Pb Les programme sur le bureau ne trouvent pl

Question

Bonjour,
Bon Voilà j'ai un problème c'est que les racorcis du bureau ne s'ecutent plus Par exemple MSN Intervidéo Emule etc...

pour vous dire j'ai pas déplacé les programmes ça s'est arrivé d'un jour à l'autre vous savez c'est comme ce qui arrive avec le virs MSLOURDESS qui change l'i^cne des documents WORD en icône MSDOS 

je vous demande de m'aider pour trouver une solution et Merci d'Avance

sherred · Answer

télechargez ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html


Lancez HijackThis en double cliquant sur son icône puis cliquez sur le bouton Do a system scan only

Le rapport est retranscrit aussitôt apres le scan dans une fenêtre de type Bloc-notes
il vous suffit de realiser un copier/coller et de le poster dans le forum

Pierre222 · Answer

Re


merci pour votre Intervention 

Donc voilà le rapport
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:09:30, on 27/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://account.adobe.com/products
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\RunOnce: [avp6_post_install] msiexec.exe /i"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.0.125\French\kis.fr.msi"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [E06FXLRD_31539578] "E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [3679736099] "C:\WINDOWS\system32\winknote.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\syslnreg.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: DefWatch - Unknown owner - C:\Program Files\NavNT\defwatch.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe (file missing)

sherred · Answer

tu a un antivirus ?

Pierre222 · Answer

Re

Merci mais qu'est ce que je dois faire ????????????

Et quel antivirus qui peut arranger ça Merci

Pierre222 · Answer

Oui Norton cooperation mais  il n'est pas active

archet9 · Answer

meme desactivé il n est pas conseillé
d en avoir2
desinstalle norton....

mais dabord :
Fais un scan avec cet antispyware : 

Telecharge malwarebytes + tutoriel : 

-> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 

Tu l´instale; le programme va se mettre automatiquement a jour. 

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression". 

Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet". 

Puis click sur "rechercher". 

Laisse le scanner le pc... 

Si des elements on ete trouvés > click sur supprimer la selection. 

si il t´es demandé de redemarrer > click sur "yes". 

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum. 

Copie et colle le rapport stp.

Pierre222 · Answer

Re

Parcque lui aussi il a subit la même chose il ne souvre plus et sur la barre d'outils il ya un point d'excalamation jaune et j'arrive plus à le d'ésinstaller

sherred · Answer

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
&#8226; Redémarre ton ordinateur 
&#8226; Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
&#8226; A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
&#8226; Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
&#8226; Choisis ton compte. 

&#8226; Puis, ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
&#8226; Appuie sur une touche pour commencer le processus de nettoyage. 
&#8226; Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
&#8226; Appuie sur une touche pour redémarrer le PC. 
&#8226; Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
&#8226; Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
&#8226; Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
&#8226; Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 

&#8226; Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

Pierre222 · Answer

RE


Tout d'abord voilà le premier Rapport


----------------- FindyKill V4.095 ------------------

* User : Mehdi - QUICK-FD5096715
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 24/10/08 par Chiquitine29
* Recherche effectuée à 15:33:09 le 27/10/2008
* Windows XP - Internet Explorer 6.0.2900.2180
 
((((((((((((((((( *** Recherche *** ))))))))))))))))))  
 
 
--------------- [ Processus actifs ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
 
--------------- [ Fichiers/Dossiers infectieux ] ----------------  
 
 
»»»» Presence des fichiers dans C: 
 
 
»»»» Presence des fichiers dans C:\WINDOWS 
 
 
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch 
 
Present ! - C:\WINDOWS\prefetch\MDELK.EXE-238AA5EF.pf 
 
»»»» Presence des fichiers dans C:\WINDOWS\system32 
 
 
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers 
 
 
»»»» Presence des fichiers dans C:\Documents and Settings\Mehdi\Application Data 
 
 
»»»» Presence des fichiers dans C:\DOCUME~1\Mehdi\LOCALS~1\Temp 
 
 
--------------- [ Registre / Startup ] ----------------  
 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    High Definition Audio Property Page Shortcut	REG_SZ	HDAShCut.exe
    SoundMAXPnP	REG_SZ	C:\Program Files\Analog Devices\Core\smax4pnp.exe
    RemoteControl	REG_SZ	"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    SpeedTouch USB Diagnostics	REG_SZ	"C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    WinampAgent	REG_SZ	"C:\Program Files\Winamp\winampa.exe"
    HPDJ Taskbar Utility	REG_SZ	C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    SunJavaUpdateSched	REG_SZ	C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    vptray	REG_SZ	C:\Program Files\NavNT\vptray.exe
    NeroFilterCheck	REG_SZ	C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    E06FXLRD_31539578	REG_SZ	"E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
    LightScribe Control Panel	REG_SZ	C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
    BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	REG_SZ	"C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
    Orb	REG_SZ	"C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
    swg	REG_SZ	C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
 
--------------- [ Registre / Clés infectieuses ] ----------------  
 
 
 
--------------- [ Etat / Services ] ---------------- 
 


+- Services : [ Auto=2 Demande=3 Désactivé=4 ]

 Ndisuio - Type de démarrage = 3 
 
 Ip6Fw - Type de démarrage = 3 
 
 SharedAccess - Type de démarrage = 2 
 
 wuauserv - Type de démarrage = 2 
 
 wscsvc - Type de démarrage = 2 
 
 
 
--------------- [ Recherche dans supports amovibles] ----------------  
 
 
+- Informations : 

C: - Lecteur fixe

D: - Lecteur de CD-ROM

E: - Lecteur fixe

F: - Lecteur de CD-ROM

 
+- Contenu de l'autorun : F:\autorun.inf  

[AutoRun]
open=setup.exe
icon=setup.exe,0


































 
+- presence des fichiers :  

Présent ! [28/08/2001 12:00][-r-------] - F:\autorun.inf 
 
 
--------------- [ Registre / Moutpoint2 ] ----------------  
 
 
 -> Recherche négative. 
 
 
------------------- ! Fin du rapport ! --------------------  
 
Et voilà le deuxième rapport

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-27 15:20:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVgl]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=""C:\Program Files\Fichiers communs\System\pgKj.exe""
"DisplayName"="WinVgl"
"ObjectName"=".\Zcku"
"Description"="Symantec WMI Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinVgl]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=""C:\Program Files\Fichiers communs\System\pgKj.exe""
"DisplayName"="WinVgl"
"ObjectName"=".\Zcku"
"Description"="Symantec WMI Service"

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Pierre222 · Answer

Re



----------------- FindyKill V4.095 ------------------

* User : Mehdi - QUICK-FD5096715
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 24/10/08 par Chiquitine29
* Suppression effectuée à 15:50:54 le 27/10/2008
* Windows XP - Internet Explorer 6.0.2900.2180
 
 
((((((((((((((( *** Suppression *** ))))))))))))))))))  
 
 
--------------- [ Processus actifs ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\userinit.exe
 
--------------- [ Fichiers/Dossiers infectieux ] ----------------  
 
 
»»»» Suppression des fichiers dans C: 
 
 
»»»» Suppression des fichiers dans C:\WINDOWS 
 
 
»»»» Suppression des fichiers dans C:\WINDOWS\Prefetch 
 
Supprimé ! - C:\WINDOWS\Prefetch\LUCOMS~1.EXE-02DB5950.pf 
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-1FFC673C.pf 
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-4489B61B.pf 
Supprimé ! - C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf 
Supprimé ! - C:\WINDOWS\Prefetch\HPZTSB04.EXE-2611387D.pf 
Supprimé ! - C:\WINDOWS\Prefetch\WINTEMS.EXE-26D98C75.pf 
Supprimé ! - C:\WINDOWS\Prefetch\MDELK.EXE-238AA5EF.pf 
 
»»»» Suppression des fichiers dans C:\WINDOWS\system32 
 
 
»»»» Suppression des fichiers dans C:\WINDOWS\system32\drivers 
 
 
»»»» Suppression des fichiers dans C:\Documents and Settings\Mehdi\Application Data 
 
 
»»»» Suppression des fichiers dans C:\DOCUME~1\Mehdi\LOCALS~1\Temp 
 
 
--------------- [ Registre / Clés infectieuses ] ---------------- 
 
 
      -> Certaines clés ont été supprimées au premier reboot ...  
 
--------------- [ Etat / Redémarage des services ] ---------------- 
 

+- Services : [ Auto=2 Demande=3 Désactivé=4 ] 

 Ndisuio - Type de démarrage = 3 
 
 Ip6Fw - Type de démarrage = 2 
 
 SharedAccess - Type de démarrage = 2 
 
 wuauserv - Type de démarrage = 2 
 
 wscsvc - Type de démarrage = 2 
 
 
---------------   [ Nettoyage des supports amovibles ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

D: - Lecteur de CD-ROM

E: - Lecteur fixe

F: - Lecteur de CD-ROM

 
+- Suppression des fichiers : 
 
Echec de la supression !! - F:\autorun.inf  
 
--------------- [ Registre / Moutpoint2 ] ----------------  
 
 
 -> Recherche négative. 
 
 
--------------- [ Recherche Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\Mehdi\Bureau\MUSIQUE\LIMEWIRE1\David & David - Swallowed By The Cracks.mp3
C:\Documents and Settings\Mehdi\Bureau\sauvegarde incoming\2008\208 - 300 Sarah Cracknell - The Journey Continues.mp3
C:\Documents and Settings\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation\kissmycrack_com_2.mpeg
C:\Documents and Settings\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation	hirdmovies-crack-addict-3-12.mpeg
C:\Documents and Settings\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation\Lettre mot avi\kissmycrack_com_2_1.avi
 
 
---------------- ! Fin du rapport ! ------------------  
 
 
Merci

sherred · Answer

ok continu avec elibagla comme je te l'ai demandé puis Téléchargez Combifix http://download.bleepingcomputer.com/sUBs/ComboFix.exe ou http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/ ou https://forospyware.com puis renommez le>>> bidule.exe <<<---- IMPORTANT Déconnectez vous d'internet et fermez toutes tes applications et programmes Double-cliquez sur "bidule.exe" Appuyer sur la touche Y (Yes) pour démarrer le scan Ne pas cliquer dans la fenêtre de Combofix durant l'analyse Le rapport sera crée sous la racine: C:\Combofix.txt a demain

Pierre222 · Answer

Re

Bon je n'ai pas elibagla 11.45 j'ai la version 11.89

Pierre222 · Answer

Re donc avec Combofix voilà le rapport ComboFix 08-10-25.01 - Mehdi 2008-10-27 23:43:30.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.272 [GMT 0:00] Lancé depuis: C:\Documents and Settings\Mehdi\Bureau\ComboFix.exe [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc\console.html C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc\script0.html C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc\script1.html . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-27 au 2008-10-27 )))))))))))))))))))))))))))))))))))) . 2008-10-27 15:32 . 2008-10-27 15:52 d-------- C:\Program Files\FindyKill 2008-10-27 15:17 . 2008-10-27 00:01 d-------- C:\SDFix 2008-10-27 15:03 . 2008-10-27 15:03 d-------- C:\Documents and Settings\All Users\Application Data\NortonInstaller 2008-10-27 14:09 . 2008-10-27 14:09 d-------- C:\Program Files\Trend Micro 2008-10-27 13:23 . 2008-10-27 13:23 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-10-27 05:16 . 2008-10-27 05:32 d-------- C:\Documents and Settings\Mehdi\Application Data\Windows Live Writer 2008-10-27 04:55 . 2008-10-27 05:00 d-------- C:\Program Files\Windows Live 2008-10-27 04:48 . 2008-10-27 04:48 d-------- C:\Program Files\Google 2008-10-27 04:42 . 2008-10-27 04:42 d-------- C:\Documents and Settings\User\Application Data\InterVideo 2008-10-27 04:41 . 2008-10-27 04:42 d-------- C:\Documents and Settings\User\Application Data\Winamp 2008-10-26 20:12 . 2008-10-26 20:12 d-------- C:\Documents and Settings\Mehdi\Application Data\InterVideo 2008-10-26 20:08 . 2008-10-27 05:00 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-10-26 20:02 . 2008-10-26 20:02 d-------- C:\Program Files\InterVideo 2008-10-26 20:01 . 2008-10-26 20:01 d-------- C:\Program Files\Fichiers communs\InstallShield 2008-10-26 19:58 . 2008-10-26 19:58 d-------- C:\Program Files\Winamp Toolbar 2008-10-26 19:58 . 2008-10-26 19:58 d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar 2008-10-26 19:57 . 2008-10-26 19:57 d-------- C:\Program Files\Winamp Remote 2008-10-26 19:57 . 2008-10-26 23:58 d-------- C:\Documents and Settings\All Users\Application Data\OrbNetworks 2008-10-26 19:51 . 2008-10-26 19:59 d-------- C:\Documents and Settings\Mehdi\Application Data\Winamp 2008-10-26 19:33 . 2008-10-26 19:33 d-------- C:\Program Files\Fichiers communs\LightScribe 2008-10-26 19:30 . 2008-10-26 19:38 d-------- C:\Documents and Settings\Mehdi\Application Data\Ahead 2008-10-26 19:27 . 2008-10-26 19:27 d-------- C:\Program Files\Nero 2008-10-26 19:27 . 2008-10-26 19:29 d-------- C:\Program Files\Fichiers communs\Ahead 2008-10-26 19:27 . 2008-10-26 19:27 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-10-26 18:29 . 2005-07-26 13:43 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-10-26 18:29 . 2005-07-26 13:43 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-10-26 18:29 . 2005-07-26 13:43 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-10-26 18:29 . 2005-07-26 13:43 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-10-25 17:34 . 2006-06-03 00:19 d--h----- C:\Documents and Settings\User\Voisinage réseau 2008-10-25 17:34 . 2006-06-03 00:19 d--h----- C:\Documents and Settings\User\Voisinage d'impression 2008-10-25 17:34 . 2006-06-03 00:25 d--h----- C:\Documents and Settings\User\Modèles 2008-10-25 17:34 . 2008-10-25 17:35 dr------- C:\Documents and Settings\User\Mes documents 2008-10-25 17:34 . 2006-06-03 00:19 dr------- C:\Documents and Settings\User\Menu Démarrer 2008-10-25 17:34 . 2008-10-25 17:35 dr------- C:\Documents and Settings\User\Favoris 2008-10-25 17:34 . 2008-10-27 04:38 d-------- C:\Documents and Settings\User\Bureau 2008-10-25 17:34 . 2008-10-27 04:43 d-------- C:\Documents and Settings\User 2008-10-25 16:52 . 2008-10-25 16:52 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-25 16:52 . 2008-10-25 16:52 d-------- C:\Documents and Settings\Mehdi\Application Data\Malwarebytes 2008-10-25 16:52 . 2008-10-25 16:52 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-25 16:52 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-25 16:52 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-24 23:56 . 2008-10-24 23:56 17,618 --a------ C:\Documents and Settings\All Users\Application Data\qawyma.scr 2008-10-24 23:56 . 2008-10-24 23:56 17,507 --a------ C:\WINDOWS\yzapuj.dat 2008-10-24 23:56 . 2008-10-24 23:56 16,603 --a------ C:\Program Files\Fichiers communs\usifu.reg 2008-10-24 23:56 . 2008-10-24 23:56 15,984 --a------ C:\WINDOWS\system32\arir.bin 2008-10-24 23:56 . 2008-10-24 23:56 15,477 --a------ C:\WINDOWS\bubavi.ban 2008-10-24 23:56 . 2008-10-24 23:56 12,941 --a------ C:\Documents and Settings\All Users\Application Data\javaly.pif 2008-10-24 23:56 . 2008-10-24 23:56 12,211 --a------ C:\Documents and Settings\yanis et elias\Application Data\anyzexygi.sys 2008-10-24 23:56 . 2008-10-24 23:56 10,318 --a------ C:\Program Files\Fichiers communs\iluhofigir.dat 2008-10-24 23:41 . 2008-10-24 23:41 19,067 --a------ C:\WINDOWS ikyri.dl 2008-10-24 23:41 . 2008-10-24 23:41 18,932 --a------ C:\WINDOWS\oxirosu.scr 2008-10-24 23:41 . 2008-10-24 23:41 17,777 --a------ C:\WINDOWS\system32\avaqubemib.bin 2008-10-24 23:41 . 2008-10-24 23:41 16,767 --a------ C:\WINDOWS\acebopov.db 2008-10-24 23:41 . 2008-10-24 23:41 16,703 --a------ C:\WINDOWS\ihymi.exe 2008-10-24 23:41 . 2008-10-24 23:41 15,406 --a------ C:\WINDOWS\vigur.pif 2008-10-24 23:41 . 2008-10-24 23:41 14,296 --a------ C:\Documents and Settings\All Users\Application Data ikif.scr 2008-10-24 23:41 . 2008-10-24 23:41 14,195 --a------ C:\Documents and Settings\Mehdi\Application Data\uvatelu.bat 2008-10-24 23:41 . 2008-10-24 23:41 13,379 --a------ C:\Documents and Settings\Mehdi\Application Data\yhun.com 2008-10-24 23:41 . 2008-10-24 23:41 11,131 --a------ C:\Documents and Settings\Mehdi\Application Data\ufoxabefe.dll 2008-10-24 23:41 . 2008-10-24 23:41 10,848 --a------ C:\WINDOWS elasysad.dat 2008-10-24 23:41 . 2008-10-24 23:41 10,715 --a------ C:\Documents and Settings\Mehdi\Application Data\yrasanifar.bin 2008-10-24 23:41 . 2008-10-24 23:41 10,318 --a------ C:\WINDOWS\system32\ajopijon.exe 2008-10-24 23:41 . 2008-10-24 23:41 10,295 --a------ C:\WINDOWS\aqaf._dl 2008-10-24 23:41 . 2008-10-24 23:41 10,024 --a------ C:\WINDOWS\system32\merycy._sy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-27 23:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-10-26 20:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-26 19:59 --------- d-----w C:\Program Files\Winamp 2008-10-24 23:44 --------- d-----w C:\Program Files\Sony 2008-10-24 23:44 --------- d-----w C:\Program Files\FinePixViewer 2008-10-24 23:44 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2008-10-24 23:44 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-10-24 23:43 --------- d-----w C:\Program Files\CyberLink 2008-08-06 00:03 62,158 ----a-r C:\WINDOWS\system32\winknote.exe 2008-08-06 00:03 26,428 ----a-r C:\WINDOWS\system32\syslnreg.dll 2007-11-06 01:11 55,880 -c--a-w C:\Documents and Settings\Mehdi\Application Data\GDIPFONTCACHEV1.DAT . ------- Sigcheck ------- 2005-07-26 13:01 578048 0df75fb73f705b011630159a43d7c354 C:\WINDOWS\system32\user32.dll 2005-10-12 08:33 2017280 50b3a210b6fa8d3089a36a32e7d8b21f C:\WINDOWS\system32 tkrnlpa.exe 2005-07-26 13:01 2137600 e75f7aa5a33479f29c636fd0890f5762 C:\WINDOWS\system32 toskrnl.exe 2005-07-26 13:01 1036288 0bee3b07ace3303ee57698808e1d2de3 C:\WINDOWS\explorer.exe 2005-08-10 10:15 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-27_ 4.31.07.14 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ARPPRODUCTICON.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\UNINST_Uninstall_G_408FFBEED62349E08B232864A94D2864.exe - 2008-10-26 21:57:26 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-27 23:42:56 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-26 21:57:26 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-10-27 23:42:56 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-10-26 21:57:26 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-27 23:42:56 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2005-08-06 13:42:52 520,456 -c--a-w C:\WINDOWS\system32\LegitCheckControl.dll + 2008-03-20 18:06:36 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll - 2008-10-25 16:50:34 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-27 15:52:07 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-10-25 16:50:34 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2008-10-27 15:52:07 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2008-10-25 16:50:34 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-27 15:52:07 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-10-25 16:50:34 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2008-10-27 15:52:07 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360] "E06FXLRD_31539578"="E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" [2005-06-04 301776] "LightScribe Control Panel"="C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-04 149040] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-10-27 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-03 36352] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-29 196608] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 36975] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-05-04 161328] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 C:\WINDOWS\system32\HdAShCut.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "Config"="C:\WINDOWS\system32 un.cmd" [2005-08-23 341] "tscuninstall"="C:\WINDOWS\system32 scupgrd.exe" [2004-08-19 44544] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "3679736099"="C:\WINDOWS\system32\winknote.exe" [2008-08-06 62158] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoDesktopCleanupWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoAutoUpdate"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoDesktopCleanupWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoAutoUpdate"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WLSetupSvc"=3 (0x3) "Norton AntiVirus Server"=2 (0x2) "AVG Anti-Spyware Guard"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Winamp Remote\bin\Orb.exe"= "C:\Program Files\Winamp Remote\bin\OrbTray.exe"= "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"= S2 WinVgl;WinVgl;C:\Program Files\Fichiers communs\System\wsY.exe [2006-07-05 160256] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-10-27 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [] . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-vptray - C:\Program Files\NavNT\vptray.exe . ------- Examen supplémentaire ------- . R0 -: HKCU-Main,Search Page = hxxp://www.google.com R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://store.adobe.com/WebObjects/WEC?pageID=RegMp1&awe_571401&platformCode=WIN&prodData=m5qen5qYmp+cnJ6SnJ2Zm52cm5qbnpKb&version=7.0&nameCode=PHSP&languageCode=F&systemCode=AOLN R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie O8 -: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO O8 -: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar esources\en-US\local\search.html O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 23:46:02 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinVgl] "ImagePath"="\"C:\Program Files\Fichiers communs\System\wsY.exe\"" . --------------------- DLLs chargées dans les processus actifs --------------------- PROCESSUS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\NavLogon.dll . ------------------------ Autres processus actifs ------------------------ . C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\FinePixViewer\QuickDCF2.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Heure de fin: 2008-10-27 23:48:28 - La machine a redémarré ComboFix-quarantined-files.txt 2008-10-27 23:48:25 ComboFix2.txt 2008-10-27 04:31:27 Avant-CF: 29 504 847 872 octets libres Après-CF: 29,532,811,264 octets libres 255

Pierre222 · Answer

Re donc avec Combofix voilà le rapport ComboFix 08-10-25.01 - Mehdi 2008-10-27 23:43:30.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.272 [GMT 0:00] Lancé depuis: C:\Documents and Settings\Mehdi\Bureau\ComboFix.exe [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc\console.html C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc\script0.html C:\Documents and Settings\Mehdi\Local Settings\Temporary Internet Files\sc\script1.html . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-27 au 2008-10-27 )))))))))))))))))))))))))))))))))))) . 2008-10-27 15:32 . 2008-10-27 15:52 d-------- C:\Program Files\FindyKill 2008-10-27 15:17 . 2008-10-27 00:01 d-------- C:\SDFix 2008-10-27 15:03 . 2008-10-27 15:03 d-------- C:\Documents and Settings\All Users\Application Data\NortonInstaller 2008-10-27 14:09 . 2008-10-27 14:09 d-------- C:\Program Files\Trend Micro 2008-10-27 13:23 . 2008-10-27 13:23 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-10-27 05:16 . 2008-10-27 05:32 d-------- C:\Documents and Settings\Mehdi\Application Data\Windows Live Writer 2008-10-27 04:55 . 2008-10-27 05:00 d-------- C:\Program Files\Windows Live 2008-10-27 04:48 . 2008-10-27 04:48 d-------- C:\Program Files\Google 2008-10-27 04:42 . 2008-10-27 04:42 d-------- C:\Documents and Settings\User\Application Data\InterVideo 2008-10-27 04:41 . 2008-10-27 04:42 d-------- C:\Documents and Settings\User\Application Data\Winamp 2008-10-26 20:12 . 2008-10-26 20:12 d-------- C:\Documents and Settings\Mehdi\Application Data\InterVideo 2008-10-26 20:08 . 2008-10-27 05:00 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-10-26 20:02 . 2008-10-26 20:02 d-------- C:\Program Files\InterVideo 2008-10-26 20:01 . 2008-10-26 20:01 d-------- C:\Program Files\Fichiers communs\InstallShield 2008-10-26 19:58 . 2008-10-26 19:58 d-------- C:\Program Files\Winamp Toolbar 2008-10-26 19:58 . 2008-10-26 19:58 d-------- C:\Documents and Settings\All Users\Application Data\Winamp Toolbar 2008-10-26 19:57 . 2008-10-26 19:57 d-------- C:\Program Files\Winamp Remote 2008-10-26 19:57 . 2008-10-26 23:58 d-------- C:\Documents and Settings\All Users\Application Data\OrbNetworks 2008-10-26 19:51 . 2008-10-26 19:59 d-------- C:\Documents and Settings\Mehdi\Application Data\Winamp 2008-10-26 19:33 . 2008-10-26 19:33 d-------- C:\Program Files\Fichiers communs\LightScribe 2008-10-26 19:30 . 2008-10-26 19:38 d-------- C:\Documents and Settings\Mehdi\Application Data\Ahead 2008-10-26 19:27 . 2008-10-26 19:27 d-------- C:\Program Files\Nero 2008-10-26 19:27 . 2008-10-26 19:29 d-------- C:\Program Files\Fichiers communs\Ahead 2008-10-26 19:27 . 2008-10-26 19:27 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-10-26 18:29 . 2005-07-26 13:43 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-10-26 18:29 . 2005-07-26 13:43 12,288 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-10-26 18:29 . 2005-07-26 13:43 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-10-26 18:29 . 2005-07-26 13:43 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-10-25 17:34 . 2006-06-03 00:19 d--h----- C:\Documents and Settings\User\Voisinage réseau 2008-10-25 17:34 . 2006-06-03 00:19 d--h----- C:\Documents and Settings\User\Voisinage d'impression 2008-10-25 17:34 . 2006-06-03 00:25 d--h----- C:\Documents and Settings\User\Modèles 2008-10-25 17:34 . 2008-10-25 17:35 dr------- C:\Documents and Settings\User\Mes documents 2008-10-25 17:34 . 2006-06-03 00:19 dr------- C:\Documents and Settings\User\Menu Démarrer 2008-10-25 17:34 . 2008-10-25 17:35 dr------- C:\Documents and Settings\User\Favoris 2008-10-25 17:34 . 2008-10-27 04:38 d-------- C:\Documents and Settings\User\Bureau 2008-10-25 17:34 . 2008-10-27 04:43 d-------- C:\Documents and Settings\User 2008-10-25 16:52 . 2008-10-25 16:52 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-25 16:52 . 2008-10-25 16:52 d-------- C:\Documents and Settings\Mehdi\Application Data\Malwarebytes 2008-10-25 16:52 . 2008-10-25 16:52 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-25 16:52 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-25 16:52 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-24 23:56 . 2008-10-24 23:56 17,618 --a------ C:\Documents and Settings\All Users\Application Data\qawyma.scr 2008-10-24 23:56 . 2008-10-24 23:56 17,507 --a------ C:\WINDOWS\yzapuj.dat 2008-10-24 23:56 . 2008-10-24 23:56 16,603 --a------ C:\Program Files\Fichiers communs\usifu.reg 2008-10-24 23:56 . 2008-10-24 23:56 15,984 --a------ C:\WINDOWS\system32\arir.bin 2008-10-24 23:56 . 2008-10-24 23:56 15,477 --a------ C:\WINDOWS\bubavi.ban 2008-10-24 23:56 . 2008-10-24 23:56 12,941 --a------ C:\Documents and Settings\All Users\Application Data\javaly.pif 2008-10-24 23:56 . 2008-10-24 23:56 12,211 --a------ C:\Documents and Settings\yanis et elias\Application Data\anyzexygi.sys 2008-10-24 23:56 . 2008-10-24 23:56 10,318 --a------ C:\Program Files\Fichiers communs\iluhofigir.dat 2008-10-24 23:41 . 2008-10-24 23:41 19,067 --a------ C:\WINDOWS ikyri.dl 2008-10-24 23:41 . 2008-10-24 23:41 18,932 --a------ C:\WINDOWS\oxirosu.scr 2008-10-24 23:41 . 2008-10-24 23:41 17,777 --a------ C:\WINDOWS\system32\avaqubemib.bin 2008-10-24 23:41 . 2008-10-24 23:41 16,767 --a------ C:\WINDOWS\acebopov.db 2008-10-24 23:41 . 2008-10-24 23:41 16,703 --a------ C:\WINDOWS\ihymi.exe 2008-10-24 23:41 . 2008-10-24 23:41 15,406 --a------ C:\WINDOWS\vigur.pif 2008-10-24 23:41 . 2008-10-24 23:41 14,296 --a------ C:\Documents and Settings\All Users\Application Data ikif.scr 2008-10-24 23:41 . 2008-10-24 23:41 14,195 --a------ C:\Documents and Settings\Mehdi\Application Data\uvatelu.bat 2008-10-24 23:41 . 2008-10-24 23:41 13,379 --a------ C:\Documents and Settings\Mehdi\Application Data\yhun.com 2008-10-24 23:41 . 2008-10-24 23:41 11,131 --a------ C:\Documents and Settings\Mehdi\Application Data\ufoxabefe.dll 2008-10-24 23:41 . 2008-10-24 23:41 10,848 --a------ C:\WINDOWS elasysad.dat 2008-10-24 23:41 . 2008-10-24 23:41 10,715 --a------ C:\Documents and Settings\Mehdi\Application Data\yrasanifar.bin 2008-10-24 23:41 . 2008-10-24 23:41 10,318 --a------ C:\WINDOWS\system32\ajopijon.exe 2008-10-24 23:41 . 2008-10-24 23:41 10,295 --a------ C:\WINDOWS\aqaf._dl 2008-10-24 23:41 . 2008-10-24 23:41 10,024 --a------ C:\WINDOWS\system32\merycy._sy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-27 23:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-10-26 20:02 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-26 19:59 --------- d-----w C:\Program Files\Winamp 2008-10-24 23:44 --------- d-----w C:\Program Files\Sony 2008-10-24 23:44 --------- d-----w C:\Program Files\FinePixViewer 2008-10-24 23:44 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2008-10-24 23:44 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-10-24 23:43 --------- d-----w C:\Program Files\CyberLink 2008-08-06 00:03 62,158 ----a-r C:\WINDOWS\system32\winknote.exe 2008-08-06 00:03 26,428 ----a-r C:\WINDOWS\system32\syslnreg.dll 2007-11-06 01:11 55,880 -c--a-w C:\Documents and Settings\Mehdi\Application Data\GDIPFONTCACHEV1.DAT . ------- Sigcheck ------- 2005-07-26 13:01 578048 0df75fb73f705b011630159a43d7c354 C:\WINDOWS\system32\user32.dll 2005-10-12 08:33 2017280 50b3a210b6fa8d3089a36a32e7d8b21f C:\WINDOWS\system32 tkrnlpa.exe 2005-07-26 13:01 2137600 e75f7aa5a33479f29c636fd0890f5762 C:\WINDOWS\system32 toskrnl.exe 2005-07-26 13:01 1036288 0bee3b07ace3303ee57698808e1d2de3 C:\WINDOWS\explorer.exe 2005-08-10 10:15 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-27_ 4.31.07.14 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ARPPRODUCTICON.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe + 2008-10-27 04:48:10 26,694 ----a-r C:\WINDOWS\Installer\{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}\UNINST_Uninstall_G_408FFBEED62349E08B232864A94D2864.exe - 2008-10-26 21:57:26 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-27 23:42:56 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-26 21:57:26 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-10-27 23:42:56 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-10-26 21:57:26 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-27 23:42:56 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2005-08-06 13:42:52 520,456 -c--a-w C:\WINDOWS\system32\LegitCheckControl.dll + 2008-03-20 18:06:36 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll - 2008-10-25 16:50:34 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-27 15:52:07 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-10-25 16:50:34 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat + 2008-10-27 15:52:07 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat - 2008-10-25 16:50:34 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-27 15:52:07 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-10-25 16:50:34 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat + 2008-10-27 15:52:07 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15360] "E06FXLRD_31539578"="E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" [2005-06-04 301776] "LightScribe Control Panel"="C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-05-04 149040] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-10-27 171448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-03 36352] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-10-29 196608] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 36975] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-05-04 161328] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 C:\WINDOWS\system32\HdAShCut.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="move" [X] "Config"="C:\WINDOWS\system32 un.cmd" [2005-08-23 341] "tscuninstall"="C:\WINDOWS\system32 scupgrd.exe" [2004-08-19 44544] [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run] "3679736099"="C:\WINDOWS\system32\winknote.exe" [2008-08-06 62158] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoDesktopCleanupWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoAutoUpdate"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoDesktopCleanupWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoAutoUpdate"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WLSetupSvc"=3 (0x3) "Norton AntiVirus Server"=2 (0x2) "AVG Anti-Spyware Guard"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Winamp Remote\bin\Orb.exe"= "C:\Program Files\Winamp Remote\bin\OrbTray.exe"= "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"= S2 WinVgl;WinVgl;C:\Program Files\Fichiers communs\System\wsY.exe [2006-07-05 160256] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe" . Contenu du dossier 'Tâches planifiées' 2008-10-27 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [] . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-vptray - C:\Program Files\NavNT\vptray.exe . ------- Examen supplémentaire ------- . R0 -: HKCU-Main,Search Page = hxxp://www.google.com R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://store.adobe.com/WebObjects/WEC?pageID=RegMp1&awe_571401&platformCode=WIN&prodData=m5qen5qYmp+cnJ6SnJ2Zm52cm5qbnpKb&version=7.0&nameCode=PHSP&languageCode=F&systemCode=AOLN R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie O8 -: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO O8 -: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar esources\en-US\local\search.html O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 23:46:02 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinVgl] "ImagePath"="\"C:\Program Files\Fichiers communs\System\wsY.exe\"" . --------------------- DLLs chargées dans les processus actifs --------------------- PROCESSUS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\NavLogon.dll . ------------------------ Autres processus actifs ------------------------ . C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\FinePixViewer\QuickDCF2.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Heure de fin: 2008-10-27 23:48:28 - La machine a redémarré ComboFix-quarantined-files.txt 2008-10-27 23:48:25 ComboFix2.txt 2008-10-27 04:31:27 Avant-CF: 29 504 847 872 octets libres Après-CF: 29,532,811,264 octets libres 255

Pierre222 · Answer

Bonjour comment ça va ?
Bon d'accord pour pour ces manoeuvtres Mais ce que je voulais vous dire Bon je n'ai pas elibagla 11.45 j'ai la version 11.89
Ok Merci

Pierre222 · Answer

Re

donc tout d'abord voilà le 1ier Rapport :

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1332
Windows 5.1.2600 Service Pack 2

28/10/2008 13:23:00
mbam-log-2008-10-28 (13-23-00).txt

Type de recherche: Examen rapide
Eléments examinés: 58120
Temps écoulé: 5 minute(s), 54 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


Et le second :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:27, on 28/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://account.adobe.com/products
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [E06FXLRD_31539578] "E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [3679736099] "C:\WINDOWS\system32\winknote.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\syslnreg.dll
O23 - Service: DefWatch - Unknown owner - C:\Program Files\NavNT\defwatch.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

Pierre222 · Answer

Re

Bien sûr le premier scan de Maware était en mode sans Echec 


voilà donc le rapport

   -----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.06GHz )
   BIOS : BIOS Date: 11/24/05 11:11:21 Ver: 08.00.12
   USER : Mehdi ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:58 Go (Free:27 Go)
   D:\ (CD or DVD)
   E:\ (Local Disk) - NTFS - Total:93 Go (Free:30 Go)
   F:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [1] ( 28/10/2008|14:07 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Mehdi\Bureau\MUSIQUE\LIMEWIRE1\David & David - Swallowed By The Cracks.mp3
   C:\DOCUME~1\Mehdi\Bureau\sauvegarde incoming\2008\208 - 300 Sarah Cracknell - The Journey Continues.mp3
   C:\DOCUME~1\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation\kissmycrack_com_2.mpeg
   C:\DOCUME~1\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation	hirdmovies-crack-addict-3-12.mpeg
   C:\DOCUME~1\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation\Lettre mot avi\kissmycrack_com_2_1.avi



   1 - "C:\ToolBar SD\TB_1.txt" - 28/10/2008|14:07 - Option : [1]

   -----------\  Fin du rapport a 14:07:54,67

Pierre222 · Answer

Re 

S.V.P  pour Messenger donc l'icône ne donne rien  et lorsque je veux le reinstller il me donne que c'est déja installer 

que dois je faire 
Merci

Pierre222 · Answer

Re


Avira AntiVir Personal
Report file date: mardi 28 octobre 2008  14:24

Scanning for 1369550 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    QUICK-FD5096715

Version information:
BUILD.DAT     : 8.1.0.331      16934 Bytes  12/08/2008 11:46:00
AVSCAN.EXE    : 8.1.4.7       315649 Bytes  26/06/2008 10:57:53
AVSCAN.DLL    : 8.1.4.0        40705 Bytes  26/05/2008 09:56:40
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 14:44:19
LUKERES.DLL   : 8.1.4.0        12033 Bytes  26/05/2008 09:58:52
ANTIVIR0.VDF  : 6.40.0.0    11030528 Bytes  18/07/2007 12:33:34
ANTIVIR1.VDF  : 7.0.5.1      8182784 Bytes  24/06/2008 15:54:15
ANTIVIR2.VDF  : 7.0.5.20      142336 Bytes  30/06/2008 07:20:53
ANTIVIR3.VDF  : 7.0.5.23       17408 Bytes  30/06/2008 11:24:47
Engineversion : 8.1.1.19  
AEVDF.DLL     : 8.1.0.5       102772 Bytes  25/02/2008 11:58:21
AESCRIPT.DLL  : 8.1.0.63      311673 Bytes  06/08/2008 15:13:47
AESCN.DLL     : 8.1.0.23      119156 Bytes  10/07/2008 14:44:49
AERDL.DLL     : 8.1.0.20      418165 Bytes  24/04/2008 14:37:48
AEPACK.DLL    : 8.1.2.1       364917 Bytes  15/07/2008 14:58:35
AEOFFICE.DLL  : 8.1.0.21      192891 Bytes  18/07/2008 08:35:21
AEHEUR.DLL    : 8.1.0.47     1368437 Bytes  06/08/2008 15:13:47
AEHELP.DLL    : 8.1.0.15      115063 Bytes  10/07/2008 14:44:48
AEGEN.DLL     : 8.1.0.35      315764 Bytes  06/08/2008 16:38:47
AEEMU.DLL     : 8.1.0.7       430452 Bytes  31/07/2008 10:33:21
AECORE.DLL    : 8.1.1.8       172406 Bytes  31/07/2008 10:33:21
AEBB.DLL      : 8.1.0.1        53617 Bytes  10/07/2008 14:44:48
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 10:40:05
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 11:28:01
AVREP.DLL     : 7.0.0.1       155688 Bytes  30/06/2008 16:35:20
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 13:26:40
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 10:29:23
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 14:27:49
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 19:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 14:49:40
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 14:05:10
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  12/06/2008 15:48:07
RCTEXT.DLL    : 8.0.52.0       86273 Bytes  27/06/2008 15:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, E:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 28 octobre 2008  14:24

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'WinCinemaMgr.exe' - '1' Module(s) have been scanned
Scan process 'QuickDCF2.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'OrbTray.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'LightScribeControlPanel.exe' - '1' Module(s) have been scanned
Scan process 'EDICT.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'hpztsb04.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'dragdiag.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned
Scan process 'winknote.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
38 processes with 38 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!
Boot sector 'E:\'
    [INFO]      No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\winknote.exe
    [WARNING]   The file could not be opened!
The registry was scanned ( '60' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\System\CBF.exe
    [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\System\dtDyR.exe
    [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\System\Dyc.exe
    [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\System\HNkbDy.exe
    [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\System
Zf.exe
    [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\System\QGg.exe
    [WARNING]   The file could not be opened!
C:\WINDOWS\system32\syslnreg.dll
    [WARNING]   The file could not be opened!
C:\WINDOWS\system32\winknote.exe
    [WARNING]   The file could not be opened!
Begin scan in 'E:\'


End of the scan: mardi 28 octobre 2008  14:45
Used time: 20:49 Minute(s)

The scan has been done completely.

   4206 Scanning directories
 112882 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
     10 Files cannot be scanned
 112872 Files not concerned
    870 Archives were scanned
     10 Warnings
      0 Notes

Et le second

   -----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.06GHz )
   BIOS : BIOS Date: 11/24/05 11:11:21 Ver: 08.00.12
   USER : Mehdi ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:58 Go (Free:27 Go)
   D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   E:\ (Local Disk) - NTFS - Total:93 Go (Free:30 Go)
   F:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [2] ( 28/10/2008|14:55 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="http://www.google.com/toolbar/ie8/sidebar.html"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Mehdi\Bureau\MUSIQUE\LIMEWIRE1\David & David - Swallowed By The Cracks.mp3
   C:\DOCUME~1\Mehdi\Bureau\sauvegarde incoming\2008\208 - 300 Sarah Cracknell - The Journey Continues.mp3
   C:\DOCUME~1\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation\kissmycrack_com_2.mpeg
   C:\DOCUME~1\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation	hirdmovies-crack-addict-3-12.mpeg
   C:\DOCUME~1\Mehdi\Mes documents\holcim\stats\investRH\lettre motivation\Lettre mot avi\kissmycrack_com_2_1.avi



   1 - "C:\ToolBar SD\TB_1.txt" - 28/10/2008|14:07 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 28/10/2008|14:56 - Option : [2]

   -----------\  Fin du rapport a 14:56:38,28

Merci Beaucoup

Pierre222 · Answer

Bonjour


Bon donc Le scan MBAM a duré presque 5h voilà le rapport et merc i Beaucoup

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1332
Windows 5.1.2600 Service Pack 2

28/10/2008 20:17:58
mbam-log-2008-10-28 (20-17-58).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 94156
Temps écoulé: 5 hour(s), 0 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

sherred · Answer

bon tous ca pour rien

mais comme ca on est sure 

comment ce comporte ton pc ?

pour tous les programmes qui pose un probleme tu n'a plus qu'a les desinstaller completement
et reinstaller a nouveau

Pierre222 · Answer

Re 

C'est le problème j'arrive pas à les désinstaller et pourtant j'ai utilisé ajout et supression , msconfign  ?////§§§§§

et rien à faire 

S.V.P.  si vous avez une autre methode    je vous remercie

Pierre222 · Answer

Re

Alors SVP Est ce que vous quelque chose pour la désinstallation et merci

Pierre222 · Answer

Re 

Merci beaucoup

Pierre222 · Answer

Re 

Désolé mais les programmes comme windows live messenger ne figure pas dans la liste des prommes listés sur le désinstallateur 


Que dois je faire  et merci

sherred · Answer

tu n'a pas fait ceci
http://www.commentcamarche.net/forum/affich 9093882 pb les programme sur le bureau ne trouvent pl#12

Pierre222 · Answer

Bonjour

bon donc j'ai passé le SDFIX et voilà le rapport  et Merci



[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 00:43:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVgl]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=""C:\Program Files\Fichiers communs\System\Olx.exe""
"DisplayName"="WinVgl"
"ObjectName"=".\Zcku"
"Description"="Symantec WMI Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinVgl]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=""C:\Program Files\Fichiers communs\System\Olx.exe""
"DisplayName"="WinVgl"
"ObjectName"=".\Zcku"
"Description"="Symantec WMI Service"

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"appinit_dlls"=""

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:


[b]Finished![/b]

sherred · Answer

tu peu me refaire un hijak

et me dire exactement quel sont les programmes qui ne fonctionne pas
apparament msn ?
ton antivirus fonctionne ?

Pierre222 · Answer

Re 

Voilà le rapport 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:53, on 30/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32	cpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\internet explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://account.adobe.com/products
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [E06FXLRD_31539578] "E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\syslnreg.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

Pierre222 · Answer

Re 

Voilà le rapport 


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:53, on 30/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32	cpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\internet explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://account.adobe.com/products
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [E06FXLRD_31539578] "E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\syslnreg.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

sherred · Answer

bon il y a un probleme
je vais essaye par le moins risquer
telecharge spybot
https://www.01net.com/outils/telecharger/windows/Securite/anti-spyware/fiches/tele26157.html
un passe un scan avec

Pierre222 · Answer

Bonjour 


Bon j'ai problèlme pour envoyer le rapport Merci

Pierre222 · Answer

Comme vous voyez le rapport mentionne que j'ai 21 contaminatios et je les ai corigé
Merci

Pierre222 · Answer

Re 
je ne comprends pas est ce que c'est le rapport qui est trés long c'est pour cela je n'arrive pas à vous l'envoyer


Merci

Pierre222 · Answer

Re


est ce que  vous êtes là ?

Pierre222 · Answer

--- Search result list ---
Hint of the Day: Click the bar at the right of this to see more information! ()
  

Microsoft.Windows.Security.InternetExplorer: [SBI $A3433CBF] Réglages (Modification du registre, nothing done)
  HKEY_USERS\S-1-5-21-484763869-113007714-839522115-1006\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe

Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Réglages (Modification du registre, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride

Microsoft.WindowsSecurityCenter.FirewallOverride: [SBI $0C94D702] Réglages (Modification du registre, nothing done)
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride

Altnet: [SBI $71A50055] Class ID (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\CLSID\{1D3BCE37-7834-4579-8169-E67681420A98}

Altnet: [SBI $FA09DDB6] Interface (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\Interface\{258A3625-183B-4477-AEE2-EA54DF6D878D}

Altnet: [SBI $EF3D907D] Type library (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\TypeLib\{676F6D1D-C559-42A9-860B-27C1477B7179}

Altnet: [SBI $43C13CD3] Class ID (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\CLSID\{DEF37997-D9C9-4A4B-BF3C-88F99EACEEC2}

Altnet: [SBI $749CD120] Interface (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\Interface\{9D4548CE-92FD-4C6C-AE7F-3DBE3BC763D8}

Altnet: [SBI $2B06AF8D] Type library (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\TypeLib\{BFF4F684-677E-44F4-8C74-1D575C950E10}

Altnet: [SBI $CF7AC00C] Class ID (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\CLSID\{B7156514-A76C-4545-9D5B-A4E1D02C7AEC}

Altnet: [SBI $3C0179F9] Class ID (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\Interface\{582AB125-1403-42FB-9EFB-198690BA1496}

Altnet: [SBI $4CCFA286] Type library (Clé du registre, nothing done)
  HKEY_CLASSES_ROOT\TypeLib\{EDD3B3E9-3FFD-4836-A6DE-D4A9C473A971}

Klez: [SBI $ABF83DA5]  Exécutable (Fichier, nothing done)
  C:\WINDOWS\system32\winknote.exe

Tradedoubler: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

DoubleClick: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

Right Media: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

BlueStreak: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

AdRevolver: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

AdRevolver: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

WebTrends live: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  

AdRevolver: Cookie traceur (Internet Explorer: Mehdi) (Cookie, nothing done)
  


--- Spybot - Search & Destroy version: 1.6.0  (build: 20080707) ---

2008-07-07 blindman.exe (1.0.0.8)
2008-07-07 SDFiles.exe (1.6.0.4)
2008-07-07 SDMain.exe (1.0.0.6)
2008-07-07 SDShred.exe (1.0.2.3)
2008-07-07 SDUpdate.exe (1.6.0.8)
2008-07-07 SDWinSec.exe (1.0.0.12)
2008-07-07 SpybotSD.exe (1.6.0.30)
2008-09-16 TeaTimer.exe (1.6.3.25)
2008-10-31 unins000.exe (51.49.0.0)
2008-07-07 Update.exe (1.6.0.7)
2008-07-07 advcheck.dll (1.6.1.12)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2008-09-15 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2008-07-07 Tools.dll (2.1.5.7)
2008-09-02 Includes\Adware.sbi (*)
2008-10-27 Includes\AdwareC.sbi (*)
2008-06-03 Includes\Cookies.sbi (*)
2008-09-02 Includes\Dialer.sbi (*)
2008-09-09 Includes\DialerC.sbi (*)
2008-07-23 Includes\HeavyDuty.sbi (*)
2008-09-02 Includes\Hijackers.sbi (*)
2008-10-28 Includes\HijackersC.sbi (*)
2008-09-09 Includes\Keyloggers.sbi (*)
2008-10-28 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-10-28 Includes\Malware.sbi (*)
2008-10-28 Includes\MalwareC.sbi (*)
2008-09-02 Includes\PUPS.sbi (*)
2008-10-28 Includes\PUPSC.sbi (*)
2007-11-07 Includes\Revision.sbi (*)
2008-06-18 Includes\Security.sbi (*)
2008-10-23 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2008-10-28 Includes\Spyware.sbi (*)
2008-10-29 Includes\SpywareC.sbi (*)
2008-06-03 Includes\Tracks.uti
2008-10-29 Includes\Trojans.sbi (*)
2008-10-29 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Windows XP (Build: 2600) Service Pack 2 (5.1.2600)
 / .NETFramework / 1.1: Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
 / MSXML4SP2: FIX: ASP stops responding when calling Response.Redirect to another server using msxml4 sp2
 / MSXML4SP2: Security update for MSXML4 SP2 (KB936181)
 / Windows / SP1: Microsoft Internationalized Domain Names Mitigation APIs
 / Windows / SP1: Microsoft National Language Support Downlevel APIs
 / Windows Media Player 6.4: Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)
 / Windows Media Player 9: Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734)
 / Windows XP: Mise à jour de sécurité pour Windows XP (KB923689)
 / Windows XP: Mise à jour de sécurité pour Windows XP (KB941569)
 / Windows XP / SP3: Correctif Windows XP - KB885884
 / Windows XP / SP3: Windows Installer 3.1 (KB893803)
 / Windows XP / SP3: Mise à jour pour Windows XP (KB904942)
 / Windows XP / SP3: Correctif pour Windows XP (KB914440)
 / Windows XP / SP3: Hotfix for Windows XP (KB915865)
 / Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB944338-v2)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB938464)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB946648)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB950762)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB950974)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951066)
 / Windows XP / SP4: Mise à jour pour Windows XP (KB951072-v2)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951376-v2)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB951698)
 / Windows XP / SP4: Correctif pour Windows XP (KB952287)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB952954)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB954211)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB956390)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB956391)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB956803)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB956841)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB957095)
 / Windows XP / SP4: Mise à jour de sécurité pour Windows XP (KB958644)


--- Startup entries list ---
Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
   file: C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
   size: 34672
    MD5: 69B16C7B7746BA5C642FC05B3561FC73

Located: HK_LM:Run, avgnt
command: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
   file: C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
   size: 266497
    MD5: 6E812818306D460D62B4ABEA9FDC6679

Located: HK_LM:Run, High Definition Audio Property Page Shortcut
command: HDAShCut.exe
   file: C:\WINDOWS\system32\HDAShCut.exe
   size: 61952
    MD5: 21C8A24455FDAFC9D6D8BCD38D62B10B

Located: HK_LM:Run, HPDJ Taskbar Utility
command: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
   file: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
   size: 196608
    MD5: 7C6B5065E7326E3C91A62800DF3A31FA

Located: HK_LM:Run, NeroFilterCheck
command: C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
   file: C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
   size: 161328
    MD5: 9306F50AB4F21E4782E41EA8C43F5350

Located: HK_LM:Run, RemoteControl
command: "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
   file: C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
   size: 32768
    MD5: 1EEA64D8599B5B7BD8721498E4019CF0

Located: HK_LM:Run, SoundMAXPnP
command: C:\Program Files\Analog Devices\Core\smax4pnp.exe
   file: C:\Program Files\Analog Devices\Core\smax4pnp.exe
   size: 925696
    MD5: 115332A83AC2726FA974D30DB4BFD8DE

Located: HK_LM:Run, SpeedTouch USB Diagnostics
command: "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
   file: C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
   size: 866816
    MD5: D40191AA225638AB20E59524CDD74030

Located: HK_LM:Run, SunJavaUpdateSched
command: C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
   file: C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
   size: 36975
    MD5: BD902D0D7ED7C2D5FC327567CE96B97C

Located: HK_LM:Run, SweetIM
command: C:\Program Files\SweetIM\Messenger\SweetIM.exe
   file: C:\Program Files\SweetIM\Messenger\SweetIM.exe
   size: 111928
    MD5: 180643BEEC13974246010344AF6A4326

Located: HK_LM:Run, VTTimer
command: VTTimer.exe
   file: C:\WINDOWS\system32\VTTimer.exe
   size: 53248
    MD5: 09F1A97848BFAB3F36EB216681465B85

Located: HK_LM:Run, VTTrayp
command: VTtrayp.exe
   file: C:\WINDOWS\system32\VTtrayp.exe
   size: 147456
    MD5: A6B6031FA13BCAF77EA11B3B50440A5C

Located: HK_LM:Run, WinampAgent
command: "C:\Program Files\Winamp\winampa.exe"
   file: C:\Program Files\Winamp\winampa.exe
   size: 36352
    MD5: E7DEADB409CD8A4552C91ABF624F138F

Located: HK_CU:RunOnce, Config
  where: .DEFAULT...
command: %systemroot%\system32un.cmd
   file: C:\WINDOWS\system32un.cmd
   size: 341
    MD5: 0BBDE38DAA7413555B415EAF7FEBDC2F

Located: HK_CU:RunOnce, nlsf
  where: .DEFAULT...
command: cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll"
   file: C:\WINDOWS\system32\cmd.exe
   size: 400896
    MD5: F44BB9A608C0577776022E2E9132325D

Located: HK_CU:RunOnce, tscuninstall
  where: .DEFAULT...
command: %systemroot%\system32	scupgrd.exe
   file: C:\WINDOWS\system32	scupgrd.exe
   size: 44544
    MD5: D2D52012C5A3CD41FEC0F090A8E47EE7

Located: HK_CU:Run, ctfmon.exe
  where: PE_C_ADMIN...
command: C:\WINDOWS\system32\ctfmon.exe
   file: C:\WINDOWS\system32\ctfmon.exe
   size: 15360
    MD5: 64E41E8FEE655B03E3F19DED21BA5118

Located: HK_CU:Run, msnmsgr
  where: PE_C_ADMIN...
command: "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
   file: C:\Program Files\Windows Live\Messenger\msnmsgr.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, NeroHomeFirstStart
  where: PE_C_ADMIN...
command: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
   file: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
   size: 16432
    MD5: E06E48051A6E096EB2EC50D4092240B0

Located: HK_CU:RunOnce, NeroHomeFirstStart
  where: PE_C_ADMINISTRATEUR...
command: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
   file: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
   size: 16432
    MD5: E06E48051A6E096EB2EC50D4092240B0

Located: HK_CU:Run, LightScribe Control Panel
  where: PE_C_USER...
command: C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
   file: C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
   size: 484904
    MD5: 9B6414517444980F2ECAD8FA5F66E162

Located: HK_CU:Run, ctfmon.exe
  where: PE_C_YANIS ET ELIAS...
command: C:\WINDOWS\system32\ctfmon.exe
   file: C:\WINDOWS\system32\ctfmon.exe
   size: 15360
    MD5: 64E41E8FEE655B03E3F19DED21BA5118

Located: HK_CU:Run, E06FXLRD_2451468
  where: PE_C_YANIS ET ELIAS...
command: "E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m
   file: E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE
   size: 301776
    MD5: 7DE00EC41F65B590753F0D15EC95B3F6

Located: HK_CU:Run, msnmsgr
  where: PE_C_YANIS ET ELIAS...
command: "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
   file: C:\Program Files\Windows Live\Messenger\msnmsgr.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, NeroHomeFirstStart
  where: PE_C_YANIS ET ELIAS...
command: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
   file: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe
   size: 16432
    MD5: E06E48051A6E096EB2EC50D4092240B0

Pierre222 · Answer

Located: HK_CU:RunOnce, Config where: PE_C_ZCKU... command: %systemroot%\system32 un.cmd file: C:\WINDOWS\system32 un.cmd size: 341 MD5: 0BBDE38DAA7413555B415EAF7FEBDC2F Located: HK_CU:RunOnce, NeroHomeFirstStart where: PE_C_ZCKU... command: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe file: C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe size: 16432 MD5: E06E48051A6E096EB2EC50D4092240B0 Located: HK_CU:RunOnce, nlsf where: PE_C_ZCKU... command: cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" file: C:\WINDOWS\system32\cmd.exe size: 400896 MD5: F44BB9A608C0577776022E2E9132325D Located: HK_CU:RunOnce, tscuninstall where: PE_C_ZCKU... command: %systemroot%\system32 scupgrd.exe file: C:\WINDOWS\system32 scupgrd.exe size: 44544 MD5: D2D52012C5A3CD41FEC0F090A8E47EE7 Located: HK_CU:RunOnce, Config where: S-1-5-19... command: %systemroot%\system32 un.cmd file: C:\WINDOWS\system32 un.cmd size: 341 MD5: 0BBDE38DAA7413555B415EAF7FEBDC2F Located: HK_CU:RunOnce, nlsf where: S-1-5-19... command: cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" file: C:\WINDOWS\system32\cmd.exe size: 400896 MD5: F44BB9A608C0577776022E2E9132325D Located: HK_CU:RunOnce, tscuninstall where: S-1-5-19... command: %systemroot%\system32 scupgrd.exe file: C:\WINDOWS\system32 scupgrd.exe size: 44544 MD5: D2D52012C5A3CD41FEC0F090A8E47EE7 Located: HK_CU:RunOnce, Config where: S-1-5-20... command: %systemroot%\system32 un.cmd file: C:\WINDOWS\system32 un.cmd size: 341 MD5: 0BBDE38DAA7413555B415EAF7FEBDC2F Located: HK_CU:RunOnce, nlsf where: S-1-5-20... command: cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" file: C:\WINDOWS\system32\cmd.exe size: 400896 MD5: F44BB9A608C0577776022E2E9132325D Located: HK_CU:RunOnce, tscuninstall where: S-1-5-20... command: %systemroot%\system32 scupgrd.exe file: C:\WINDOWS\system32 scupgrd.exe size: 44544 MD5: D2D52012C5A3CD41FEC0F090A8E47EE7 Located: HK_CU:Run, BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} where: S-1-5-21-484763869-113007714-839522115-1006... command: "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" file: C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe size: 149040 MD5: A3C330F2731F52BE593FD7DB3617C50E Located: HK_CU:Run, ctfmon.exe where: S-1-5-21-484763869-113007714-839522115-1006... command: C:\WINDOWS\system32\ctfmon.exe file: C:\WINDOWS\system32\ctfmon.exe size: 15360 MD5: 64E41E8FEE655B03E3F19DED21BA5118 Located: HK_CU:Run, E06FXLRD_31539578 where: S-1-5-21-484763869-113007714-839522115-1006... command: "E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE" -m file: E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE size: 301776 MD5: 7DE00EC41F65B590753F0D15EC95B3F6 Located: HK_CU:Run, LightScribe Control Panel where: S-1-5-21-484763869-113007714-839522115-1006... command: C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden file: C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe size: 484904 MD5: 9B6414517444980F2ECAD8FA5F66E162 Located: HK_CU:Run, MSMSGS where: S-1-5-21-484763869-113007714-839522115-1006... command: "C:\Program Files\Messenger\msmsgs.exe" /background file: C:\Program Files\Messenger\msmsgs.exe size: 1667584 MD5: 4E7D8BF30DCC0BDA2A250769169C878D Located: HK_CU:Run, Orb where: S-1-5-21-484763869-113007714-839522115-1006... command: "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background file: C:\Program Files\Winamp Remote\bin\OrbTray.exe size: 507904 MD5: 5A4CD8C1747B0C5E66F1A7B6A93453EB Located: HK_CU:Run, SpybotSD TeaTimer where: S-1-5-21-484763869-113007714-839522115-1006... command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe size: 1833296 MD5: 63B3FF83B87AFCEBA89CED54695DA0F6 Located: HK_CU:Run, swg where: S-1-5-21-484763869-113007714-839522115-1006... command: C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe file: C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe size: 171448 MD5: 0FA44EA8B03ABA3E1D240B5A333D8E6A Located: HK_CU:RunOnce, Config where: S-1-5-18... command: %systemroot%\system32 un.cmd file: C:\WINDOWS\system32 un.cmd size: 341 MD5: 0BBDE38DAA7413555B415EAF7FEBDC2F Located: HK_CU:RunOnce, nlsf where: S-1-5-18... command: cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" file: C:\WINDOWS\system32\cmd.exe size: 400896 MD5: F44BB9A608C0577776022E2E9132325D Located: HK_CU:RunOnce, tscuninstall where: S-1-5-18... command: %systemroot%\system32 scupgrd.exe file: C:\WINDOWS\system32 scupgrd.exe size: 44544 MD5: D2D52012C5A3CD41FEC0F090A8E47EE7 Located: Démarrage (tous utilisateurs), Adobe Gamma Loader.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe file: C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: Démarrage (tous utilisateurs), ExifLauncher2.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\FinePixViewer\QuickDCF2.exe file: C:\Program Files\FinePixViewer\QuickDCF2.exe size: 303104 MD5: EE7B9D446C9C49228008CB39204C5CAA Located: Démarrage (tous utilisateurs), InterVideo WinCinema Manager.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe file: C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe size: 114688 MD5: 04D2C335677E7B1BE55162C5445E155F Located: Démarrage (tous utilisateurs), Microsoft Office.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\Microsoft Office\Office10\OSA.EXE file: C:\Program Files\Microsoft Office\Office10\OSA.EXE size: 83360 MD5: 5BC65464354A9FD3BEAA28E18839734A Located: Démarrage (tous utilisateurs), PalTalk.lnk where: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage... command: C:\Program Files\Paltalk Messenger\paltalk.exe file: C:\Program Files\Paltalk Messenger\paltalk.exe size: 11713536 MD5: 4E40437878D69182103F582E195ED9F1 Located: WinLogon, crypt32chain command: crypt32.dll file: crypt32.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, cryptnet command: cryptnet.dll file: cryptnet.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, cscdll command: cscdll.dll file: cscdll.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, NavLogon command: C:\WINDOWS\system32\NavLogon.dll file: C:\WINDOWS\system32\NavLogon.dll size: 45056 MD5: C8D5EBECF889534FE52537F18CFEB1C0 Located: WinLogon, ScCertProp command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, Schedule command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, sclgntfy command: sclgntfy.dll file: sclgntfy.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, SensLogn command: WlNotify.dll file: WlNotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, termsrv command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, WgaLogon command: WgaLogon.dll file: WgaLogon.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! Located: WinLogon, wlballoon command: wlnotify.dll file: wlnotify.dll size: 0 MD5: D41D8CD98F00B204E9800998ECF8427E Warning: if the file is actually larger than 0 bytes, the checksum could not be properly calculated! --- Browser helper object list --- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} (AcroIEHelperStub) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: AcroIEHelperStub CLSID name: Adobe PDF Link Helper Path: C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\ Long name: AcroIEHelperShim.dll Short name: ACROIE~2.DLL Date (created): 11/06/2008 22:33:16 Date (last access): 29/10/2008 11:36:50 Date (last write): 11/06/2008 22:33:16 Filesize: 75128 Attributes: archive MD5: E96C752BBA0E22330A43258FC800200E CRC32: E5D72083 Version: 9.0.0.332 {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} (Winamp Toolbar Loader) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: Winamp Toolbar Loader CLSID name: Winamp Toolbar Loader Path: C:\Program Files\Winamp Toolbar\ Long name: winamptb.dll Short name: Date (created): 16/07/2008 20:51:34 Date (last access): 26/10/2008 19:58:08 Date (last write): 16/07/2008 20:51:34 Filesize: 1266992 Attributes: archive MD5: 945FEFD0146F5870765F4FF8477BBD3D CRC32: E85ADBBB Version: 5.1.28.2 {955BE0B8-BC85-4CAF-856E-8E0D8B610560} (BHO pour Compagnon Web Encarta) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: BHO pour Compagnon Web Encarta CLSID name: BHO pour Compagnon Web Encarta Path: C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ Long name: ENCWCBAR.DLL Short name: Date (created): 04/06/2005 16:04:06 Date (last access): 26/10/2008 18:39:02 Date (last write): 04/06/2005 16:04:06 Filesize: 228048 Attributes: archive MD5: 32DFA1F7FBFF2092374DAB6AEF0BC0CB CRC32: 30C2C111 Version: 15.0.3400.603 {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Google Toolbar Helper description: Google toolbar classification: Open for discussion known filename: googletoolbar.dll
googletoolbar*.dll
(* = number)
googletoolbar_en_*.**-big.dll
Googletoolbar_en_*.*.**-deleon.dll info link: http://www.google.com/intl/fr/toolbar/ie/index.html info source: TonyKlein Path: c:\program files\google\ Long name: GoogleToolbar1.dll Short name: GOOGLE~1.DLL Date (created): 27/10/2008 04:48:36 Date (last access): 27/10/2008 04:48:36 Date (last write): 27/10/2008 04:48:36 Filesize: 2436160 Attributes: readonly archive MD5: 6D44E0C3B43D27484FBB355E470C4188 CRC32: 2DE875CD Version: 4.0.1601.4978 {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: CLSID name: Windows Live Toolbar Helper Path: C:\Program Files\Windows Live Toolbar\ Long name: msntb.dll {EEE6C35C-6118-11DC-9C72-001320C79847} (SWEETIE) location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ BHO name: SWEETIE CLSID name: SweetIM Toolbar Helper Path: C:\Program Files\SweetIM\Toolbars\Internet Explorer\ Long name: mgToolbarIE.dll Short name: MGTOOL~1.DLL Date (created): 08/10/2008 12:22:06 Date (last access): 31/10/2008 02:41:38 Date (last write): 08/10/2008 12:22:06 Filesize: 1172792 Attributes: archive MD5: 7827ECF63377923D1509E20A272AC57E CRC32: DB680AAC Version: 3.3.0.1 --- ActiveX list --- --- Process list --- PID: 0 ( 0) [System] PID: 660 ( 4) \SystemRoot\System32\smss.exe size: 50688 PID: 732 ( 660) \??\C:\WINDOWS\system32\winlogon.exe size: 506368 PID: 776 ( 732) C:\WINDOWS\system32\services.exe size: 108544 MD5: 63DCDE1A0D86EEB8924D6738FF616EAD PID: 788 ( 732) C:\WINDOWS\system32\lsass.exe size: 13312 MD5: 259AF82A0932EEA4F316F92DB94707B6 PID: 964 ( 776) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 2979B03D5382A602623C0535B16AB9C0 PID: 1132 ( 776) C:\WINDOWS\System32\svchost.exe size: 14336 MD5: 2979B03D5382A602623C0535B16AB9C0 PID: 1524 ( 776) C:\WINDOWS\system32\spoolsv.exe size: 57856 MD5: DF9FC62AD51CB082B0AE371919A232CB PID: 1564 ( 776) C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe size: 68865 MD5: D6C8942BEA3698A2E7559BD423BFA5D7 PID: 1792 ( 776) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe size: 151297 MD5: 335A142923FE7F97E8C8388ACD067568 PID: 1844 ( 776) C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe size: 75304 MD5: 31D8B705DCD5F2366186E731F87C7A71 PID: 1888 ( 776) C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe size: 270336 MD5: B06C4C1A5AB7867363922F771AC6AF05 PID: 1988 ( 776) C:\WINDOWS\system32 cpsvcs.exe size: 19456 MD5: 50F22575C0FB5D85A9D41EF963610C32 PID: 2032 ( 776) C:\WINDOWS\system32\svchost.exe size: 14336 MD5: 2979B03D5382A602623C0535B16AB9C0 PID: 952 (1808) C:\WINDOWS\Explorer.EXE size: 1036288 MD5: 2A7BD330924252A2FD80344FC949BB72 PID: 472 ( 952) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe size: 32768 MD5: 1EEA64D8599B5B7BD8721498E4019CF0 PID: 368 ( 952) C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe size: 866816 MD5: D40191AA225638AB20E59524CDD74030 PID: 1852 ( 952) C:\Program Files\Winamp\winampa.exe size: 36352 MD5: E7DEADB409CD8A4552C91ABF624F138F PID: 548 ( 952) C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe size: 196608 MD5: 7C6B5065E7326E3C91A62800DF3A31FA PID: 576 ( 952) C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe size: 36975 MD5: BD902D0D7ED7C2D5FC327567CE96B97C PID: 572 ( 952) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe size: 266497 MD5: 6E812818306D460D62B4ABEA9FDC6679 PID: 1624 ( 952) C:\WINDOWS\system32\VTTimer.exe size: 53248 MD5: 09F1A97848BFAB3F36EB216681465B85 PID: 1640 ( 952) C:\WINDOWS\system32\VTtrayp.exe size: 147456 MD5: A6B6031FA13BCAF77EA11B3B50440A5C PID: 856 ( 952) C:\Program Files\SweetIM\Messenger\SweetIM.exe size: 111928 MD5: 180643BEEC13974246010344AF6A4326 PID: 836 ( 952) C:\WINDOWS\system32\ctfmon.exe size: 15360 MD5: 64E41E8FEE655B03E3F19DED21BA5118 PID: 636 ( 952) E:\Program Files\Microsoft Encarta\Collection Microsoft Encarta 2006 DVD\EDICT.EXE size: 301776 MD5: 7DE00EC41F65B590753F0D15EC95B3F6 PID: 1152 ( 952) C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe size: 484904 MD5: 9B6414517444980F2ECAD8FA5F66E162 PID: 2028 ( 952) C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe size: 149040 MD5: A3C330F2731F52BE593FD7DB3617C50E PID: 1264 ( 952) C:\Program Files\Winamp Remote\bin\OrbTray.exe size: 507904 MD5: 5A4CD8C1747B0C5E66F1A7B6A93453EB PID: 1972 ( 952) C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe size: 171448 MD5: 0FA44EA8B03ABA3E1D240B5A333D8E6A PID: 336 ( 952) C:\Program Files\Messenger\msmsgs.exe size: 1667584 MD5: 4E7D8BF30DCC0BDA2A250769169C878D PID: 2064 ( 964) C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe size: 910896 MD5: BA2C62D33C18E2663D3873129996D419 PID: 2192 ( 952) C:\Program Files\FinePixViewer\QuickDCF2.exe size: 303104 MD5: EE7B9D446C9C49228008CB39204C5CAA PID: 2244 ( 952) C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe size: 114688 MD5: 04D2C335677E7B1BE55162C5445E155F PID: 2316 ( 952) C:\Program Files\Paltalk Messenger\paltalk.exe size: 11713536 MD5: 4E40437878D69182103F582E195ED9F1 PID: 2552 ( 776) C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe size: 267824 MD5: DBB5F7B1A4F109CD7A1ABD3AC7A10D39 PID: 3060 ( 776) C:\Program Files\Windows Live\installer\WLSetupSvc.exe size: 266240 MD5: 94A85E956A065E23E0010A6A7826243B PID: 2088 ( 952) C:\WINDOWS\system32\mmc.exe size: 816128 MD5: 51ACF30AFCE6A1511D12465EADDDB4C1 PID: 2172 ( 964) C:\WINDOWS\system32\DfrgNtfs.exe size: 104960 MD5: 00401EE5B19FDB687AE0ED9D80438C5D PID: 1696 ( 952) C:\Program Files\Internet Explorer\iexplore.exe size: 93184 MD5: 385D1644E676C96EB07848ADA63E37FA PID: 2724 ( 964) c:\program files\winamp toolbar\WinampTbServer.exe size: 140592 MD5: CDA223339C353F02DDD5F8FA76F49FCB PID: 2896 (2904) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe size: 4891472 MD5: 3B1B5D09D3C9C4CD39D4DB06ED7A0855 PID: 4 ( 0) System PID: 708 ( 660) csrss.exe size: 6144 PID: 1032 ( 776) svchost.exe size: 14336 PID: 1316 ( 776) svchost.exe size: 14336 PID: 1360 ( 776) svchost.exe size: 14336 PID: 112 ( 776) alg.exe size: 44544 --- Browser start & search pages list --- Spybot - Search & Destroy browser pages report, 31/10/2008 11:45:24 HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page C:\WINDOWS\system32\blank.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page https://www.google.com/?gws_rd=ssl HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar http://www.google.com/toolbar/ie8/sidebar.html HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page https://www.msn.com/fr-fr/?ocid=iehp HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@ http://home.microsoft.com/access/autosearch.asp?p=%s HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page %SystemRoot%\system32\blank.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page https://home.sweetim.com/ HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL http://www.google.com/toolbar/ie8/sidebar.html HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant http://www.google.com/toolbar/ie8/sidebar.html HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm --- Winsock Layered Service Provider list --- Namespace Provider 0: GUID: {D3C911A4-3F89-4760-9AE5-02FA7075FC34} Filename: C:\WINDOWS\system32\syslnreg.dll Namespace Provider 1: Fournisseur d'espace de noms du nuage PNRP GUID: {03FE89CE-766D-4976-B9C1-BB9BC42C7B4D} Filename: C:\WINDOWS\system32\pnrpnsp.dll Namespace Provider 2: Fournisseur d'espace de noms du nom PNRP GUID: {03FE89CD-766D-4976-B9C1-BB9BC42C7B4D} Filename: C:\WINDOWS\system32\pnrpnsp.dll --- Uninstall list --- (%BETA1_RELEASE_NAME%) (%BETA2_RELEASE_NAME%) (%MSI30a_NAME%) (%MSI30RTM_NAME%) (%MSI30v2RTM_Name%) (%MSI31RTM%) (%MSI31_Beta%) (%MSI31_RC1%) (%RC1_RELEASE_NAME%) (%RC2_RELEASE_NAME%) (AddressBook) Adobe Flash Player ActiveX 9.0.115.0 (Adobe Flash Player ActiveX) uninstall cmd: C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe publisher: Adobe Systems Incorporated help link: https://helpx.adobe.com/flash-player.html Adobe Photoshop 7.0 7.0 (Adobe Photoshop 7.0) version (major): 7 install location: C:\Program Files\Adobe\Photoshop 7.0 install source: D:\Photoshop\ uninstall cmd: C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll" publisher: Adobe Systems, Inc. Avira AntiVir Personal - Free Antivirus (AntiVir PersonalEdition Classic) uninstall cmd: C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE publisher: Avira GmbH help link: http://www.avira.com/classic-support (Branding) (Connection Manager) (DirectAnimation) (DirectDrawEx) Dofus 1.24.0 1.24.0 (Dofus 1.24.0) uninstall cmd: C:\Program Files\Dofus\uninstall.exe publisher: Ankama Games (DXM_Runtime) FindyKill (FindyKill) uninstall cmd: C:\Program Files\FindyKill\Uninstal.exe Firebird SQL Server - MAGIX Edition (F) 2.0.0.1 (Firebird SQL Server F) install date: 20070414 install location: C:\MAGIX\Common\Database uninstall cmd: C:\MAGIX\Common\Database\uninstall.exe publisher: MAGIX AG (Fontcore) HijackThis 2.0.2 2.0.2 (HijackThis) uninstall cmd: "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall publisher: TrendMicro hp deskjet 920c series (Supprimer uniquement) (hp deskjet 920c series) uninstall cmd: C:\Program Files\hp deskjet 920c series\hpfiui.exe -c -vdivid=HPF -vpnum=95 -vinstport=LPT1: -vproduct=920c -huninstall hp deskjet 920c series (hp deskjet 920c series_Driver) uninstall cmd: rundll32 hpzcon04.dll,VendorJettison hp deskjet 920c series (ICW) Microsoft Internationalized Domain Names Mitigation APIs (IDNMitigationAPIs) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" publisher: Microsoft Corporation (IE40) (IE4Data) (IE5BAKEX) (IEData) (InstallShield Uninstall Information) VIA Platform Device Manager 1.13 (InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) version: 17629184 version (major): 1 version (minor): 13 estimated size: 2648 install date: 20060603 install source: D:\Drivers\Chipset\VIA4in1\ uninstall cmd: C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} publisher: VIA Technologies, Inc. comments: VIA Hyperion Pro Setup Program contact: http://forums.viaarena.com/ help link: http://www.viaarena.com/ help telephone: NULL readme: NULL (KB884016) Correctif Windows XP - KB885884 20040924.025457 (KB885884) uninstall cmd: C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/885884 Windows Genuine Advantage Validation Tool (KB892130) (KB892130) install date: 20081027 publisher: Microsoft Corporation help link: https://www.microsoft.com/en-us/howtotell/default.aspx (KB893803) Windows Installer 3.1 (KB893803) 3.1 (KB893803v2) uninstall cmd: "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/893803/windows-installer-3-1-v2-3-1-4000-2435-is-available Mise à jour pour Windows XP (KB904942) 2 (KB904942) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/904942/authentication-fails-when-you-use-outlook-or-outlook-express-to-try-to Correctif pour Windows XP (KB914440) 12 (KB914440) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/914440 Hotfix for Windows XP (KB915865) 10 (KB915865) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/915865 Mise à jour de sécurité pour Windows XP (KB923689) (KB923689) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/923689 Mise à jour de sécurité pour Windows XP (KB938464) 1 (KB938464) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/938464/ms08-052-description-of-the-security-update-for-gdi-for-all-editions-o Mise à jour de sécurité pour Windows XP (KB941569) (KB941569) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/941569/ms07-068-vulnerability-in-windows-media-file-format-could-allow-remote Mise à jour de sécurité pour Windows XP (KB944338-v2) 2 (KB944338-v2) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/944338/ms08-022-vulnerability-in-the-vbscript-and-jscript-scripting-engines-c Mise à jour de sécurité pour Windows XP (KB946648) 1 (KB946648) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/946648 Mise à jour de sécurité pour Windows XP (KB950762) 1 (KB950762) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/950762/ms08-036-vulnerabilities-in-pragmatic-general-multicast-pgm-could-allo Mise à jour de sécurité pour Windows XP (KB950974) 1 (KB950974) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/950974/ms08-049-vulnerability-in-event-system-could-allow-remote-code-executi Mise à jour de sécurité pour Windows XP (KB951066) 1 (KB951066) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/951066 Mise à jour pour Windows XP (KB951072-v2) 2 (KB951072-v2) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/951072/ Mise à jour de sécurité pour Windows XP (KB951376-v2) 2 (KB951376-v2) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/951376/ms08-030-vulnerability-in-bluetooth-stack-could-allow-remote-code-exec Mise à jour de sécurité pour Windows XP (KB951698) 1 (KB951698) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/951698 Correctif pour Windows XP (KB952287) 1 (KB952287) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/952287 Mise à jour de sécurité pour Windows XP (KB952954) 1 (KB952954) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/952954/ms08-046-vulnerabilities-in-microsoft-windows-image-color-management-c Mise à jour de sécurité pour Windows XP (KB954211) 1 (KB954211) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/954211/ms08-061-vulnerabilities-in-windows-kernel-could-allow-elevation-of-pr Mise à jour de sécurité pour Windows XP (KB956390) 1 (KB956390) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/956390 Mise à jour de sécurité pour Windows XP (KB956391) 1 (KB956391) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/956391/ Mise à jour de sécurité pour Windows XP (KB956803) 1 (KB956803) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/956803/ms08-066-vulnerability-in-the-microsoft-ancillary-function-driver-coul Mise à jour de sécurité pour Windows XP (KB956841) 1 (KB956841) install date: 20081031 uninstall cmd: "C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe" publisher: Microsoft Corporation help link: https://support.microsoft.com/en-us/help/956841

Pierre222 · Answer

Service (registry key): Fips
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): FirebirdServerMAGIXInstance
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Firebird Server - MAGIX Instance
   Object name: LocalSystem
    Image path: C:\MAGIX\Common\Database\bin\fbserver.exe
    Image size: 1527900
     Image MD5: 167D24A045499EBEF438F231976158DF
   Control Set: CurrentControlSet
         Start: 3
          Type: 272
 Error Control: 1

Service (registry key): Flpydisk
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de lecteur de disquettes
    Image path: system32\DRIVERS\flpydisk.sys
    Image size: 20480
     Image MD5: 0DD1DE43115B93F4D85E889D7A86F548
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): FltMgr
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: FltMgr
   Description: Pilote du gestionnaire de filtre de système de fichiers
    Image path: system32\DRIVERS\fltMgr.sys
    Image size: 124800
     Image MD5: 157754F0DF355A9E0A6F54721914F9C6
   Control Set: CurrentControlSet
         Start: 0
          Type: 2
 Error Control: 1

Service (registry key): Fs_Rec
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 8
 Error Control: 0

Service (registry key): Ftdisk
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote du Gestionnaire de volume
    Image path: system32\DRIVERS\ftdisk.sys
    Image size: 126080
     Image MD5: A86859B77B908C18C2657F284AA29FE3
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): Gpc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Classificateur de paquets générique
   Description: Classificateur de paquets générique
    Image path: system32\DRIVERS\msgpc.sys
    Image size: 35072
     Image MD5: C0F1D4A21DE5A415DF8170616703DEBF
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): gusvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Google Updater Service
   Object name: LocalSystem
    Image path: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
    Image size: 138168
     Image MD5: 751C1D2CA2ABF4A9F5A6B8D7D45B907C
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 0
 Depends On services: RPCSS

Service (registry key): HdAudAddService
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Microsoft UAA Function Driver for High Definition Audio Service
    Image path: system32\drivers\HdAudio.sys
    Image size: 145920
     Image MD5: F58D2900C66A1E773E3375098E0E9337
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): HDAudBus
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Microsoft UAA Bus Driver for High Definition Audio
    Image path: system32\DRIVERS\HDAudBus.sys
    Image size: 138240
     Image MD5: CBC3DEF409549672B915FB9403D63F74
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): helpsvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Aide et support
   Description: Permet à l'application Aide et support de fonctionner sur cet ordinateur. Si ce service est arrêté, la fonctionnalité Aide et support ne sera pas disponible. S'il est désactivé, tous les services dépendant explicitement de ce service ne pourront pas démarrer.
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1
 Depends On services: RPCSS

Service (registry key): HidServ
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Accès du périphérique d'interface utilisateur
   Description: Permet l'accès entrant générique aux périphériques d'interface utilisateur, qui activent et maintiennent l'utilisation des boutons actifs prédéfinis sur le clavier, les contrôles à distance, et d'autres périphériques multimédia. Si ce service est arrêté, les boutons actifs contrôlés par ce service ne fonctionneront pas. Si ce service est désactivé, tout service en dépendant explicitement ne démarrera pas.
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 4
          Type: 32
 Error Control: 1
 Depends On services: RpcSs

Service (registry key): HidUsb
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de classe HID Microsoft
    Image path: system32\DRIVERS\hidusb.sys
    Image size: 9600
     Image MD5: 1DE6783B918F540149AA69943BDFEBA8
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): hpn
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): HTTP
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: HTTP
   Description: Ce service implémente le protocole HTTP (HyperText Transfer Protocol). Si ce service est désactivé, tous les services qui en dépendent de manière explicite échoueront au démarrage.
    Image path: System32\Drivers\HTTP.sys
    Image size: 263040
     Image MD5: C19B522A9AE0BBC3293397F3055E80A1
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): HTTPFilter
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: HTTP SSL
   Description: Ce service implémente le protocole sécurisé HTTPS (Secure HyperText Transfer Protocol) pour le service HTTP, en utilisant la couche SSL (Secure Socket Layer). Si ce service est désactivé, tous les services qui en dépendent de manière explicite échoueront au démarrage.
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k HTTPFilter
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: HTTP

Service (registry key): i2omgmt
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): i2omp
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): i8042prt
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote pour clavier i8042 et souris sur port PS/2
    Image path: system32\DRIVERS\i8042prt.sys
    Image size: 54400
     Image MD5: D1EFCBD693B5BA21314D06368C471070
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): ICSharing
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): IDriverT
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: InstallDriver Table Manager
   Description: Provides support for the Running Object Table for InstallShield Drivers
   Object name: LocalSystem
    Image path: "C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 0

Service (registry key): Imapi
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de filtre de gravure CD
    Image path: system32\DRIVERS\imapi.sys
    Image size: 41856
     Image MD5: F8AA320C6A0409C0380E5D8A99D76EC6
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): ImapiService
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Service COM de gravage de CD IMAPI
   Description: Gère le gravage des CD via l'interface série IMAPI (Image Mastering Applications Programming Interface). Si ce service est arrêté, cet ordinateur ne pourra plus enregistrer de CD. Si ce service est désactivé, les services qui en dépendent ne vont pas pouvoir démarrer.
   Object name: LocalSystem
    Image path: C:\WINDOWS\system32\imapi.exe
    Image size: 150016
     Image MD5: 17B7A4375868B8C38F2DFC98B3B420C6
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 1

Service (registry key): inetaccs
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): ini910u
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): Inport
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): IntelIde
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): intelppm
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de processeur Intel
    Image path: system32\DRIVERS\intelppm.sys
    Image size: 40320
     Image MD5: DD5AD1E79AC26D3F8D8828AD4627F160
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): Ip6Fw
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote du pare-feu Windows IPv6
   Description: Fournit un service de prévention d'intrusion pour un réseau domestique ou de petite entreprise.
    Image path: system32\DRIVERS\Ip6Fw.sys
    Image size: 29056
     Image MD5: 4448006B6BC60E6C027932CFC38D6855
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): IpFilterDriver
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de filtre de trafic IP
   Description: Pilote de filtre de trafic IP
    Image path: system32\DRIVERS\ipfltdrv.sys
    Image size: 32896
     Image MD5: 731F22BA402EE4B62748ADAF6363C182
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): IpInIp
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de tunnelage IP dans IP
   Description: Pilote de tunnelage IP dans IP
    Image path: system32\DRIVERS\ipinip.sys
    Image size: 20992
     Image MD5: E1EC7F5DA720B640CD8FB8424F1B14BB
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): IpNat
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Traducteur d'adresses réseau IP
   Description: Traducteur d'adresses réseau IP
    Image path: system32\DRIVERS\ipnat.sys
    Image size: 134912
     Image MD5: B5A8E215AC29D24D60B4D1250EF05ACE
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): Iprip
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Écouteur RIP
   Description: Écoute les mises à jour d'itinéraires envoyées par les routeurs qui utilisent le protocole d'information de routage version 1 (RIPv1).
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1
 Depends On services: RpcSS

Service (registry key): IPSec
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote IPSEC
   Description: Pilote IPSEC
    Image path: system32\DRIVERS\ipsec.sys
    Image size: 74752
     Image MD5: 64537AA5C003A6AFEEE1DF819062D0D1
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): IRENUM
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Service énumérateur IR
    Image path: system32\DRIVERS\irenum.sys
    Image size: 11264
     Image MD5: 50708DAA1B1CBB7D6AC1CF8F56A24410
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): ISAPISearch
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): isapnp
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de bus Plug-and-Play ISA/EISA
    Image path: system32\DRIVERS\isapnp.sys
    Image size: 36224
     Image MD5: 54632F1A7DE61DC3615D756F2A90FA72
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 3

Service (registry key): Kbdclass
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de la classe Clavier
    Image path: system32\DRIVERS\kbdclass.sys
    Image size: 25216
     Image MD5: E798705E8DC7FAB596EF6BFDF167E007
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): kmixer
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Mélangeur audio Wave de noyau Microsoft
    Image path: system32\drivers\kmixer.sys
    Image size: 171776
     Image MD5: D93CAD07C5683DB066B0B2D2D3790EAD
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): KSecDD
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): lanmanserver
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Serveur
   Description: Prend en charge le partage de fichiers, d'impression et des canaux nommés via le réseau pour cet ordinateur. Si ce service est arrêté, ces fonctions ne seront pas disponibles. Si ce service est désactivé, les services qui en dépendent ne pourront pas démarrer.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1

Service (registry key): lanmanworkstation
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Station de travail
   Description: Crée et maintient des connexions de réseau client à des serveurs distants. Si ce service est arrêté, ces connexions ne seront pas disponibles. Si ce service est désactivé, les services qui en dépendent ne pourront pas démarrer.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1

Service (registry key): lbrtfdc
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 0

Service (registry key): ldap
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): LicenseService
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): LightScribeService
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: LightScribeService Direct Disc Labeling Service
   Description: Used by the LightScribe software components to support 3rd party disc labeling applications using the LightScribe COM Application Programming Interface (LSCAPI). This service needs to run for LightScribe direct disc labeling to work.
   Object name: LocalSystem
    Image path: "C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe"
    Image size: 75304
     Image MD5: 31D8B705DCD5F2366186E731F87C7A71
   Control Set: CurrentControlSet
         Start: 2
          Type: 16
 Error Control: 0

Service (registry key): LmHosts
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Assistance TCP/IP NetBIOS
   Description: Permet la prise en charge pour NetBIOS sur un service TCP/IP (NetBT) et la résolution des noms NetBIOS.
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\system32\svchost.exe -k LocalService
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1
 Depends On services: NetBT,Afd

Service (registry key): MDM
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Machine Debug Manager
   Description: Manages local and remote debugging for Visual Studio debuggers
   Object name: LocalSystem
    Image path: "C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe"
    Image size: 270336
     Image MD5: B06C4C1A5AB7867363922F771AC6AF05
   Control Set: CurrentControlSet
         Start: 2
          Type: 272
 Error Control: 1
 Depends On services: RPCSS

Service (registry key): Messenger
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Affichage des messages
   Description: Envoie et reçoit les messages des services d'alertes entre les clients et les serveurs. Ce service n'est pas lié à Windows Messenger. Si ce service est arrêté, les messages d'alertes ne seront pas transmis. Si ce service est désactivé, les services qui en dépendent ne pourront pas démarrer.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 4
          Type: 32
 Error Control: 1
 Depends On services: LanmanWorkstation,NetBIOS,PlugPlay,RpcSS

Service (registry key): mnmdd
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 0

Service (registry key): mnmsrvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Partage de Bureau à distance NetMeeting
   Description: Permet à un utilisateur autorisé d'accéder à cet ordinateur à distance en utilisant NetMeeting sur un réseau intranet d'entreprise. Si ce service est arrêté, le partage du Bureau à distance ne sera pas disponible. Si ce service est désactivé, tous les services qui en dépendent explicitement ne pourront pas démarrer.
   Object name: LocalSystem
    Image path: C:\WINDOWS\system32\mnmsrvc.exe
    Image size: 32768
     Image MD5: 5B219F99CF6D5BE05A6C6E86C38CB7CE
   Control Set: CurrentControlSet
         Start: 3
          Type: 272
 Error Control: 1

Service (registry key): Modem
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): Mouclass
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de la classe Souris
    Image path: system32\DRIVERS\mouclass.sys
    Image size: 23680
     Image MD5: 7D4F19411BD941E1D432A99E24230386
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): mouhid
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote HID de souris
    Image path: system32\DRIVERS\mouhid.sys
    Image size: 12288
     Image MD5: 124D6846040C79B9C997F78EF4B2A4E5
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): MountMgr
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): mraid35x
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): MRxDAV
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Redirecteur client WebDav
   Description: Redirecteur client WebDav
    Image path: system32\DRIVERS\mrxdav.sys
    Image size: 181248
     Image MD5: 46EDCC8F2DB2F322C24F48785CB46366
   Control Set: CurrentControlSet
         Start: 3
          Type: 2
 Error Control: 1

Service (registry key): MRxSmb
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: MRXSMB
   Description: MRXSMB
    Image path: system32\DRIVERS\mrxsmb.sys
    Image size: 451456
     Image MD5: 1FD607FC67F7F7C633C3DA65BFC53D18
   Control Set: CurrentControlSet
         Start: 1
          Type: 2
 Error Control: 1

Service (registry key): MSDTC
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Distributed Transaction Coordinator
   Description: Coordonne les transactions qui comportent plusieurs gestionnaires de ressources, tels que des bases de données, des files d'attente de messages net des systèmes de fichiers. Si ce service est arrêté, ces transactions ne se produiront pas. S'il est désactivé, le démarrage de tout service qui en dépend explicitement échouera. 
   Object name: NT AUTHORITY\NetworkService
    Image path: C:\WINDOWS\system32\msdtc.exe
    Image size: 6144
     Image MD5: 11CA338B8765DB8E2D1B459F2CFAD147
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 1
 Depends On services: RPCSS,SamSS

Service (registry key): Msfs
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 2
 Error Control: 1

Service (registry key): MSIServer
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Windows Installer
   Description: Ajoute, modifie et supprime des applications fournies en tant que package Windows Installer (*.msi). Si ce service est désactivé, tous les services qui en dépendent explicitement ne vont pas démarrer.
   Object name: LocalSystem
    Image path: C:\WINDOWS\system32\msiexec.exe /V
    Image size: 78848
     Image MD5: F5F0146580E7023ADB963879840777F8
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: RpcSs

Pierre222 · Answer

Service (registry key): MSKSSRV
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Proxy de service de répartition Microsoft
    Image path: system32\drivers\MSKSSRV.sys
    Image size: 7552
     Image MD5: AE431A8DD3C1D0D0610CDBAC16057AD0
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): MSPCLOCK
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Proxy d'horloge de répartition Microsoft
    Image path: system32\drivers\MSPCLOCK.sys
    Image size: 5376
     Image MD5: 13E75FEF9DFEB08EEDED9D0246E1F448
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): MSPQM
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Proxy de gestion de qualité de répartition Microsoft
    Image path: system32\drivers\MSPQM.sys
    Image size: 4992
     Image MD5: 1988A33FF19242576C3D0EF9CE785DA7
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): mssmbios
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote BIOS de gestion de systèmes Microsoft
    Image path: system32\DRIVERS\mssmbios.sys
    Image size: 15488
     Image MD5: 469541F8BFD2B32659D5D463A6714BCE
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): MTsensor
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: ATK0110 ACPI UTILITY
    Image path: system32\DRIVERS\ASACPI.sys
    Image size: 5810
     Image MD5: D48659BB24C48345D926ECB45C1EBDF5
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): Mup
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Mup
   Control Set: CurrentControlSet
         Start: 0
          Type: 2
 Error Control: 1

Service (registry key): NAVAP
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NAVAP
    Image path: \??\C:\Program Files\NavNT\NAVAP.sys
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): NAVAPEL
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NAVAPEL
    Image path: \??\C:\Program Files\NavNT\NAVAPEL.SYS
    Image size: 0
     Image MD5: D41D8CD98F00B204E9800998ECF8427E
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): NDIS
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote système NDIS
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): NdisTapi
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote TAPI NDIS d'accès distant
   Description: Pilote TAPI NDIS d'accès distant
    Image path: system32\DRIVERS
distapi.sys
    Image size: 9600
     Image MD5: 08D43BBDACDF23F34D79E44ED35C1B4C
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): Ndisuio
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NDIS mode utilisateur E/S Protocole
   Description: NDIS mode utilisateur E/S Protocole
    Image path: system32\DRIVERS
disuio.sys
    Image size: 12928
     Image MD5: 34D6CD56409DA9A7ED573E1C90A308BF
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): NdisWan
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote réseau étendu NDIS d'accès distant
   Description: Pilote réseau étendu NDIS d'accès distant
    Image path: system32\DRIVERS
diswan.sys
    Image size: 91776
     Image MD5: 0B90E255A9490166AB368CD55A529893
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): NDProxy
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): NetBIOS
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Interface NetBIOS
   Description: Interface NetBIOS
    Image path: system32\DRIVERS
etbios.sys
    Image size: 34560
     Image MD5: 3A2ACA8FC1D7786902CA434998D7CEB4
   Control Set: CurrentControlSet
         Start: 1
          Type: 2
 Error Control: 1

Service (registry key): NetBT
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NetBIOS sur TCP/IP
   Description: NetBIOS sur TCP/IP
    Image path: system32\DRIVERS
etbt.sys
    Image size: 162816
     Image MD5: 0C80E410CD2F47134407EE7DD19CC86B
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1
 Depends On services: Tcpip

Service (registry key): NetDDE
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: DDE réseau
   Description: Fournit le transport en réseau et la sécurité pour l'échange dynamique de données pour les programmes exécutés sur un même ordinateur ou des ordinateurs différents. Si ce service est arrêté, le transport et la sécurité de l'échange dynamique de données seront indisponibles. Si ce service est désactivé, tout service en dépendant explicitement ne démarrera pas.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32
etdde.exe
    Image size: 114176
     Image MD5: D40598FD7B7DCCBFB22D777E0DFB1CF0
   Control Set: CurrentControlSet
         Start: 4
          Type: 32
 Error Control: 1
 Depends On services: NetDDEDSDM

Service (registry key): NetDDEdsdm
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: DSDM DDE réseau
   Description: Gère l'échange dynamique de données partagées de réseau. Si ce service est arrêté, l'échange dynamique de données partagées de réseau ne sera plus disponible. Si ce service est désactivé, tout service en dépendant explicitement ne démarrera pas. 
   Object name: LocalSystem
    Image path: %SystemRoot%\system32
etdde.exe
    Image size: 114176
     Image MD5: D40598FD7B7DCCBFB22D777E0DFB1CF0
   Control Set: CurrentControlSet
         Start: 4
          Type: 32
 Error Control: 1

Service (registry key): Netlogon
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Ouverture de session réseau
   Description: Prend en charge l'authentification directe des événements d'ouverture de session du compte pour les ordinateurs dans un domaine.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\lsass.exe
    Image size: 13312
     Image MD5: 259AF82A0932EEA4F316F92DB94707B6
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: LanmanWorkstation

Service (registry key): Netman
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Connexions réseau
   Description: Prend en charge les objets dans le dossier Connexions réseau et accès à distance, dans lequel vous pouvez afficher à la fois les connexions du réseau local et les connexions à distance.
   Object name: LocalSystem
    Image path: %SystemRoot%\System32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 288
 Error Control: 1
 Depends On services: RpcSs

Service (registry key): Nla
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NLA (Network Location Awareness)
   Description: Recueille et stocke les informations de configuration et d'emplacement réseau, et notifie les applications quand ces informations changent.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: Tcpip,Afd

Service (registry key): nm
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): NMIndexingService
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NMIndexingService
   Object name: LocalSystem
    Image path: "C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe"
    Image size: 267824
     Image MD5: DBB5F7B1A4F109CD7A1ABD3AC7A10D39
   Control Set: CurrentControlSet
         Start: 3
          Type: 16
 Error Control: 1
 Depends On services: RPCSS

Service (registry key): Npfs
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 2
 Error Control: 1

Service (registry key): Ntfs
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 2
 Error Control: 1

Service (registry key): NtLmSsp
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Fournisseur de la prise en charge de sécurité LM NT
   Description: Assure la sécurité des programmes RPC (appels de procédure distante) qui utilisent des transports autres que des canaux nommés.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\lsass.exe
    Image size: 13312
     Image MD5: 259AF82A0932EEA4F316F92DB94707B6
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1

Service (registry key): NtmsSvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Stockage amovible
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: RpcSs

Service (registry key): Null
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 1

Service (registry key): nv
 Registry path: \SYSTEM\CurrentControlSet\Services\
    Image path: system32\DRIVERS
v4_mini.sys
    Image size: 1897408
     Image MD5: 2B298519EDBFCF451D43E0F1E8F1006D
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): NWCWorkstation
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Service client pour NetWare
   Description: Assure l'accès aux ressources de fichiers et d'impression sur les réseaux NetWare.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\svchost.exe -k netsvcs
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1

Service (registry key): NwlnkFlt
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de filtre de trafic IPX
   Description: Pilote de filtre de trafic IPX
    Image path: system32\DRIVERS
wlnkflt.sys
    Image size: 12416
     Image MD5: B305F3FAD35083837EF46A0BBCE2FC57
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: NwlnkFwd

Service (registry key): NwlnkFwd
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de transfert de trafic IPX
   Description: Pilote de transfert de trafic IPX
    Image path: system32\DRIVERS
wlnkfwd.sys
    Image size: 32512
     Image MD5: C99B3415198D1AAB7227F2C88FD664B9
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): NwlnkIpx
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole de transport compatible NWLink IPX/SPX/NetBIOS
   Description: Protocole de transport compatible NWLink IPX/SPX/NetBIOS
    Image path: system32\DRIVERS
wlnkipx.sys
    Image size: 88448
     Image MD5: 79EA3FCDA7067977625B3363A2657C80
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): NwlnkNb
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NetBIOS NWLink
   Description: NetBIOS NWLink
    Image path: system32\DRIVERS
wlnknb.sys
    Image size: 63232
     Image MD5: 56D34A67C05E94E16377C60609741FF8
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): NwlnkSpx
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole NWLink SPX/SPXII
   Description: Protocole NWLink SPX/SPXII
    Image path: system32\DRIVERS
wlnkspx.sys
    Image size: 55936
     Image MD5: C0BB7D1615E1ACBDC99757F6CEAF8CF0
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 1

Service (registry key): NWRDR
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: NetWare Rdr
   Description: NetWare Rdr
    Image path: system32\DRIVERS
wrdr.sys
    Image size: 163584
     Image MD5: 03373A79440473062C6F3AEDEC6A49C8
   Control Set: CurrentControlSet
         Start: 3
          Type: 2
 Error Control: 1

Service (registry key): p2pgasvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Authentification de groupe réseau homologue
   Description: Fournit une authentification réseau pour les membres de groupes homologues.
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\system32\svchost.exe -k p2psvc
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: p2pimsvc

Service (registry key): p2pimsvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Gestionnaire d'identité réseau homologue
   Description: Fournit un service d'identité pour les réseaux homologues
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\system32\svchost.exe -k p2psvc
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1

Service (registry key): p2psvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Réseau homologue
   Description: Fournit les services réseaux homologues
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\system32\svchost.exe -k p2psvc
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: PNRPSvc,p2pgasvc

Service (registry key): Parport
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de port parallèle
    Image path: system32\DRIVERS\parport.sys
    Image size: 80384
     Image MD5: 318696359AC7DF48D1E51974EC527DD2
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): PartMgr
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): ParVdm
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 2
          Type: 1
 Error Control: 0
 Depends On services: Parport
 Depends On group: "Parallel arbitrator"

Service (registry key): PCI
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Pilote de bus PCI
    Image path: system32\DRIVERS\pci.sys
    Image size: 68608
     Image MD5: 7C5DA5C1ED801AD8B0309D5514F0B75E
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 3

Service (registry key): PCIDump
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 1
          Type: 1
 Error Control: 0

Service (registry key): PCIIde
 Registry path: \SYSTEM\CurrentControlSet\Services\
    Image path: system32\DRIVERS\pciide.sys
    Image size: 3328
     Image MD5: F4BFDE7209C14A07AAA61E4D6AE69EAC
   Control Set: CurrentControlSet
         Start: 0
          Type: 1
 Error Control: 1

Service (registry key): Pcmcia
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): PDCOMP
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): PDFRAME
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): PDRELI
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): PDRFRAME
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 0

Service (registry key): perc2
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): perc2hib
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 4
          Type: 1
 Error Control: 1

Service (registry key): PerfDisk
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): PerfNet
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): PerfOS
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): PerfProc
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): PlugPlay
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Plug-and-Play
   Description: Permet à l'ordinateur de reconnaître et d'adapter les modifications matérielles avec peu ou pas du tout d'intervention de l'utilisateur. Arrêter ou désactiver ce service provoque une instabilité du système.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\services.exe
    Image size: 108544
     Image MD5: 63DCDE1A0D86EEB8924D6738FF616EAD
   Control Set: CurrentControlSet
         Start: 2
          Type: 32
 Error Control: 1

Service (registry key): PNRPSvc
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Protocole de résolution de noms d'homologues
   Description: Permet la résolution de noms d'homologues sans serveur via Internet
   Object name: NT AUTHORITY\LocalService
    Image path: %SystemRoot%\system32\svchost.exe -k p2psvc
    Image size: 14336
     Image MD5: 2979B03D5382A602623C0535B16AB9C0
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: tcpip6,p2pimsvc

Service (registry key): PolicyAgent
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Services IPSEC
   Description: Gère la stratégie de sécurité IP et démarre les pilotes de gestion de sécurité IP et ISAKMP/Oakley (IKE).
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\lsass.exe
    Image size: 13312
     Image MD5: 259AF82A0932EEA4F316F92DB94707B6
   Control Set: CurrentControlSet
         Start: 3
          Type: 32
 Error Control: 1
 Depends On services: RPCSS,Tcpip,IPSec

Service (registry key): PortProxy
 Registry path: \SYSTEM\CurrentControlSet\Services\
   Control Set: CurrentControlSet
         Start: 0
          Type: 0
 Error Control: 0

Service (registry key): PptpMiniport
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Miniport réseau étendu (PPTP)
   Description: Miniport réseau étendu (PPTP)
    Image path: system32\DRIVERSaspptp.sys
    Image size: 48384
     Image MD5: 1C5CC65AAC0783C344F16353E60B72AC
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1

Service (registry key): ProtectedStorage
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Emplacement protégé
   Description: Fournit un stockage protégé pour les données sensibles, telles que les clés privées, afin d'empêcher l'accès par des services, des processus ou des utilisateurs non autorisés.
   Object name: LocalSystem
    Image path: %SystemRoot%\system32\lsass.exe
    Image size: 13312
     Image MD5: 259AF82A0932EEA4F316F92DB94707B6
   Control Set: CurrentControlSet
         Start: 2
          Type: 288
 Error Control: 1
 Depends On services: RpcSs

Service (registry key): PSched
 Registry path: \SYSTEM\CurrentControlSet\Services\
  Display name: Planificateur de paquets QoS
   Description: Planificateur de paquets QoS
    Image path: system32\DRIVERS\psched.sys
    Image size: 69120
     Image MD5: 48671F327553DCF1D27F6197F622A668
   Control Set: CurrentControlSet
         Start: 3
          Type: 1
 Error Control: 1
 Depends On services: Gpc

Pierre222 · Answer

Re 

donc j'étais obligé de diviser le rapport en plusieurs parties pour vous l'envoyer 

Merci

sherred · Answer

c'est cet endroit qui nous interesse

--- Winsock Layered Service Provider list --- 
Namespace Provider 0: 
GUID: {D3C911A4-3F89-4760-9AE5-02FA7075FC34} 
Filename: C:\WINDOWS\system32\syslnreg.dll 

spybot a t'il effectué des correction ?

refait un hijack stp

Pb Les programme sur le bureau ne trouvent pl - Page 3

Discussions similaires

Newsletters