bonjour j'ai des fenetres qui s'ouvrent toutes seul suis infecté Résolu/Fermé

Question

Bonjour,  j'ai des fenêtres qui s'ouvrent toutes seul, je pense que je suis infecté , si une personne a le temps de pouvoir m'expliquer comment procéder je serais très heureux , en attendent vos réponses avec impatience , je vous en remercie d'avance , amicalement . 



Configuration: windows seven

Malekal_morte- · Answer

Salut,     



Télécharge http://general-changelog-team.fr/telechargements/logiciels/viewdownload/75-outils-de-xplode/28-adwcleaner AdwCleaner ( d'Xplode ) sur ton bureau.  
Lance le, clique sur [Suppression] puis patiente le temps du scan (Pas besoin de faire de Recherche avant).  
Une fois le scan fini, un rapport s'ouvrira. Copie/colle le contenu du rapport dans ta prochaine réponse par un copier/coller.
Si cela ne fonctionne pas, utilise le site http://pjjoint.malekal.com pour héberger le rapport, donne le lien du rapport dans un nouveau message.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt  


puis:


Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections - Le programme va générer deux rapports OTL.txt et Extras.txt 
Fournir les deux rapports :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/    

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.    
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)    

Dans le cas d'Avast!, ne pas lancer le programme dans la Sandbox (voir lien d'aide ci-dessus).

* Lance OTL    
* En haut à droite de Analyse rapide, coche "tous les utilisateurs"
* Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :    



netsvcs   
msconfig   
safebootminimal   
safebootnetwork   
activex   
drivers32   
%ALLUSERSPROFILE%\Application Data\*.   
%ALLUSERSPROFILE%\Application Data\*.exe /s   
%APPDATA%\*.   
%APPDATA%\*.exe /s   
%temp%\*.exe /s   
%SYSTEMDRIVE%\*.exe   
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles   
%windir%\Tasks\*.job /lockedfiles   
%systemroot%\system32\drivers\*.sys /lockedfiles   
%systemroot%\System32\config\*.sav   
/md5start   
explorer.exe   
winlogon.exe
services.exe
wininit.exe
/md5stop
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
CREATERESTOREPOINT   
nslookup https://www.google.fr/?gws_rd=ssl /c   
SAVEMBR:0   
hklm\software\clients\startmenuinternet|command /rs   
hklm\software\clients\startmenuinternet|command /64 /rs



* Clique sur le bouton Analyse.

* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent).
Donne le ou les liens pjjoint qui pointent vers ces rapports ici dans un nouveau message.
Je répète : donne le lien du rapport pjjoint ici dans un nouveau message.

NE PAS COPIER/COLLER LE RAPPORT ICI - DONNER LE LIEN PJJOINT DANS UN NOUVEAU MESSAGE

spherius · Answer

je suis sous windows vista de marque TOSHIBA (Satellite) et ne peux avoir de réponses par e-mail merci .

spherius · Answer

Bonjour, merci j'étais entrain de télécharger Hidjackthis mais apparemment il n'y a plus de place sur l'ordinateur je vais enlever des programmes inutiles et je vous tient au courant merci beaucoup d'avoir répondu aussi vite ensuite je ferais ce que vous m'avait demandé de faire a toute de suite .




Configuration: windows vista

spherius · Answer

quand je clique sur le lien :---->Télécharge http://general-changelog-team.fr/telechargements/logiciels/viewdownload/75-outils-de-xplode/28-adwcleaner AdwCleaner ( d'Xplode ) sur ton bureau. je clique sur download now je vois xplode mais ne vois pas le lien pour télécharger sinon je le télécharge ailleurs !!!

spherius · Answer

je vous envoi le rapport adwcleaner ?

spherius · Answer

# AdwCleaner v2.306 - Rapport créé le 23/07/2013 à 14:27:02 # Mis à jour le 19/07/2013 par Xplode # Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # Nom d'utilisateur : polak - PC-DE-POLAK # Mode de démarrage : Normal # Exécuté depuis : C:\Users\polak\Desktop\Downloads\adwcleaner.exe # Option [Suppression] ***** [Services] ***** ***** [Fichiers / Dossiers] ***** Dossier Supprimé : C:\Program Files\AskBarDis Dossier Supprimé : C:\Program Files\DealPly Dossier Supprimé : C:\Program Files\DealPlyLive Dossier Supprimé : C:\Program Files\Fluendo Dossier Supprimé : C:\Program Files\Free Offers from Freeze.com Dossier Supprimé : C:\Program Files\LyricsPal Dossier Supprimé : C:\Program Files\PriceGong Dossier Supprimé : C:\ProgramData\DealPlyLive Dossier Supprimé : C:\Users\polak\AppData\Local\Bundled software uninstaller Dossier Supprimé : C:\Users\polak\AppData\Local\DealPlyLive Dossier Supprimé : C:\Users\polak\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf Dossier Supprimé : C:\Users\polak\AppData\Local\moovida air Dossier Supprimé : C:\Users\polak\AppData\LocalLow\BabylonToolbar Dossier Supprimé : C:\Users\polak\AppData\LocalLow\Conduit Dossier Supprimé : C:\Users\polak\AppData\LocalLow\PriceGong Dossier Supprimé : C:\Users\polak\AppData\LocalLow\ShoppingReport2 Dossier Supprimé : C:\Users\polak\AppData\Roaming\DealPly Dossier Supprimé : C:\Users\polak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly Dossier Supprimé : C:\Users\polak\AppData\Roaming\moovida-1 Dossier Supprimé : C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\Conduit Dossier Supprimé : C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\ConduitCommon Dossier Supprimé : C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\CT2542115 Dossier Supprimé : C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\extensions\{4daac69c-cba7-45e2-9bc8-1044483d3352} Dossier Supprimé : C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f} Dossier Supprimé : C:\Users\polak\AppData\Roaming\Nosibay Dossier Supprimé : C:\Users\polak\AppData\Roaming\OfferBox Dossier Supprimé : C:\Users\polak\AppData\Roaming\OpenCandy Fichier Supprimé : C:\Program Files\Mozilla FireFox\Components\AskSearch.js Fichier Supprimé : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml Fichier Supprimé : C:\Users\polak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\lollipop.lnk Fichier Supprimé : C:\Users\polak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop.lnk Fichier Supprimé : C:\Windows\Tasks\Dealply.job ***** [Registre] ***** Clé Supprimée : HKCU\Software\AppDataLow\Software\Crossrider Clé Supprimée : HKCU\Software\AppDataLow\Software\PriceGong Clé Supprimée : HKCU\Software\AppDataLow\Software\ShoppingReport2 Clé Supprimée : HKCU\Software\AppDataLow\Software\Toolbar Clé Supprimée : HKCU\Software\BI Clé Supprimée : HKCU\Software\Conduit Clé Supprimée : HKCU\Software\DealPly Clé Supprimée : HKCU\Software\FissaSearch Clé Supprimée : HKCU\Software\InstallCore Clé Supprimée : HKCU\Software\InstalledBrowserExtensions Clé Supprimée : HKCU\Software\lollipop Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5} Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E} Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B41306C6-96D0-442A-BCC4-B0F621E82CE9} Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\bi_uninstaller Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DealPly Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\hblitesa Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\lollipop Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\lrcspal@lyricspal.co Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Optimizer Pro_is1 Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\QuestScan Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport2 Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311711180} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{434DD048-C41D-43FC-B41D-D6F124AF9434} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly Clé Supprimée : HKCU\Software\Nosibay Clé Supprimée : HKCU\Software\Offerbox Clé Supprimée : HKCU\Software\Softonic Clé Supprimée : HKCU\Software\Spointer Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\escort.DLL Clé Supprimée : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Clé Supprimée : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711180} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1} Clé Supprimée : HKLM\SOFTWARE\Classes\Conduit.Engine Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.BHO Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.BHO.1 Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.Sandbox Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.Sandbox.1 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc Clé Supprimée : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc.1.0 Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C} Clé Supprimée : HKLM\SOFTWARE\Classes\Toolbar.CT2542115 Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947} Clé Supprimée : HKLM\Software\DealPly Clé Supprimée : HKLM\Software\Freeze.com Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311711180} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{434DD048-C41D-43FC-B41D-D6F124AF9434} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311711180} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966 Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lrcspal@lyricspal.co Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3 Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9 Clé Supprimée : HKLM\Software\Offerbox Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Bubble Dock] ***** [Navigateurs] ***** -\ Internet Explorer v9.0.8112.16496 Remplacé : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=3ef3947e000000000000002163a57300&tlver=1.4.19.19&affID=17160 --> hxxp://www.google.com -\ Mozilla Firefox v12.0 (fr) Fichier : C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\prefs.js C:\Users\polak\AppData\Roaming\Mozilla\Firefox\Profiles\mzjdfymp.default\user.js ... Supprimé ! Supprimée : user_pref("CT2542115..clientLogIsEnabled", false); Supprimée : user_pref("CT2542115..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Supprimée : user_pref("CT2542115..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Supprimée : user_pref("CT2542115.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Supprimée : user_pref("CT2542115.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Supprimée : user_pref("CT2542115.AppTrackingLastCheckTime", "Fri Jul 19 2013 19:18:05 GMT+0200"); Supprimée : user_pref("CT2542115.BrowserCompStateIsOpen_129780208973942041", true); Supprimée : user_pref("CT2542115.BrowserCompStateIsOpen_129790546080283738", true); Supprimée : user_pref("CT2542115.BrowserCompStateIsOpen_1367226505000", true); Supprimée : user_pref("CT2542115.CTID", "CT2542115"); Supprimée : user_pref("CT2542115.CurrentServerDate", "23-7-2013"); Supprimée : user_pref("CT2542115.DialogsAlignMode", "LTR"); Supprimée : user_pref("CT2542115.DialogsGetterLastCheckTime", "Fri Jul 19 2013 19:17:57 GMT+0200"); Supprimée : user_pref("CT2542115.DownloadReferralCookieData", ""); Supprimée : user_pref("CT2542115.EMailNotifierPollDate", "Tue Jul 23 2013 13:21:19 GMT+0200"); Supprimée : user_pref("CT2542115.FeedLastCount3702671119025834822", 904); Supprimée : user_pref("CT2542115.FeedPollDate1154579606993571455", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607031076616", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607120332248", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607120463320", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607120528856", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607120594392", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607120659928", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607254614839", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579607731405437", "Fri Dec 16 2011 20:17:37 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579608231640385", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579608467137450", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579608468016907", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579608628136389", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579608675890832", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579608833656362", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579609299927420", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579609521108563", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579609576983218", "Fri Dec 16 2011 20:17:37 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579610226745907", "Fri Dec 16 2011 20:17:41 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579610508907107", "Fri Dec 16 2011 20:17:40 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate1154579610709294640", "Fri Dec 16 2011 20:17:38 GMT+0100"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915761", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915767", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915773", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915779", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915785", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915791", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915797", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915803", "Thu Mar 31 2011 06:39:13 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915809", "Thu Mar 31 2011 06:39:15 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915815", "Thu Mar 31 2011 06:39:15 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915821", "Thu Mar 31 2011 06:39:15 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915827", "Thu Mar 31 2011 06:39:15 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915833", "Thu Mar 31 2011 06:39:15 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915839", "Thu Mar 31 2011 06:39:15 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915845", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915851", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915857", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915863", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915869", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915875", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedPollDate129255209834915881", "Thu Mar 31 2011 06:39:16 GMT+0200"); Supprimée : user_pref("CT2542115.FeedTTL1154579606993571455", 5); Supprimée : user_pref("CT2542115.FeedTTL1154579607731405437", 2); Supprimée : user_pref("CT2542115.FeedTTL1154579608468016907", 30); Supprimée : user_pref("CT2542115.FeedTTL1154579608675890832", 2); Supprimée : user_pref("CT2542115.FeedTTL1154579608833656362", 5); Supprimée : user_pref("CT2542115.FeedTTL1154579609521108563", 5); Supprimée : user_pref("CT2542115.FeedTTL1154579609576983218", 15); Supprimée : user_pref("CT2542115.FeedTTL1154579610508907107", 5); Supprimée : user_pref("CT2542115.FeedTTL1154579610709294640", 2); Supprimée : user_pref("CT2542115.FeedTTL129255209834915761", 2); Supprimée : user_pref("CT2542115.FeedTTL129255209834915767", 2); Supprimée : user_pref("CT2542115.FeedTTL129255209834915773", 2); Supprimée : user_pref("CT2542115.FeedTTL129255209834915785", 2); Supprimée : user_pref("CT2542115.FeedTTL129255209834915791", 30); Supprimée : user_pref("CT2542115.FeedTTL129255209834915809", 5); Supprimée : user_pref("CT2542115.FeedTTL129255209834915815", 5); Supprimée : user_pref("CT2542115.FeedTTL129255209834915821", 5); Supprimée : user_pref("CT2542115.FeedTTL129255209834915839", 5); Supprimée : user_pref("CT2542115.FirstServerDate", "1-12-2010"); Supprimée : user_pref("CT2542115.FirstTime", true); Supprimée : user_pref("CT2542115.FirstTimeFF3", true); Supprimée : user_pref("CT2542115.FixPageNotFoundErrors", true); Supprimée : user_pref("CT2542115.GroupingServerCheckInterval", 1440); Supprimée : user_pref("CT2542115.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Supprimée : user_pref("CT2542115.HasUserGlobalKeys", true); Supprimée : user_pref("CT2542115.HomePageProtectorEnabled", false); Supprimée : user_pref("CT2542115.HomepageBeforeUnload", "hxxp://www.google.fr/ig"); Supprimée : user_pref("CT2542115.Initialize", true); Supprimée : user_pref("CT2542115.InitializeCommonPrefs", true); Supprimée : user_pref("CT2542115.InstallationAndCookieDataSentCount", 3); Supprimée : user_pref("CT2542115.InstallationId", "integrated_CT2542115.exe"); Supprimée : user_pref("CT2542115.InstallationType", "ConduitIntegration"); Supprimée : user_pref("CT2542115.InstalledDate", "Wed Dec 01 2010 18:03:44 GMT+0100"); Supprimée : user_pref("CT2542115.InvalidateCache", false); Supprimée : user_pref("CT2542115.IsAlertDBUpdated", true); Supprimée : user_pref("CT2542115.IsGrouping", false); Supprimée : user_pref("CT2542115.IsMulticommunity", false); Supprimée : user_pref("CT2542115.IsOpenThankYouPage", false); Supprimée : user_pref("CT2542115.IsOpenUninstallPage", true); Supprimée : user_pref("CT2542115.LanguagePackLastCheckTime", "Tue Jul 23 2013 13:16:18 GMT+0200"); Supprimée : user_pref("CT2542115.LanguagePackReloadIntervalMM", 1440); Supprimée : user_pref("CT2542115.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Supprimée : user_pref("CT2542115.LastLogin_3.19.0.3", "Tue Jul 23 2013 13:21:56 GMT+0200"); Supprimée : user_pref("CT2542115.LastLogin_3.2.1.3", "Tue Dec 14 2010 21:34:13 GMT+0100"); Supprimée : user_pref("CT2542115.LastLogin_3.2.5.2", "Thu Apr 07 2011 01:51:24 GMT+0200"); Supprimée : user_pref("CT2542115.LastLogin_3.3.3.2", "Fri Jul 19 2013 19:17:51 GMT+0200"); Supprimée : user_pref("CT2542115.LatestVersion", "3.19.0.3"); Supprimée : user_pref("CT2542115.Locale", "fr-fr"); Supprimée : user_pref("CT2542115.MCDetectTooltipHeight", "83"); Supprimée : user_pref("CT2542115.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Supprimée : user_pref("CT2542115.MCDetectTooltipWidth", "295"); Supprimée : user_pref("CT2542115.MyStuffEnabledAtInstallation", true); Supprimée : user_pref("CT2542115.RadioIsPodcast", false); Supprimée : user_pref("CT2542115.RadioLastCheckTime", "Tue Jul 23 2013 13:16:13 GMT+0200"); Supprimée : user_pref("CT2542115.RadioLastUpdateIPServer", "3"); Supprimée : user_pref("CT2542115.RadioLastUpdateServer", "3"); Supprimée : user_pref("CT2542115.RadioMediaID", "9962"); Supprimée : user_pref("CT2542115.RadioMediaType", "Media Player"); Supprimée : user_pref("CT2542115.RadioMenuSelectedID", "EBRadioMenu_CT25421159962"); Supprimée : user_pref("CT2542115.RadioShrinkedFromSetup", false); Supprimée : user_pref("CT2542115.RadioStationName", "California%20Rock"); Supprimée : user_pref("CT2542115.RadioStationURL", "hxxp://feedlive.net/california.asx"); Supprimée : user_pref("CT2542115.SavedHomepage", "hxxp://www.fissa.com/en/?s=h&c=1012018614&suid=Elk..RMUs&d=6&p[...] Supprimée : user_pref("CT2542115.SearchEngine", "Recherche||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_[...] Supprimée : user_pref("CT2542115.SearchEngineBeforeUnload", "AOL search"); Supprimée : user_pref("CT2542115.SearchFromAddressBarIsInit", true); Supprimée : user_pref("CT2542115.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT254[...] Supprimée : user_pref("CT2542115.SearchInNewTabEnabled", true); Supprimée : user_pref("CT2542115.SearchInNewTabIntervalMM", 1440); Supprimée : user_pref("CT2542115.SearchInNewTabLastCheckTime", "Tue Jul 23 2013 13:16:13 GMT+0200"); Supprimée : user_pref("CT2542115.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Supprimée : user_pref("CT2542115.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...] Supprimée : user_pref("CT2542115.SearchProtectorEnabled", false); Supprimée : user_pref("CT2542115.SearchProtectorToolbarDisabled", false); Supprimée : user_pref("CT2542115.ServiceMapLastCheckTime", "Tue Jul 23 2013 13:16:10 GMT+0200"); Supprimée : user_pref("CT2542115.SettingsLastCheckTime", "Tue Jul 23 2013 13:16:07 GMT+0200"); Supprimée : user_pref("CT2542115.SettingsLastUpdate", "1374567187"); Supprimée : user_pref("CT2542115.ThirdPartyComponentsInterval", 504); Supprimée : user_pref("CT2542115.ThirdPartyComponentsLastCheck", "Fri Jul 19 2013 19:17:46 GMT+0200"); Supprimée : user_pref("CT2542115.ThirdPartyComponentsLastUpdate", "1368739332"); Supprimée : user_pref("CT2542115.ToolbarShrinkedFromSetup", false); Supprimée : user_pref("CT2542115.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2542115"); Supprimée : user_pref("CT2542115.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Supprimée : user_pref("CT2542115.UserID", "UN76101816195901872"); Supprimée : user_pref("CT2542115.ValidationData_Search", 2); Supprimée : user_pref("CT2542115.ValidationData_Toolbar", 2); Supprimée : user_pref("CT2542115.WeatherNetwork", ""); Supprimée : user_pref("CT2542115.WeatherPollDate", "Tue Jul 23 2013 13:16:18 GMT+0200"); Supprimée : user_pref("CT2542115.WeatherUnit", "C"); Supprimée : user_pref("CT2542115.alertChannelId", "935078"); Supprimée : user_pref("CT2542115.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B474[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e-x305", "247E29327641363937333545397E3F493B2F77317E2025203[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e.:2z527", "2423"); Supprimée : user_pref("CT2542115.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e06cg5el8:", "6E6D6A6E6E6D6D756E72"); Supprimée : user_pref("CT2542115.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A747370747473737B7478242F4B4947[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347513[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7ex305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4B524B4[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...] Supprimée : user_pref("CT2542115.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934235[...] Supprimée : user_pref("CT2542115.backendstorage./9b-0?3g>d", "3C6740706A74706F7A77727A7620787D494A257D7C507E2A55[...] Supprimée : user_pref("CT2542115.backendstorage./9b-0?3g@6:5;", ""); Supprimée : user_pref("CT2542115.backendstorage./9b-0?3gfa7ef", "2B2E2C3D"); Supprimée : user_pref("CT2542115.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F297B7E7D21202F26313E424[...] Supprimée : user_pref("CT2542115.backendstorage./9b/>01=9a6k6@44i48?", "372C2D32697576334236334148477B213F3E484F4E4D464[...] Supprimée : user_pref("CT2542115.backendstorage./9b5ba==9cjag", "396840724171426F7A4779447B774A794A7B222224"); Supprimée : user_pref("CT2542115.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6A6E6E6D6D756E7071757B"); Supprimée : user_pref("CT2542115.backendstorage./9b9643g3/9e", "6A"); Supprimée : user_pref("CT2542115.backendstorage./9b;45>:bi9i7ie", "2B2E2C3D"); Supprimée : user_pref("CT2542115.backendstorage./9b<:222h64<", "393F352F3E"); Supprimée : user_pref("CT2542115.backendstorage./9b<:222h64

spherius · Answer

j'attends car OTL by Old Time (ne répond pas) j'enverrais le rapport comme dit ,
je pense que c'est a cause de mon ordinateur qui est infecté

spherius · Answer

y'a une fenêtre qui c'est ouverte il y a écrit ToshibaRegistration.exe - ERREUR d'application (en titre ) il me dit: l'application a généré une execption non gérée.
ID de processus=0x58c (1420). ID de thread =0x664 ( 1636).
cliquez sur ok pour terminer l'application.
cliquez sur annuler pour déboguer l'application.

que dois-je faire ?
 j'attends toujours que OTL répond ;}

spherius · Answer

c'est bon OTL c'est remis au travail :]

spherius · Answer

voila je vous est envoyé les 2 rapport don : 1 OTL et le 2 eme Extras.Txt sur ce lien http://pjjoint.malekal.com/ j'espère que je n'ai pas fait d'erreur jusqu'à présent .

spherius · Answer

et voilà Extras.Txt le 2 eme OTL Extras logfile created on: 23/07/2013 14:46:29 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\polak\Desktop\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 3,00 Gb Total Physical Memory | 1,75 Gb Available Physical Memory | 58,40% Memory free 6,20 Gb Paging File | 4,92 Gb Available in Paging File | 79,37% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 74,22 Gb Total Space | 1,97 Gb Free Space | 2,65% Space Free | Partition Type: NTFS Drive E: | 73,36 Gb Total Space | 73,22 Gb Free Space | 99,80% Space Free | Partition Type: NTFS Computer Name: PC-DE-POLAK | User Name: polak | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-2465910400-424495605-2526843765-1000\SOFTWARE\Classes\] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "UacDisableNotify" = 1 "InternetSettingsDisableNotify" = 1 "AutoUpdateDisableNotify" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0A4D9416-1390-4E1B-AA7E-78539B33651C}" = rport=137 | protocol=17 | dir=out | app=system | "{1572120B-A666-4089-B9A4-76CFD6EEE752}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{1A868CA7-F95E-4124-9FAC-BB0129291617}" = lport=445 | protocol=6 | dir=in | app=system | "{3ED503CE-1120-46DD-A383-418C33892981}" = lport=139 | protocol=6 | dir=in | app=system | "{55770798-BFBD-41A4-A250-75F435EE37B2}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{5878AF00-B226-490C-A89E-632967AB1807}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{597F27D6-2680-45BA-A768-202E000832AC}" = lport=2869 | protocol=6 | dir=in | app=system | "{5DCA3979-9549-4AD4-B553-04F520B44837}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{62C8B07C-4215-4D1A-892D-60CCF4C81A53}" = rport=445 | protocol=6 | dir=out | app=system | "{6C6B128A-3AD7-4880-8BD5-E053544CA4FC}" = rport=138 | protocol=17 | dir=out | app=system | "{728C360B-5811-4084-967A-1137CC217657}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{8546B97F-D242-4B42-8E7B-2CCEC4F2CD84}" = rport=10243 | protocol=6 | dir=out | app=system | "{9ECDF029-8F4F-49C5-B768-2F8615FB1107}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{AAA79D5F-08DD-40F0-91D5-7BAC66ED15F6}" = lport=137 | protocol=17 | dir=in | app=system | "{C95BB32A-532D-432C-86BE-F4D91F3E45EA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{CEA21ED1-0EAB-4701-B56C-8595D04E434C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{D408FFD4-6F54-4CC0-BC87-F9EDBE2BB0C6}" = lport=2869 | protocol=6 | dir=in | app=system | "{DEF21E30-C06C-42AE-ABC8-0D341D1C6045}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{EB30B52E-B645-4B51-AAEF-082BFC588728}" = lport=138 | protocol=17 | dir=in | app=system | "{EDAA4A68-1A5E-4BE5-A49A-E2D199322B2B}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{EFE4452E-092A-4B7C-9C36-39E32BEB57FA}" = rport=139 | protocol=6 | dir=out | app=system | "{F494BA0C-ECEA-45B6-BFAF-A0F8FCEA9955}" = lport=10243 | protocol=6 | dir=in | app=system | "{FB56A358-2DD1-4252-B794-7BD481BFC4F5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{23437DCB-8C5E-46DA-81F6-D8A1A2E36A48}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{37C53222-AE6A-46EA-97BE-E57D31C9111D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{3CB90144-B1D9-44AD-ACCE-C96CA28F0076}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{3FD77E04-C2B2-4B78-A750-6DE58FEB8B53}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{429FB69D-E795-4E21-A570-BDA702D76958}" = dir=in | app=c:\program files\windows live\mesh\moe.exe | "{518B19E7-52DC-4CFB-A596-5279DDBA6638}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{548B8CBB-D5A4-4BBC-B67E-CC7854B3E053}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | "{56A961CD-E871-4BB2-A457-4C7170C7DBD2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{6A367D23-AA2C-4ECE-BB31-DECA91DA2256}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{6E2AECD0-8A66-4A30-A1E2-9555D31C9EFB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{70FDB722-C558-45CB-958B-C6136E1BED02}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{73A1DD25-6D89-49C9-A1BE-B358A25D9FA8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{78B5F6A0-F580-48DA-A6D9-9DCEB2291814}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{89BFB690-2DDA-49A6-980E-BAB1C392A450}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | "{89FF16B5-BB8C-4C11-AB4D-D7427DC33503}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{9E3B2D73-BFE4-488B-94E3-44FB15899C8B}" = protocol=6 | dir=out | app=system | "{BD16AD30-A71A-4241-85BF-2B025FE90B7B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{CC500CC5-3518-4723-8C72-F6EA8251BB94}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{CC96E181-073F-44FC-AB9B-753244C3733C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{D1608E08-80D1-445D-894D-8C462B429663}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{D182DF62-1C44-4C83-B689-E0A92A603CAA}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{E37814C8-9670-4ED8-A9B4-D0A7083D570A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{EB278918-D777-4783-AEE7-F0B58CEDA139}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | "{EE8F3031-EC1D-484C-A617-3E8FE44FF912}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{F43CD8CC-1A7D-4D01-8969-FEAF73510487}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{FCB37F07-FF02-4CBF-9EF2-3613CD2BCDE9}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "TCP Query User{45DB5097-0C39-41E1-9440-04F958E4D209}C:\program files\shareaza\shareaza.exe" = protocol=6 | dir=in | app=c:\program files\shareaza\shareaza.exe | "TCP Query User{4914BEE0-F695-40BD-B313-E133EFA05DC4}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | "TCP Query User{A1B4BA4A-FFE9-42A3-B006-1B6BF2ED4EB4}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | "UDP Query User{28BCC1D9-7ADA-456E-B6A9-E933D17BF5DB}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | "UDP Query User{6DE256BB-78F3-4904-BE1C-5478498A1E2B}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | "UDP Query User{A7D8A03A-2B15-401E-AF2F-353E1446C903}C:\program files\shareaza\shareaza.exe" = protocol=17 | dir=in | app=c:\program files\shareaza\shareaza.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{04CB6099-90D2-896A-8E01-8F1228499D93}" = Catalyst Control Center Localization Dutch "{068138BE-11F5-8F56-8D88-13837314558E}" = CCC Help German "{09F56A49-A7B1-4AAB-95B9-D13094254AD1}" = Windows Live UX Platform Language Pack "{0A2F0BB6-D45B-AF3C-C19A-6950342AF6B1}" = Catalyst Control Center Localization Turkish "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{0BAA36F4-8138-AD8A-3791-44A7F0DD63E7}" = CCC Help Japanese "{0C2B0B35-CF80-1384-D2F0-14F119F1784E}" = Catalyst Control Center Localization Chinese Standard "{0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}" = Microsoft .NET Framework 4 Client Profile FRA Language Pack "{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist "{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter "{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client "{1A998953-E64F-CE34-4517-C58EF5092157}" = CCC Help Turkish "{1AED74D3-4C54-3CAA-65DE-4EAB7B589AE1}" = Catalyst Control Center Localization Greek "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{2075CB0A-D26F-4DAA-B424-5079296B43BA}" = Windows Live FolderShare "{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service "{228A2F09-4557-92B9-44A9-E13D41FFAD02}" = Catalyst Control Center Localization Hungarian "{228D6BCB-7B30-39F5-5442-A99CD76A9762}" = Catalyst Control Center Localization Danish "{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information "{2672817F-EB60-5FA1-9691-FE03D3E674F9}" = CCC Help French "{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25 "{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program "{2CC25320-CD83-B987-4B0A-B53B8413CC87}" = CCC Help Italian "{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6 "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{33A0D18A-019E-8F30-6EDA-776CDC319771}" = CCC Help Norwegian "{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live "{34537704-7E4C-F552-AFC7-E3FDB0A4FDC1}" = Catalyst Control Center Localization Italian "{357D2DAA-1743-AC07-D88B-0077FC725DF6}" = Catalyst Control Center Graphics Full Existing "{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba "{3899B709-95BD-752E-B320-1686DACA370E}" = CCC Help Portuguese "{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra "{3E84E56E-FC81-4E08-AA90-E8B2FDC02557}" = Catalyst Control Center Localization Norwegian "{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{469DFB95-185F-CA9E-3D5E-0036754B5033}" = Catalyst Control Center Localization German "{475BF3D4-E418-18CF-34FC-1D8DD3E67F46}" = Catalyst Control Center Localization Chinese Traditional "{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform "{4D881F9F-90B1-6992-BA30-72333A6BC669}" = CCC Help Danish "{51035563-B7F5-01AF-0BE4-47533DEE5B51}" = Catalyst Control Center Localization Russian "{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password "{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup "{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime "{5AC66835-7850-401E-AC93-65AD4D6A7E2E}" = Catalyst Control Center Localization Portuguese "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator "{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{6057E21C-ABE9-4059-AE3E-3BEB9925E660}" = Windows Live Messenger "{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center "{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant "{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility "{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources "{6789E743-FF41-3E96-8C59-0F43ADE6D9E6}" = Catalyst Control Center Localization French "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{698CEC51-8E29-5B7C-2C88-20CDE9DC3DFF}" = ccc-core-static "{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari "{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker "{6E5324C1-84FC-4F76-9A3A-C65E07F80EE6}" = Complément Messenger "{74E2F60E-5C4D-3200-3AB5-6A5C1806A64F}" = CCC Help Hungarian "{759D7567-3027-5605-BF42-9363090FAF71}" = CCC Help Czech "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel "{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core "{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree "{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh "{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support "{85737D46-5FDE-7798-02BA-68AC06CD0B17}" = CCC Help Spanish "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{892DB0A0-CF31-DA46-8142-2B3953CA7B38}" = CCC Help English "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{8F2E8ADC-871F-7B91-708D-BC2899C7D986}" = Catalyst Control Center Localization Swedish "{8FC9A62D-90DB-7122-09F3-587C42EE9FAC}" = Catalyst Control Center Localization Czech "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager "{9128A108-FE27-997F-A118-E6C65FAE2256}" = CCC Help Korean "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9809A7E4-3B3B-4547-3B80-0073E0115EB4}" = Catalyst Control Center Graphics Previews Vista "{9842DEA7-806B-08CA-608C-9717F5F5D7F3}" = Catalyst Control Center Graphics Light "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9C6ABCF3-A9BF-2A09-0974-777B6C421E28}" = CCC Help Swedish "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver "{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = Réducteur de bruit lect. CD/DVD "{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver "{A6F2C0CD-E0A2-BCC1-5BEF-600AC4D9AE62}" = Catalyst Control Center Localization Spanish "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer "{AB93C51F-71F9-4A28-8134-FE1B5B9373E9}" = Windows Live Remote Service Resources "{AC76BA86-7AD7-1036-7B44-A94000000001}" = Adobe Reader 9.4.7 - Français "{AED8FA19-763C-BA3F-A243-3136EEF255E8}" = CCC Help Russian "{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter "{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter "{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser "{BA98E840-DCB3-10B7-D016-8890E4F8F4CC}" = Catalyst Control Center Graphics Full New "{BC1ADEAD-99F1-4707-B31B-CDB222D5BB68}" = Catalyst Control Center - Branding "{C1F4123D-6C93-D087-F50F-8D7AC51AFE76}" = ATI Catalyst Install Manager "{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour "{C3E7A3AD-142E-2433-0107-D2CA4D85F19F}" = CCC Help Greek "{C5A5F901-08F3-7E96-3049-A950A80ACCF4}" = Catalyst Control Center Graphics Previews Common "{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common "{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support "{CB082B01-F65B-05DA-3048-8979BF7B5BD2}" = CCC Help Dutch "{CC0E0442-B3BA-6FB5-3E94-C5F96B9B8915}" = Skins "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba "{D281F20C-FA11-D09A-8A20-B78D771222F8}" = Catalyst Control Center Localization Japanese "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{DB6BD5D5-8482-45C0-99CF-745C5B924497}" = WOT pour Internet Explorer "{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI "{DD766B16-BE10-F87C-73A7-A6FC09148633}" = CCC Help Polish "{DDF91F62-6CBF-2932-93BA-D487B60635B5}" = Catalyst Control Center Core Implementation "{DEC00B1F-5E63-D40F-6291-A2A531414613}" = CCC Help Chinese Traditional "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh "{DF066D23-C0C8-8755-8244-A8A78B8798A5}" = CCC Help Thai "{DFDBE1F9-04CE-4645-BB6C-4590EABC7A9C}" = Windows Live Remote Client Resources "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Codeur Windows Media Série 9 "{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger "{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities "{EC2F2081-6B46-810C-8408-EC04D29EDFF0}" = Catalyst Control Center Localization Thai "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0EF93AE-6B13-DB6A-3C03-8CB5A51D0A7A}" = CCC Help Finnish "{F0FFE43C-7FCC-55F3-6BDE-11F6E9F9FB4A}" = CCC Help Chinese Standard "{F1E1E2E3-2F93-E548-7675-10A78CDD04A6}" = Catalyst Control Center Localization Finnish "{F20B6876-0F18-1A47-D858-D0D9F6888B99}" = Catalyst Control Center Localization Polish "{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA "{F400ED9E-848C-DB0B-CED5-F69DAA2CE8AD}" = ccc-utility "{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety "{F5EFBB2D-2CD6-FD3D-FA53-DFB962BFD14C}" = Catalyst Control Center Localization Korean "{FCFBA290-CB48-4AF1-A241-2685AEDEDD66}" = Windows Live Family Safety "{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package "7-Zip" = 7-Zip 9.20 "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "ahdjfs" = Favorit "avast" = avast! Free Antivirus "AVS Update Manager_is1" = AVS Update Manager 1.0 "CCleaner" = CCleaner "DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters "DivX Setup.divx.com" = Configuration DivX "Drumaxx" = Drumaxx "EssentialPIM" = EssentialPIM "FileHippo.com" = FileHippo.com Update Checker "FoxTab PDF Converter" = FoxTab PDF Converter "Google Desktop" = Google Desktop "Hardcore" = Hardcore "InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Mot de passe responsable "InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup "InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center "InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility "InstallShield_{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver "InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers. "InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package "LastPass" = LastPass(Désinstaller uniquement) "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300 "Microsoft .NET Framework 3.5 Language Pack SP1 - fra" = Module linguistique Microsoft .NET Framework 3.5 SP1- fra "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile FRA Language Pack" = Module linguistique Microsoft .NET Framework 4 Client Profile FRA "Mozilla Firefox 12.0 (x86 fr)" = Mozilla Firefox 12.0 (x86 fr) "MozillaMaintenanceService" = Mozilla Maintenance Service "Plus-HD-3.5" = Plus-HD-3.5 "PoiZone" = PoiZone "TOSHIBA Software Modem" = TOSHIBA Software Modem "VLC media player" = VLC media player 1.1.9 "Windows Media Encoder 9" = Codeur Windows Media Série 9 "WinLiveSuite" = Windows Live [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-2465910400-424495605-2526843765-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Notification de cadeaux MSN" = Notification de cadeaux MSN [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 21/07/2013 12:25:03 | Computer Name = PC-de-polak | Source = MsiInstaller | ID = 1023 Description = Error - 21/07/2013 13:35:12 | Computer Name = PC-de-polak | Source = SideBySide | ID = 16842785 Description = La création du contexte d'activation a échoué pour « C:\Program Files\TOSHIBA\Utilities\Microsoft.VC80.MFC\MFC80U.DLL ». Assembly dépendant Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé. Error - 21/07/2013 15:48:01 | Computer Name = PC-de-polak | Source = MsiInstaller | ID = 1023 Description = Error - 21/07/2013 16:07:14 | Computer Name = PC-de-polak | Source = SideBySide | ID = 16842785 Description = La création du contexte d'activation a échoué pour « C:\Program Files\TOSHIBA\Utilities\Microsoft.VC80.MFC\MFC80U.DLL ». Assembly dépendant Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé. Error - 21/07/2013 18:11:09 | Computer Name = PC-de-polak | Source = MsiInstaller | ID = 1023 Description = Error - 22/07/2013 05:19:19 | Computer Name = PC-de-polak | Source = SideBySide | ID = 16842785 Description = La création du contexte d'activation a échoué pour « C:\Program Files\TOSHIBA\Utilities\Microsoft.VC80.MFC\MFC80U.DLL ». Assembly dépendant Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé. Error - 22/07/2013 07:03:44 | Computer Name = PC-de-polak | Source = SideBySide | ID = 16842785 Description = La création du contexte d'activation a échoué pour « C:\Program Files\TOSHIBA\Utilities\Microsoft.VC80.MFC\MFC80U.DLL ». Assembly dépendant Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé. Error - 22/07/2013 08:15:43 | Computer Name = PC-de-polak | Source = EventSystem | ID = 4621 Description = Error - 22/07/2013 08:19:18 | Computer Name = PC-de-polak | Source = MsiInstaller | ID = 1023 Description = Error - 23/07/2013 04:11:30 | Computer Name = PC-de-polak | Source = SideBySide | ID = 16842785 Description = La création du contexte d'activation a échoué pour « C:\Program Files\TOSHIBA\Utilities\Microsoft.VC80.MFC\MFC80U.DLL ». Assembly dépendant Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé. Error - 23/07/2013 08:31:47 | Computer Name = PC-de-polak | Source = SideBySide | ID = 16842785 Description = La création du contexte d'activation a échoué pour « C:\Program Files\TOSHIBA\Utilities\Microsoft.VC80.MFC\MFC80U.DLL ». Assembly dépendant Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" introuvable. Utilisez sxstrace.exe pour un diagnostic détaillé. [ System Events ] Error - 21/07/2013 16:07:18 | Computer Name = PC-de-polak | Source = Service Control Manager | ID = 7000 Description = Error - 21/07/2013 18:07:44 | Computer Name = PC-de-polak | Source = DCOM | ID = 10010 Description = Error - 21/07/2013 18:11:10 | Computer Name = PC-de-polak | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Error - 22/07/2013 05:19:28 | Computer Name = PC-de-polak | Source = Service Control Manager | ID = 7000 Description = Error - 22/07/2013 07:03:53 | Computer Name = PC-de-polak | Source = Service Control Manager | ID = 7000 Description = Error - 22/07/2013 08:15:42 | Computer Name = PC-de-polak | Source = DCOM | ID = 10010 Description = Error - 22/07/2013 08:19:18 | Computer Name = PC-de-polak | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Error - 23/07/2013 04:11:25 | Computer Name = PC-de-polak | Source = Service Control Manager | ID = 7000 Description = Error - 23/07/2013 08:31:55 | Computer Name = PC-de-polak | Source = Service Control Manager | ID = 7000 Description = Error - 23/07/2013 08:34:07 | Computer Name = PC-de-polak | Source = Service Control Manager | ID = 7000 Description = < End of report >

spherius · Answer

Est-ce que je peux fermer OTL ?

Malekal_morte- · Answer

tu as copié/coller le rapport directement ici
et en plus il manque OTL.txt

Peux-tu lire la procédure et appliquer...

spherius · Answer

je vois qu'il n'est pas posté en entier je vous rajoute le reste : [2013/07/22 13:25:56 | 000,867,240 | ---- | C] (Oracle Corporation) -- C:\Windows\System32 pDeployJava1.dll [2013/07/22 13:25:56 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2013/07/22 13:25:27 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2013/07/22 13:25:27 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe [2013/07/22 13:25:27 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2013/07/22 13:18:29 | 000,000,000 | ---D | C] -- C:\Program Files\FileHippo.com [2013/07/22 11:21:01 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Local\{78BD870B-56EE-4597-9202-F5C627EF0224} [2013/07/21 22:09:58 | 000,000,000 | ---D | C] -- C:\Users\polak\Desktop\TESTEUR [2013/07/21 20:35:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2013/07/21 20:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2013/07/21 14:36:09 | 011,019,776 | ---- | C] (LastPass) -- C:\Program Files\Common Files\lpuninstall.exe [2013/07/21 14:35:56 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LastPass [2013/07/21 14:35:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LastPass [2013/07/21 14:35:53 | 000,000,000 | ---D | C] -- C:\Program Files\LastPass [2013/07/21 14:28:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2013/07/21 14:28:13 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2013/07/21 14:25:27 | 000,000,000 | ---D | C] -- C:\Program Files\Plus-HD-3.5 [2013/07/21 13:32:50 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Local\{B53FC5D7-85C5-417D-B161-444491B9563A} [2013/07/20 20:07:43 | 000,000,000 | ---D | C] -- C:\Users\polak\dwhelper [2013/07/20 18:24:57 | 000,000,000 | ---D | C] -- C:\Users\polak\Desktop\philoup [2013/07/20 18:20:33 | 000,000,000 | R--D | C] -- C:\Users\polak\Desktop\Sécurité [2013/07/20 17:36:54 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Local\{0B8FFC2A-406C-4EA6-BCDC-4068AFBF3B8B} [2013/07/20 17:34:26 | 000,000,000 | ---D | C] -- C:\Users\polak\Downloads [2013/07/20 17:07:54 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013/07/20 17:07:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013/07/20 17:07:51 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013/07/20 17:07:50 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013/07/20 17:07:50 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013/07/20 17:07:48 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013/07/20 17:07:48 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013/07/20 17:07:43 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013/07/20 16:50:53 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2013/07/20 16:35:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Astroburn Lite [2013/07/20 16:24:32 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Roaming\WinRAR [2013/07/19 22:12:02 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Roaming\Malwarebytes [2013/07/19 22:11:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013/07/19 22:11:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013/07/19 22:11:06 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013/07/19 22:11:05 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013/07/19 21:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2013/07/19 21:19:13 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2013/07/19 20:42:17 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Local\Macromedia [2013/07/19 19:31:48 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2013/07/19 19:31:35 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll [2013/07/19 19:31:29 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe [2013/07/19 19:31:27 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll [2013/07/19 19:31:21 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32 tkrnlpa.exe [2013/07/19 19:31:20 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32 toskrnl.exe [2013/07/19 19:31:09 | 001,069,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2013/07/19 19:31:08 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2013/07/19 19:31:08 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2013/07/19 19:31:08 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2013/07/19 19:31:07 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2013/07/19 19:31:07 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2013/07/19 19:31:07 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2013/07/19 19:31:06 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2013/07/19 19:31:04 | 000,505,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qedit.dll [2013/07/19 19:31:03 | 001,548,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL [2013/07/19 19:30:54 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll [2013/07/19 19:18:48 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013/07/19 19:17:26 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Local\{F4D68697-809D-4168-951D-7DE6EF6AFE90} [2013/07/19 18:57:33 | 000,000,000 | ---D | C] -- C:\Users\polak\AppData\Local\{87F1C9D7-D59C-470E-980A-68975E71EF65} [11 C:\*.tmp files -> C:\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========/color [2013/07/23 15:25:28 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin [2013/07/23 15:06:00 | 000,001,002 | ---- | M] () -- C:\Windows asks\Adobe Flash Player Updater.job [2013/07/23 14:50:59 | 000,000,892 | ---- | M] () -- C:\Windows asks\DealPlyLiveUpdateTaskMachineUA.job [2013/07/23 14:39:00 | 000,001,054 | ---- | M] () -- C:\Windows asks\GoogleUpdateTaskMachineUA.job [2013/07/23 14:31:41 | 000,001,884 | ---- | M] () -- C:\Windows asks\Plus-HD-3.5-chromeinstaller.job [2013/07/23 14:31:41 | 000,001,808 | ---- | M] () -- C:\Windows asks\Plus-HD-3.5-firefoxinstaller.job [2013/07/23 14:31:41 | 000,001,050 | ---- | M] () -- C:\Windows asks\GoogleUpdateTaskMachineCore.job [2013/07/23 14:31:40 | 000,001,276 | ---- | M] () -- C:\Windows asks\Plus-HD-3.5-updater.job [2013/07/23 14:31:40 | 000,001,188 | ---- | M] () -- C:\Windows asks\Plus-HD-3.5-codedownloader.job [2013/07/23 14:31:40 | 000,001,086 | ---- | M] () -- C:\Windows asks\Plus-HD-3.5-enabler.job [2013/07/23 14:31:32 | 000,000,888 | ---- | M] () -- C:\Windows asks\DealPlyLiveUpdateTaskMachineCore.job [2013/07/23 14:31:32 | 000,000,416 | ---- | M] () -- C:\Windows asks\PCConfidential.job [2013/07/23 14:31:32 | 000,000,350 | ---- | M] () -- C:\Windows asks\Lyrics-Pal Update.job [2013/07/23 14:31:04 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013/07/23 14:31:04 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013/07/23 14:30:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013/07/23 13:55:56 | 000,001,948 | ---- | M] () -- C:\Users\polak\Desktop\HiJackThis.lnk [2013/07/22 13:29:20 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013/07/22 13:29:20 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013/07/22 13:25:10 | 000,094,632 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2013/07/22 13:25:05 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2013/07/22 13:25:05 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2013/07/22 13:25:05 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe [2013/07/22 13:25:04 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\System32 pDeployJava1.dll [2013/07/22 13:25:04 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll [2013/07/21 22:13:13 | 000,674,670 | ---- | M] () -- C:\Windows\System32\perfh00C.dat [2013/07/21 22:13:13 | 000,591,854 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013/07/21 22:13:13 | 000,124,546 | ---- | M] () -- C:\Windows\System32\perfc00C.dat [2013/07/21 22:13:13 | 000,102,126 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013/07/21 14:36:47 | 011,019,776 | ---- | M] (LastPass) -- C:\Program Files\Common Files\lpuninstall.exe [2013/07/21 14:36:47 | 000,001,860 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2013/07/21 14:36:44 | 000,001,142 | ---- | M] () -- C:\Users\polak\Application Data\Microsoft\Internet Explorer\Quick Launch\My LastPass Vault.lnk [2013/07/21 14:36:29 | 000,001,860 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2013/07/21 14:35:56 | 000,001,142 | ---- | M] () -- C:\Users\polak\Desktop\My LastPass Vault.lnk [2013/07/21 14:30:00 | 000,104,960 | ---- | M] () -- C:\Users\polak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013/07/20 18:38:57 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt [2013/07/20 17:30:17 | 000,254,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013/07/19 22:56:22 | 000,000,300 | ---- | M] () -- C:\Users\polak\Desktop\polak - Raccourci.lnk [2013/07/19 22:18:21 | 000,000,144 | ---- | M] () -- C:\Users\polak\Desktop\I E IGOOGLE.URL [2013/07/19 22:11:14 | 000,000,895 | ---- | M] () -- C:\Users\polak\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk [2013/07/19 21:26:51 | 000,424,624 | ---- | M] () -- C:\Users\polak\Documents\cc_20130719_212634.reg [2013/07/19 19:19:13 | 000,770,344 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys [2013/07/19 19:19:13 | 000,369,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys [2013/07/19 19:19:13 | 000,175,176 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys [2013/07/19 19:19:13 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys.sum [2013/07/19 19:19:13 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSP.sys.sum [2013/07/19 19:19:13 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSnx.sys.sum [11 C:\*.tmp files -> C:\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========/color [2013/07/23 15:25:28 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin [2013/07/23 13:55:56 | 000,001,948 | ---- | C] () -- C:\Users\polak\Desktop\HiJackThis.lnk [2013/07/22 13:18:30 | 000,001,749 | ---- | C] () -- C:\Users\polak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk [2013/07/21 20:35:29 | 000,000,823 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013/07/21 14:36:47 | 000,001,860 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2013/07/21 14:36:29 | 000,001,860 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2013/07/21 14:36:08 | 000,001,142 | ---- | C] () -- C:\Users\polak\Application Data\Microsoft\Internet Explorer\Quick Launch\My LastPass Vault.lnk [2013/07/21 14:35:56 | 000,001,142 | ---- | C] () -- C:\Users\polak\Desktop\My LastPass Vault.lnk [2013/07/21 14:26:05 | 000,001,276 | ---- | C] () -- C:\Windows asks\Plus-HD-3.5-updater.job [2013/07/21 14:26:01 | 000,001,086 | ---- | C] () -- C:\Windows asks\Plus-HD-3.5-enabler.job [2013/07/21 14:25:57 | 000,001,188 | ---- | C] () -- C:\Windows asks\Plus-HD-3.5-codedownloader.job [2013/07/21 14:25:42 | 000,001,808 | ---- | C] () -- C:\Windows asks\Plus-HD-3.5-firefoxinstaller.job [2013/07/21 14:25:32 | 000,001,884 | ---- | C] () -- C:\Windows asks\Plus-HD-3.5-chromeinstaller.job [2013/07/20 17:44:38 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys [2013/07/20 16:46:35 | 000,000,892 | ---- | C] () -- C:\Windows asks\DealPlyLiveUpdateTaskMachineUA.job [2013/07/20 16:46:25 | 000,000,888 | ---- | C] () -- C:\Windows asks\DealPlyLiveUpdateTaskMachineCore.job [2013/07/20 16:44:28 | 000,000,350 | ---- | C] () -- C:\Windows asks\Lyrics-Pal Update.job [2013/07/19 22:56:22 | 000,000,300 | ---- | C] () -- C:\Users\polak\Desktop\polak - Raccourci.lnk [2013/07/19 22:11:14 | 000,000,895 | ---- | C] () -- C:\Users\polak\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk [2013/07/19 21:26:37 | 000,424,624 | ---- | C] () -- C:\Users\polak\Documents\cc_20130719_212634.reg [2013/07/19 21:14:13 | 000,000,144 | ---- | C] () -- C:\Users\polak\Desktop\I E IGOOGLE.URL [2013/07/19 19:20:17 | 000,001,002 | ---- | C] () -- C:\Windows asks\Adobe Flash Player Updater.job [2013/07/19 19:19:13 | 000,175,176 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys [2013/07/19 19:19:13 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys.sum [2013/07/19 19:19:13 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSP.sys.sum [2013/07/19 19:19:13 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSnx.sys.sum [2010/08/30 09:19:00 | 000,000,680 | ---- | C] () -- C:\Users\polak\AppData\Local\d3d9caps.dat [2009/12/16 03:28:51 | 000,000,089 | ---- | C] () -- C:\Users\polak\AppData\Local\ahdjfs.bat [2009/12/13 09:42:19 | 000,023,112 | ---- | C] () -- C:\Users\polak\AppData\Roaming\UserTile.png [2009/09/19 21:31:28 | 000,104,960 | ---- | C] () -- C:\Users\polak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [color=#E56717]========== ZeroAccess Check ==========/color [2006/11/02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== Custom Scans ==========/color [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >/color [color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >/color [color=#A23BEC]< %APPDATA%\*. >/color [2009/12/18 08:36:48 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Adobe [2010/12/07 18:53:29 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\AIMP [2009/12/14 09:11:17 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Apple Computer [2009/09/19 17:36:59 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\ATI [2009/09/19 17:49:11 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\AVS4YOU [2013/07/19 21:23:25 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Azureus [2009/12/13 23:10:45 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\DesktopSMS [2010/05/08 09:01:44 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\DivX [2011/06/11 10:12:20 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\EssentialPIM [2010/12/04 21:59:02 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\FinalMediaPlayer [2013/07/19 19:49:03 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Google [2009/09/19 17:35:54 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Identities [2009/12/26 17:28:38 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\igraal [2009/09/19 18:19:46 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Macromedia [2013/07/19 22:12:02 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Malwarebytes [2010/11/29 20:16:54 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\MaxTV Technologies [2006/11/02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Media Center Programs [2013/07/21 20:14:55 | 000,000,000 | --SD | M] -- C:\Users\polak\AppData\Roaming\Microsoft [2010/12/01 19:13:23 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\MMToolz [2013/07/21 16:23:53 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Mozilla [2010/12/11 22:08:26 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming 2 Studios [2010/12/14 02:17:49 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Real [2013/07/21 16:22:38 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Shareaza [2009/09/19 18:00:46 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Toshiba [2013/02/24 13:35:54 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\vlc [2013/07/20 16:24:38 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\WinRAR [2010/11/29 19:42:56 | 000,000,000 | ---D | M] -- C:\Users\polak\AppData\Roaming\Yahoo! [color=#A23BEC]< %APPDATA%\*.exe /s >/color [2013/07/23 13:55:57 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\polak\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe [2012/01/21 16:41:37 | 000,000,000 | ---- | M] () -- C:\Users\polak\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2012/01/21 16:41:37 | 000,000,000 | ---- | M] () -- C:\Users\polak\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe [2012/01/21 16:41:37 | 000,000,000 | ---- | M] () -- C:\Users\polak\AppData\Roaming\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe [2010/12/10 20:12:22 | 000,510,120 | ---- | M] (RealNetworks, Inc.) -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13\setup.exe [2010/03/25 12:08:26 | 013,407,072 | ---- | M] () -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13\chr\ChromeInstaller.exe [2010/10/22 19:10:16 | 000,190,632 | ---- | M] (RealNetworks, Inc.) -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13\chr_helper\LaunchHelper.exe [2010/05/13 13:09:52 | 000,220,272 | ---- | M] (Google Inc.) -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe [2010/10/22 19:10:16 | 000,190,632 | ---- | M] (RealNetworks, Inc.) -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13\gtb_helper\LaunchHelper.exe [2010/12/11 04:12:49 | 026,444,432 | ---- | M] (RealNetworks, Inc.) -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13 p\RealPlayer_fr.exe [2010/12/02 15:29:50 | 000,092,328 | ---- | M] (RealNetworks, Inc.) -- C:\Users\polak\AppData\Roaming\Real\Update\setup3.13\ui_data\vista.exe [color=#A23BEC]< %temp%\*.exe /s >/color [2013/07/20 16:44:14 | 001,443,656 | ---- | M] (DealPly Technologies Ltd.) -- C:\Users\polak\AppData\Local\Temp\dp.exe [2013/07/21 14:24:17 | 000,629,856 | ---- | M] () -- C:\Users\polak\AppData\Local\Temp\ICReinstall_7z920.exe [2013/07/20 16:44:12 | 004,620,384 | ---- | M] (PC Utilities Pro) -- C:\Users\polak\AppData\Local\Temp\OptimizerPro.exe [98 C:\Users\polak\AppData\Local\Temp\*.tmp files -> C:\Users\polak\AppData\Local\Temp\*.tmp -> ] [2013/07/21 14:19:56 | 001,110,476 | ---- | M] () -- C:\Users\polak\AppData\Local\Temp\is42483369\3063068_Setup.EXE [2013/07/21 14:24:20 | 001,110,476 | ---- | M] () -- C:\Users\polak\AppData\Local\Temp\is42483369\3327611_Setup.EXE [2013/04/30 14:01:22 | 000,775,152 | ---- | M] () -- C:\Users\polak\AppData\Local\Temp\is42483369\DeltaTB.exe [2013/07/18 11:14:10 | 005,163,600 | ---- | M] (Cvyfzzamad) -- C:\Users\polak\AppData\Local\Temp\is42483369\PlusHD_TC.exe [2013/07/20 20:09:30 | 000,608,208 | ---- | M] (CatenaLogic) -- C:\Users\polak\AppData\Local\Temp\xcrashreport\XCrashReport.exe [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >/color [color=#A23BEC]< %systemroot%\*. /mp /s >/color [color=#A23BEC]< %systemroot%\system32\consrv.dll >/color [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >/color [2007/11/02 00:09:12 | 000,364,544 | ---- | M] (Advanced Micro Devices, Inc.)[b] Unable to obtain MD5/b -- C:\Windows\system32\ATIDEMGX.dll [color=#A23BEC]< %windir%\Tasks\*.job /lockedfiles >/color [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >/color [color=#A23BEC]< %systemroot%\System32\config\*.sav >/color [2007/04/18 07:02:58 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2007/04/18 07:02:56 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2007/04/18 07:02:58 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2007/04/18 07:03:05 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2007/04/18 07:03:06 | 006,008,832 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV [color=#A23BEC]< MD5 for: EXPLORER.EXE >/color [2009/09/19 19:55:32 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2009/09/19 19:55:32 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2009/09/19 19:55:31 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009/09/19 20:19:59 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe [2009/09/19 20:19:59 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe [2009/04/11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009/04/11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2009/09/19 19:55:32 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2006/11/02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe [2008/01/19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe [color=#A23BEC]< MD5 for: SERVICES.EXE >/color [2008/01/19 09:33:28 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe [2006/11/02 11:45:40 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe [2009/04/11 08:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe [2009/04/11 08:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe [color=#A23BEC]< MD5 for: WININIT.EXE >/color [2008/01/19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008/01/19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe [2006/11/02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe [color=#A23BEC]< MD5 for: WINLOGON.EXE >/color [2009/04/11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009/04/11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2006/11/02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008/01/19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s >/color "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s >/color [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s >/color "Debug" = "" = mnmsrvc "Kmode" = \SystemRoot\System32\win32k.sys "Optional" = Posix [binary data] "Posix" = %SystemRoot%\system32\psxss.exe "Required" = DebugWindows [binary data] "Windows" = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\CSRSS] "CsrSrvSharedSectionBase" = 2137980928 [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s >/color [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s >/color "ProfilesDirectory" = %SystemDrive%\Users -- [2009/09/19 17:32:35 | 000,000,000 | R--D | M] "Default" = %SystemDrive%\Users\Default -- [2009/09/19 17:31:23 | 000,000,000 | RH-D | M] "Public" = %SystemDrive%\Users\Public -- [2006/11/02 14:50:50 | 000,000,000 | R--D | M] "ProgramData" = %SystemDrive%\ProgramData -- [2013/07/23 14:27:07 | 000,000,000 | -H-D | M] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18] "Flags" = 12 "State" = 0 "RefCount" = 1 "Sid" = 01 01 00 00 00 00 00 05 12 00 00 00 [binary data] "ProfileImagePath" = %systemroot%\system32\config\systemprofile -- [2010/01/03 14:15:00 | 000,000,000 | ---D | M] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19] "ProfileImagePath" = %SystemRoot%\ServiceProfiles\LocalService -- [2006/11/02 14:47:53 | 000,000,000 | ---D | M] "Flags" = 0 "State" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20] "ProfileImagePath" = %SystemRoot%\ServiceProfiles\NetworkService -- [2006/11/02 14:47:53 | 000,000,000 | ---D | M] "Flags" = 0 "State" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2465910400-424495605-2526843765-1000] "ProfileImagePath" = C:\Users\polak -- [2013/07/23 13:51:37 | 000,000,000 | ---D | M] "Flags" = 0 "State" = 0 "Sid" = 01 05 00 00 00 00 00 05 15 00 00 00 80 CE FA 92 F5 49 4D 19 75 93 9C 96 E8 03 00 00 [binary data] "ProfileLoadTimeLow" = 0 "ProfileLoadTimeHigh" = 0 "RefCount" = 2 "RunLogonScriptSync" = 0 [color=#A23BEC]< HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s >/color "CompletionChar" = 64 "DefaultColor" = 0 "EnableExtensions" = 1 "PathCompletionChar" = 64 [color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s >/color "CompletionChar" = 9 "DefaultColor" = 0 "EnableExtensions" = 1 "PathCompletionChar" = 9 [color=#A23BEC]< nslookup https://www.google.fr/?gws_rd=ssl /c >/color Serveur : neufbox Address: 192.168.1.1 [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >/color HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2013/07/21 20:35:19 | 000,869,120 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2013/07/21 20:35:19 | 000,869,120 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013/07/21 20:35:19 | 000,869,120 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\: C:\Program Files\Mozilla Firefox\firefox.exe [2013/07/21 20:35:23 | 000,924,600 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2013/07/21 20:35:23 | 000,924,600 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2013/07/21 20:35:23 | 000,924,600 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\ShowIconsCommand: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" --show-icons HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\HideIconsCommand: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" --hide-icons HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\ReinstallCommand: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" --make-default-browser HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2011/05/25 17:52:06 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2011/05/25 17:52:06 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2011/05/25 17:52:06 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell aom\command\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2013/05/29 04:24:32 | 000,757,400 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\: C:\Program Files\Internet Explorer\iexplore.exe [2013/05/29 04:24:32 | 000,757,400 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\ReinstallCommand: "C:\Program Files\Safari\Safari.exe" /reinstall [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\HideIconsCommand: "C:\Program Files\Safari\Safari.exe" /hideicons [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\ShowIconsCommand: "C:\Program Files\Safari\Safari.exe" /showicons [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\shell\open\command\: "C:\Program Files\Safari\Safari.exe" [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >/color HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2013/07/21 20:35:19 | 000,869,120 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2013/07/21 20:35:19 | 000,869,120 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2013/07/21 20:35:19 | 000,869,120 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\: C:\Program Files\Mozilla Firefox\firefox.exe [2013/07/21 20:35:23 | 000,924,600 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2013/07/21 20:35:23 | 000,924,600 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2013/07/21 20:35:23 | 000,924,600 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\ShowIconsCommand: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" --show-icons HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\HideIconsCommand: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" --hide-icons HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\ReinstallCommand: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" --make-default-browser HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\: "C:\Users\polak\AppData\Local\Google\Chrome\Application\chrome.exe" HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2011/05/25 17:52:06 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2011/05/25 17:52:06 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2011/05/25 17:52:06 | 000,074,240 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell aom\command\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2013/05/29 04:24:32 | 000,757,400 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\: C:\Program Files\Internet Explorer\iexplore.exe [2013/05/29 04:24:32 | 000,757,400 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\ReinstallCommand: "C:\Program Files\Safari\Safari.exe" /reinstall [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\HideIconsCommand: "C:\Program Files\Safari\Safari.exe" /hideicons [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\ShowIconsCommand: "C:\Program Files\Safari\Safari.exe" /showicons [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\shell\open\command\: "C:\Program Files\Safari\Safari.exe" [2011/03/21 20:10:48 | 002,388,264 | ---- | M] (Apple Inc.) [color=#E56717]========== Alternate Data Streams ==========/color @Alternate Data Stream - 16 bytes -> C:\Users\polak\Desktop\Downloads:Shareaza.GUID < End of report >

spherius · Answer

je suis vraiment désolé pourtant j'ai tout copier mais vu que le poste est long c'est peut-être parce qu'il n'y avait plus de place !!!

spherius · Answer

je vais recommencer a copier les 2 rapports et je vous les envois sur votre site et je vous donne les liens de votre site ? je pense que oui pour que vous les trouver de suite .

spherius · Answer

c'est bon j'ai tout envoyer dans ce que vous m'avez demandez je suis désolé pour le retard .

spherius · Answer

je suis allez dans parcourir et je vous ais envoyer les 2 rapports sur votre site j'espère que c'est bon que je n'ai pas fait d'erreur j'ai bien relu vos instructions s'il faut que j'efface les 2 rapports que j'ai posté sur C.C.M je le ferais .

Malekal_morte- · Answer

MERCI DE LIRE - MERCI DE LIRE 

Pour la 3e edition, il faut donner les liens pjjoint ici pour que je puisse lire les rapports.
Tu as lu au moins ça : https://www.malekal.com/tutorial-otl/ ?
Tu as lu l'intégralité de la procédure donnée dans mon premier message ?

MERCI DE LIRE - MERCI DE LIRE 

PS : ce sera ma dernière réponse.

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

spherius · Answer

j'aimerais vraiment vous envoyez le lien qu'il y a dans l'url mais je n'ai aucun lien d'écrit a part si je vais sur un site exp: www.http//commentçamarche. c'est tout comment pourrais-je faire pour qu'il y a un lien d'écrit dans la barre de navigation

Bonjour j'ai des fenetres qui s'ouvrent toutes seul suis infecté

32 réponses

Discussions similaires