trojan horse bho.ffg

Question

Bonjour,

J'ai besoin de votre aide car mon antivirus AVG8.0 détecte un virus : TROJAN HORSE BHO.FFG
AVG8.0 ne veut pasle supprimer ou le mettre en quarantaine. Ensuite j'ai essayé avec spybot et c'est pareil. J'ai aussi essayer avec AD-AWARE 2008 et le virus est toujours là.

Je ne sais plus quoi faire.

Pouvez-vous me dire si c'est grave comme VIRUS et me dire comment l'éradiquer définitivement.

MERCI d'avance pour votre aide.

yann000 · Answer

bonjour etein ton anti virus et telecharge https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/12884.html fait un scan

00julien00 · Answer

éssais avast et si tu a des fichier personnelle je te conseille de les copier et de les supprimer car un trojan sa serre a piquer des info de ton pc et les plus evoluée comme netbus peuvent prendre le controle de ton pc !

anankronik · Answer

Merci pour vos réponse, 

yann peux tu me dire comment désactiver SPYBOT ?

NB : Je ne pense pas qu'il faut que je désactive AD-AWARE 2008 car c'est la version free et elle n'est pas active en temps réel. Je dis bien "je pense" ( ce n'est pas une affirmation ) car je suis débutant en informatique.

anankronik · Answer

Ah oui, j'ai oublier de demander aussi comment désactiver AVG8.0 AUSSI

yann000 · Answer

en bas a droite tu doit avoir l icone spyboot dans ta barre de tache clic droit et met quitter

anankronik · Answer

OK MERCI ET J'ai fait pareil pour AVG 8.0

yann000 · Answer

pour avg tu doit a mon avis faire la meme manip il doit y avoir ecrit desactiver la protection ou sinon essaye en le laissant

anankronik · Answer

C'est bon yann, j'ai fait le scan avec le logiciel que tu m'a proposé et après ?

yann000 · Answer

il a trouver quelque chose

anankronik · Answer

J'ai pas l'impression mais je peux toujours te faire voir l'historique si tu veux ?

Dis moi OUI ou NON

yann000 · Answer

si tu veux vas dans statut   statistique   menu detaillé et regarde

anankronik · Answer

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.1.2538. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 11:09:56 16 août 2008
Using Database v7102
Operating System:  Windows Vista  [Windows Vista (Build 6000)]
Edition:           Windows Vista (TM) Home Premium
File System:       NTFS
User Account Control is Enabled.
Data directory:     C:\Users\maxime\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Users\maxime\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
Microsoft Windows Defender
Avast! Antivirus

************************************************************


************************************************************
11:09:56: Scanning ----------WIN.INI-----------
WIN.INI found in C:\Windows

************************************************************
11:09:56: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\Windows

************************************************************
11:09:56: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
11:09:57: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: explorer.exe
C:\Windows\explorer.exe
2923520 bytes
Created:  09/01/2008
Modified: 09/01/2008
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
24576 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: Windows Defender
Value Data: %ProgramFiles%\Windows Defender\MSASCui.exe -hide
C:\Program Files\Windows Defender\MSASCui.exe
1006264 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Microsoft Corporation
--------------------
Value Name: ECenter
Value Data: C:\Dell\E-Center\EULALauncher.exe
C:\Dell\E-Center\EULALauncher.exe
17920 bytes
Created:  02/01/2008
Modified: 25/05/2007
Company:   
--------------------
Value Name: Bluetooth HCI Monitor
Value Data: RunDll32 HCIMNTR.DLL,RunCheckHCIMode
C:\Windows\system32\HCIMNTR.DLL
9728 bytes
Created:  02/01/2008
Modified: 08/12/2006
Company:  Logitech Inc.
--------------------
Value Name: SigmatelSysTrayApp
Value Data: C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
405504 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  SigmaTel, Inc.
--------------------
Value Name: Windows Mobile Device Center
Value Data: %windir%\WindowsMobile\wmdc.exe
C:\Windows\WindowsMobile\wmdc.exe
648072 bytes
Created:  31/05/2007
Modified: 31/05/2007
Company:  Microsoft Corporation
--------------------
Value Name: SunJavaUpdateSched
Value Data: "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
c:\Program Files\Java\jre1.6.0\bin\jusched.exe
77824 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Sun Microsystems, Inc.
--------------------
Value Name: PMX Daemon
Value Data: ICO.EXE
C:\Windows\system32\ICO.EXE
49152 bytes
Created:  02/01/2008
Modified: 08/11/2006
Company:  Primax Electronics Ltd.
--------------------
Value Name: IAAnotif
Value Data: "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
178712 bytes
Created:  02/01/2008
Modified: 26/07/2007
Company:  Intel Corporation
--------------------
Value Name: NMSSupport
Value Data: "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
439512 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel Corporation
--------------------
Value Name: CCUTRAYICON
Value Data: "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
215256 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
--------------------
Value Name: dscactivate
Value Data: "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
16384 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:   
--------------------
Value Name: Google Desktop Search
Value Data: "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
1838592 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
--------------------
Value Name: fssui
Value Data: "C:\Program Files\Windows Live\Contrôle parental\fssui.exe" -autorun
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
243240 bytes
Created:  17/12/2007
Modified: 17/12/2007
Company:  Microsoft Corporation
--------------------
Value Name: TkBellExe
Value Data: "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
C:\Program Files\Common Files\Real\Update_OBealsched.exe
185896 bytes
Created:  27/01/2008
Modified: 27/01/2008
Company:  RealNetworks, Inc.
--------------------
Value Name: e-TF1
Value Data: C:\Program Files\TF1Vision\TF1vision.exe
C:\Program Files\TF1Vision\TF1vision.exe
345600 bytes
Created:  22/02/2008
Modified: 24/12/2007
Company:  1-Click Media
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created:  11/01/2008
Modified: 11/01/2008
Company:  Adobe Systems Incorporated
--------------------
Value Name: DellSupportCenter
Value Data: "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
202544 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:  SupportSoft, Inc.
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
78008 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
--------------------
Value Name: AVG8_TRAY
Value Data: C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
1232152 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
--------------------
Value Name: AGEIA PhysX SysTray
Value Data: "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
C:\Program Files\AGEIA Technologies\TrayIcon.exe
339968 bytes
Created:  16/08/2006
Modified: 16/08/2006
Company:  
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created:  22/07/2008
Modified: 22/07/2008
Company:  Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
C:\Program Files\QuickTime\QTTask.exe
413696 bytes
Created:  27/05/2008
Modified: 27/05/2008
Company:  Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created:  30/07/2008
Modified: 30/07/2008
Company:  Apple Inc.
--------------------
Value Name: NvCplDaemon
Value Data: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
C:\Windows\system32\NvCpl.dll
13535776 bytes
Created:  12/06/2008
Modified: 12/06/2008
Company:  NVIDIA Corporation
--------------------
Value Name: NvMediaCenter
Value Data: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
C:\Windows\system32\NvMcTray.dll
92704 bytes
Created:  02/01/2008
Modified: 12/06/2008
Company:  NVIDIA Corporation
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
909904 bytes
Created:  16/08/2008
Modified: 30/07/2008
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: DellSupportCenter
Value Data: "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
202544 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:  SupportSoft, Inc.
--------------------
Value Name: ehTray.exe
Value Data: C:\Windows\ehome\ehTray.exe
C:\Windows\ehome\ehTray.exe
125440 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
--------------------
Value Name: CanalPlayer
Value Data: C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe [file not found to scan]
--------------------
Value Name: swg
Value Data: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
68856 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google Inc.
--------------------
Value Name: ISUSPM
Value Data: "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
218032 bytes
Created:  11/09/2006
Modified: 11/09/2006
Company:  Macrovision Corporation
--------------------
Value Name: AlcoholAutomount
Value Data: "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
217544 bytes
Created:  20/03/2008
Modified: 20/03/2008
Company:  Alcohol Soft Development Team
--------------------
Value Name: WindowsWelcomeCenter
Value Data: rundll32.exe oobefldr.dll,ShowWelcomeCenter
C:\Windows\system32\oobefldr.dll
2159104 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty

************************************************************
11:10:01: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {522E0112-EDD9-413D-A99E-C311A54B6676}
File:      C:\Windows\system32\pmnNGwuT.dll
C:\Windows\system32\pmnNGwuT.dll - this registry value has been removed [file not found to scan]
HKCR\CLSID\{522E0112-EDD9-413D-A99E-C311A54B6676} - this key has been removed
----------

************************************************************
11:10:35: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
11:10:35: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\system32\STARWA~1.SCR
C:\Windows\system32\STARWA~1.SCR
2540251 bytes
Created:  29/02/2008
Modified: 29/02/2008
Company:  Axialis Software
--------------------

************************************************************
11:10:37: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

************************************************************
11:10:37: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key:  BthServ
Path: %SystemRoot%\System32\bthserv.dll
C:\Windows\System32\bthserv.dll
39936 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
--------------------
Key:  RapiMgr
Path: %windir%\WindowsMobileapimgr.dll
C:\Windows\WindowsMobileapimgr.dll
183688 bytes
Created:  31/05/2007
Modified: 31/05/2007
Company:  Microsoft Corporation
--------------------
Key:  WcesComm
Path: %windir%\WindowsMobile\wcescomm.dll
C:\Windows\WindowsMobile\wcescomm.dll
379784 bytes
Created:  31/05/2007
Modified: 31/05/2007
Company:  Microsoft Corporation
--------------------

************************************************************
11:10:38: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       aawservice
ImagePath: "C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe"
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
611664 bytes
Created:  12/05/2008
Modified: 16/08/2008
Company:  Lavasoft
----------
Key:       AdobeActiveFileMonitor6.0
ImagePath: C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
124832 bytes
Created:  11/09/2007
Modified: 11/09/2007
Company:  
----------
Key:       AlertService
ImagePath: "C:\Program Files\Intel\IntelDH\CCU\AlertService.exe"
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
223448 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       Apple Mobile Device
ImagePath: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created:  22/07/2008
Modified: 22/07/2008
Company:  Apple Inc.
----------
Key:       aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\Windows\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created:  16/05/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       aswMonFlt
ImagePath: system32\DRIVERS\aswMonFlt.sys
C:\Windows\system32\DRIVERS\aswMonFlt.sys
51280 bytes
Created:  16/05/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
16056 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       atapi
ImagePath: \SystemRoot\system32\drivers\atapi.sys
C:\Windows\system32\drivers\atapi.sys
21688 bytes
Created:  02/11/2006
Modified: 02/01/2008
Company:  Microsoft Corporation
----------
Key:       avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
147640 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
250040 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
348344 bytes
Created:  15/08/2008
Modified: 23/07/2008
Company:  ALWIL Software
----------
Key:       avg8emc
ImagePath: C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
873752 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       avg8wd
ImagePath: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
231192 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgLdx86
ImagePath: \SystemRoot\System32\Drivers\avgldx86.sys
C:\Windows\System32\Drivers\avgldx86.sys
96520 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgMfx86
ImagePath: \SystemRoot\System32\Drivers\avgmfx86.sys
C:\Windows\System32\Drivers\avgmfx86.sys
26824 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgWfpX
ImagePath: \SystemRoot\System32\Drivers\avgwfpx.sys
C:\Windows\System32\Drivers\avgwfpx.sys
69128 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       BCM43XV
ImagePath: system32\DRIVERS\bcmwl6.sys
C:\Windows\system32\DRIVERS\bcmwl6.sys
464384 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Broadcom Corporation
----------
Key:       blbdrive
ImagePath: \SystemRoot\system32\drivers\blbdrive.sys - file is missing - alert is globally excluded
----------
Key:       Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created:  24/07/2007
Modified: 24/07/2007
Company:  Apple Inc.
----------
Key:       BthEnum
ImagePath: system32\DRIVERS\BthEnum.sys
C:\Windows\system32\DRIVERS\BthEnum.sys
19456 bytes
Created:  11/06/2008
Modified: 29/04/2008
Company:  Microsoft Corporation
----------
Key:       BthPan
ImagePath: system32\DRIVERS\bthpan.sys
C:\Windows\system32\DRIVERS\bthpan.sys
92160 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       BTHPORT
ImagePath: System32\Drivers\BTHport.sys
C:\Windows\System32\Drivers\BTHport.sys
220160 bytes
Created:  11/06/2008
Modified: 29/04/2008
Company:  Microsoft Corporation
----------
Key:       BTHUSB
ImagePath: System32\Drivers\BTHUSB.sys
C:\Windows\System32\Drivers\BTHUSB.sys
29184 bytes
Created:  11/06/2008
Modified: 29/04/2008
Company:  Microsoft Corporation
----------
Key:       btwaudio
ImagePath: system32\drivers\btwaudio.sys
C:\Windows\system32\drivers\btwaudio.sys
79664 bytes
Created:  02/01/2008
Modified: 02/04/2007
Company:  Broadcom Corporation.
----------
Key:       btwavdt
ImagePath: system32\drivers\btwavdt.sys
C:\Windows\system32\drivers\btwavdt.sys
80688 bytes
Created:  02/01/2008
Modified: 02/04/2007
Company:  Broadcom Corporation.
----------
Key:       btwrchid
ImagePath: system32\DRIVERS\btwrchid.sys
C:\Windows\system32\DRIVERS\btwrchid.sys
16432 bytes
Created:  02/01/2008
Modified: 02/04/2007
Company:  Broadcom Corporation.
----------
Key:       DHTRACE
ImagePath: C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
39640 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       DQLWinService
ImagePath: "C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe"
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
208896 bytes
Created:  12/02/2007
Modified: 12/02/2007
Company:  
----------
Key:       e1express
ImagePath: system32\DRIVERS\e1e6032.sys
C:\Windows\system32\DRIVERS\e1e6032.sys
228224 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  Intel Corporation
----------
Key:       EMSUSB2
ImagePath: system32\DRIVERS\EMSUSB2.sys
C:\Windows\system32\DRIVERS\EMSUSB2.sys
9728 bytes
Created:  27/07/2008
Modified: 03/01/2007
Company:  
----------
Key:       FLEXnet Licensing Service
ImagePath: "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
654848 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Macrovision Europe Ltd.
----------
Key:       fssfltr
ImagePath: system32\DRIVERS\fssfltr.sys
C:\Windows\system32\DRIVERS\fssfltr.sys
43816 bytes
Created:  09/01/2008
Modified: 17/10/2007
Company:  Microsoft Corporation
----------
Key:       fsssvc
ImagePath: "C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe"
C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe
523816 bytes
Created:  17/12/2007
Modified: 17/12/2007
Company:  Microsoft Corporation
----------
Key:       GoogleDesktopManager
ImagePath: "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
1838592 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------
Key:       gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
138168 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------
Key:       IAANTMON
ImagePath: C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
358936 bytes
Created:  02/01/2008
Modified: 26/07/2007
Company:  Intel Corporation
----------
Key:       iaStor
ImagePath: system32\drivers\iastor.sys
C:\Windows\system32\drivers\iastor.sys
305688 bytes
Created:  02/01/2008
Modified: 29/08/2007
Company:  Intel Corporation
----------
Key:       IDriverT
ImagePath: "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
73728 bytes
Created:  22/10/2004
Modified: 22/10/2004
Company:  Macrovision Corporation
----------
Key:       IntelDH
ImagePath: System32\Drivers\IntelDH.sys
C:\Windows\System32\Drivers\IntelDH.sys
5632 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Intel Corporation
----------
Key:       IpInIp
ImagePath: system32\DRIVERS\ipinip.sys - file is missing - alert is globally excluded
----------
Key:       ISSM
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
59096 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       M1 Server
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
268504 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  
----------
Key:       MCLServiceATL
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
157912 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       msiserver
ImagePath: %systemroot%\system32\msiexec /V
----------
Key:       NMSCore
ImagePath: "C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe"
C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
317656 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       nmsunidr
ImagePath: system32\DRIVERS
msunidr.sys
C:\Windows\system32\DRIVERS
msunidr.sys
-S- 5376 bytes
Created:  18/02/2007
Modified: 18/02/2007
Company:  Gteko Ltd.
----------
Key:       nvsvc
ImagePath: %SystemRoot%\system32
vvsvc.exe
C:\Windows\system32
vvsvc.exe
118784 bytes
Created:  12/06/2008
Modified: 12/06/2008
Company:  NVIDIA Corporation
----------
Key:       NwlnkFlt
ImagePath: system32\DRIVERS
wlnkflt.sys - file is missing - alert is globally excluded
----------
Key:       NwlnkFwd
ImagePath: system32\DRIVERS
wlnkfwd.sys - file is missing - alert is globally excluded
----------
Key:       phaudlwr
ImagePath: system32\DRIVERS\phaudlwr.sys
C:\Windows\system32\DRIVERS\phaudlwr.sys
88704 bytes
Created:  07/05/2008
Modified: 07/05/2008
Company:  Philips Applied Technologies
----------
Key:       pmxmouse
ImagePath: system32\DRIVERS\pmxmouse.sys
C:\Windows\system32\DRIVERS\pmxmouse.sys
18432 bytes
Created:  02/01/2008
Modified: 01/06/2007
Company:  Primax Electronics Ltd.
----------
Key:       pmxusblf
ImagePath: system32\DRIVERS\pmxusblf.sys
C:\Windows\system32\DRIVERS\pmxusblf.sys
19008 bytes
Created:  02/01/2008
Modified: 24/05/2007
Company:  Primax Electronics Ltd.
----------
Key:       QualityManager
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
272600 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       Remote UI Service
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
446680 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       RFCOMM
ImagePath: system32\DRIVERSfcomm.sys
C:\Windows\system32\DRIVERSfcomm.sys
49664 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       RoxMediaDB9
ImagePath: "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe"
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
1010160 bytes
Created:  06/09/2007
Modified: 06/09/2007
Company:  Sonic Solutions
----------
Key:       Serenum
ImagePath: \SystemRoot\system32\drivers\serenum.sys
C:\Windows\system32\drivers\serenum.sys
17920 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       Serial
ImagePath: \SystemRoot\system32\drivers\serial.sys
C:\Windows\system32\drivers\serial.sys
83456 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       sfdrv01
ImagePath: System32\drivers\sfdrv01.sys
C:\Windows\System32\drivers\sfdrv01.sys
59256 bytes
Created:  05/07/2006
Modified: 05/07/2006
Company:  Protection Technology (StarForce)
----------
Key:       sfhlp02
ImagePath: System32\drivers\sfhlp02.sys
C:\Windows\System32\drivers\sfhlp02.sys
13680 bytes
Created:  14/06/2006
Modified: 14/06/2006
Company:  Protection Technology (StarForce)
----------
Key:       sfsync03
ImagePath: System32\drivers\sfsync03.sys
C:\Windows\System32\drivers\sfsync03.sys
35328 bytes
Created:  06/12/2005
Modified: 06/12/2005
Company:  Protection Technology
----------
Key:       sfvfs02
ImagePath: System32\drivers\sfvfs02.sys
C:\Windows\System32\drivers\sfvfs02.sys
83320 bytes
Created:  08/02/2007
Modified: 08/02/2007
Company:  Protection Technology (StarForce)
----------
Key:       SPC520
ImagePath: system32\drivers\SPC520.sys
C:\Windows\system32\drivers\SPC520.sys
483328 bytes
Created:  16/08/2008
Modified: 01/10/2007
Company:  Philips                                                     
----------
Key:       SPC520m
ImagePath: system32\drivers\SPC520m.sys
C:\Windows\system32\drivers\SPC520m.sys
7680 bytes
Created:  16/08/2008
Modified: 01/10/2007
Company:  Philips                                                     
----------
Key:       sprtsvc_dellsupportcenter
ImagePath: C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter
C:\Program Files\Dell Support Center\bin\sprtsvc.exe 
202544 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:  SupportSoft, Inc.
----------
Key:       sptd
ImagePath: System32\Drivers\sptd.sys - this file is globally excluded
----------
Key:       STacSV
ImagePath: C:\Windows\system32\STacSV.exe
C:\Windows\system32\STacSV.exe
94208 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  SigmaTel, Inc.
----------
Key:       StarWindServiceAE
ImagePath: C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
275968 bytes
Created:  28/05/2007
Modified: 28/05/2007
Company:  Rocket Division Software
----------
Key:       STHDA
ImagePath: system32\drivers\stwrt.sys
C:\Windows\system32\drivers\stwrt.sys
326656 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  SigmaTel, Inc.
----------
Key:       stllssvr
ImagePath: "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe"
C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
-R- 69632 bytes
Created:  11/07/2007
Modified: 11/07/2007
Company:  MicroVision Development, Inc.
----------
Key:       TSHWMDTCP
ImagePath: \??\C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys
14552 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  
----------
Key:       usnjsvc
ImagePath: "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
C:\Program Files\Windows Live\Messenger\usnsvc.exe
98328 bytes
Created:  18/10/2007
Modified: 18/10/2007
Company:  Microsoft Corporation
----------
Key:       WinUsb
ImagePath: system32\DRIVERS\WinUSB.SYS
C:\Windows\system32\DRIVERS\WinUSB.SYS
31616 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       WLSetupSvc
ImagePath: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe"
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
266240 bytes
Created:  25/10/2007
Modified: 25/10/2007
Company:  Microsoft Corporation
----------

************************************************************
11:10:51: Scanning -----VXD ENTRIES-----

************************************************************
11:10:51: Scanning ----- WINLOGON\NOTIFY DLLS -----
No WINLOGON\NOTIFY DLLs found to scan

************************************************************
11:10:51: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   ALZip
CLSID: {4EB37360-49E8-11D3-95B5-004033382980}
Path:  C:\PROGRA~1\ESTsoft\ALZip\AZCTM.dll
C:\PROGRA~1\ESTsoft\ALZip\AZCTM.dll
471552 bytes
Created:  03/07/2007
Modified: 03/07/2007
Company:  ESTsoft
----------
Key:   avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path:  C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
73912 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:   AVG8 Shell Extension
CLSID: {9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
Path:  C:\Program Files\AVG\AVG8\avgse.dll
C:\Program Files\AVG\AVG8\avgse.dll
99608 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------

************************************************************
11:10:51: Scanning ----- FOLDER\COLUMNHANDLERS -----

************************************************************
11:10:51: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created:  23/10/2006
Modified: 23/10/2006
Company:  Adobe Systems Incorporated
----------
Key: {2E03C0FD-4C48-43A7-9A54-00240C70FF16}
BHO: C:\Windows\system32\BhoECart.dll
C:\Windows\system32\BhoECart.dll
139264 bytes
Created:  31/10/2003
Modified: 31/10/2003
Company:  Orbiscom Ltd. All rights reserved.
----------
Key: {3049C3E9-B461-4BC5-8870-4C09146192CA}
BHO: C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
370296 bytes
Created:  27/01/2008
Modified: 27/01/2008
Company:  RealPlayer
----------
Key: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
BHO: C:\Program Files\AVG\AVG8\avgssie.dll
C:\Program Files\AVG\AVG8\avgssie.dll
455960 bytes
Created:  27/05/2008
Modified: 05/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}
BHO: C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
56360 bytes
Created:  17/12/2007
Modified: 17/12/2007
Company:  Microsoft Corporation
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
1562448 bytes
Created:  15/08/2008
Modified: 07/07/2008
Company:  Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: c:\Program Files\Java\jre1.6.0\bin\ssv.dll
c:\Program Files\Java\jre1.6.0\bin\ssv.dll
501384 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Sun Microsystems, Inc.
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
328752 bytes
Created:  20/09/2007
Modified: 20/09/2007
Company:  Microsoft Corporation
----------
Key: {A057A204-BACC-4D26-9990-79A187E2698E}
BHO: C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
2055960 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG, Technologies CZ, s.r.o                  
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2582136 bytes
Created:  16/05/2008
Modified: 16/05/2008
Company:  Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
325048 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google Inc.
----------
Key: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
BHO: C:\Program Files\Windows Live Toolbar\msntb.dll
C:\Program Files\Windows Live Toolbar\msntb.dll
546320 bytes
Created:  19/10/2007
Modified: 19/10/2007
Company:  Microsoft Corporation
----------
Key: {CA6319C0-31B7-401E-A518-A07C3DB8F777}
BHO: C:\Program Files\Dell\BAE\BAE.dll
C:\Program Files\Dell\BAE\BAE.dll
98304 bytes
Created:  09/11/2006
Modified: 09/11/2006
Company:  Dell Inc.
----------

************************************************************
11:10:52: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
11:10:52: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
11:10:52: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
11:10:52: Scanning ----- APPINIT_DLLS -----
AppInitDLLs entry = [C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL]
File: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
145408 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------
File: avgrsstx.dll
C:\Windows\system32\avgrsstx.dll
10520 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
File: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
145408 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------

************************************************************
11:10:53: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
11:10:53: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
715568 bytes
Created:  13/02/2007
Modified: 13/02/2007
Company:  Broadcom Corporation.
BTTray.lnk - links to C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
--------------------
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  02/11/2006
Modified: 10/07/2008
Company:  
--------------------
C:\Windows\VPro520.exe
73728 bytes
Created:  14/01/2008
Modified: 06/04/2007
Company:  Philips
VPro520.lnk - links to C:\Windows\VPro520.exe
--------------------

************************************************************
11:10:53: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: Invité
[C:\Users\Invité\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\Invité\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  18/07/2008
Modified: 18/07/2008
Company:  
----------
--------------------
Checking Startup Group for: maxime
[C:\Users\maxime\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\maxime\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  05/01/2008
Modified: 05/01/2008
Company:  
----------
--------------------

************************************************************
11:10:53: Scanning ----- SCHEDULED TASKS -----
Taskname:      Vérifier les mises à jour de Windows Live Toolbar.job
File:          C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
99856 bytes
Created:  19/10/2007
Modified: 19/10/2007
Company:  Microsoft Corporation
Parameters:    [blank]
Next Run Time: 16/08/2008 11:38:00
Status:        La tâche n'a pas encore été exécutée
Creator:       maxime
Comments:      [blank]
----------

************************************************************
11:10:53: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
No ShellIconOverlayIdentifiers Registry key found to scan

************************************************************
11:10:53: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\maxime\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
C:\Users\maxime\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
2273454 bytes
Created:  28/06/2008
Modified: 28/06/2008
Company:  
----------
Web Desktop Wallpaper: %USERPROFILE%\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
C:\Users\maxime\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
2273454 bytes
Created:  28/06/2008
Modified: 28/06/2008
Company:  
----------
Additional checks completed

************************************************************
11:10:54: Scanning ----- RUNNING PROCESSES -----

C:\Windows\System32\smss.exe
--------------------
C:\Windows\system32\csrss.exe
--------------------
C:\Windows\system32\wininit.exe
--------------------
C:\Windows\system32\csrss.exe
--------------------
C:\Windows\system32\services.exe
--------------------
C:\Windows\system32\lsass.exe
--------------------
C:\Windows\system32\lsm.exe
--------------------
C:\Windows\system32\winlogon.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\SLsvc.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\WUDFHost.exe
--------------------
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
--------------------
C:\Windows\System32\spoolsv.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\Dwm.exe
--------------------
C:\Windows\Explorer.EXE
--------------------
C:\Program Files\Windows Defender\MSASCui.exe
--------------------
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
--------------------
C:\Windows\WindowsMobile\wmdc.exe
--------------------
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
--------------------
C:\Windows\System32\ico.exe
--------------------
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
--------------------
C:\Windows\System32\Pmxmiced.exe
--------------------
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
--------------------
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
--------------------
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
--------------------
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
--------------------
C:\Program Files\Common Files\Real\Update_OBealsched.exe
--------------------
C:\Program Files\TF1Vision\TF1vision.exe
--------------------
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
--------------------
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
--------------------
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
--------------------
C:\Windows\System32undll32.exe
--------------------
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
--------------------
C:\Windows\System32undll32.exe
--------------------
C:\Program Files\AGEIA Technologies\TrayIcon.exe
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
--------------------
C:\Windows\ehome\ehtray.exe
--------------------
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
--------------------
C:\Windows\ehome\ehmsas.exe
--------------------
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
--------------------
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
--------------------
C:\Windows\VPro520.exe
--------------------
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
--------------------
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
--------------------
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
--------------------
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
--------------------
C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe
--------------------
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
--------------------
C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
--------------------
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
--------------------
C:\Windows\system32\STacSV.exe
--------------------
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
--------------------
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\system32\SearchIndexer.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
--------------------
C:\Windows\system32\WUDFHost.exe
--------------------
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
--------------------
C:\PROGRA~1\AVG\AVG8\avgemc.exe
--------------------
C:\Program Files\Windows Media Player\wmplayer.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32	askeng.exe
--------------------
C:\Program Files\iPod\bin\iPodService.exe
--------------------
C:\Windows\system32	askeng.exe
--------------------
C:\Windows\system32	askeng.exe
--------------------
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
--------------------
C:\Program Files\Windows Mail\WindowsMailGadget.exe
--------------------
C:\Program Files\Windows Mail\WinMail.exe
--------------------
C:\Windows\system32
vvsvc.exe
--------------------
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
--------------------
C:\Program Files\Trojan Remover\Rmvtrjan.exe
FileSize:          2540096
[This is a Trojan Remover component]
--------------------
--------------------
C:\Windows\system32\conime.exe
--------------------

************************************************************
11:10:57: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
%SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
https://www.msn.com/fr-fr
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

************************************************************
=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
Scan completed at: 11:10:57 16 août 2008
************************************************************

anankronik · Answer

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.1.2538. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 11:09:56 16 août 2008
Using Database v7102
Operating System:  Windows Vista  [Windows Vista (Build 6000)]
Edition:           Windows Vista (TM) Home Premium
File System:       NTFS
User Account Control is Enabled.
Data directory:     C:\Users\maxime\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Users\maxime\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
Microsoft Windows Defender
Avast! Antivirus

************************************************************


************************************************************
11:09:56: Scanning ----------WIN.INI-----------
WIN.INI found in C:\Windows

************************************************************
11:09:56: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\Windows

************************************************************
11:09:56: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
11:09:57: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: explorer.exe
C:\Windows\explorer.exe
2923520 bytes
Created:  09/01/2008
Modified: 09/01/2008
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
24576 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: Windows Defender
Value Data: %ProgramFiles%\Windows Defender\MSASCui.exe -hide
C:\Program Files\Windows Defender\MSASCui.exe
1006264 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Microsoft Corporation
--------------------
Value Name: ECenter
Value Data: C:\Dell\E-Center\EULALauncher.exe
C:\Dell\E-Center\EULALauncher.exe
17920 bytes
Created:  02/01/2008
Modified: 25/05/2007
Company:   
--------------------
Value Name: Bluetooth HCI Monitor
Value Data: RunDll32 HCIMNTR.DLL,RunCheckHCIMode
C:\Windows\system32\HCIMNTR.DLL
9728 bytes
Created:  02/01/2008
Modified: 08/12/2006
Company:  Logitech Inc.
--------------------
Value Name: SigmatelSysTrayApp
Value Data: C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
405504 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  SigmaTel, Inc.
--------------------
Value Name: Windows Mobile Device Center
Value Data: %windir%\WindowsMobile\wmdc.exe
C:\Windows\WindowsMobile\wmdc.exe
648072 bytes
Created:  31/05/2007
Modified: 31/05/2007
Company:  Microsoft Corporation
--------------------
Value Name: SunJavaUpdateSched
Value Data: "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
c:\Program Files\Java\jre1.6.0\bin\jusched.exe
77824 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Sun Microsystems, Inc.
--------------------
Value Name: PMX Daemon
Value Data: ICO.EXE
C:\Windows\system32\ICO.EXE
49152 bytes
Created:  02/01/2008
Modified: 08/11/2006
Company:  Primax Electronics Ltd.
--------------------
Value Name: IAAnotif
Value Data: "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
178712 bytes
Created:  02/01/2008
Modified: 26/07/2007
Company:  Intel Corporation
--------------------
Value Name: NMSSupport
Value Data: "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
439512 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel Corporation
--------------------
Value Name: CCUTRAYICON
Value Data: "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
215256 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
--------------------
Value Name: dscactivate
Value Data: "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
16384 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:   
--------------------
Value Name: Google Desktop Search
Value Data: "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
1838592 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
--------------------
Value Name: fssui
Value Data: "C:\Program Files\Windows Live\Contrôle parental\fssui.exe" -autorun
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
243240 bytes
Created:  17/12/2007
Modified: 17/12/2007
Company:  Microsoft Corporation
--------------------
Value Name: TkBellExe
Value Data: "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
C:\Program Files\Common Files\Real\Update_OBealsched.exe
185896 bytes
Created:  27/01/2008
Modified: 27/01/2008
Company:  RealNetworks, Inc.
--------------------
Value Name: e-TF1
Value Data: C:\Program Files\TF1Vision\TF1vision.exe
C:\Program Files\TF1Vision\TF1vision.exe
345600 bytes
Created:  22/02/2008
Modified: 24/12/2007
Company:  1-Click Media
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created:  11/01/2008
Modified: 11/01/2008
Company:  Adobe Systems Incorporated
--------------------
Value Name: DellSupportCenter
Value Data: "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
202544 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:  SupportSoft, Inc.
--------------------
Value Name: avast!
Value Data: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
78008 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
--------------------
Value Name: AVG8_TRAY
Value Data: C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
1232152 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
--------------------
Value Name: AGEIA PhysX SysTray
Value Data: "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
C:\Program Files\AGEIA Technologies\TrayIcon.exe
339968 bytes
Created:  16/08/2006
Modified: 16/08/2006
Company:  
--------------------
Value Name: AppleSyncNotifier
Value Data: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
116040 bytes
Created:  22/07/2008
Modified: 22/07/2008
Company:  Apple Inc.
--------------------
Value Name: QuickTime Task
Value Data: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
C:\Program Files\QuickTime\QTTask.exe
413696 bytes
Created:  27/05/2008
Modified: 27/05/2008
Company:  Apple Inc.
--------------------
Value Name: iTunesHelper
Value Data: "C:\Program Files\iTunes\iTunesHelper.exe"
C:\Program Files\iTunes\iTunesHelper.exe
289064 bytes
Created:  30/07/2008
Modified: 30/07/2008
Company:  Apple Inc.
--------------------
Value Name: NvCplDaemon
Value Data: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
C:\Windows\system32\NvCpl.dll
13535776 bytes
Created:  12/06/2008
Modified: 12/06/2008
Company:  NVIDIA Corporation
--------------------
Value Name: NvMediaCenter
Value Data: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
C:\Windows\system32\NvMcTray.dll
92704 bytes
Created:  02/01/2008
Modified: 12/06/2008
Company:  NVIDIA Corporation
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
909904 bytes
Created:  16/08/2008
Modified: 30/07/2008
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: DellSupportCenter
Value Data: "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
202544 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:  SupportSoft, Inc.
--------------------
Value Name: ehTray.exe
Value Data: C:\Windows\ehome\ehTray.exe
C:\Windows\ehome\ehTray.exe
125440 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
--------------------
Value Name: CanalPlayer
Value Data: C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe [file not found to scan]
--------------------
Value Name: swg
Value Data: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
68856 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google Inc.
--------------------
Value Name: ISUSPM
Value Data: "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
218032 bytes
Created:  11/09/2006
Modified: 11/09/2006
Company:  Macrovision Corporation
--------------------
Value Name: AlcoholAutomount
Value Data: "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
217544 bytes
Created:  20/03/2008
Modified: 20/03/2008
Company:  Alcohol Soft Development Team
--------------------
Value Name: WindowsWelcomeCenter
Value Data: rundll32.exe oobefldr.dll,ShowWelcomeCenter
C:\Windows\system32\oobefldr.dll
2159104 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty

************************************************************
11:10:01: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {522E0112-EDD9-413D-A99E-C311A54B6676}
File:      C:\Windows\system32\pmnNGwuT.dll
C:\Windows\system32\pmnNGwuT.dll - this registry value has been removed [file not found to scan]
HKCR\CLSID\{522E0112-EDD9-413D-A99E-C311A54B6676} - this key has been removed
----------

************************************************************
11:10:35: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
11:10:35: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\system32\STARWA~1.SCR
C:\Windows\system32\STARWA~1.SCR
2540251 bytes
Created:  29/02/2008
Modified: 29/02/2008
Company:  Axialis Software
--------------------

************************************************************
11:10:37: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

************************************************************
11:10:37: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key:  BthServ
Path: %SystemRoot%\System32\bthserv.dll
C:\Windows\System32\bthserv.dll
39936 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
--------------------
Key:  RapiMgr
Path: %windir%\WindowsMobileapimgr.dll
C:\Windows\WindowsMobileapimgr.dll
183688 bytes
Created:  31/05/2007
Modified: 31/05/2007
Company:  Microsoft Corporation
--------------------
Key:  WcesComm
Path: %windir%\WindowsMobile\wcescomm.dll
C:\Windows\WindowsMobile\wcescomm.dll
379784 bytes
Created:  31/05/2007
Modified: 31/05/2007
Company:  Microsoft Corporation
--------------------

************************************************************
11:10:38: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       aawservice
ImagePath: "C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe"
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
611664 bytes
Created:  12/05/2008
Modified: 16/08/2008
Company:  Lavasoft
----------
Key:       AdobeActiveFileMonitor6.0
ImagePath: C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
124832 bytes
Created:  11/09/2007
Modified: 11/09/2007
Company:  
----------
Key:       AlertService
ImagePath: "C:\Program Files\Intel\IntelDH\CCU\AlertService.exe"
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
223448 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       Apple Mobile Device
ImagePath: "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
116040 bytes
Created:  22/07/2008
Modified: 22/07/2008
Company:  Apple Inc.
----------
Key:       aswFsBlk
ImagePath: system32\DRIVERS\aswFsBlk.sys
C:\Windows\system32\DRIVERS\aswFsBlk.sys
20560 bytes
Created:  16/05/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       aswMonFlt
ImagePath: system32\DRIVERS\aswMonFlt.sys
C:\Windows\system32\DRIVERS\aswMonFlt.sys
51280 bytes
Created:  16/05/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       aswUpdSv
ImagePath: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
16056 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       atapi
ImagePath: \SystemRoot\system32\drivers\atapi.sys
C:\Windows\system32\drivers\atapi.sys
21688 bytes
Created:  02/11/2006
Modified: 02/01/2008
Company:  Microsoft Corporation
----------
Key:       avast! Antivirus
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
C:\Program Files\Alwil Software\Avast4\ashServ.exe
147640 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       avast! Mail Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
250040 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:       avast! Web Scanner
ImagePath: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
348344 bytes
Created:  15/08/2008
Modified: 23/07/2008
Company:  ALWIL Software
----------
Key:       avg8emc
ImagePath: C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
873752 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       avg8wd
ImagePath: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
231192 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgLdx86
ImagePath: \SystemRoot\System32\Drivers\avgldx86.sys
C:\Windows\System32\Drivers\avgldx86.sys
96520 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgMfx86
ImagePath: \SystemRoot\System32\Drivers\avgmfx86.sys
C:\Windows\System32\Drivers\avgmfx86.sys
26824 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgWfpX
ImagePath: \SystemRoot\System32\Drivers\avgwfpx.sys
C:\Windows\System32\Drivers\avgwfpx.sys
69128 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       BCM43XV
ImagePath: system32\DRIVERS\bcmwl6.sys
C:\Windows\system32\DRIVERS\bcmwl6.sys
464384 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Broadcom Corporation
----------
Key:       blbdrive
ImagePath: \SystemRoot\system32\drivers\blbdrive.sys - file is missing - alert is globally excluded
----------
Key:       Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created:  24/07/2007
Modified: 24/07/2007
Company:  Apple Inc.
----------
Key:       BthEnum
ImagePath: system32\DRIVERS\BthEnum.sys
C:\Windows\system32\DRIVERS\BthEnum.sys
19456 bytes
Created:  11/06/2008
Modified: 29/04/2008
Company:  Microsoft Corporation
----------
Key:       BthPan
ImagePath: system32\DRIVERS\bthpan.sys
C:\Windows\system32\DRIVERS\bthpan.sys
92160 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       BTHPORT
ImagePath: System32\Drivers\BTHport.sys
C:\Windows\System32\Drivers\BTHport.sys
220160 bytes
Created:  11/06/2008
Modified: 29/04/2008
Company:  Microsoft Corporation
----------
Key:       BTHUSB
ImagePath: System32\Drivers\BTHUSB.sys
C:\Windows\System32\Drivers\BTHUSB.sys
29184 bytes
Created:  11/06/2008
Modified: 29/04/2008
Company:  Microsoft Corporation
----------
Key:       btwaudio
ImagePath: system32\drivers\btwaudio.sys
C:\Windows\system32\drivers\btwaudio.sys
79664 bytes
Created:  02/01/2008
Modified: 02/04/2007
Company:  Broadcom Corporation.
----------
Key:       btwavdt
ImagePath: system32\drivers\btwavdt.sys
C:\Windows\system32\drivers\btwavdt.sys
80688 bytes
Created:  02/01/2008
Modified: 02/04/2007
Company:  Broadcom Corporation.
----------
Key:       btwrchid
ImagePath: system32\DRIVERS\btwrchid.sys
C:\Windows\system32\DRIVERS\btwrchid.sys
16432 bytes
Created:  02/01/2008
Modified: 02/04/2007
Company:  Broadcom Corporation.
----------
Key:       DHTRACE
ImagePath: C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
39640 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       DQLWinService
ImagePath: "C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe"
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
208896 bytes
Created:  12/02/2007
Modified: 12/02/2007
Company:  
----------
Key:       e1express
ImagePath: system32\DRIVERS\e1e6032.sys
C:\Windows\system32\DRIVERS\e1e6032.sys
228224 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  Intel Corporation
----------
Key:       EMSUSB2
ImagePath: system32\DRIVERS\EMSUSB2.sys
C:\Windows\system32\DRIVERS\EMSUSB2.sys
9728 bytes
Created:  27/07/2008
Modified: 03/01/2007
Company:  
----------
Key:       FLEXnet Licensing Service
ImagePath: "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
654848 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Macrovision Europe Ltd.
----------
Key:       fssfltr
ImagePath: system32\DRIVERS\fssfltr.sys
C:\Windows\system32\DRIVERS\fssfltr.sys
43816 bytes
Created:  09/01/2008
Modified: 17/10/2007
Company:  Microsoft Corporation
----------
Key:       fsssvc
ImagePath: "C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe"
C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe
523816 bytes
Created:  17/12/2007
Modified: 17/12/2007
Company:  Microsoft Corporation
----------
Key:       GoogleDesktopManager
ImagePath: "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
1838592 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------
Key:       gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
138168 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------
Key:       IAANTMON
ImagePath: C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
358936 bytes
Created:  02/01/2008
Modified: 26/07/2007
Company:  Intel Corporation
----------
Key:       iaStor
ImagePath: system32\drivers\iastor.sys
C:\Windows\system32\drivers\iastor.sys
305688 bytes
Created:  02/01/2008
Modified: 29/08/2007
Company:  Intel Corporation
----------
Key:       IDriverT
ImagePath: "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
73728 bytes
Created:  22/10/2004
Modified: 22/10/2004
Company:  Macrovision Corporation
----------
Key:       IntelDH
ImagePath: System32\Drivers\IntelDH.sys
C:\Windows\System32\Drivers\IntelDH.sys
5632 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Intel Corporation
----------
Key:       IpInIp
ImagePath: system32\DRIVERS\ipinip.sys - file is missing - alert is globally excluded
----------
Key:       ISSM
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
59096 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       M1 Server
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
268504 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  
----------
Key:       MCLServiceATL
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
157912 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       msiserver
ImagePath: %systemroot%\system32\msiexec /V
----------
Key:       NMSCore
ImagePath: "C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe"
C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
317656 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       nmsunidr
ImagePath: system32\DRIVERS
msunidr.sys
C:\Windows\system32\DRIVERS
msunidr.sys
-S- 5376 bytes
Created:  18/02/2007
Modified: 18/02/2007
Company:  Gteko Ltd.
----------
Key:       nvsvc
ImagePath: %SystemRoot%\system32
vvsvc.exe
C:\Windows\system32
vvsvc.exe
118784 bytes
Created:  12/06/2008
Modified: 12/06/2008
Company:  NVIDIA Corporation
----------
Key:       NwlnkFlt
ImagePath: system32\DRIVERS
wlnkflt.sys - file is missing - alert is globally excluded
----------
Key:       NwlnkFwd
ImagePath: system32\DRIVERS
wlnkfwd.sys - file is missing - alert is globally excluded
----------
Key:       phaudlwr
ImagePath: system32\DRIVERS\phaudlwr.sys
C:\Windows\system32\DRIVERS\phaudlwr.sys
88704 bytes
Created:  07/05/2008
Modified: 07/05/2008
Company:  Philips Applied Technologies
----------
Key:       pmxmouse
ImagePath: system32\DRIVERS\pmxmouse.sys
C:\Windows\system32\DRIVERS\pmxmouse.sys
18432 bytes
Created:  02/01/2008
Modified: 01/06/2007
Company:  Primax Electronics Ltd.
----------
Key:       pmxusblf
ImagePath: system32\DRIVERS\pmxusblf.sys
C:\Windows\system32\DRIVERS\pmxusblf.sys
19008 bytes
Created:  02/01/2008
Modified: 24/05/2007
Company:  Primax Electronics Ltd.
----------
Key:       QualityManager
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
272600 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       Remote UI Service
ImagePath: "C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe"
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
446680 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  Intel(R) Corporation
----------
Key:       RFCOMM
ImagePath: system32\DRIVERSfcomm.sys
C:\Windows\system32\DRIVERSfcomm.sys
49664 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       RoxMediaDB9
ImagePath: "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe"
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
1010160 bytes
Created:  06/09/2007
Modified: 06/09/2007
Company:  Sonic Solutions
----------
Key:       Serenum
ImagePath: \SystemRoot\system32\drivers\serenum.sys
C:\Windows\system32\drivers\serenum.sys
17920 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       Serial
ImagePath: \SystemRoot\system32\drivers\serial.sys
C:\Windows\system32\drivers\serial.sys
83456 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       sfdrv01
ImagePath: System32\drivers\sfdrv01.sys
C:\Windows\System32\drivers\sfdrv01.sys
59256 bytes
Created:  05/07/2006
Modified: 05/07/2006
Company:  Protection Technology (StarForce)
----------
Key:       sfhlp02
ImagePath: System32\drivers\sfhlp02.sys
C:\Windows\System32\drivers\sfhlp02.sys
13680 bytes
Created:  14/06/2006
Modified: 14/06/2006
Company:  Protection Technology (StarForce)
----------
Key:       sfsync03
ImagePath: System32\drivers\sfsync03.sys
C:\Windows\System32\drivers\sfsync03.sys
35328 bytes
Created:  06/12/2005
Modified: 06/12/2005
Company:  Protection Technology
----------
Key:       sfvfs02
ImagePath: System32\drivers\sfvfs02.sys
C:\Windows\System32\drivers\sfvfs02.sys
83320 bytes
Created:  08/02/2007
Modified: 08/02/2007
Company:  Protection Technology (StarForce)
----------
Key:       SPC520
ImagePath: system32\drivers\SPC520.sys
C:\Windows\system32\drivers\SPC520.sys
483328 bytes
Created:  16/08/2008
Modified: 01/10/2007
Company:  Philips                                                     
----------
Key:       SPC520m
ImagePath: system32\drivers\SPC520m.sys
C:\Windows\system32\drivers\SPC520m.sys
7680 bytes
Created:  16/08/2008
Modified: 01/10/2007
Company:  Philips                                                     
----------
Key:       sprtsvc_dellsupportcenter
ImagePath: C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter
C:\Program Files\Dell Support Center\bin\sprtsvc.exe 
202544 bytes
Created:  15/11/2007
Modified: 15/11/2007
Company:  SupportSoft, Inc.
----------
Key:       sptd
ImagePath: System32\Drivers\sptd.sys - this file is globally excluded
----------
Key:       STacSV
ImagePath: C:\Windows\system32\STacSV.exe
C:\Windows\system32\STacSV.exe
94208 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  SigmaTel, Inc.
----------
Key:       StarWindServiceAE
ImagePath: C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
275968 bytes
Created:  28/05/2007
Modified: 28/05/2007
Company:  Rocket Division Software
----------
Key:       STHDA
ImagePath: system32\drivers\stwrt.sys
C:\Windows\system32\drivers\stwrt.sys
326656 bytes
Created:  02/01/2008
Modified: 12/09/2007
Company:  SigmaTel, Inc.
----------
Key:       stllssvr
ImagePath: "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe"
C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
-R- 69632 bytes
Created:  11/07/2007
Modified: 11/07/2007
Company:  MicroVision Development, Inc.
----------
Key:       TSHWMDTCP
ImagePath: \??\C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys
14552 bytes
Created:  27/06/2007
Modified: 27/06/2007
Company:  
----------
Key:       usnjsvc
ImagePath: "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
C:\Program Files\Windows Live\Messenger\usnsvc.exe
98328 bytes
Created:  18/10/2007
Modified: 18/10/2007
Company:  Microsoft Corporation
----------
Key:       WinUsb
ImagePath: system32\DRIVERS\WinUSB.SYS
C:\Windows\system32\DRIVERS\WinUSB.SYS
31616 bytes
Created:  02/11/2006
Modified: 02/11/2006
Company:  Microsoft Corporation
----------
Key:       WLSetupSvc
ImagePath: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe"
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
266240 bytes
Created:  25/10/2007
Modified: 25/10/2007
Company:  Microsoft Corporation
----------

************************************************************
11:10:51: Scanning -----VXD ENTRIES-----

************************************************************
11:10:51: Scanning ----- WINLOGON\NOTIFY DLLS -----
No WINLOGON\NOTIFY DLLs found to scan

************************************************************
11:10:51: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   ALZip
CLSID: {4EB37360-49E8-11D3-95B5-004033382980}
Path:  C:\PROGRA~1\ESTsoft\ALZip\AZCTM.dll
C:\PROGRA~1\ESTsoft\ALZip\AZCTM.dll
471552 bytes
Created:  03/07/2007
Modified: 03/07/2007
Company:  ESTsoft
----------
Key:   avast
CLSID: {472083B0-C522-11CF-8763-00608CC02F24}
Path:  C:\Program Files\Alwil Software\Avast4\ashShell.dll
C:\Program Files\Alwil Software\Avast4\ashShell.dll
73912 bytes
Created:  15/08/2008
Modified: 19/07/2008
Company:  ALWIL Software
----------
Key:   AVG8 Shell Extension
CLSID: {9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
Path:  C:\Program Files\AVG\AVG8\avgse.dll
C:\Program Files\AVG\AVG8\avgse.dll
99608 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------

************************************************************
11:10:51: Scanning ----- FOLDER\COLUMNHANDLERS -----

************************************************************
11:10:51: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created:  23/10/2006
Modified: 23/10/2006
Company:  Adobe Systems Incorporated
----------
Key: {2E03C0FD-4C48-43A7-9A54-00240C70FF16}
BHO: C:\Windows\system32\BhoECart.dll
C:\Windows\system32\BhoECart.dll
139264 bytes
Created:  31/10/2003
Modified: 31/10/2003
Company:  Orbiscom Ltd. All rights reserved.
----------
Key: {3049C3E9-B461-4BC5-8870-4C09146192CA}
BHO: C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
370296 bytes
Created:  27/01/2008
Modified: 27/01/2008
Company:  RealPlayer
----------
Key: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
BHO: C:\Program Files\AVG\AVG8\avgssie.dll
C:\Program Files\AVG\AVG8\avgssie.dll
455960 bytes
Created:  27/05/2008
Modified: 05/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}
BHO: C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
56360 bytes
Created:  17/12/2007
Modified: 17/12/2007
Company:  Microsoft Corporation
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
1562448 bytes
Created:  15/08/2008
Modified: 07/07/2008
Company:  Safer Networking Limited
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: c:\Program Files\Java\jre1.6.0\bin\ssv.dll
c:\Program Files\Java\jre1.6.0\bin\ssv.dll
501384 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Sun Microsystems, Inc.
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
328752 bytes
Created:  20/09/2007
Modified: 20/09/2007
Company:  Microsoft Corporation
----------
Key: {A057A204-BACC-4D26-9990-79A187E2698E}
BHO: C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
2055960 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG, Technologies CZ, s.r.o                  
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar2.dll
c:\program files\google\googletoolbar2.dll
-R- 2582136 bytes
Created:  16/05/2008
Modified: 16/05/2008
Company:  Google Inc.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
325048 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google Inc.
----------
Key: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
BHO: C:\Program Files\Windows Live Toolbar\msntb.dll
C:\Program Files\Windows Live Toolbar\msntb.dll
546320 bytes
Created:  19/10/2007
Modified: 19/10/2007
Company:  Microsoft Corporation
----------
Key: {CA6319C0-31B7-401E-A518-A07C3DB8F777}
BHO: C:\Program Files\Dell\BAE\BAE.dll
C:\Program Files\Dell\BAE\BAE.dll
98304 bytes
Created:  09/11/2006
Modified: 09/11/2006
Company:  Dell Inc.
----------

************************************************************
11:10:52: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
11:10:52: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
11:10:52: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
11:10:52: Scanning ----- APPINIT_DLLS -----
AppInitDLLs entry = [C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL]
File: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
145408 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------
File: avgrsstx.dll
C:\Windows\system32\avgrsstx.dll
10520 bytes
Created:  27/05/2008
Modified: 03/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
File: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
145408 bytes
Created:  02/01/2008
Modified: 02/01/2008
Company:  Google
----------

************************************************************
11:10:53: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
11:10:53: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
715568 bytes
Created:  13/02/2007
Modified: 13/02/2007
Company:  Broadcom Corporation.
BTTray.lnk - links to C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
--------------------
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  02/11/2006
Modified: 10/07/2008
Company:  
--------------------
C:\Windows\VPro520.exe
73728 bytes
Created:  14/01/2008
Modified: 06/04/2007
Company:  Philips
VPro520.lnk - links to C:\Windows\VPro520.exe
--------------------

************************************************************
11:10:53: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: Invité
[C:\Users\Invité\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\Invité\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  18/07/2008
Modified: 18/07/2008
Company:  
----------
--------------------
Checking Startup Group for: maxime
[C:\Users\maxime\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\maxime\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created:  05/01/2008
Modified: 05/01/2008
Company:  
----------
--------------------

************************************************************
11:10:53: Scanning ----- SCHEDULED TASKS -----
Taskname:      Vérifier les mises à jour de Windows Live Toolbar.job
File:          C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
99856 bytes
Created:  19/10/2007
Modified: 19/10/2007
Company:  Microsoft Corporation
Parameters:    [blank]
Next Run Time: 16/08/2008 11:38:00
Status:        La tâche n'a pas encore été exécutée
Creator:       maxime
Comments:      [blank]
----------

************************************************************
11:10:53: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
No ShellIconOverlayIdentifiers Registry key found to scan

************************************************************
11:10:53: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\maxime\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
C:\Users\maxime\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
2273454 bytes
Created:  28/06/2008
Modified: 28/06/2008
Company:  
----------
Web Desktop Wallpaper: %USERPROFILE%\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
C:\Users\maxime\Pictures\2008-07-02 Mariage Xavier Delphine 28 juin 2008\Mariage Xavier Delphine 28 juin 2008 059.JPG
2273454 bytes
Created:  28/06/2008
Modified: 28/06/2008
Company:  
----------
Additional checks completed

************************************************************
11:10:54: Scanning ----- RUNNING PROCESSES -----

C:\Windows\System32\smss.exe
--------------------
C:\Windows\system32\csrss.exe
--------------------
C:\Windows\system32\wininit.exe
--------------------
C:\Windows\system32\csrss.exe
--------------------
C:\Windows\system32\services.exe
--------------------
C:\Windows\system32\lsass.exe
--------------------
C:\Windows\system32\lsm.exe
--------------------
C:\Windows\system32\winlogon.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\SLsvc.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\WUDFHost.exe
--------------------
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
--------------------
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
--------------------
C:\Program Files\Alwil Software\Avast4\ashServ.exe
--------------------
C:\Windows\System32\spoolsv.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32\Dwm.exe
--------------------
C:\Windows\Explorer.EXE
--------------------
C:\Program Files\Windows Defender\MSASCui.exe
--------------------
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
--------------------
C:\Windows\WindowsMobile\wmdc.exe
--------------------
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
--------------------
C:\Windows\System32\ico.exe
--------------------
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
--------------------
C:\Windows\System32\Pmxmiced.exe
--------------------
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
--------------------
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
--------------------
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
--------------------
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
--------------------
C:\Program Files\Common Files\Real\Update_OBealsched.exe
--------------------
C:\Program Files\TF1Vision\TF1vision.exe
--------------------
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
--------------------
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
--------------------
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
--------------------
C:\Windows\System32undll32.exe
--------------------
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
--------------------
C:\Windows\System32undll32.exe
--------------------
C:\Program Files\AGEIA Technologies\TrayIcon.exe
--------------------
C:\Program Files\iTunes\iTunesHelper.exe
--------------------
C:\Windows\ehome\ehtray.exe
--------------------
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
--------------------
C:\Windows\ehome\ehmsas.exe
--------------------
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
--------------------
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
--------------------
C:\Windows\VPro520.exe
--------------------
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
--------------------
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
--------------------
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
--------------------
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
--------------------
C:\Program Files\Bonjour\mDNSResponder.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
--------------------
C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe
--------------------
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
--------------------
C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
--------------------
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
--------------------
C:\Windows\system32\STacSV.exe
--------------------
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
--------------------
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\System32\svchost.exe
--------------------
C:\Windows\system32\SearchIndexer.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
--------------------
C:\Windows\system32\WUDFHost.exe
--------------------
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
--------------------
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
--------------------
C:\PROGRA~1\AVG\AVG8\avgemc.exe
--------------------
C:\Program Files\Windows Media Player\wmplayer.exe
--------------------
C:\Windows\system32\svchost.exe
--------------------
C:\Windows\system32	askeng.exe
--------------------
C:\Program Files\iPod\bin\iPodService.exe
--------------------
C:\Windows\system32	askeng.exe
--------------------
C:\Windows\system32	askeng.exe
--------------------
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
--------------------
C:\Program Files\Windows Mail\WindowsMailGadget.exe
--------------------
C:\Program Files\Windows Mail\WinMail.exe
--------------------
C:\Windows\system32
vvsvc.exe
--------------------
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
--------------------
C:\Program Files\Trojan Remover\Rmvtrjan.exe
FileSize:          2540096
[This is a Trojan Remover component]
--------------------
--------------------
C:\Windows\system32\conime.exe
--------------------

************************************************************
11:10:57: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
%SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
https://www.msn.com/fr-fr
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

************************************************************
=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
Scan completed at: 11:10:57 16 août 2008
************************************************************

yann000 · Answer

c bisard j ai rien vu refait un scan une fois terminé tu as une page avec 3 onglet clic sur le 2 eme et regarde dedans si il y a quelque chose et clic sur les petit carrer et supprime tout

anankronik · Answer

yann, j'ai refait un scan mais il ne trouve pas de virus. Ecoute, c'est Bizzare car quand j'ai éteint mon ordi hier soir j'avais toujours un message de AVG8.0 comme quoi j'étais infecté, mais depuis ce matin j'ai plus de message. Ce que je vais faire c'est que je vais refaire des scans avec les différents anti-virus que j'ai et ensuite si je vois que j'ai encore un Trojanhorse je te recontactes.

Encore merci pour ton aide.

yann000 · Answer

avg8 te la peut etre effacer tous simplement si tu n a plus de virus te prend pas la tete

anankronik · Answer

OK, mais j'aurais une autre petite question :

Peux tu me dire si c'est bien d'avoir plusieurs anti-virus, est ce que cela n'empêches pas que les anti-virus se bouffe entre eux et laisse passer des virus quand même.

yann000 · Answer

tu as combien d anti virus? et oui effectivement c pas bon

anankronik · Answer

J'ai avast que je désactive toujours (c'était mon premier anti virus), j'ai AVG8.0 que j'avais télécharger en deuxième car j'avais déjà été infecté et avast n'arrivait pas à m'éradiquer le virus, c'est sur un forum que l'on m'avait conseillé de le télécharger. Je voulais désinstaller un des deux mais le soucis est que j'ai des dossiers en quarantaine dans les 2 anti-virus et je sias pas si c'est bien de les désinstaller avec ces dossiers en quarantaine. Mais saches que cela fait un mois qu'ils sont en quarantaine et que mon ordi fontionne bien. 

Ensuite depuis hier, suite à l'infection de mon ordi par le virus, comme AVG ne pouvait pas enlever le trojanhorse, et suite aux conseils de sécurité de la revue officiel de WINDOWS VISTA, ils me conseillais d'installer spybot et AD-AWARE 2008 en parallèle car c'est un logiciel anti-virus qui ne fonctionne pas en temps réel. Mais c'est bizarre car ensuite ils mettais de mettre aussi avast.

Qu'en penses tu car je sui un peu perdus ?

yann000 · Answer

moi j aime pas avast apres c une question de gout perso j ai nod 32 mais bon j aurai supprimer avast ensuite avg n a pas de protection residante don j aurai telecharger un anti spyware et lancer avg une fois par semaine par ailleur si tu supprime ton anti virus les fichier en quarantaine seront supprimer je pense mais vu que tu as ad aware trojan remover spyboot je pense que c pas mal faire un scan de chaque de temps en temp ce sera bien la tu as tout un tas de firewall freeware c est a dire gratuit

anankronik · Answer

Donc d'après toi je peux laisser tous mes anti-virus sauf qu'il faut que j'en désactive et que je fasses des scans quand même avec de temps en temps.

J'ai plusieurs questions par rapport à ça :

Combien de logiciels anti-virus je dois désactiver d'après toi ?

Ensuite, quand je désactive AVG8.0 ET SPYBOT dans la barre des têches en bas à droite, ils réapparaissent à chaque redémarrage, comment faire pour ne pas les désactiver à chaque fois.

Qu'est ce qu'un anti-spyware et si 'en ai pas peut tu m'en conseiller un en free si ça existe. Merci

yann000 · Answer

pour le spware parrdon tu as ad aware pour ne pas qu il s active a chaque demarrage vas dans menu demarrer tape msconfig puis clic sur demarrage et ote spyboot et avg tu clic sur la case agauche et tu met appliquer et ok la tu redemmarre et c bon

E..T · Answer

Salut les nautes ,
anankronik, La règle d'or c'est un seul antivirus si tu veux protéger ton PC fais ce qui suit :
Vire avast c'est une vrai passoire 

Pour l'antivirus installe AntiVir Personal  Télécharges le ici puis installes ce dernier.
Je te mets un tutoriel complet sur son installation et son utilisation >> ICI 

Ensuite il te faut un pare feu télécharges et installes Kerio, il est simple d'utilisation et efficace. 
>> Ici pour télécharger
>> Tutoriel ici qui te permettra de le configurer correctement!

Pour compléter il te faut de l' antispyware 
Télécharge spybot ici et installes le !
Tutoriel complet >> Merci à balltrap34 pour cette réalisation.
Tu peux compléter avec Ad-aware il n'y a pas de soucis
Télécharges le ici et installes le.
Un tutoriel ici 

Vérifie JAVA >> ICI c'est une chose importante aussi.
Installe la dernière version de adobe >> Ici
Une foi les nouvelles versions installées vire les anciennes. 


Ensuite tu peux installer Ccleaner si tu ne l'as pas, c'est utilitaire de nettoyage gratuit permettant de garantir un respect de la vie privée en supprimant les fichiers d'historique et de cache du système. 
>> Ici pour télécharger
>> Tuto complet
Pendant l'instalation de Ccleaner dans les options d'installation >> décoche l'option de la barre d'outils Yahoo! 


Une foi que tu as fini tout ça fais ce qui suit 

Clique sur ce lien
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
pour télécharger le fichier d'installation d'HijackThis.

Enregistre HJTInstall.exe sur ton bureau.

-Une fois installé, le renommer en HJT.exe en fesant un clic droit dessus 
On le renomme pour contrer une éventuelle infection de vundo 



Double-clique sur HJT.exe pour lancer le programme

Accepte en cliquant sur le bouton "I Accept"

Ensuite clique sur "do a system scan and save a logfile" et postes le rapport obtenu ici.

@++

PS La suite ce soir car la boulot ;-)

E..T · Answer

Pas de soucis ;-)
En attente du rapport.
@++

anankronik · Answer

Salut E..T,

Je viens de faire tout ce qui était sur ton message, mais avant de te montrer le rapport j'ai quelques questions.

J'ai téléchargé Kerio en tant que pare-feu mais est-ce que je dois désactiver mon pare-feu WINDOWS DEFENDER qui était inclu avec VISTA ?
De plus le Tutoriel de KERIO explique le logiciel mais ne donne pas de conseils pour bien le parametrer.

Pour le tutoriel de spybot, une fois que je clique sur le lien j'atterri sur une page internet blanche avec le logo aol en haut à gauche ????

Mais j'ai quand même fait un scan avec, il me détecte 2 trojans sur MessengerSkinner mais il ne veut pas les supprimés ou les corrigés !!!!

Pour le rapport de hijackthis, est-ce normal que cela a mis 2 secondes? Voici le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:05:50, on 17/08/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\ico.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\Pmxmiced.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\TF1Vision\TF1vision.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32undll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\VPro520.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files\Windows Mail\WindowsMailGadget.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\Windows\system32\BhoECart.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Bluetooth HCI Monitor] RunDll32 HCIMNTR.DLL,RunCheckHCIMode
O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Contrôle parental\fssui.exe" -autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [e-TF1] C:\Program Files\TF1Vision\TF1vision.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] "C:\Program Files\AGEIA Technologies\TrayIcon.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [getPlusUninstall] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-1000\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-1000\..\Run: [fmuldkbjbi] C:\Users\IUSR_NMPR\appdata\local\fmuldkbjbi.exe fmuldkbjbi (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-1000\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-1000\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-1000\..\Run: [CanalPlayer] C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-244751156-2771948051-3926594744-501\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (User 'Invité')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] "c:\program files\mcafee\mshr\ShrCL.EXE" /P7 /q C:\Users\maxime\AppData\Local\Temp\~DFFF66.tmp C:\Users\maxime\AppData\Local\Temp\~DFFC1A.tmp C:\Users\maxime\AppData\Local\Temp\~DFF4B0.tmp C:\Users\maxime\AppData\Local\Temp\~DFEA40.tmp C:\Users\maxime\AppData\Local\Temp\~DFD9AD.tmp C:\Users\maxime\AppData\Local\Temp\~DFD1DB.tmp C:\Users\maxime\AppData\Local\Temp\~DFA306.tmp C:\Users\maxime\AppData\Local\Temp\~DF9833.tmp C:\Users\maxime\AppData\Local\Temp\~DF7F41.tmp C:\Users\maxime\AppData\Local\Temp\~DF763C.tmp C:\Users\maxime\AppData\Local\Temp\~DF75A.tmp C:\Users\maxime\AppData\Local\Temp\~DF6E86.tmp C:\Users\maxime\AppData\Local\Temp\~DF6AB8.tmp C:\Users\maxime\AppData\Local\Temp\~DF66E1.tmp C:\Users\maxime\AppData\Local\Temp\~DF411F.tmp C:\Users\maxime\AppData\Local\Temp\~DF3756.tmp C:\Users\maxime\AppData\Local\Temp\Low\HSPERF~1.SH! C:\Users\maxime\AppData\Local\Temp\~DFEC4.tmp C:\Users\maxime\AppData\Local\Temp\~DFBA2.tmp C:\Users\maxime\AppData\Local\Temp\~D
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [DelayShred] "c:\program files\mcafee\mshr\ShrCL.EXE" /P7 /q C:\Users\maxime\AppData\Local\Temp\~DFFF66.tmp C:\Users\maxime\AppData\Local\Temp\~DFFC1A.tmp C:\Users\maxime\AppData\Local\Temp\~DFF4B0.tmp C:\Users\maxime\AppData\Local\Temp\~DFEA40.tmp C:\Users\maxime\AppData\Local\Temp\~DFD9AD.tmp C:\Users\maxime\AppData\Local\Temp\~DFD1DB.tmp C:\Users\maxime\AppData\Local\Temp\~DFA306.tmp C:\Users\maxime\AppData\Local\Temp\~DF9833.tmp C:\Users\maxime\AppData\Local\Temp\~DF7F41.tmp C:\Users\maxime\AppData\Local\Temp\~DF763C.tmp C:\Users\maxime\AppData\Local\Temp\~DF75A.tmp C:\Users\maxime\AppData\Local\Temp\~DF6E86.tmp C:\Users\maxime\AppData\Local\Temp\~DF6AB8.tmp C:\Users\maxime\AppData\Local\Temp\~DF66E1.tmp C:\Users\maxime\AppData\Local\Temp\~DF411F.tmp C:\Users\maxime\AppData\Local\Temp\~DF3756.tmp C:\Users\maxime\AppData\Local\Temp\Low\HSPERF~1.SH! C:\Users\maxime\AppData\Local\Temp\~DFEC4.tmp C:\Users\maxime\AppData\Local\Temp\~DFBA2.tmp C:\Users\maxime\AppData\Local\Temp\~D
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: VPro520.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

E..T · Answer

est-ce que je dois désactiver mon pare-feu WINDOWS DEFENDER qui était inclu avec VISTA ? 
Oui.

Pour kerio voici quelques liens :
https://forums.cnetfrance.fr
https://www.malekal.com/tutorial-et-guide-counterspy/
https://www.vulgarisation-informatique.com/kerio.php

Je regarde ton log et te dit quoi .

@++

E..T · Answer

* Télécharge SDFix depuis ce lien : http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
    * Enregistre  SDFix sur ton bureau
    * Double-clique sur l'icone SDFix
    * Une fenêtre s'ouvre, laisse les options telles quelles puis clique sur le bouton InstallSDFix . 

      Pour la suite le nettoyage se fait en mode sans échec.

Pour redémarrer en mode sans échec :

    * Redémarre ton PC, avant le logo Windows et après le changement du premier écran
    * Tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuie sur la touche entrée du clavier. 
    * Pour plus d'informations, voir la page comment redémarrer en mode sans échec

    * Une fois en mode sans échec, clique sur le menu Démarrer puis Exécuter et colle la commande suivant : 
C:\SDFix\RunThis.bat 
    * Cliquez sur OK.
    * Une fenêtre noire s'ouvre vous donnant la version du Fix.
    * Appuyez sur la touche Y (pour yes) du clavier et appuyez sur Entrée

    *A ce moment le bureau (Menu Démarrer etc.) va disparaître.
    
* Le Fix commence son travail, cela peut durer une trentaines de minutes
    * Une fois les opérations de nettoyage effectuées... SDFix signale que l'ordinateur doit être redémarré : 

                                             >>>The PC Will now restart

    * Appuie sur une touche du clavier

    * L'ordinateur va redémarrer normalement.
    * Avant d'arriver sur le bureau, une nouvelle fenêtre de SDFix va s'ouvrir. Ca peut durer cinq minutes...

>> Le rapport SDFix s'ouvre alors fais un copier coller et envoi le.

Si tu as peur d'oublier des instructions enregistre les sur ton bureau avec un fichier texte comme ça tu les auras même lors du mode sans échec.


@++

E..T · Answer

En mode normal
Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.

Puis fait la manip avec sd fix en mode sans échec. 
++

E..T · Answer

ais ce qui suit :

* Télécharge MalwareByte's Anti-Malware (by RubbeR DuckY) :
*http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
* Installe le programme sur le bureau :

o S'il manque le fichier COMCTL32.OCX,  télécharge le ici

* Fais les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)

* Démarre en mode sans échec
Comment faire >> https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
Redémarres l’ordinateur
Dès le chargement du BIOS, commences à appuyer sur la touche F8 de ton clavier,i jusqu'au ou le menu des options avancées de Windows apparait. 
Sélectionne "Mode sans échec" dans le menu puis appuyez sur Entrée. 


* Lance MalwareByte's Anti-Malware, clique sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs

* // !! \ Une fois le scan terminé, clique sur supprimer (si un message te demande de redémarrer le PC, accepte.)

* Un rapport sera généré, enregistre le de manière à le retrouver sur ton bureau par exemple et poste le ici.

@++

E..T · Answer

Bonsoir,

1) Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.


2) Télécharge Navilog1 depuis-ce lien :
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog présent sur ton bureau et choisis "Exécuter en tant qu'administrateur".

Au menu principal, Fais le choix 1
Laisse toi guider et patiente.
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche le bloc note va s'ouvrir.
Copie-colle l'intégralité du rapport ici.

@++

escan · Answer

Tu peux essayer aussi avec utilitaire :

http://www.escan-ch.com/downloads/escan_virus_cleaner.exe

Il est gratuit 30 jours .... de quoi bien nettoyer ton pc 

Boot en safe mode et fait un scan  .... 

Bon courage ....

E..T · Answer

Salut,

Relance Navilog
# Sur le menu, choisis Désinfection automatique l'option 2
# Le fix va se mettre à travailler... sois patient!
# Cliques simplement sur OK si des fenêtres apparaissent.

Un rapport va être génrer sur ton disque C:\ qui sera en option 2 >> Envoi le  

//!!\Si ton bureau ne réapparait pas après le fix ce n'est rien !, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.

Puis poste un rapport hijackthis


@++

E..T · Answer

Si ce n'est pas fait 
1) Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):
- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide. 

* Télécharge SDFix depuis ce lien : http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
    * Enregistre  SDFix sur ton bureau
    * Double-clique sur l'icone SDFix
    * Une fenêtre s'ouvre, laisse les options telles quelles puis clique sur le bouton InstallSDFix . 

      Pour la suite le nettoyage se fait en mode sans échec.

Pour redémarrer en mode sans échec :

    * Redémarre ton PC, avant le logo Windows et après le changement du premier écran
    * Tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuie sur la touche entrée du clavier. 
    * Pour plus d'informations, voir la page comment redémarrer en mode sans échec

    * Une fois en mode sans échec, clique sur le menu Démarrer puis Exécuter et colle la commande suivant : 
C:\SDFix\RunThis.bat 
    * Cliquez sur OK.
    * Une fenêtre noire s'ouvre vous donnant la version du Fix.
    * Appuyez sur la touche Y (pour yes) du clavier et appuyez sur Entrée

    *A ce moment le bureau (Menu Démarrer etc.) va disparaître.
    
* Le Fix commence son travail, cela peut durer une trentaines de minutes
    * Une fois les opérations de nettoyage effectuées... SDFix signale que l'ordinateur doit être redémarré : 

                                             >>>The PC Will now restart

    * Appuie sur une touche du clavier

    * L'ordinateur va redémarrer normalement.
    * Avant d'arriver sur le bureau, une nouvelle fenêtre de SDFix va s'ouvrir. Ca peut durer cinq minutes...

>> Le rapport SDFix s'ouvre alors fais un copier coller et envoi le.

Si tu as peur d'oublier des trucs enregistre les sur ton bureau avec un fichier texte comme ça tu les auras même lors du mode sans échec.




@++

E..T · Answer

Bon c'est pas simple tout ça ... 

Tu connais ces lignes ?
>> C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
>> C:\Program Files\Windows Mail\WindowsMailGadget.exe 

Peux tu me dire ce que fais le pc ?

@+

E..T · Answer

Désinstalles >> la google toolbar
Je te met un lien avec des explications au cas ou
https://translate.google.fr/?hl=fr|fr&u=https://support.google.com/toolbar/
Dis moi quand c'est bon ;-)
++

yann000 · Answer

bonsoir recopie tes lien dans note pad comme ca t aura plus qu a les reinstaller par la suite

yann000 · Answer

tu vas dans ton explorateur ie ou firefox tu clic sur tes page en haut tu as l adresse tu suligne avec ta souris ensuite tu appui sur ctrl+c et dans le note pad tu clic une fois et tu fais ctrl+v et tu  fais ca avec tous tes lien

yann000 · Answer

je ne me souvient pas tres bien ce que tu voulais faire rappel le moi stp

yann000 · Answer

ok ba bon courage bonne soiree

E..T · Answer

Bonsoir, Désolé pour la réponse tardive mais grosse journée de boulot! Pour les favoris fais comme yann000, t'as préciser ou regarde le lien ci dessous ;-) (Si c'est pas déjà fait) https://www.hugedomains.com/domain_profile.cfm?d=geckozone&e=org anankronik, fais ce qui suit Télécharge >> Lop S&D.exe << puis enregistres-le sur ton Bureau . double-clic sur le fichier LopSD.exe suffira à lancer l'installation Accepte le contat de licence Créer le répertoire de destination, accepte en cliquant sur oui Un raccourci sera créé sur ton Bureau. Double clic dessus. Choisis la langue f pour Français puis valide par Entrée. Choisis l'option Recherche en saisissant 1 valides par Entrée. Ton bureau va disparaitre c'est normal. Patiente le temps du scan A la fin du scan un rapport sera généré et s'ouvrira automatiquement dans le Bloc-Notes. Copies-colles le contenu de ce rapport ici. >>On le trouve aussi en %systemdrive%\LopR.txt +++

E..T · Answer

Ouep,

Refais la même chose mais la tu choisis le choix 2
Laisse travailler le pc
Une fois le nettoyage fini ,une recherche sera relancée et un rapport
s'ouvrira automatiquement dans le Bloc-Notes.
Copies-colles le contenu de ce rapport sur le forum. 


Et poste un rapport hijackthis.

++

E..T · Answer

Bonjour,

Télécharge MSNFix (de !aur3n7 et Regis59) sur le bureau :
Utilise ce lien  http://sosvirus.changelog.fr/MSNFix.exe
Explications >> https://www.malekal.com/supprimer-virus-desinfecter-pc/

Conseil : Toujours télécharger avant utilisation pour profiter des dernières mises à jour.
Remarque: Il est possible que l'antivirus détécte un virus au téléchargement, il s'agit de Process.exe qui est un faux positif.

* Décompresse-le (clic droit : Extraire tout).
A la racine du système, déplace le dossier décompressé, comme suit :
C:\MSNFix.
Ouvre-le et double clique sur le fichier MSNFix.bat

* Exécute l'option R.
* Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage.
* Sauvegarde ce rapport puis fais-en un copier/coller sur le forum, ainsi qu'un scan HijackThis fait en mode normal.
* Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt
Poste-le dans ta prochaine réponse.

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations.
Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.

Poste un nouveau rapport HijackThis.

@+

E..T · Answer

Non laisse tomber hijackthis.

Télécharger ComboFix (par sUBs) sur le Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Démarrer en mode sans echec
    * Double cliquer combofix.exe.
    * Appuyer sur la touche Y (Yes) pour démarrer le scan
    * Le rapport sera crée dans: C:\Combofix.txt
    * Refaire un rapport hijackhthis, et fixer les lignes correspondantes comme indiqué plus haut.

Ne t'inquiète pas si windows te dit que c'est un virus ce n'est pas le cas.
@++

E..T · Answer

Erreur d'écriture fais le scan ;-)
++

E..T · Answer

Peux tu envoyer un nouveau rapport hijackthis.
++

E..T · Answer

Bon on va essayer un autre truc,

1/ Télécharges le fichier GenProc.zip http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip sur le bureau
2/ Sur le bureau,  dézippes le dossier GenProc.zip (clic droit sur le dossier téléchargé) 
3/ Sur le bureau, le dossier GenProc est créé
4/ Ouvrir le dossier GenProc d'un double clique le scan se lance.
Ne t 'étonnes pas  si le rapport s'affiche en très peu de temps, c'est normal.

Un tuto complet >> ici regarde le ;-)

@+

VladTepes72 · Answer

bonjour

tu peux avoir autant de scanner anti virus ou anti malware mais l important
est d en avoir un seul anti virus ET un seul anti spyware en meme temps resident
c est a dire actif en permanence

par exemple avast en antivirus et spybot comme anti malware residents, il n y a pas de 
verité dans le choix des deux c est au feeling et a la preference d interface

@+

E..T · Answer

Salut,
VladTepes72, j'ai pas tout compris le pc du naute est bien protégé non ?
++

VladTepes72 · Answer

Super oups, je m etais arrete a la premiere page du post
lol
ma reponse ne veut rien dire ici, si un moderateur peut l effacer...

desolé

E..T · Answer

anankronik

Télécharge ToolsCleaner il permet de supprimer les logiciels installés pendant la désinfection.
--> https://www.commentcamarche.net/telecharger/
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression .
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Je vais demander de l'aide  ;-)
Car j'ai pas envi de faire des conneries!
Si tu trouves le temps trop long pour la réponse regarde >> ici

@++

anankronik · Answer

Je ferais ça plus tard ce soir car je dois m'absenter cet après-midi. A plus tard

E..T · Answer

Pas de soucis ;-)
@++

Utilisateur anonyme · Answer

Salut je prend la suite 


Affiche tous les fichiers et dossiers : 
Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cacher 

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK 


ensuite refais un scan combofix et post le rapport stp

E..T · Answer

Merci chiqui ;-))
anankronik,  suit ses conseils à la lettre sinon cacahuètes ;-)
Bonne suite à vous deux je suis le topic.
Et encore merci chiqui.
^@++

Utilisateur anonyme · Answer

PASSE direct a combofix

Utilisateur anonyme · Answer

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. 
double-clique sur OTMoveIt.exe pour le lancer. 
Assure toi que la case Unregister Dll's and Ocx's soit bien cochée 
copie la liste qui se trouve en gras ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

C:\Windows\DUMP6556.tmp 
C:\Users\maxime\AppData\Roaming\wklnhst.­dat 
C:\Program Files\Navilog1 
C:\Users\maxime\AppData\Local\Temp\~DFFF66.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFFC1A.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFF4B0.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFEA40.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFD9AD.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFD1DB.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFA306.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF9833.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF7F41.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF763C.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF75A.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF6E86.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF6AB8.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF66E1.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF411F.tmp 
C:\Users\maxime\AppData\Local\Temp\~DF3756.tmp 
C:\Users\maxime\AppData\Local\Temp\Low\HSPERF~1.SH! 
C:\Users\maxime\AppData\Local\Temp\~DFEC4.tmp 
C:\Users\maxime\AppData\Local\Temp\~DFBA2.tmp 

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

E..T · Answer

Hello les nautes,
 Il me met que OTMoveIt.exe n'est pas une application Xin 32 valide et donc je ne peux pas l'ouvrir
As tu réussis ?

Sinon essaye en mode sans échec.
* Démarre en mode sans échec
Comment faire (au cas ou ;-)>> https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
Redémarres l’ordinateur
Dès le chargement du BIOS, commences à appuyer sur la touche F8 de ton clavier,i jusqu'au ou le menu des options avancées de Windows apparait. 
Sélectionne "Mode sans échec" dans le menu puis appuyez sur Entrée.

++

Utilisateur anonyme · Answer

Telecharge FindB :

- Fas un clic droit sur le lien, enregistrer sous .... sur le bureau 


---> http://sd-1.archive-host.com/membres/up/116615172019703188/FindB.exe


--> Double clic sur FindB

--> Post le rapport FindB.txt dans ton prochain message

Note :  le rapport FindB.txt est sauvegardé a la racine du disque

E..T · Answer

Merci pour ton intervention chiqui, !!
(c'est bon les 013 ;-) jo vu)

En attente de ton rapport anankronik

++

E..T · Answer

Ouep,
Pour MSN fais l'inverse du lien ;-)
http://www.commentcamarche.net/faq/sujet 5715 comment bloquer l acces a msn windows live messenger
Dis moi quoi.
++

E..T · Answer

Salut,
Au pire désinstalle msn correctement et réinstalle le.
Et remet un rapport hijack this.
@++

Trojan horse bho.ffg - Page 4

Discussions similaires

Newsletters