program files (x86)\Glary Utilities 3\Initialize.exe [2013-07-04 08:46]
.
2013-07-06 c:\windows\Tasks\GlaryUpdate 3.job
- c:\program files (x86)\Glary Utilities 3\CheckUpdate.exe [2013-07-04 08:45]
.
2013-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce04d9d9904716.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-16 21:50]
.
2013-07-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-16 21:50]
.
2013-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-647206060-696123565-3928554089-1000Core1ce07ce83364287.job
- c:\users\rene\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-08 22:10]
.
2013-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-647206060-696123565-3928554089-1000UA.job
- c:\users\rene\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-08 22:10]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2012-11-15 23:07 23496 ----a-w- c:\program files (x86)\Internet Download Manager\IDMShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2012-06-29 380544]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-12-21 6326448]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-03-29 7174728]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2013-03-08 1278024]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-03-22 172016]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-03-22 399856]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-03-22 442352]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=A126700B99B2C4EB5F7B8451D8CD0B20
uInternet Settings,ProxyServer = localhost:21320
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Barre RoboForm - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir au format Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Download all links with IDM - c:\program files (x86)\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files (x86)\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Enregistrer les formulaires - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Personnaliser le menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Remplir les formulaires - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
Trusted Zone: hotmail.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\
FF - prefs.js: browser.startup.homepage - google.ca
FF - ExtSQL: 2013-06-07 16:50; {F003DA68-8256-4b37-A6C4-350FA04494DF}; c:\program files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF - ExtSQL: 2013-07-05 08:19; {22119944-ED35-4ab1-910B-E619EA06A115}; c:\program files (x86)\Siber Systems\AI RoboForm\Firefox
FF - ExtSQL: 2013-07-05 08:40; mozilla_cc@internetdownloadmanager.com; c:\users\rene\AppData\Roaming\IDM\idmmzcc5
FF - ExtSQL: 2013-07-07 10:41; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-07-07 10:41; adblockpopups@jessehakanen.net; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-07-07 10:42; {d49a148e-817e-4025-bee3-5d541376de3b}; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\{d49a148e-817e-4025-bee3-5d541376de3b}.xpi
FF - ExtSQL: 2013-07-07 10:42; {0545b830-f0aa-4d7e-8820-50a4629a56fe}; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
FF - ExtSQL: 2013-07-07 10:43; personas@christopher.beard; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\personas@christopher.beard.xpi
FF - ExtSQL: 2013-07-07 10:46; fr-dicollecte@dictionaries.addons.mozilla.org; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\fr-dicollecte@dictionaries.addons.mozilla.org
FF - ExtSQL: !HIDDEN! 2012-01-09 21:34; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{12DB2EA6-0BB3-01EB-26E9-41BB5AF16DF1} - c:\windows\SysWow64\rpchtttp.dll
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Search Protection - c:\programdata\Search Protection\SearchProtection.exe
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DUMeterSvc]
"ImagePath"="c:\program files (x86)\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-647206060-696123565-3928554089-1000_Classes\Wow6432Node\CLSID\{0a45eaf1-ee0f-4904-8472-778aba6ea5e4}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000086
"Therad"=dword:0000001a
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-647206060-696123565-3928554089-1000_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c5,1a,17,5f,5b,c7,56,e4,f7,3f,f2,97,d2,7a,65,66,c1,02,8a,51,80,
b2,6f,66,60,f1,9d,28,dc,0d,5e,8b,f7,d1,cb,fd,bc,b7,01,b0,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\windows\SysWOW64\java.exe
c:\progra~2\DUMETE~1\DUMeter.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
.
**************************************************************************
.
Completion time: 2013-07-07 20:36:22 - machine was rebooted
ComboFix-quarantined-files.txt 2013-07-08 00:36
.
Pre-Run: 518,130,868,224 bytes free
Post-Run: 517,617,811,456 bytes free
.
- - End Of File - - 0B9F51677D24FF6F056F24AAFDEBC2B4
4976D4A7A40B83FC7F06EE4BDD84EB9B
je vais attendre de marquer résolu.Si jamais tu trouve s'était quoi je vais le noter.
Merci
Voici le rapport:
ComboFix 13-07-08.02 - rene 07/07/2013 20:18:53.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6056.4122 [GMT -4:00]
Running from: c:\users\rene\Downloads\Programs\ComboFix.exe
AV: ESET Smart Security 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\ESET\MiNODLogin
c:\users\rene\AppData\Roaming\inst.exe
c:\users\rene\AppData\Roaming\vso_ts_preview.xml
c:\windows\InstallDir
c:\windows\SysWow64\drivers\hwinterface.sys
c:\windows\SysWow64\regobj.dll
c:\windows\SysWow64\rpCHtttp.dll
c:\windows\TEMP\jna7271995608355205024.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-06-08 to 2013-07-08 )))))))))))))))))))))))))))))))
.
.
2013-07-08 00:28 . 2013-07-08 00:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-07 16:21 . 2013-07-07 16:21 -------- d-----w- C:\ToolBar SD
2013-07-07 16:18 . 2013-07-07 16:18 -------- d-----w- C:\rsit
2013-07-07 16:18 . 2013-07-07 16:18 -------- d-----w- c:\program files (x86)\trend micro
2013-07-07 14:30 . 2013-07-07 14:30 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2013-07-07 02:53 . 2013-07-07 02:53 3243520 ----a-w- C:\ezcddax.exe
2013-07-07 02:08 . 2013-07-07 13:32 -------- d-----w- c:\users\rene\AppData\Roaming\LavasoftStatistics
2013-07-07 02:06 . 2013-07-07 02:06 -------- d-----w- c:\programdata\Lavasoft
2013-07-07 02:05 . 2013-07-07 02:05 -------- d-----w- c:\programdata\Downloaded Installations
2013-07-07 02:04 . 2013-07-07 02:04 14456 ----a-w- c:\windows\system32\drivers\gfibto.sys
2013-07-07 02:03 . 2013-07-07 02:03 -------- d-----w- c:\program files\CCleaner
2013-07-05 17:16 . 2013-07-05 17:16 -------- d-----w- c:\programdata\Package Cache
2013-07-05 12:07 . 2009-03-13 17:13 8118488 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\RoboForm\roboform-x64.dll
2013-07-05 12:07 . 2009-03-13 17:13 5085696 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\RoboForm\roboform.dll
2013-07-05 11:34 . 2013-07-05 11:34 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2013-07-05 11:16 . 2009-01-25 17:14 17272 ----a-w- c:\windows\system32\sdnclean64.exe
2013-07-05 11:16 . 2013-07-05 11:17 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2013-07-05 10:47 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{486800A9-5ED8-4E63-AF8C-5F07A8EB557A}\mpengine.dll
2013-07-04 11:21 . 2013-07-04 11:21 -------- d-----w- c:\users\rene\AppData\Roaming\DiskDefrag
2013-07-02 15:17 . 2013-06-25 08:20 117024 ----a-w- c:\windows\SysWow64\BootDefrag.exe
2013-07-02 15:17 . 2013-06-25 08:20 117024 ----a-w- c:\windows\system32\BootDefrag.exe
2013-07-02 15:17 . 2013-04-24 06:52 16640 ----a-w- c:\windows\SysWow64\drivers\BootDefragDriver.sys
2013-07-02 15:10 . 2013-07-07 14:29 -------- d-----w- c:\program files (x86)\Glary Utilities 3
2013-07-02 14:58 . 2013-07-02 14:58 -------- d-----w- c:\users\rene\AppData\Roaming\Absolute Uninstaller
2013-07-02 14:54 . 2013-07-02 15:10 -------- d-----w- c:\users\rene\AppData\Roaming\GlarySoft
2013-06-30 21:37 . 2013-06-30 21:37 -------- d-----w- c:\users\rene\AppData\Roaming\CrystalIdea Software
2013-06-28 04:31 . 2013-06-27 09:57 172920 ----a-w- c:\windows\system32\drivers\idmwfp.sys
2013-06-27 22:26 . 2013-06-28 00:55 -------- d-----r- c:\users\rene\YandexDisk
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\users\rene\AppData\Roaming\Yandex
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\users\rene\AppData\Local\Yandex
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\program files (x86)\Yandex
2013-06-27 22:26 . 2013-06-27 22:26 -------- d-----w- c:\programdata\Yandex
2013-06-22 15:29 . 2013-06-22 15:29 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 23:59 . 2010-07-26 02:23 56496 ----a-w- c:\windows\SysWow64\wbhelp2.dll
2013-06-21 23:59 . 2010-07-26 02:23 544768 ----a-w- c:\windows\SysWow64\wbocx.ocx
2013-06-21 23:59 . 2010-07-26 02:23 33968 ----a-w- c:\windows\SysWow64\anim.dll
2013-06-21 23:59 . 2010-07-26 02:23 258352 ----a-w- c:\windows\SysWow64\unicows.dll
2013-06-21 23:59 . 2010-07-26 02:23 4608 ----a-w- c:\windows\SysWow64\W95INF32.DLL
2013-06-21 23:59 . 2010-07-26 02:23 2272 ----a-w- c:\windows\SysWow64\W95INF16.DLL
2013-06-21 23:22 . 2010-09-23 17:29 511328 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\CAPICOM\CAPICOM.DLL
2013-06-21 23:18 . 2013-06-21 23:18 74703 ----a-w- c:\windows\SysWow64\mfc45.dll
2013-06-21 23:18 . 2013-06-22 13:11 -------- d-----w- c:\programdata\iolo
2013-06-21 23:18 . 2013-06-21 23:32 -------- d-----w- c:\users\rene\AppData\Roaming\iolo
2013-06-21 22:46 . 2013-06-21 22:46 -------- d-----w- c:\users\rene\AppData\Roaming\AVG
2013-06-21 22:46 . 2013-06-21 23:03 -------- d-----w- c:\program files (x86)\AVG
2013-06-21 22:46 . 2013-06-21 22:46 -------- d-----w- c:\programdata\AVG
2013-06-21 22:46 . 2013-06-21 22:46 -------- d-sh--w- c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-16 14:19 . 2013-06-18 22:31 -------- d-----w- c:\program files (x86)\MAGIX
2013-06-12 19:41 . 2013-06-08 14:08 279040 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2013-06-12 11:45 . 2013-05-08 06:39 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-08 00:31 . 2013-01-02 23:02 151552 ----a-w- c:\windows\KMSEmulator.exe
2013-06-25 22:12 . 2012-12-19 23:44 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2013-06-22 15:29 . 2012-06-06 15:07 867240 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-06-22 15:29 . 2011-12-13 02:01 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-18 22:16 . 2012-04-02 14:22 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-18 22:16 . 2011-12-13 01:16 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-16 14:20 . 2007-04-27 13:43 120200 ----a-w- c:\windows\SysWow64\DLLDEV32i.dll
2013-06-12 19:42 . 2011-12-13 01:16 75825640 ----a-w- c:\windows\system32\MRT.exe
2013-06-07 20:51 . 2013-06-07 20:51 53248 ----a-r- c:\users\rene\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-05-17 11:33 . 2010-06-24 19:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-02 06:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-13 05:49 . 2013-05-15 14:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 14:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 14:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 14:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 14:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 14:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 23:19 . 2013-05-09 14:44 2431792 ----a-w- c:\windows\system32\drivers\netr28x.sys
2013-04-12 14:45 . 2013-04-24 01:54 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 16:31 . 2013-04-10 16:31 2140160 ----a-w- c:\windows\SysWow64\python26.dll
2013-04-10 15:09 . 2013-06-07 20:52 849992 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2013-04-10 15:09 . 2013-06-07 20:52 73800 ----a-w- c:\windows\system32\RtNicProp64.dll
2013-04-10 15:09 . 2011-05-12 07:11 108104 ----a-w- c:\windows\system32\RTNUninst64.dll
2013-04-10 14:25 . 2013-04-10 14:25 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-10 14:25 . 2013-04-10 14:25 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-10 14:25 . 2013-04-10 14:25 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-10 14:25 . 2013-04-10 14:25 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-10 14:25 . 2013-04-10 14:25 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-10 14:25 . 2013-04-10 14:25 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-10 14:25 . 2013-04-10 14:25 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-10 14:25 . 2013-04-10 14:25 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-10 14:25 . 2013-04-10 14:25 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-10 14:25 . 2013-04-10 14:25 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-10 14:25 . 2013-04-10 14:25 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-10 14:25 . 2013-04-10 14:25 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-10 14:25 . 2013-04-10 14:25 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-10 14:25 . 2013-04-10 14:25 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-10 14:25 . 2013-04-10 14:25 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-10 14:25 . 2013-04-10 14:25 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-10 14:25 . 2013-04-10 14:25 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-10 14:25 . 2013-04-10 14:25 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-10 14:25 . 2013-04-10 14:25 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-10 14:25 . 2013-04-10 14:25 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-10 14:25 . 2013-04-10 14:25 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-10 14:25 . 2013-04-10 14:25 441856 ----a-w- c:\windows\system32\html.iec
2013-04-10 14:25 . 2013-04-10 14:25 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-10 14:25 . 2013-04-10 14:25 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-10 14:25 . 2013-04-10 14:25 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-10 14:25 . 2013-04-10 14:25 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-10 14:25 . 2013-04-10 14:25 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-10 14:25 . 2013-04-10 14:25 235008 ----a-w- c:\windows\system32\url.dll
2013-04-10 14:25 . 2013-04-10 14:25 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-10 14:25 . 2013-04-10 14:25 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-10 14:25 . 2013-04-10 14:25 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-10 14:25 . 2013-04-10 14:25 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-10 14:25 . 2013-04-10 14:25 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-10 14:25 . 2013-04-10 14:25 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-10 14:25 . 2013-04-10 14:25 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-10 14:25 . 2013-04-10 14:25 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-10 14:25 . 2013-04-10 14:25 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-10 14:25 . 2013-04-10 14:25 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-10 14:25 . 2013-04-10 14:25 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-10 14:25 . 2013-04-10 14:25 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-10 14:25 . 2013-04-10 14:25 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-10 14:25 . 2013-04-10 14:25 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-10 14:25 . 2013-04-10 14:25 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-10 14:25 . 2013-04-10 14:25 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-10 14:25 . 2013-04-10 14:25 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-10 14:25 . 2013-04-10 14:25 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-10 14:25 . 2013-04-10 14:25 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-10 14:25 . 2013-04-10 14:25 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-10 14:25 . 2013-04-10 14:25 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-10 06:01 . 2013-05-15 14:36 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-15 14:36 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:46 . 2013-07-08 00:31 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB7EF53F-303C-439B-AD22-6B6B69428DDC}\mpengine.dll
2013-04-10 03:30 . 2013-05-15 14:36 3153920 ----a-w- c:\windows\system32\win32k.sys
2012-10-27 06:17 . 2012-10-27 06:17 2174976 ----a-w- c:\program files (x86)\Common Files\atimpenc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="c:\program files (x86)\DU Meter\DUMeter.exe" [2009-03-13 1188752]
"googletalk"="c:\users\rene\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2013-07-05 108624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk * \0BootDefrag.exe\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"TrueImageMonitor.exe"=c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
"RunAIShell"=c:\program files (x86)\ASUS\AI Manager\AsShellApplication.exe
"LWS"=c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"hpqSRMon"=c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
.
R0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 DIRECTIO;DIRECTIO;c:\program files\PerformanceTest\DirectIo64.sys;c:\program files\PerformanceTest\DirectIo64.sys [x]
R3 DUMeterDrv;Hagel Technologies DU Meter traffic accounting driver;c:\program files (x86)\DU Meter\DUMETR64.SYS;c:\program files (x86)\DU Meter\DUMETR64.SYS [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan60.sys [x]
R3 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R3 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R3 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 asahci64;asahci64;c:\windows\system32\drivers\asahci64.sys;c:\windows\SYSNATIVE\drivers\asahci64.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\DRIVERS\tdrpm251.sys;c:\windows\SYSNATIVE\DRIVERS\tdrpm251.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [x]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [x]
S2 Device Handle Service;Device Handle Service;c:\windows\SysWOW64\AsHookDevice.exe;c:\windows\SysWOW64\AsHookDevice.exe [x]
S2 DUMeterSvc;DU Meter Service;c:\program files (x86)\DU Meter\DUMeterSvc.exe;c:\program files (x86)\DU Meter\DUMeterSvc.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys;c:\windows\SYSNATIVE\DRIVERS\idmwfp.sys [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 Nakido;Nakido;c:\program files (x86)\Nakido\nakido.exe;c:\program files (x86)\Nakido\nakido.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 PS3 Media Server;PS3 Media Server;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe;c:\program files (x86)\PS3 Media Server\win32\service\wrapper.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-03 21:32 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.71\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 22:16]
.
2013-07-08 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2013-01-02 23:03]
.
2013-07-08 c:\windows\Tasks\GlaryInitialize 3.job
- c:\program files (x86)\Glary Utilities 3\Initialize.exe [2013-07-04 08:46]
.
2013-07-06 c:\windows\Tasks\GlaryUpdate 3.job
- c:\program files (x86)\Glary Utilities 3\CheckUpdate.exe [2013-07-04 08:45]
.
2013-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce04d9d9904716.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-16 21:50]
.
2013-07-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-16 21:50]
.
2013-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-647206060-696123565-3928554089-1000Core1ce07ce83364287.job
- c:\users\rene\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-08 22:10]
.
2013-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-647206060-696123565-3928554089-1000UA.job
- c:\users\rene\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-08 22:10]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-07 03:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2012-11-15 23:07 23496 ----a-w- c:\program files (x86)\Internet Download Manager\IDMShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2012-06-29 380544]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-12-21 6326448]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-03-29 7174728]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2013-03-08 1278024]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-03-22 172016]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-03-22 399856]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-03-22 442352]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=A126700B99B2C4EB5F7B8451D8CD0B20
uInternet Settings,ProxyServer = localhost:21320
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Barre RoboForm - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir au format Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Download all links with IDM - c:\program files (x86)\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files (x86)\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Enregistrer les formulaires - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Personnaliser le menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Remplir les formulaires - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
Trusted Zone: hotmail.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\
FF - prefs.js: browser.startup.homepage - google.ca
FF - ExtSQL: 2013-06-07 16:50; {F003DA68-8256-4b37-A6C4-350FA04494DF}; c:\program files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF - ExtSQL: 2013-07-05 08:19; {22119944-ED35-4ab1-910B-E619EA06A115}; c:\program files (x86)\Siber Systems\AI RoboForm\Firefox
FF - ExtSQL: 2013-07-05 08:40; mozilla_cc@internetdownloadmanager.com; c:\users\rene\AppData\Roaming\IDM\idmmzcc5
FF - ExtSQL: 2013-07-07 10:41; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-07-07 10:41; adblockpopups@jessehakanen.net; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-07-07 10:42; {d49a148e-817e-4025-bee3-5d541376de3b}; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\{d49a148e-817e-4025-bee3-5d541376de3b}.xpi
FF - ExtSQL: 2013-07-07 10:42; {0545b830-f0aa-4d7e-8820-50a4629a56fe}; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
FF - ExtSQL: 2013-07-07 10:43; personas@christopher.beard; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\personas@christopher.beard.xpi
FF - ExtSQL: 2013-07-07 10:46; fr-dicollecte@dictionaries.addons.mozilla.org; c:\users\rene\AppData\Roaming\Mozilla\Firefox\Profiles\98miq5jz.default-1373207868233\extensions\fr-dicollecte@dictionaries.addons.mozilla.org
FF - ExtSQL: !HIDDEN! 2012-01-09 21:34; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{12DB2EA6-0BB3-01EB-26E9-41BB5AF16DF1} - c:\windows\SysWow64\rpchtttp.dll
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Search Protection - c:\programdata\Search Protection\SearchProtection.exe
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DUMeterSvc]
"ImagePath"="c:\program files (x86)\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-647206060-696123565-3928554089-1000_Classes\Wow6432Node\CLSID\{0a45eaf1-ee0f-4904-8472-778aba6ea5e4}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000086
"Therad"=dword:0000001a
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-647206060-696123565-3928554089-1000_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c5,1a,17,5f,5b,c7,56,e4,f7,3f,f2,97,d2,7a,65,66,c1,02,8a,51,80,
b2,6f,66,60,f1,9d,28,dc,0d,5e,8b,f7,d1,cb,fd,bc,b7,01,b0,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\SysWOW64\IoctlSvc.exe
c:\windows\SysWOW64\java.exe
c:\progra~2\DUMETE~1\DUMeter.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
.
**************************************************************************
.
Completion time: 2013-07-07 20:36:22 - machine was rebooted
ComboFix-quarantined-files.txt 2013-07-08 00:36
.
Pre-Run: 518,130,868,224 bytes free
Post-Run: 517,617,811,456 bytes free
.
- - End Of File - - 0B9F51677D24FF6F056F24AAFDEBC2B4
4976D4A7A40B83FC7F06EE4BDD84EB9B
je vais attendre de marquer résolu.Si jamais tu trouve s'était quoi je vais le noter.
Merci
culturelles2
Messages postés
100
Date d'inscription
vendredi 26 décembre 2008
Statut
Membre
Dernière intervention
29 octobre 2019
15
11 juil. 2013 à 21:05
11 juil. 2013 à 21:05
Bon pas de réponse je vais le mettre comme résolu combofix.Merci
