Virus - liens demandes errones

lilou270102 -  
Bonjour,
j'ai un gros problème depuis hier soir
J'ai été infecté par total pc defender mais j'ai essayé de le upprimer avec malwarebytes. Apparement, il en aurait supprime une partie mais en rouvrant le pc ce matin je constate que les recherches sur google sont redirigés vers des sites non demandes
J'ai aussi une fenetre qui s'ouvre en me demandant de réecrire des mots
que dois-je faire?
merci pour votre aide tres precieuse
Configuration: Windows XP / Internet Explorer 8.0

17 réponses

  1. lilou2810
    je n'arrice pas à télécharger zebulon
    cela me dit "IE" ne peut pas afficher cette page web
    0
    1. lilou2810
      Malwarebytes' Anti-Malware 1.44
      Version de la base de données: 3510
      Windows 5.1.2600 Service Pack 3
      Internet Explorer 8.0.6001.18702

      22/03/2010 19:07:28
      mbam-log-2010-03-22 (19-07-28).txt

      Type de recherche: Examen rapide
      Eléments examinés: 109837
      Temps écoulé: 5 minute(s), 27 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 0
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 0

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      (Aucun élément nuisible détecté)
      0
      1. lilou2810
        bonsoir,
        mon virus empeche malwarebytes de se maettre à jour
        il l'empeche de se connecter au site
        je lui faire faire un scan
        0
        1. gen-hackman
          salut remets malwarebytes à jour et fais un scan complet
          0
          2. lilou2810
            Kill'em by g3n-h@ckm@n 1.6.0.0

            User : Admin (Administrateurs)
            Update on 17/03/2010 by g3n-h@ckm@n ::::: 18.50
            Start at: 20:13:48 | 18/03/2010
            Contact : https://forums.commentcamarche.net/forum/virus-securite-7

            Internet Explorer 8.0.6001.18702
            Windows Firewall Status : Enabled

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\csrss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\RTHDCPL.EXE
            C:\WINDOWS\system32\RUNDLL32.EXE
            C:\Program Files\Java\jre6\bin\jusched.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
            C:\PROGRA~1\CONTRO~1\bin\optgui.exe
            C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
            C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Java\jre6\bin\jqs.exe
            C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
            C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
            C:\Program Files\Messenger\msmsgs.exe
            C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
            C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
            C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\Controle Parental\bin\optproxy.exe
            C:\WINDOWS\system32\PSIService.exe
            C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
            C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
            C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
            C:\WINDOWS\System32\alg.exe
            C:\WINDOWS\system32\cmd.exe
            C:\Program Files\List_Kill'em\pv.exe

            Detections :
            ==========

            ¤¤¤¤¤¤¤¤¤¤ Files/folders :

            Quarantined & Deleted !! : C:\Program Files\Fast Browser Search
            Quarantined & Deleted !! : C:\Program Files\SGPSA
            Quarantined & Deleted !! : C:\WINDOWS\002694_.tmp
            Quarantined & Deleted !! : C:\WINDOWS\SET3.tmp
            Quarantined & Deleted !! : C:\WINDOWS\SET4.tmp
            Quarantined & Deleted !! : C:\WINDOWS\SET8.tmp
            Quarantined & Deleted !! : C:\WINDOWS\bill103.exe

            Quarantined & Deleted !! : C:\WINDOWS\System32\MSINET.oca
            Quarantined & Deleted !! : C:\WINDOWS\System32\rezumatenoi.dat
            Quarantined & Deleted !! : C:\WINDOWS\System32\SET3E.tmp
            Quarantined & Deleted !! : C:\WINDOWS\System32\SET4A.tmp
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Application Data\.#
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Application Data\Desktopicon
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740550.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740943.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268758802.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268759155.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763084.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763427.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763472.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763674.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766459.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766763.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766766.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766839.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766925.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766996.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767246.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767787.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767835.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268768745.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769127.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769128.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268773887.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774194.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774195.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774196.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774198.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774203.exe
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Temp\89.tmp
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Temp\8A.tmp
            Quarantined & Deleted !! : C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\SuggestedSites.dat

            ==============
            host file OK !
            ==============

            ========
            Registry
            ========

            Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
            Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
            Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
            Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
            Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
            Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
            Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}"
            Deleted : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"
            Deleted : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
            Deleted : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
            Deleted : HKCR\interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
            Deleted : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
            Deleted : HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
            Deleted : HKCR\urlsearchhook.toolbarurlsearchhook
            Deleted : HKCR\urlsearchhook.toolbarurlsearchhook.1
            Deleted : HKCU\SOFTWARE\EoRezo
            Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
            Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cb0d163c-e9f4-4236-9496-0597e24b23a5}
            Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
            Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
            Deleted : HKCU\Software\SweetIM
            Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TBSB07183.TBSB07183Toolbar
            Deleted : HKLM\SOFTWARE\SweetIM
            Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_WEBSERVER
            Deleted : HKLM\SYSTEM\ControlSet002\Services\webserver
            Deleted : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_WEBSERVER
            Deleted : HKLM\SYSTEM\ControlSet004\Services\webserver
            ========
            Services
            =========

            Ndisuio : Start = 3
            EapHost : Start = 2
            Ip6Fw : Start = 2
            SharedAccess : Start = 2
            wuauserv : Start = 2
            wscsvc : Start = 2

            ============
            Disk Cleaned
            ============

            =================
            anti-ver blaster : OK !!
            =================

            ================
            Prefetch cleaned
            ================

            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
            0
            1. gen-hackman
              tu n'as pas un fichier du nom de Kil'em.txt sur ton bureau ?
              0
              1. lilou2810
                je l'ai lance manuellement
                il y a eu un scan e puis plus rien
                0
                2. lilou2810
                  je suis au bureau je fais ca quand je rentre
                  0
                  1. gen-hackman
                    ok mets toi sur ce fichier et double-clique dessus :

                    C:\Program Files\List_Kill'em\del_reg.bat
                    0
                    1. lilou2810
                      apparemment le fichier c del-reg.bat
                      0
                      1. lilou2810
                        bonjour,
                        J'ai fait tout ce que tu m'a dis mais lorsque le PC a redémarré , il y avait marqué qu'un fichier de listkill n'avait pas été trouvé et donc le scan ne s"'est pas lancé
                        0
                        1. gen-hackman
                          ▶ Relance List_Kill'em(soit en clic droit "executer en tant que......" pour vista/7),avec le raccourci sur ton bureau.
                          mais cette fois-ci :

                          ▶ choisis l'option 2 = Mode Suppression

                          ton PC va redemarrer,

                          laisse travailler l'outil.

                          en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

                          ▶ colle le contenu dans ta reponse
                          0
                          1. lilou2810
                            VOILA LE RESULTAT /

                            List'em by g3n-h@ckm@n 1.6.0.0

                            User : Admin (Administrateurs)
                            Update on 17/03/2010 by g3n-h@ckm@n ::::: 18.50
                            Start at: 21:21:27 | 17/03/2010
                            Contact : https://forums.commentcamarche.net/forum/virus-securite-7

                            Internet Explorer 8.0.6001.18702
                            Windows Firewall Status : Enabled

                            Boot: Normal

                            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\csrss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\WINDOWS\RTHDCPL.EXE
                            C:\WINDOWS\system32\RUNDLL32.EXE
                            C:\Program Files\Java\jre6\bin\jusched.exe
                            C:\PROGRA~1\CONTRO~1\bin\optgui.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
                            C:\Program Files\Messenger\msmsgs.exe
                            C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe
                            C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
                            C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Java\jre6\bin\jqs.exe
                            C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                            C:\WINDOWS\system32\nvsvc32.exe
                            C:\Program Files\Controle Parental\bin\optproxy.exe
                            C:\WINDOWS\system32\PSIService.exe
                            C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
                            C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
                            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                            C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
                            C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
                            C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
                            C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\System32\alg.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\Program Files\Windows Live\Toolbar\wltuser.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\WINDOWS\system32\msfeedssync.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\Program Files\List_Kill'em\List_Kill'em.exe
                            C:\WINDOWS\system32\cmd.exe
                            C:\Program Files\List_Kill'em\pv.exe

                            ======================
                            Keys "Run"
                            ======================
                            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
                            BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
                            MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background
                            msnlivesearch REG_SZ C:\Program Files\Windows Live\MessengerSearchAddon\msgrsrch.exe /Run
                            swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
                            RoboForm REG_SZ "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
                            NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                            nwiz REG_SZ nwiz.exe /install
                            RTHDCPL REG_SZ RTHDCPL.EXE
                            QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                            EoEngine REG_SZ
                            SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
                            OPTENET_GUI REG_SZ C:\PROGRA~1\CONTRO~1\bin\optgui.exe
                            Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                            Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
                            BitDefender Antiphishing Helper REG_SZ "C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe"
                            BDAgent REG_SZ "C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe"

                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

                            =====================
                            Other Keys
                            =====================
                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
                            dontdisplaylastusername REG_DWORD 0 (0x0)
                            legalnoticecaption REG_SZ
                            legalnoticetext REG_SZ
                            shutdownwithoutlogon REG_DWORD 1 (0x1)
                            undockwithoutlogon REG_DWORD 1 (0x1)
                            DisableRegistryTools REG_DWORD 0 (0x0)
                            HideLegacyLogonScripts REG_DWORD 0 (0x0)
                            HideLogoffScripts REG_DWORD 0 (0x0)
                            RunLogonScriptSync REG_DWORD 1 (0x1)
                            RunStartupScriptSync REG_DWORD 0 (0x0)
                            HideStartupScripts REG_DWORD 0 (0x0)

                            ===============
                            [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                            NoDriveTypeAutoRun REG_BINARY ff000000
                            NoDrives REG_DWORD 0 (0x0)

                            ===============
                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                            NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
                            NoDriveTypeAutoRun REG_DWORD 255 (0xff)
                            NoDrives REG_DWORD 0 (0x0)
                            HonorAutoRunSetting REG_DWORD 1 (0x1)

                            ===============
                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                            AppInit_DLLS REG_SZ

                            ===============
                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                            AutoRestartShell REG_DWORD 1 (0x1)
                            DefaultDomainName REG_SZ 1E815C5E2D77411
                            DefaultUserName REG_SZ Admin
                            LegalNoticeCaption REG_SZ
                            LegalNoticeText REG_SZ
                            PowerdownAfterShutdown REG_SZ 0
                            ReportBootOk REG_SZ 1
                            Shell REG_SZ Explorer.exe
                            ShutdownWithoutLogon REG_SZ 0
                            System REG_SZ
                            Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
                            VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
                            SfcQuota REG_DWORD -1 (0xffffffff)
                            allocatecdroms REG_SZ 0
                            allocatedasd REG_SZ 0
                            allocatefloppies REG_SZ 0
                            cachedlogonscount REG_SZ 10
                            forceunlocklogon REG_DWORD 0 (0x0)
                            passwordexpirywarning REG_DWORD 14 (0xe)
                            scremoveoption REG_SZ 0
                            AllowMultipleTSSessions REG_DWORD 1 (0x1)
                            UIHost REG_EXPAND_SZ logonui.exe
                            LogonType REG_DWORD 1 (0x1)
                            Background REG_SZ 0 0 0
                            DebugServerCommand REG_SZ no
                            SFCDisable REG_DWORD 0 (0x0)
                            WinStationsDisabled REG_SZ 0
                            HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
                            ShowLogonOptions REG_DWORD 0 (0x0)
                            AltDefaultUserName REG_SZ Admin
                            AltDefaultDomainName REG_SZ 1E815C5E2D77411
                            ChangePasswordUseKerberos REG_DWORD 1 (0x1)

                            ===============
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

                            ===============
                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                            {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

                            ===============
                            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                            %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                            %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
                            C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
                            C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe REG_SZ C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime Essentials
                            X:\Program Files\Anno 1701\Anno1701.exe REG_SZ X:\Program Files\Anno 1701\Anno1701.exe:*:Enabled:Anno1701.exe
                            C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                            C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                            C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
                            C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Detect.exe REG_SZ C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Detect.exe:*:Enabled:garfieldfr
                            C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield.exe REG_SZ C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield.exe:*:Enabled:garfieldfr
                            C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield_Launcher.exe REG_SZ C:\Metaboli\Games\garfieldfr\Garfield Lasagna World Tour\Garfield_Launcher.exe:*:Enabled:garfieldfr
                            C:\Program Files\ma-config.com\maconfservice.exe REG_SZ C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice

                            [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                            %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                            %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
                            C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                            C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                            C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare

                            ===============
                            ActivX controls
                            ===============
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{17492023-C23A-453E-A040-C7C580BBF700}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1E54D648-B804-468d-BC78-4AFFED8E262E}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6A060448-60F9-11D5-A6CD-0002B31F7455}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{74DBCB52-F298-4110-951D-AD2FF67BC8AB}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{867E13F2-7F31-44FB-AC97-CD38E0DC46EF}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D0C0F75C-683A-4390-A791-1ACFD5599AB8}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}]

                            ===============
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{4af7dff0-969a-4d14-b432-8b1924890224}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{17CE6D33-7C7C-00D8-4C32-0BC6B0AB3E10}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{70DF3035-CD1E-EBD7-7831-0D43FAB5EE27}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{946571C6-F9CD-AC10-CE8F-02CABE22C22B}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D069B0E7-DE11-2BF8-1D13-1B9C50ADBD3A}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]

                            ==============
                            BHO :
                            ======
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]

                            ===
                            DNS
                            ===

                            ================
                            Internet Explorer :
                            ================
                            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                            Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

                            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                            Start Page REG_SZ https://www.orange.fr/portail

                            ========
                            Services
                            ========
                            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

                            Ndisuio : 0x3 ( OK = 3 )
                            EapHost : 0x3 ( OK = 2 )
                            SharedAccess : 0x2 ( OK = 2 )
                            wuauserv : 0x2 ( OK = 2 )

                            =========
                            Atapi.sys
                            =========

                            %%%% HASHDEEP-1.0
                            %%%% size,md5,sha256,filename
                            ## Invoked from: C:\Program Files\List_Kill'em
                            ## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
                            ##
                            95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
                            %%%% HASHDEEP-1.0
                            %%%% size,md5,sha256,filename
                            ## Invoked from: C:\Program Files\List_Kill'em
                            ## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
                            ##
                            96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
                            %%%% HASHDEEP-1.0
                            %%%% size,md5,sha256,filename
                            ## Invoked from: C:\Program Files\List_Kill'em
                            ## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
                            ##
                            96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
                            %%%% HASHDEEP-1.0
                            %%%% size,md5,sha256,filename
                            ## Invoked from: C:\Program Files\List_Kill'em
                            ## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
                            ##
                            95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

                            Référence :
                            ==========

                            Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
                            Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
                            Win XP_32b : a64013e98426e1877cb653685c5c0009
                            Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
                            Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
                            Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
                            Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
                            Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
                            Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
                            Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
                            Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
                            Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

                            =======
                            Drive :
                            =======

                            D‚fragmenteur de disque Windows
                            Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

                            Rapport d'analyse
                            233 Go total, 3,13 Go libre (1%), 40% fragment‚ (fragmentation du fichier 77%)

                            Vous devriez d‚fragmenter ce volume.

                            ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                            Present !! : C:\Program Files\Fast Browser Search
                            Present !! : C:\Program Files\SGPSA
                            Present !! : C:\WINDOWS\002694_.tmp
                            Present !! : C:\WINDOWS\SET3.tmp
                            Present !! : C:\WINDOWS\SET4.tmp
                            Present !! : C:\WINDOWS\SET8.tmp
                            Present !! : C:\WINDOWS\bill103.exe
                            Present !! : C:\WINDOWS\System32\MSINET.oca
                            Present !! : C:\WINDOWS\System32\SET*.tmp
                            Present !! : C:\Documents and Settings\Admin\Application Data\.#
                            Present !! : C:\Documents and Settings\Admin\Application Data\Desktopicon
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740550.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268740943.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268758802.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268759155.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763084.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763427.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763472.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268763674.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766459.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766763.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766766.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766839.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766925.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268766996.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767246.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767787.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268767835.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268768745.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769127.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268769128.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268773887.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774194.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774195.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774196.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774198.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Application Data\rdr_1268774203.exe
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Temp\89.tmp
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Temp\8A.tmp
                            Present !! : C:\Documents and Settings\Admin\LOCAL Settings\Temp\GoogleUpdate.exe887a7
                            Present !! : C:\Documents and Settings\Admin\LOCAL Settings\Temp\goopdate.dll88815
                            Present !! : C:\Documents and Settings\Admin\LOCAL Settings\Temp\goopdateres_fr.dll88853
                            Present !! : C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\SuggestedSites.dat

                            ¤¤¤¤¤¤¤¤¤¤ Keys :

                            Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
                            Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                            Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                            Present !! : HKEY_USERS\S-1-5-21-1454471165-1957994488-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                            Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                            Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                            Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
                            Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}"
                            Present !! : "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}"
                            Present !! : HKCR\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0}
                            Present !! : HKCR\Interface\{4897bba6-48d9-468c-8efa-846275d7701b}
                            Present !! : HKCR\interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
                            Present !! : HKCR\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d}
                            Present !! : HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
                            Present !! : HKCR\urlsearchhook.toolbarurlsearchhook
                            Present !! : HKCR\urlsearchhook.toolbarurlsearchhook.1
                            Present !! : HKCU\SOFTWARE\EoRezo
                            Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
                            Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cb0d163c-e9f4-4236-9496-0597e24b23a5}
                            Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
                            Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
                            Present !! : HKCU\Software\SweetIM
                            Present !! : HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
                            Present !! : HKLM\Software\Classes\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
                            Present !! : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TBSB07183.TBSB07183Toolbar
                            Present !! : HKLM\SOFTWARE\SweetIM
                            Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_WEBSERVER
                            Present !! : HKLM\SYSTEM\ControlSet002\Services\webserver
                            Present !! : HKLM\SYSTEM\ControlSet004\Enum\Root\Legacy_WEBSERVER
                            Present !! : HKLM\SYSTEM\ControlSet004\Services\webserver
                            Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_WEBSERVER
                            Present !! : HKLM\SYSTEM\CurrentControlSet\Services\webserver

                            ============

                            catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                            Rootkit scan 2010-03-17 21:55:59
                            Windows 5.1.2600 Service Pack 3 FAT NTAPI

                            scanning hidden processes ...

                            scanning hidden services ...

                            scanning hidden autostart entries ...

                            scanning hidden files ...

                            scan completed successfully
                            hidden processes: 0
                            hidden services: 0
                            hidden files: 0

                            Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                            device: opened successfully
                            user: MBR read successfully
                            called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvata.sys
                            kernel: MBR read successfully
                            user & kernel MBR OK

                            ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

                            ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

                            End of scan : 21:56:21,82
                            0
                            1. gen-hackman
                              DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

                              ▶ Télécharge List_Kill'em et enregistre le sur ton bureau

                              double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

                              une fois terminée , clic sur "terminer" et le programme se lancera seul

                              choisis choisis l'option Search

                              un icone blanc et noir va s'afficher sur le bureau , il te servira à relancer le programme par la suite.

                              ▶ laisse travailler l'outil

                              à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

                              un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

                              ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

                              0
                              1. lilou270102 Auteur
                                bonsoir,
                                voici le rapport :
                                Malwarebytes' Anti-Malware 1.44
                                Version de la base de données: 3510
                                Windows 5.1.2600 Service Pack 3
                                Internet Explorer 8.0.6001.18702

                                16/03/2010 22:50:46
                                mbam-log-2010-03-16 (22-50-46).txt

                                Type de recherche: Examen rapide
                                Eléments examinés: 108441
                                Temps écoulé: 6 minute(s), 25 second(s)

                                Processus mémoire infecté(s): 0
                                Module(s) mémoire infecté(s): 0
                                Clé(s) du Registre infectée(s): 5
                                Valeur(s) du Registre infectée(s): 2
                                Elément(s) de données du Registre infecté(s): 0
                                Dossier(s) infecté(s): 2
                                Fichier(s) infecté(s): 8

                                Processus mémoire infecté(s):
                                (Aucun élément nuisible détecté)

                                Module(s) mémoire infecté(s):
                                (Aucun élément nuisible détecté)

                                Clé(s) du Registre infectée(s):
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
                                HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

                                Valeur(s) du Registre infectée(s):
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\total pc defender (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysfbtray (Worm.KoobFace) -> Quarantined and deleted successfully.

                                Elément(s) de données du Registre infecté(s):
                                (Aucun élément nuisible détecté)

                                Dossier(s) infecté(s):
                                C:\Documents and Settings\Admin\Menu Démarrer\Total PC Defender (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
                                C:\Program Files\Total PC Defender (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.

                                Fichier(s) infecté(s):
                                C:\Documents and Settings\Admin\Menu Démarrer\Total PC Defender\Total PC Defender.lnk (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
                                C:\Program Files\Total PC Defender\Total PC Defender.exe (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Admin\Bureau\Total PC Defender.lnk (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
                                C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Total PC Defender.lnk (Rogue.TotalPCDefender) -> Quarantined and deleted successfully.
                                C:\WINDOWS\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
                                C:\WINDOWS\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
                                C:\Googleregjs.bat (Malware.Trace) -> Quarantined and deleted successfully.
                                C:\newblogger.bat (KoobFace.Trace) -> Quarantined and deleted successfully.

                                depuis il ne detecte plus de virus

                                merci de votre aide
                                0
                                1. gen-hackman
                                  salut tu as le rapport de malwarebytes ? onglet rappport/logs le dernier en date
                                  0

                                  Discussions similaires

                                  Annonces de demande sur Leboncoin : comment les trouver
                                  kyanoss

                                  2 réponses
                                  Retrouver liens copiés sur le téléphone
                                  SAMA

                                  2 réponses
                                  Copier un lien instagram
                                  alaurore

                                  7 réponses
                                  lien copié presse papier smartphone Samsung
                                  luckygirl63

                                  3 réponses
                                  Softonic,est-ce un virus ?
                                  techmel1

                                  6 réponses