Combofix Résolu

Question

Bonjour,
Je demande un volontaire qui pourrait analyser une analyse Combofix que je viens de réaliser.
Merci d'avance

2011N2 · Answer

Bonjour,

Pourquoi as-tu utiliser cet outil ? Quelqu'un te l'a conseillé ?
Poste le rapport.

Gabriel.

Ricordière · Answer

ComboFix 13-08-28.02 - Bernard 28/08/2013   9:33.1.4 - x64
Microsoft Windows 7 Édition Familiale Premium   6.1.7601.1.1252.33.1036.18.3576.2158 [GMT 2:00]
Lancé depuis: c:\users\Bernard\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bernard\AppData\Roaming\Microsoft\Windows\Recent\KG Avis de recherche.url
c:\users\Bernard\AppData\Roaming\Microsoft\Windows\Recent\PDFCreator.url
c:\windows\SysWow64\SETC8DA.tmp
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2013-07-28 au 2013-08-28  ))))))))))))))))))))))))))))))))))))
.
.
2013-08-27 18:03 . 2012-08-23 15:09	3584	----a-w-	c:\windows\system32\drivers\fr-FR	susbflt.sys.mui
2013-08-27 18:03 . 2012-08-23 13:41	13312	----a-w-	c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-27 18:03 . 2012-08-23 13:40	13312	----a-w-	c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-27 18:03 . 2012-08-23 13:24	15360	----a-w-	c:\windows\system32\RdpGroupPolicyExtension.dll
2013-08-27 18:03 . 2012-08-23 14:10	19456	----a-w-	c:\windows\system32\driversdpvideominiport.sys
2013-08-27 18:03 . 2012-08-23 14:08	30208	----a-w-	c:\windows\system32\drivers\TsUsbGD.sys
2013-08-27 18:03 . 2012-08-23 14:07	57856	----a-w-	c:\windows\system32\drivers\TsUsbFlt.sys
2013-08-27 18:01 . 2012-08-24 18:05	340992	----a-w-	c:\windows\system32\schannel.dll
2013-08-27 18:01 . 2012-08-24 18:13	154480	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2013-08-27 18:01 . 2012-08-24 18:09	458712	----a-w-	c:\windows\system32\drivers\cng.sys
2013-08-27 18:01 . 2012-08-24 16:57	247808	----a-w-	c:\windows\SysWow64\schannel.dll
2013-08-27 18:01 . 2012-08-24 18:03	1448448	----a-w-	c:\windows\system32\lsasrv.dll
2013-08-27 18:01 . 2012-08-24 16:57	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2013-08-27 18:01 . 2012-08-24 16:53	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2013-08-27 18:01 . 2012-05-04 11:00	366592	----a-w-	c:\windows\system32\qdvd.dll
2013-08-27 18:01 . 2012-05-04 09:59	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2013-08-27 07:45 . 2013-08-27 07:45	--------	d-----w-	c:\program files (x86)\Microsoft
2013-08-27 07:45 . 2013-08-27 07:45	--------	d-----w-	c:\program files (x86)\Windows Live SkyDrive
2013-08-27 07:45 . 2013-08-27 07:45	--------	d-----w-	c:\program files (x86)\Windows Live
2013-08-27 07:45 . 2013-08-27 07:45	--------	d-----w-	c:\windows\PCHEALTH
2013-08-26 15:28 . 2013-08-26 15:29	--------	d-----w-	c:\windows\SysWow64\Adobe
2013-08-26 08:05 . 2013-08-26 13:42	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-26 08:05 . 2013-08-26 13:42	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-26 07:44 . 2013-08-20 09:21	117024	----a-w-	c:\windows\system32\BootDefrag.exe
2013-08-25 08:27 . 2013-08-26 12:15	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2013-08-24 18:19 . 2013-08-26 13:53	--------	d-----w-	c:\users\Bernard\AppData\Roaming\vlc
2013-08-24 10:18 . 2013-07-26 03:35	2706432	----a-w-	c:\windows\system32\mshtml.tlb
2013-08-24 10:18 . 2013-07-26 02:49	2706432	----a-w-	c:\windows\SysWow64\mshtml.tlb
2013-08-24 10:18 . 2013-07-26 05:12	526336	----a-w-	c:\windows\system32\ieui.dll
2013-08-24 06:59 . 2013-07-09 05:52	224256	----a-w-	c:\windows\system32\wintrust.dll
2013-08-23 16:17 . 2013-08-24 16:17	--------	d-----w-	c:\programdata\BoxUpdChk
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-24 10:07 . 2011-07-18 20:31	78161360	----a-w-	c:\windows\system32\MRT.exe
2013-07-16 13:09 . 2013-07-16 13:09	98	----a-w-	c:\windows\DeleteOnReboot.bat
2013-07-01 16:17 . 2013-07-01 16:17	108968	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2013-07-01 16:17 . 2013-07-01 16:17	312232	----a-w-	c:\windows\system32\javaws.exe
2013-07-01 16:17 . 2013-07-01 16:17	189352	----a-w-	c:\windows\system32\javaw.exe
2013-07-01 16:17 . 2013-07-01 16:17	188840	----a-w-	c:\windows\system32\java.exe
2013-07-01 16:17 . 2013-05-23 15:46	1093032	----a-w-	c:\windows\system32
pDeployJava1.dll
2013-07-01 16:17 . 2011-07-18 21:14	972712	----a-w-	c:\windows\system32\deployJava1.dll
2013-06-30 14:33 . 2013-04-28 15:36	378944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-06-30 14:33 . 2013-04-28 15:36	1030952	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-06-30 14:33 . 2013-04-28 15:36	189936	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-06-25 09:06 . 2013-06-13 07:12	181064	----a-w-	c:\windows\PSEXESVC.EXE
2013-06-24 19:57 . 2013-07-07 15:23	81408	----a-w-	c:\windows\gmt.exe
2013-06-23 09:10 . 2013-06-23 09:11	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-23 09:10 . 2011-07-18 21:13	789416	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-06-12 07:30 . 2013-06-12 07:30	53248	----a-r-	c:\users\Bernard\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-06-09 19:59 . 2013-07-06 16:53	216064	----a-w-	c:\windows\SysWow64\gcapi_dll.dll
2013-06-05 03:34 . 2013-07-14 17:04	3153920	----a-w-	c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-14 17:04	624128	----a-w-	c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-14 17:04	509440	----a-w-	c:\windows\SysWow64\qedit.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-29 08:09	220632	----a-w-	c:\users\Bernard\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-29 08:09	220632	----a-w-	c:\users\Bernard\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-29 08:09	220632	----a-w-	c:\users\Bernard\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-03-22 248208]
"Tomtomax MaxiBox"="c:\program files (x86)\Tomtomax Maxi-Box V3\Tomtomax_MaxiBox.exe" [2012-09-03 1216000]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-07-25 20684656]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Rainlendar2"="c:\program files (x86)\Rainlendar2\Rainlendar2.exe" [2011-08-12 2433024]
"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2013-04-18 1090912]
"DriverMax_RESTART"="c:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2013-04-26 7162232]
"Calendridier"="c:\program files\BitenSoft\Calendridier\Calendridier3.exe" [2013-06-02 87552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-10 57393]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2013-07-20 2010624]
"IndexSearch"="c:\program files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-10 40960]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2010-08-03 107816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk * \0BootDefrag.exe
.
R0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\driversdpvideominiport.sys;c:\windows\SYSNATIVE\driversdpvideominiport.sys [x]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2013.SP2\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2013.SP2\RpcAgentSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers	susbflt.sys;c:\windows\SYSNATIVE\drivers	susbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\drivers\amdhub30.sys;c:\windows\SYSNATIVE\drivers\amdhub30.sys [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\drivers\amdiox64.sys;c:\windows\SYSNATIVE\drivers\amdiox64.sys [x]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\drivers\amdxhc.sys;c:\windows\SYSNATIVE\drivers\amdxhc.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2013-08-26 c:\windows\Tasks\GlaryInitialize 3.job
- c:\program files (x86)\Glary Utilities 3\Initialize.exe [2013-08-20 09:19]
.
2013-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-16 14:21]
.
2013-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-16 14:21]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-29 08:09	244696	----a-w-	c:\users\Bernard\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-29 08:09	244696	----a-w-	c:\users\Bernard\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-29 08:09	244696	----a-w-	c:\users\Bernard\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58	133840	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-04-24 12480616]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 134416]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1612880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Bernard\AppData\Roaming\Mozilla\Firefox\Profiles\vmwlovyx.default\
FF - ExtSQL: 2013-08-25 10:31; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Bernard\AppData\Roaming\Mozilla\Firefox\Profiles\vmwlovyx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-08-26 15:25; keefox@chris.tomlinson; c:\users\Bernard\AppData\Roaming\Mozilla\Firefox\Profiles\vmwlovyx.default\extensions\keefox@chris.tomlinson
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\Windows\SysWOW64\Macromed\Flash\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\Windows\SysWOW64\Macromed\Flash\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\Windows\SysWOW64\Macromed\Flash\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\Windows\SysWOW64\Macromed\Flash\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.






Bonjour

Bonjour,
Mon ordi Médion fixe 1 an et demi, W7,  plante souvent les programmes, me disant, a cessé de fonctionner.
A tout hasard j'ai passé un coup de combe dont j'ai eu vent par mon gendre.

merci pour la prompte réponse.



[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2013-08-28  09:41:44
ComboFix-quarantined-files.txt  2013-08-28 07:41
.
Avant-CF: 775 719 792 640 octets libres
Après-CF: 775 335 890 944 octets libres
.
- - End Of File - - EC0B0B73B49E7B31CC927B221E01FC79
4624822E540EC83CD0819525C65846BA

2011N2 · Answer

Re,

Pas grave, mais donc, pourquoi as-tu utilisé ComboFix ?
Quelqu'un te l'a conseillé ?

Gabriel.

Ricordière · Answer

Bonjour,
Je l'ai fait à tout hazard, ayant lu sur les forums qu'un malware ou autre virus malveillant aurait pu infecter mon ordi. Car depuis quelque temps, les  programmes de ferment inopinément en affichant " a cessé de fonctionner" ce qui n'est malheureusement pas résolu.
Cela a commence avec windows live 2012 que j'ai réparé sans succés, et remplacé par windows live 2009. Et cela continue, depuis la mise a jour de Flash Player, et avec d'autres programmes sans ordre précis.
J'envisage de tout réinstaller depuis le F11 ayant une partition de secours. Mais quel travail en perspective.
Amicalement

2011N2 · Answer

Bonjour,

Ok, mais attends, on va voir si on peut faire quelque chose.

Fais un diagnostic de ton PC avec ZHPDiag et poste moi le rapport précédemment hébergé sur cjoint : http://www.forum-entraide-informatique.com/support/zhpdiag-tutoriel-t4831.html

Gabriel.

Ricordière · Answer

Rapport ci-joint

Amicalement,

Ricordière (Bernard DURAND)

~ Rapport de ZHPDiag v2013.8.29.381 - Nicolas Coolman (29/08/2013)
~ Lancé par Bernard (29/08/2013 16:55:00)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user

---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16660
MFIE: Mozilla Firefox 23.0.1 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 8TFF7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
avast! Free Antivirus v8.0.1489.0
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v4.04 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 ActiveX
Java 7 Update 25
Java 7 Update 25

---\\ Informations sur le système
~ Processor: AMD64 Family 18 Model 1 Stepping 0, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3576 MB (62% free)
System Restore: Activé (Enable)
System drive C: has 725 GB (82%) free of 880 GB

---\\ Mode de connexion au système
~ Computer Name: BERNARD-PC
~ User Name: Bernard
~ All Users Names: Pierrette, HomeGroupUser$, Bernard, Aurélia, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppData% : C:\Users\Bernard\AppData\Roaming\
~ %Desktop% : C:\Users\Bernard\Desktop\
~ %Favorites% : C:\Users\Bernard\Favorites\
~ %LocalAppData% : C:\Users\Bernard\AppData\Local\
~ %StartMenu% : C:\Users\Bernard\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C:\ Hard drive, Flash drive, Thumb drive (Free 725 Go of 880 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 28 Go of 50 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Hard drive, Flash drive, Thumb drive (Free 344 Go of 932 Go)

---\\ Etat du Centre de Sécurité Windows
~ Security Center: 37 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AC155DD9BD1E6D3B740826A4D1C68AAE] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/07/2013 - 06:13:37.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/10121
~ Mes musiques (My Musics) : 1/628
~ Mes Videos (My Videos) : 2/136
~ Mes Favoris (My Favorites) : 1/311
~ Mes Documents (My Documents) : 3/42410
~ Menu demarrer (Programs) : 1/38
~ Hidden Files: Scanned in 00mn 26s

---\\ Processus lancés au démarrage du système
[MD5.9EC9218D94DB00C67BBB28DC62B8A46B] - (.Microsoft Corporation - Microsoft LifeCam Device Application.) -- C:\Windows\vVX1000.exe [762736] [PID.1116]
[MD5.F7128E5772F9312F0D111A5FA5D41773] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656] [PID.4092]
[MD5.B67322F9FF401846E56F3D719069270E] - (.Pas de propriétaire - Rainlendar2.) -- C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2433024] [PID.3648]
[MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968] [PID.1188]
[MD5.950DB6EDA08A6C48D29189248F4D0C3F] - (.ScanSoft, Inc. - PaperPort Print to Desktop for NT.) -- C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [57393] [PID.1976]
[MD5.35048D8E8A0BF7A797CD5757ACD7EED0] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816] [PID.2528]
[MD5.7DFCCC67990B6DE7F30F553A4E4612A4] - (...) -- C:\Program Files (x86)\RocketDock\RocketDock.exe [495616] [PID.2128]
[MD5.27502022B75551385957D223DD9CB72B] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7842304] [PID.1336]
[MD5.34C75FFB072C7239F22936E937C8CD78] - (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files (x86)\Windows Live\Mail\wlmail.exe [114000] [PID.3180]
[MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1400]
[MD5.B33CF4DE909A5B30F526D82053A63C8E] - (.ABBYY - ABBYY network license server.) -- C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048] [PID.1700]
[MD5.879F46329B7DC4D109345AA96F1AB47F] - (.TeamViewer GmbH - TeamViewer 8.) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [4150112] [PID.1272]
[MD5.0765EE4A7A0D6609BF91CA2E4700E885] - (.TomTom - Windows Service for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072] [PID.1900]
~ Processes Running: Scanned in 00mn 01s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
M2 - MFEP: prefs.js [Bernard - vmwlovyx.default\***@***son] [] KeeFox v1.2.3 (..)
~ Firefox Browser: 7 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 1

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Clé orpheline
O3 - Toolbar: (no name) [64Bits] - [HKLM]{9421DD08-935F-4701-A9CA-22DF90AC4EA6} Clé orpheline
~ Toolbar: Scanned in 00mn 00s

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [VX1000] . (.Microsoft Corporation - Microsoft LifeCam Device Application.) -- C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] . (.Logitech Inc. - Logitech KHAL Main Process.) -- C:\Windows\KHALMNPR.exe
O4 - HKLM\..\Run: [EvtMgr6] . (.Logitech, Inc. - Logitech SetPoint Event Manager (UNICODE).) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
O4 - HKLM\..\RunOnce: [MedionReminder] . (.CyberLink - PowerRecover.) -- C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Rainlendar2] . (.Pas de propriétaire - Rainlendar2.) -- C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [Calendridier] . (.BitenSoft - Calendridier 3.) -- C:\Program Files\BitenSoft\Calendridier\Calendridier3.exe
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [PaperPort PTD] . (.ScanSoft, Inc. - PaperPort Print to Desktop for NT.) -- C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Wow6432Node\Run: [LifeCam] . (.Microsoft Corporation - LifeExp.exe.) -- C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
O4 - HKLM\..\Wow6432Node\Run: [IndexSearch] . (.ScanSoft, Inc. - PaperPort IndexSearch.) -- C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Wow6432Node\Run: [CLMLServer] . (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
O4 - HKUS\S-1-5-21-761653568-1509139988-1937572610-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-761653568-1509139988-1937572610-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-761653568-1509139988-1937572610-1001\..\Run: [Rainlendar2] . (.Pas de propriétaire - Rainlendar2.) -- C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
O4 - HKUS\S-1-5-21-761653568-1509139988-1937572610-1001\..\Run: [Calendridier] . (.BitenSoft - Calendridier 3.) -- C:\Program Files\BitenSoft\Calendridier\Calendridier3.exe
~ Application: Scanned in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - GS\TaskBar: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Programs: Microsoft SkyDrive.lnk . (.Microsoft Corporation - Microsoft SkyDrive Setup.) -- C:\Program Files (x86)\Microsoft SkyDrive\SkyDriveSetup.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: VSO DivxToDVD.lnk . (.VSO Software - Divx to DVD converter.) -- C:\Program Files (x86)\vso\DivxToDVD\DivxToDVD.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\SendTo: Notepad.lnk . (.Microsoft Corporation - Bloc-notes.) -- C:\Windows\system32\notepad.exe
O4 - GS\SendTo: Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe
O4 - GS\Desktop: Généatique 2006.lnk . (.CDIP - Logiciel de généalogie.) -- C:\Program Files (x86)\Geneatique2006\Genea2006.exe
O4 - GS\Desktop: Protectis - Sauvegarde en ligne.lnk . (...) -- C:\Program Files (x86)\Protectis\Protectis.exe (.not file.)
O4 - GS\Desktop: VSO DivxToDVD.lnk . (.VSO Software - Divx to DVD converter.) -- C:\Program Files (x86)\vso\DivxToDVD\DivxToDVD.exe
O4 - GS\Desktop: Yamb.lnk . (.Kurtnoise - Yet Another MP4Box GUI.) -- C:\Program Files (x86)\YAMB\Yamb.exe
O4 - GS\TaskBar: Captvty.lnk . (...) -- C:\Users\Bernard\Videos\Captvty\Captvty.exe
O4 - GS\TaskBar: FreeCommander.lnk . (.Marek Jasinski - www.FreeCommander.com - Freeware file manager for windows.) -- C:\Program Files (x86)\FreeCommander\FreeCommander.exe
O4 - GS\TaskBar: Gestionnaire des tâches de Windows.lnk . (.Microsoft Corporation - Gestionnaire des tâches de Windows.) -- C:\Windows\System32\taskmgr.exe
O4 - GS\TaskBar: KeePass 2.lnk . (.Dominik Reichl - KeePass.) -- C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
O4 - GS\TaskBar: MailWasher Free.lnk . (.Firetrust Ltd - MailWasher 6.5.4.) -- C:\Program Files (x86)\Firetrust\MailWasher Free\MailWasher.exe
O4 - GS\TaskBar: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\TaskBar: PaperPort.lnk . (.InstallShield Software Corp. - InstallShield.) -- C:\Windows\Installer\{A17EABB6-D0C6-44E5-820C-72DC7F495064}\PaperPort.exe
O4 - GS\TaskBar: Snipping Tool.lnk . (.Microsoft Corporation - Outil Capture.) -- C:\Windows\system32\SnippingTool.exe
O4 - GS\TaskBar: SyncBackFree.lnk . (.2BrightSparks Pte Ltd - SyncBackFree.) -- C:\Program Files (x86)\2BrightSparks\SyncBackFree\SyncBackFree.exe
O4 - GS\TaskBar: Windows Live Mail.lnk . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
O4 - GS\Programs: Microsoft SkyDrive.lnk . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Bernard\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
O4 - GS\QuickLaunch: Glary Utilities 3.lnk . (.Glarysoft Ltd - Glary Utilities 3.) -- C:\Program Files (x86)\Glary Utilities 3\Integrator.exe
O4 - GS\SendTo: Simple PDF.lnk . (...) -- C:\Program Files (x86)\Simple PDF\liste
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
~ Global Startup: Scanned in 00mn 01s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: eBay.fr [64Bits] - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} . (...) -- C:\Program Files\Internet Explorer\Custom\eBay.ico
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{196D89EC-4CBC-4865-9D60-C790455BFCE2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{E700DAEE-439D-4EE4-962B-7D3507F98C6A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{196D89EC-4CBC-4865-9D60-C790455BFCE2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{E700DAEE-439D-4EE4-962B-7D3507F98C6A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{196D89EC-4CBC-4865-9D60-C790455BFCE2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{E700DAEE-439D-4EE4-962B-7D3507F98C6A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s

---\\ Titr_HJT34=Protocole additionnel (O18)
O18 - Handler: wlmailhtml [64Bits] - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Enumère les données de BootExecute (BEX) (O34)
O34 - HKLM BootExecute: (autocheck autochk * ) - File not found
O34 - HKLM BootExecute: (BootDefrag.exe) - File not found
~ BEX: 2 Legitimates Filtered in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
[MD5.C34968C46A99BBD6248D30F9F1B778C2] [APT] [BoxSoftwareUpdate] (...) -- C:\ProgramData\BoxUpdChk\updchk.exe [177152]
[MD5.7DFCCC67990B6DE7F30F553A4E4612A4] [APT] [RocketDock] (...) -- C:\Program Files (x86)\RocketDock\RocketDock.exe [495616]
[MD5.00000000000000000000000000000000] [APT] [{AD30E604-6C43-4306-8456-2AE93C3DBC76}] (...) -- C:\Users\Bernard\Downloads\MapSource_6163(1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{CE9AC798-D7F2-4D8D-9BBC-948575FCB4A3}] (...) -- C:\Users\Bernard\Documents\Programes Portables\revouninstaller-portable\Revouninstaller.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{DC96496E-2022-4591-B862-16B3CE84FD4E}] (...) -- C:\Users\Bernard\Downloads\MapSource_6163(1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{E2DB4AA8-A1A6-432C-AA21-3AB44CA16BA2}] (...) -- C:\Users\Bernard\Downloads\F8T016-F8T017\BelkinBluetooth.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F60E9C1D-CC7C-4706-BD5A-0BCFDC9F8654}] (...) -- E:\install.exe (.not file.) [0]
~ Scheduled Task: 25 Legitimates Filtered in 00mn 04s

---\\ Logiciels installés (O42)
O42 - Logiciel: Calendridier - (.BitenSoft.) [HKLM][64Bits] -- DreamShield_ca158298-d912-4ff1-b738-512e2361c121
O42 - Logiciel: Français enrichi version 2011.09.25 - (.Denis Liégeois (mailto:***@***).) [HKLM][64Bits] -- {641F9E67-B5D1-4F42-89E9-E9A8323FD32F}
O42 - Logiciel: HDD Unlock Wizard v4.2 - (.A-FF Data Recovery.) [HKLM][64Bits] -- HDD Unlock Wizard_is1
O42 - Logiciel: Simple PDF - (...) [HKLM][64Bits] -- Simple PDF_is1
~ Logic: 150 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\BitenSoft]
[HKCU\Software\finisher]
[HKLM\Software\Wow6432Node\Markement]
[HKLM\Software\Wow6432Node\sPDF]
~ Key Software: 255 Legitimates Filtered in 00mn 00s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 28/04/2013 - 16:35:18 - [21,470] ----D C:\Program Files (x86)\MARKEMENT
O43 - CFD: 01/05/2013 - 17:00:47 - [8,838] ----D C:\Program Files (x86)\Simple PDF
O43 - CFD: 24/08/2013 - 18:17:00 - [0,169] ----D C:\ProgramData\BoxUpdChk
O43 - CFD: 02/06/2013 - 09:53:49 - [0,012] ----D C:\Users\Bernard\AppData\Roaming\BitenSoft
~ Program Folder: 246 Legitimates Filtered in 00mn 21s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.6B82EDBFDC1F795C9A46F8A01E8293E3] - 28/08/2013 - 21:23:53 ----- . (...) -- C:\bootsqm.dat [3544]
O44 - LFC:[MD5.E39991B6672A7FEE541E4D44FFCE81D0] - 28/08/2013 - 08:41:45 ---A- . (...) -- C:\ComboFix.txt [22914]
O44 - LFC:[MD5.3CF3D4A45CC2AF973DBC30EC8D33252B] - 28/08/2013 - 08:39:39 ---A- . (...) -- C:\Windows\system.ini [215]
O44 - LFC:[MD5.0277C027A26428DB64EF4F64F52BB4FD] - 28/08/2013 - 08:31:30 ---A- . (...) -- C:\Windows\MBR.exe [208896]
O44 - LFC:[MD5.F042EE4C8D66248D9B86DCF52ABAE416] - 28/08/2013 - 08:31:30 ---A- . (...) -- C:\Windows\PEV.exe [256000]
O44 - LFC:[MD5.9E05A9C264C8A908A8E79450FCBFF047] - 28/08/2013 - 08:31:30 ---A- . (...) -- C:\Windows\grep.exe [80412]
O44 - LFC:[MD5.2B657A67AEBB84AEA5632C53E61E23BF] - 28/08/2013 - 08:31:30 ---A- . (...) -- C:\Windows\sed.exe [98816]
O44 - LFC:[MD5.5E832F4FAF5F481F2EAF3B3A48F603B8] - 28/08/2013 - 08:31:30 ---A- . (...) -- C:\Windows\zip.exe [68096]
O44 - LFC:[MD5.02E13072E254911BE5FF01200079C81E] - 26/08/2013 - 08:44:54 ---A- . (...) -- C:\DiskDefrag.log [75]
~ Files: 121 Legitimates Filtered in 00mn 20s

---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.23F4EDBDDAEA9E04AFA6915CDE1AD94A] - 28/08/2013 - 11:45:30 ---A- - C:\Windows\Prefetch\NCLINSTALLER64.EXE-BABBDE05.pf
O45 - LFCP:[MD5.E09F3AC411BBADDD1178FE801DC42004] - 28/08/2013 - 11:45:31 ---A- - C:\Windows\Prefetch\DRIVERMAX.EXE-0EEB5770.pf
O45 - LFCP:[MD5.BDE3737D8D19FD1DE4B2A26FA6E69F7F] - 28/08/2013 - 11:45:36 ---A- - C:\Windows\Prefetch\INDEXSEARCH.EXE-2373A5B1.pf
O45 - LFCP:[MD5.020C455DFC1555E03CE4AC199A780E2D] - 28/08/2013 - 11:45:45 ---A- - C:\Windows\Prefetch\PPTD40NT.EXE-24B4DF39.pf
O45 - LFCP:[MD5.895DBF081EDD1E8FD1837B36C7335125] - 28/08/2013 - 17:50:57 ---A- - C:\Windows\Prefetch\YAMB.EXE-7FC75FBB.pf
O45 - LFCP:[MD5.D13C2EE2C5FD48965F9EEA2519328CEA] - 28/08/2013 - 18:56:10 ---A- - C:\Windows\Prefetch\MKVMERGE.EXE-B6554107.pf
O45 - LFCP:[MD5.AA390DB6A6CDEDA5CF8951254FECB741] - 28/08/2013 - 18:56:12 ---A- - C:\Windows\Prefetch\MKVEXTRACT.EXE-292F3FD6.pf
O45 - LFCP:[MD5.8EC290C6B188CD50C72A8204872ECA6A] - 29/08/2013 - 08:52:57 ---A- - C:\Windows\Prefetch\REMINDER.EXE-41D2E779.pf
O45 - LFCP:[MD5.DBDD75ED29EFF9FAA48EF4FEE7CCFCA0] - 29/08/2013 - 08:53:24 ---A- - C:\Windows\Prefetch\RAINLENDAR2.EXE-761F2A0D.pf
O45 - LFCP:[MD5.269B94E6C7BA71DE5ABB007779A96589] - 29/08/2013 - 08:53:25 ---A- - C:\Windows\Prefetch\CALENDRIDIER3.EXE-09C8CF8B.pf
O45 - LFCP:[MD5.1F8BF91BEF4E6001F76AA2698CAE6BEC] - 29/08/2013 - 08:53:25 ---A- - C:\Windows\Prefetch\SETPOINT.EXE-3D9C2601.pf
O45 - LFCP:[MD5.50C821211D63F58B8A953144899BEA08] - 29/08/2013 - 09:27:30 ---A- - C:\Windows\Prefetch\KEEPASS.EXE-1D4B5135.pf
O45 - LFCP:[MD5.90FBC91EE13B4C568F1195B29B1A7727] - 29/08/2013 - 09:49:16 ---A- - C:\Windows\Prefetch\SYNCBACKFREE.EXE-8CAA9EF3.pf
O45 - LFCP:[MD5.38F98CB9946A907B410C2AA93ECFB0CB] - 29/08/2013 - 15:23:30 ---A- - C:\Windows\Prefetch\MAILWASHER.EXE-5DFBC681.pf
~ Prefetcher: 139 Legitimates Filtered in 00mn 01s

---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\KeePass 2 PreLoad [Key] . (.Dominik Reichl - KeePass.) -- C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
~ SMSR Keys: 6 Legitimates Filtered in 00mn 00s

---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s

---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.5573AA70993A2BB81525B1C704B88763] - 09/05/2013 - 09:59:07 . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65336]
O58 - SDL:[MD5.AAF8456F8115EAA51C477DD11A82DB2E] - 24/02/2011 - 19:06:28 ---A- . (.Windows (R) Codename Longhorn DDK provider - A-ff HDD driver.) -- C:\Windows\System32\affhdd.sys [12880]
O58 - SDL:[MD5.4E66F7C81682EDA57F6682D1FB1F7E0D] - 24/02/2011 - 19:06:22 ---A- . (.Windows (R) Codename Longhorn DDK provider - A-ff HDD driver.) -- C:\Windows\SysWOW64\affhdd.sys [11472]
~ Drivers: 17 Legitimates Filtered in 00mn 00s

---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 26/08/2013 - 09:22:09 --HA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Divers Pierrette\PPThumbs.ptn [47153]
O61 - LFC: 26/08/2013 - 09:24:30 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\En Chiffres\Factures\Divers\2013\130730 B. Thermes 03 Bourbon.pdf [360950]
O61 - LFC: 26/08/2013 - 09:27:55 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\En Chiffres\Factures\Divers\2013\130730 P. Thermes 03 Bourbon.pdf [354745]
O61 - LFC: 26/08/2013 - 09:50:55 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\En Chiffres\Factures\Divers\2013\130726 Chevallier J.P. Ramonage Virrefollet.pdf [191122]
O61 - LFC: 26/08/2013 - 09:51:35 --HA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\En Chiffres\Factures\Divers\2013\PPThumbs.ptn [609089]
O61 - LFC: 26/08/2013 - 13:58:23 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\mwLog.20130826 [5152]
O61 - LFC: 26/08/2013 - 14:11:18 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Ameli\130300 releveMensuel.pdf [65536]
O61 - LFC: 26/08/2013 - 14:11:45 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Ameli\130400 releveMensuel.pdf [65536]
O61 - LFC: 26/08/2013 - 14:12:01 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Ameli\130500 releveMensuel.pdf [65536]
O61 - LFC: 26/08/2013 - 14:12:22 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Ameli\130600 releveMensuel.pdf [65536]
O61 - LFC: 26/08/2013 - 14:12:33 ---A- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Ameli\130700 releveMensuel.pdf [65536]
O61 - LFC: 26/08/2013 - 14:15:49 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Thumbs.db [12288]
O61 - LFC: 26/08/2013 - 14:16:46 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Divers Bernard\Thumbs.db [4096]
O61 - LFC: 26/08/2013 - 14:21:32 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Santé\Ameli\Thumbs.db [62976]
O61 - LFC: 27/08/2013 - 08:25:29 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Backup\new\Mail.MSMessageStore [12607488]
O61 - LFC: 27/08/2013 - 08:25:29 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Backup\new\Mail.pat [16384]
O61 - LFC: 27/08/2013 - 08:25:29 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Mail.pat [16384]
O61 - LFC: 27/08/2013 - 08:55:00 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Calendars\DBStore\Backup\new\WLCalendarStore.edb [4218880]
O61 - LFC: 27/08/2013 - 08:55:00 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Calendars\DBStore\Backup\new\WLCalendarStore.pat [16384]
O61 - LFC: 27/08/2013 - 08:55:00 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Calendars\DBStore\WLCalendarStore.pat [16384]
O61 - LFC: 27/08/2013 - 08:56:30 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Vèhicules+Voyages\CampingCar\Thumbs.db [31744]
O61 - LFC: 27/08/2013 - 13:44:35 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\oeconfig.xml [41]
O61 - LFC: 27/08/2013 - 13:46:01 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Calendars\DBStore\WLCalendarStore.edb [4210688]
O61 - LFC: 27/08/2013 - 13:46:01 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Calendars\DBStore\edb.chk [8192]
O61 - LFC: 27/08/2013 - 13:46:01 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Sentinel\WLMailSearchSentinel.eml [38]
O61 - LFC: 27/08/2013 - 13:46:03 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\Mail.MSMessageStore [12599296]
O61 - LFC: 27/08/2013 - 13:46:03 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\RssFeeds.xml [1476]
O61 - LFC: 27/08/2013 - 13:46:03 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\edb.chk [8192]
O61 - LFC: 27/08/2013 - 13:46:03 ---A- . (...) -- C:\Users\Bernard\Documents\Essais courrier\sqmnoopt00.sqm [11440]
O61 - LFC: 27/08/2013 - 14:01:51 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\account{1A5FFC26-44D0-41E5-8B45-35D05741017E}.oeaccount [1822]
O61 - LFC: 27/08/2013 - 14:13:37 ---A- . (...) -- C:\Users\Bernard\Downloads\CA20130827_1505.slk [1938]
O61 - LFC: 27/08/2013 - 14:25:27 ---A- . (.Bernard DURAND.) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Vèhicules+Voyages\CampingCar\CR Voyages\En Cours\2012_12_20 RAPIDO 991DF.doc [58368]
O61 - LFC: 27/08/2013 - 15:03:09 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Notices\Camping-Car\991DF Radio Rapido\Thumbs.db [14848]
O61 - LFC: 27/08/2013 - 15:03:09 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Notices\M 7000 hd\Thumbs.db [16896]
O61 - LFC: 27/08/2013 - 15:03:10 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Notices\Téléphone PhilipsMagic3\Thumbs.db [12288]
O61 - LFC: 27/08/2013 - 15:03:10 -SHA- . (...) -- C:\Users\Bernard\Documents\UNCAFN\UncAfn10\10 En Lettres\10CourrierArrivée\Thumbs.db [17408]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Autres\Notices\LecteurDVD Philips 733\Thumbs.db [23040]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Autres\Notices\Thumbs.db [23040]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Autres\Notices\Téléphone PhilipsMagic3\Thumbs.db [12288]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Autres\Notices\Téléphone Philips\Thumbs.db [12288]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Notices\LecteurDVD Philips 733\Thumbs.db [23040]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Vèhicules+Voyages\CampingCar\CR Voyages\Comptes-Rendus Globaux\Thumbs.db [13824]
O61 - LFC: 27/08/2013 - 15:03:11 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\Vèhicules+Voyages\CampingCar\CR Voyages\Rapido_972M\Thumbs.db [23552]
O61 - LFC: 27/08/2013 - 15:03:12 -SHA- . (...) -- C:\Users\Bernard\Documents\Mes documents PaperPort\En Lettres\Contrats\Thumbs.db [26112]
O61 - LFC: 27/08/2013 - 15:03:12 -SHA- . (...) -- C:\Users\Bernard\Documents\Thumbs.db [129536]
O61 - LFC: 27/08/2013 - 15:03:12 -SHA- . (...) -- C:\Users\Bernard\Documents\UNCAFN\UncAfn11\11 Manifestations\110000 Onzenove\Thumbs.db [24064]
O61 - LFC: 27/08/2013 - 15:03:12 -SHA- . (...) -- C:\Users\Bernard\Documents\UNCAFN\UncAfn11\11 Manifestations\110000 Pique-nique\Thumbs.db [22016]
O61 - LFC: 27/08/2013 - 15:03:12 -SHA- . (...) -- C:\Users\Bernard\Documents\UNCAFN\UncAfn12\12Manifestations\121111 Onzenove\Thumbs.db [43520]
O61 - LFC: 27/08/2013 - 15:03:12 -SHA- . (...) -- C:\Users\Bernard\Documents\UNCAFN\UncAfn13\13 Manifestations\121111 Onzenove\Thumbs.db [43520]
O61 - LFC: 27/08/2013 - 15:03:39 ---A- . (...) -- C:\Users\Bernard\Documents\Autres\Documents and Settings\Default User\Menu Démarrer\Programmes\Accessoires\Invite de commandes.lnk [1995]
O61 - LFC: 27/08/2013 - 15:35:58 ---A- . (.Piriform Ltd.) -- C:\Users\Bernard\Downloads\dfsetup215_slim.exe [3084304]
O61 - LFC: 27/08/2013 - 15:37:19 ---A- . (.HTTrack.) -- C:\Users\Bernard\Downloads\httrack_x64-3.47.24.exe [4356488]
O61 - LFC: 27/08/2013 - 15:53:39 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Actualités 7e5\00294823-0000000B.rss [1042]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\0124305E-00000025.rss [748]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\074D4DC8-0000002A.rss [763]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\0BB32EA6-00000021.rss [746]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\0F3E0099-00000024.rss [748]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\12DB153C-00000022.rss [783]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\154754DE-00000028.rss [776]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\16496DF1-0000001E.rss [748]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\18BE6784-0000001A.rss [754]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\26E901EB-00000020.rss [767]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\2CD672AE-0000001C.rss [776]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\39B32D12-00000029.rss [756]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\3B251E1F-00000030.rss [748]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\428B26A6-0000002C.rss [741]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\440D491C-00000026.rss [691]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\45091238-0000002F.rss [777]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\4AE13D6C-0000001B.rss [760]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\4D064DB7-00000027.rss [777]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\5AF141BB-0000001F.rss [790]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\63CB6BFC-00000032.rss [742]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\644366BB-0000002B.rss [776]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\69525F90-0000001D.rss [725]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\6E5D1AD4-00000031.rss [747]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\701F5D03-0000002D.rss [767]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\7A5A767D-0000002E.rss [747]
O61 - LFC: 27/08/2013 - 15:53:43 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Revues @ Si 53\7E87390C-00000023.rss [688]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\0120759A-00000011.rss [1530]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\2213260D-0000000D.rss [1550]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\235022EE-00000012.rss [1508]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\301C0BDB-0000000F.rss [1559]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\4B405878-00000013.rss [1471]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\4E45323B-0000000C.rss [1509]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\56AE0732-00000010.rss [1565]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\6B365CFD-00000014.rss [1404]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\6B89030A-0000000E.rss [1520]
O61 - LFC: 27/08/2013 - 15:53:44 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Your Feeds\Flux de sit e9c\Actualité d a1d\7F967FF5-0000000B.rss [1484]
O61 - LFC: 27/08/2013 - 16:22:27 ---A- . (...) -- C:\Users\Bernard\Documents\ProtectedMode=0.txt [15]
O61 - LFC: 27/08/2013 - 17:03:49 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\mwLog.20130827 [2944]
O61 - LFC: 27/08/2013 - 19:33:13 ---A- . (...) -- C:\Users\Bernard\AppData\Local\GDIPFONTCACHEV1.DAT [110016]
O61 - LFC: 28/08/2013 - 08:07:07 ---A- . (...) -- C:\Users\Bernard\Downloads\CA20130828_0856.slk [1936]
O61 - LFC: 28/08/2013 - 08:19:06 ---A- . (...) -- C:\Users\Bernard\Documents\PDF Creator Enregistrements\20130828091905_Un guide et un tutoriel sur l'utilisation de ComboFix.pdf [389737]
O61 - LFC: 28/08/2013 - 08:28:36 R--A- . (.Swearware.) -- C:\Users\Bernard\Downloads\ComboFix.exe [5114728]
O61 - LFC: 28/08/2013 - 08:57:53 -SHA- . (...) -- C:\Users\Bernard\Documents\PDF Creator Enregistrements\Thumbs.db [129024]
O61 - LFC: 28/08/2013 - 10:00:55 -SHA- . (...) -- C:\Users\Bernard\Videos\Thumbs.db [15360]
O61 - LFC: 28/08/2013 - 10:13:41 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\Microsoft\MMC\taskschd [145239]
O61 - LFC: 28/08/2013 - 16:57:59 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Calendars\DBStore\Backup\new\WLCalendarStore.edb [4218880]
O61 - LFC: 28/08/2013 - 16:57:59 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Calendars\DBStore\Backup\new\WLCalendarStore.pat [16384]
O61 - LFC: 28/08/2013 - 16:57:59 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Calendars\DBStore\WLCalendarStore.pat [16384]
O61 - LFC: 28/08/2013 - 17:41:31 -SHA- . (...) -- C:\Users\Bernard\Documents\RegroupRocketDock\Programmes Files\Thumbs.db [92160]
O61 - LFC: 28/08/2013 - 18:38:49 ---A- . (...) -- C:\Users\Bernard\Videos\Vidéos à voir\R.I.S Police scientifique - Temps mort_0 h 45.mp4 [154857378]
O61 - LFC: 28/08/2013 - 18:40:27 ---A- . (...) -- C:\Users\Bernard\Videos\Vidéos à voir\R.I.S Police scientifique - Zone rouge_0 h 47.mp4 [160933025]
O61 - LFC: 28/08/2013 - 18:57:38 ---A- . (...) -- C:\Users\Bernard\Videos\Vidéos à voir\R.I.S Police scientifique - Le cercle des initiés_1 h 32.mp4 [384146839]
O61 - LFC: 28/08/2013 - 19:02:01 -SHA- . (...) -- C:\Users\Bernard\Videos\Vidéos à voir\Thumbs.db [226304]
O61 - LFC: 28/08/2013 - 19:02:22 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\mwLog.20130828 [3312]
O61 - LFC: 28/08/2013 - 19:03:03 -SHA- . (...) -- C:\Users\Bernard\Videos\2008\Thumbs.db [14848]
O61 - LFC: 29/08/2013 - 08:57:46 ---A- . (...) -- C:\Users\Bernard\Downloads\CA20130829_0957.slk [5367]
O61 - LFC: 29/08/2013 - 09:03:43 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\Training\Performance.txt [7484]
O61 - LFC: 29/08/2013 - 09:03:43 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\Training\TrainingMA.dat [52790]
O61 - LFC: 29/08/2013 - 09:03:45 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\Training\Training archive - legitimate.rot135 [129671]
O61 - LFC: 29/08/2013 - 09:03:46 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Backup\new\Mail.MSMessageStore [12607488]
O61 - LFC: 29/08/2013 - 09:03:46 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Backup\new\Mail.pat [16384]
O61 - LFC: 29/08/2013 - 09:03:46 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Mail.pat [16384]
O61 - LFC: 29/08/2013 - 09:06:45 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\blackList.txt.backup [9490]
O61 - LFC: 29/08/2013 - 09:06:45 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\filters.txt.backup [566]
O61 - LFC: 29/08/2013 - 09:56:21 R--A- . (...) -- C:\Users\Bernard\Documents\Money Fichiers\TotalNewAnSauv.mbf [49889552]
O61 - LFC: 29/08/2013 - 09:56:27 ---A- . (...) -- C:\Users\Bernard\Documents\Money Fichiers\totalnewan.mny [49131520]
O61 - LFC: 29/08/2013 - 15:12:41 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\BitenSoft\Calendridier\Evenements.xml [12838]
O61 - LFC: 29/08/2013 - 15:34:55 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\mwLog.20130829 [1472]
O61 - LFC: 29/08/2013 - 15:34:55 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\mwSummary.Log [632]
O61 - LFC: 29/08/2013 - 15:34:57 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\Trash.rot135 [470894]
O61 - LFC: 29/08/2013 - 15:52:14 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Sentinel\WLMailSearchSentinel.eml [37]
O61 - LFC: 29/08/2013 - 15:52:18 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\RssFeeds.xml [1476]
O61 - LFC: 29/08/2013 - 15:52:18 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\edb.chk [8192]
O61 - LFC: 29/08/2013 - 15:52:19 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\Blacklist.txt [9534]
O61 - LFC: 29/08/2013 - 15:52:19 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\filters.txt [566]
O61 - LFC: 29/08/2013 - 15:52:19 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\seenEmail.txt [33]
O61 - LFC: 29/08/2013 - 15:52:19 ---A- . (...) -- C:\Users\Bernard\AppData\Roaming\MailWasherFree\spamLog.txt [858798]
O61 - LFC: 29/08/2013 - 15:53:31 ---A- . (...) -- C:\Users\Bernard\Documents\RegroupRocketDock\Nettoyeurs\ZHPDiag.lnk [1864]
O61 - LFC: 29/08/2013 - 15:55:24 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\oeconfig.xml [41]
O61 - LFC: 29/08/2013 - 15:55:34 ---A- . (...) -- C:\Users\Bernard\Documents\Stockage Courriers WLM11 New\Calendars\DBStore\edb.chk [8192]
~ 12 Fichiers temporaires (Temporary files)
~ Files: 1385 Legitimates Filtered in 06mn 41s

---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s

---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (BootDefragDriver) .(...) - LEGACY_BOOTDEFRAGDRIVER
~ Legacy: 82 Legitimates Filtered in 00mn 01s

---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKLM\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s

---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {D94DD7CE-8E2A-4A9D-8FF1-21B985AC0BCC} - (Google) - http://www.google.com
~ Keys: Scanned in 00mn 00s

---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.BCB0728F4B117855765CE8FE883B5E9B] [SPRF][28/08/2013] (...) -- C:\Users\Bernard\AppData\Local\Temp\NOSEventMessages.dll [1536]
[MD5.D4452DA999EA87F78D9B43BDA1B0A8F9] [SPRF][26/07/2013] (...) -- C:\Users\Bernard\AppData\Roaming\wklnhst.dat [3240]
~ Files: 5 Legitimates Filtered in 00mn 00s

---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{51926B9B-1608-4CC6-928B-78F58416F923}" |In - Private - P6 - TRUE | .(...) -- E:\Network\EpsonNetSetup\ENEasyApp.exe (.not file.)
O87 - FAEL: "{F96406B1-ED7D-469E-B209-E3023C7C1884}" |In - Private - P17 - TRUE | .(...) -- E:\Network\EpsonNetSetup\ENEasyApp.exe (.not file.)
~ Firewall: 207 Legitimates Filtered in 00mn 01s

---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "6F42B19C92612E116B691276168807B9" . (.PDF Split And Merge Basic.) -- C:\Windows\Installer\{C91B24F6-1629-11E2-B696-21676188709B}\pdfsam.ico
~ Update Products: 97 Legitimates Filtered in 00mn 00s

---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.B67811645C5A3B8E4E4B1A1DB1EE271C] [WIS][23/07/2013] (.Boxore OU. - Software Update Helper.) -- C:\Windows\Installer\3f841da.msi [45056] =>Adware.Boxore
[MD5.37FFD481E7D0409F9E34ABC1B1982CB1] [WIS][25/09/2011] (.Denis - Keyboard Layout Creator 1.4.) -- C:\Windows\Installer\65f0f7.msi [114688]
~ WIS: 100 Legitimates Filtered in 00mn 19s

---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 14/05/2009 759048 | (ABBYY.Licensing.FineReader.Sprint.9.0) . (.ABBYY.) - C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
SR - | Auto 15/09/2011 204288 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 15/09/2011 361984 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SS - | Auto 16/07/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/07/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 09/05/2011 136120 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 29/01/2010 357456 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Demand 26/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/03/2009 71832 | (SandraAgentSrv) . (.SiSoftware.) - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP2\RpcAgentSrv.exe
SS - | Demand 18/04/2013 737616 | (ServiceLayer) . (.Nokia.) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 25/07/2013 162672 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 07/06/2013 4150112 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
SR - | Auto 22/03/2013 93072 | (TomTomHOMEService) . (.TomTom.) - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 00\00\0000 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 22s

---\\ Recherche dinfection sur le Master Boot Record (MBR)(O80)
Run by Bernard at 29/08/2013 17:04:24
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s

---\\ Recherche dinfection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Bernard at 29/08/2013 17:04:26

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s

---\\ Scan Additionnel (O88)
Database Version : v2.12869 - (29/08/2013)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 1

[HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}] =>Spyware.Soft2PC
[HKLM\Software\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}] =>Spyware.Soft2PC
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\BA086F2D38A8E1A47912955A68B3AD24] =>Adware.PredictAd
[HKLM\Software\Classes\Installer\Features\64A6E60055D801F4BB8AC269354B72B8] =>Adware.Boxore
[HKLM\Software\Classes\Installer\Products\64A6E60055D801F4BB8AC269354B72B8] =>Adware.Boxore
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\64A6E60055D801F4BB8AC269354B72B8] =>Adware.Boxore
[HKLM\Software\Wow6432Node\Classes\Installer\Features\64A6E60055D801F4BB8AC269354B72B8] =>Adware.Boxore
[HKLM\Software\Wow6432Node\Classes\Installer\Products\64A6E60055D801F4BB8AC269354B72B8] =>Adware.Boxore
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>Toolbar.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>Toolbar.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^
C:\Program Files (x86)\Software =>Adware.Boxore
C:\Users\Bernard\AppData\Local\Software =>Adware.Boxore
C:\Windows\Installer\3f841da.msi =>Adware.Boxore^
~ Additionnel Scan: 282297 Items scanned in 00mn 28s

---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com26626977-adware-boxore =>Adware.Boxore
~ http://nicolascoolman.webs.com26630554-spyware-soft2pc =>Spyware.Soft2PC
~ http://nicolascoolman.webs.com27229962-adware-predictad =>Adware.PredictAd
~ http://nicolascoolman.webs.com29637859-toolbar-tarma =>Toolbar.Tarma
~ MSI: 4 link(s) detected in 00mn 29s

~ 2832 Legitimates filtered by white list
End of the scan (638 lines in 09mn 54s)(0)

2011N2 · Answer

Re,

Tu n'as pas fait comme demandé.
Regarde le tutoriel, il faut cliquer sur Configurer, ...
Et héberger le rapport sur cjoint avant de le poster.

Gabriel.

Ricordière · Answer

http://cjoint.com/?CHEsDPmqaUn

Le lien pour acceder au fichier

Amicalement

2011N2 · Answer

Bonjour,

C'est pas tout à fait encore ça mais on s'approche^^

Va sur VirusTotal comme ceci : http://www.forum-entraide-informatique.com/support/virustotal-tutoriel-t8345.html
Et analyse le fichier suivant : C:\Windows\PEV.exe
Puis celui-ci : C:\Windows\MBR.exe

Tu me donneras les 2 liens d'analyses.

Gabriel.

Ricordière · Answer

Je pense que c'est cela que tu veux

SHA256: 	ae0f5cc54e4b133df66a54572a7ce52faff11f8fd0caeab088aad3699d6ec924
SHA1: 	4cd785c7c3e40c42e3d126086d986c4d4d940bb2
MD5: 	f042ee4c8d66248d9b86dcf52abae416
Taille du fichier : 	250.0 KB ( 256000 bytes )
Nom du fichier : 	PEV.exe
Type du fichier : 	Win32 EXE
Ratio de détection : 	0 / 46
Date d'analyse : 	2013-08-31 13:54:24 UTC (il y a 0 minute)

Ricordière · Answer

J'ajoute le lien

https://www.virustotal.com/fr/file/ae0f5cc54e4b133df66a54572a7ce52faff11f8fd0caeab088aad3699d6ec924/analysis/

2011N2 · Answer

Re,

Oui c'est ça et pour MBR.exe ?

Gabriel.

Ricordière · Answer

https://www.virustotal.com/fr/file/ff14a83caafe2c941e29e9d177a876d72aed865571d8518f24d9ea265222741e/analysis/

Je pense que le lien permet d'accéder à l'analyse ?

J'avais encore lu trop vite et oublié le 2° fichier, mille excuses.

Ceci dit, après avoir fouillé les "a cesse de fonctionner" sur les sites, j'ai appliqué la méthode préconisée par Microsoft, soit "mise à jour du pilote de carte graphique. Pourtant mon ordinateur me disait "pilote à jour", mais le constructeur de la carte (MSI) proposant une analyse en ligne, à laquelle je me suis livré, puis a proposé une nouvelle version que j'ai installée, et il semble que maintenant je n'ai plus cet agaçant "a cessé de fonctionner" Et il me semble aussi que depuis cette modification je pédale plus vite.

Mais dis moi quand même ce que tu penses des analyses que tu m'as demandé.

Merci, amicalement

2011N2 · Answer

Re,

Ok, justement si après la désinfection les problèmes persistaient, j'allais te proposer les pilotes.

Pour PEV.exe c'est bon oui, mais pour MBR.exe tu as visiblement reprit une ancienne analyse (il y a 4 jours), tu n'as pas cliqué sur Réanalyser ?

Gabriel.

Ricordière · Answer

OK Sitôt dit sitôt fait

https://www.virustotal.com/fr/file/ff14a83caafe2c941e29e9d177a876d72aed865571d8518f24d9ea265222741e/analysis/1378037580/

Remerci

2011N2 · Answer

Re,

Très bien. :)

Fais ZHPFix comme ceci avec ces lignes.

Gabriel.

Ricordière · Answer

Rapport de ZHPFix 2013.8.28.2 par Nicolas Coolman, Update du 28/08/2013
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-04-09-2013-12-00-13.txt
Run by Bernard at 04/09/2013 12:00:13
High Elevated Privileges : OK
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)

Corbeille vidée

========== Clé(s) du Registre ==========
SUPPRIME Key*: HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
ABSENT Key: HKLM\Software\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
SUPPRIME Key*: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\BA086F2D38A8E1A47912955A68B3AD24
SUPPRIME Key: HKLM\Software\Classes\Installer\Features\64A6E60055D801F4BB8AC269354B72B8
SUPPRIME Key: HKLM\Software\Classes\Installer\Products\64A6E60055D801F4BB8AC269354B72B8
SUPPRIME Key*: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\64A6E60055D801F4BB8AC269354B72B8
ABSENT Key: HKLM\Software\Wow6432Node\Classes\Installer\Features\64A6E60055D801F4BB8AC269354B72B8
ABSENT Key: HKLM\Software\Wow6432Node\Classes\Installer\Products\64A6E60055D801F4BB8AC269354B72B8
SUPPRIME Key*: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC
SUPPRIME  Key: CLSID: [HKLM\SOFTWARE\Classes\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
SUPPRIME Key*: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
SUPPRIME Key*: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5

========== Valeur(s) du Registre ==========
SUPPRIME Toolbar: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5}

========== Dossier(s) ==========
Aucun dossiers CLSID Local utilisateur vide

========== Fichier(s) ==========
SUPPRIME File: C:\Windows\Installer\3f841da.msi
ABSENT Folder/File: c:\windows\installer\3f841da.msi
SUPPRIME File: c:\diskdefrag.log 
ABSENT File: c:\windows\prefetch
clinstaller64.exe-babbde05.pf
ABSENT File: c:\windows\prefetch\drivermax.exe-0eeb5770.pf
SUPPRIME File: c:\windows\prefetch\indexsearch.exe-2373a5b1.pf 
SUPPRIME File: c:\windows\prefetch\pptd40nt.exe-24b4df39.pf 
ABSENT File: c:\windows\prefetch\yamb.exe-7fc75fbb.pf
ABSENT File: c:\windows\prefetch\mkvmerge.exe-b6554107.pf
ABSENT File: c:\windows\prefetch\mkvextract.exe-292f3fd6.pf
ABSENT File: c:\windows\prefetcheminder.exe-41d2e779.pf
SUPPRIME File: c:\windows\prefetchainlendar2.exe-761f2a0d.pf 
SUPPRIME File: c:\windows\prefetch\calendridier3.exe-09c8cf8b.pf 
SUPPRIME File: c:\windows\prefetch\setpoint.exe-3d9c2601.pf 
SUPPRIME File: c:\windows\prefetch\mailwasher.exe-5dfbc681.pf 
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Tache planifiée ==========
SUPPRIME Task: {AD30E604-6C43-4306-8456-2AE93C3DBC76}
SUPPRIME Task: {CE9AC798-D7F2-4D8D-9BBC-948575FCB4A3}
SUPPRIME Task: {DC96496E-2022-4591-B862-16B3CE84FD4E}
SUPPRIME Task: {E2DB4AA8-A1A6-432C-AA21-3AB44CA16BA2}

========== Restauration Système ==========
Point de restauration du système créé avec succès


========== Récapitulatif ==========
12 : Clé(s) du Registre
1 : Valeur(s) du Registre
1 : Dossier(s)
17 : Fichier(s)
4 : Tache planifiée
1 : Restauration Système


End of clean in 00mn 26s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 04/09/2013 10:59:34 [541]
C:\ZHP\ZHPFix[R2].txt - 04/09/2013 12:00:13 [3433]

2011N2 · Answer

Salut,

Ok, fais moi un nouveau ZHPDiag pour voir si tout est ok.
Comment se comporte le PC ?

Gabriel.

Ricordière · Answer

Bonjour,

Merci pour la réponse, mais je dois m'absenter quelques jours.

Je réagirai au retour.

Le PC se comporte bien.

Amicalement

2011N2 · Answer

Bonjour,

Ok, @+. :)

Gabriel.

Combofix

20 réponses

Discussions similaires

Newsletters