virus en quarantaine

Question

Bonjour, 

J'ai fais une analyse avec antimalware, il a trouvé 25 virus que jai effacés, mais il en reste en quarantaine?  Que faut-il faire? Merci pour vos réponses



Configuration: Windows 7 / Internet Explorer 8.0

anthony5151 · Answer

Bonjour,


Bienvenue sur CCM !
Nous allons essayer de régler ton problème ensemble. D'abord, quelques rappels :

- N'ouvre pas d'autres sujets pour le même problème (que ce soit sur ce forum ou sur un autre)
- N'hésite pas à poser des questions en cas de besoin ;)
- Sois patient(e) quand tu postes un message, je ne réponds pas instantanément : je suis bénévole et je ne suis pas en permanence devant mon ordinateur. Mais rassure toi, je ne laisse jamais tomber personne ;)
- La désinfection (si nécessaire) va se dérouler en plusieurs étapes. Même si les symptômes de l'infection disparaissent, la désinfection ne sera terminée que quand je te le confirmerai --> Merci de revenir jusqu'au bout, sinon ce qu'on a fait n'aura servi à rien.


Commence par utiliser ce logiciel de diagnostic stp, ça me permettra de t'aider :

* Télécharge ZHPDiag (de Nicolas Coolman)
* Laisse toi guider lors de l'installation
* Il se lancera automatiquement à la fin de l'installation
* Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Héberge le rapport ZHPDiag.txt sur ce site, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum


Poste aussi le rapport de MalwareBytes qui montre les 25 éléments néfastes stp (tu le retrouveras dans l'onglet "rapports/logs")

claztum · Answer

bonjour,
J'ai effectivement posté 2 sujets, mais ce ne sont pas les memes problemes.
Voici le rapport Malwerbyte

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 5230

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

02/12/2010 06:45:16
mbam-log-2010-12-02 (06-45-16).txt

Type d'examen: Examen complet (C:\|D:\|F:\|)
Elément(s) analysé(s): 203503
Temps écoulé: 32 minute(s), 3 seconde(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
c:\programdataesultbaresultbar113.exe (Adware.ResultBar) -> 2152 -> Unloaded process successfully.
c:\program filesesultbaresultbar.exe (Adware.ResultBar) -> 2672 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\program filesesultbaresultbar.dll (Adware.Agent.Gen) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ResultBar Service (Adware.ResultBar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47FD-81F3-EE91287F9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{46897C77-E7A6-4C33-BFFB-E9C2E2718942} (Adware.Mp3Tube) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{46897C77-E7A6-4C33-BFFB-E9C2E2718942} (Adware.Mp3Tube) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ResultBar (Adware.ResultBar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{46897C77-E7A6-4C33-BFFB-E9C2E2718942} (Adware.Mp3Tube) -> Value: {46897C77-E7A6-4C33-BFFB-E9C2E2718942} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{46897C77-E7A6-4C33-BFFB-E9C2E2718942} (Adware.Mp3Tube) -> Value: {46897C77-E7A6-4C33-BFFB-E9C2E2718942} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790476B676595434AA95 (Malware.Trace) -> Value: SRS_IT_E8790476B676595434AA95 -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\programdataesultbar (Adware.ResultBar) -> Quarantined and deleted successfully.
c:\program filesesultbar (Adware.ResultBar) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\programdataesultbaresultbar113.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
c:\program filesesultbaresultbar.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.
c:\program filesesultbaresultbar.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
c:\Temp\xvid-win32.exe (Adware.HotBar) -> Quarantined and deleted successfully.
c:\Windows\Temp\RES9484.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.

Rapport ZHPDiag
Rapport de ZHPDiag v1.27.138 par Nicolas Coolman, Update du 30/11/2010
Run by Utilizador at 02/12/2010 09:48:48
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\ Web Browser
MSIE: Internet Explorer v8.0.7600.16385 (Defaut)

---\ System Information
Windows 7 Home Premium Edition, 32-bit  (Build 7600)
Processor: x86 Family 6 Model 15 Stepping 2, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1015 MB (25% free)
System drive C: has 63 GB (75%) free of 83 GB

---\ Logged in mode
Computer Name: UTILISATEUR-PC
User Name: Utilizador
All Users Names: Utilizador, HomeGroupUser$, Convidado, Administrador, 
Unselected Option:  O1,O45,O61,O62,O65,O82
Logged in as Administrator

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 63 Go of 83 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Floppy drive, Flash card reader, USB Key (Free 1 Go of 1 Go)
F:\ Hard drive, Flash drive, Thumb drive (Free 62 Go of 66 Go)


---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK


---\ Recherche particulière de fichiers génériques
[MD5.2626FC9755BE22F805D3CFA0CE3EE727] - (.Microsoft Corporation - Explorateur Windows.) (.31/10/2009 06:45:39.) -- C:\Windows\Explorer.exe [2614272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.28/10/2009 07:17:59.) -- C:\Windows\System32\Winlogon.exe [285696]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 02:26:15.) -- C:\Windows\System32\drivers\atapi.sys [21584]


---\ Processus lancés
[MD5.68239842340DDFF8993DFD9127553EDA] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe   [141848]
[MD5.004763BDF8E48244DBB9FDFDE3065EBC] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe   [173592]
[MD5.CD1102E5D340216138C7F56FA8D26998] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe   [150552]
[MD5.D9C51528488EA0D98D3C4D02ABD16759] - (.Intel Corporation - igfxsrvc Module.) -- C:\Windows\system32\igfxsrvc.exe   [252952]
[MD5.22EC0852DBF032A93D8DA697065FA189] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe   [87336]
[MD5.5F2AE48E395C93278EFBABC5FF3A98AF] - (.cyberlink - brs.) -- C:\Program Files\CyberLink\Shared files\brs.exe   [75048]
[MD5.AB2055B3872B12A735613AAD7293CEFE] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe   [7596576]
[MD5.3BE11E0690ABC300E67305E27758004E] - (.IVT Corporation - Bluetooth Application.) -- C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe   [315478]
[MD5.8895BE670D1D4BD478B16DD311273F4A] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe   [1557800]
[MD5.6C1B31F5C16E03153F0037AC6C451FFD] - (.AVAST Software - avast! Antivirus.) -- F:\avast\AvastUI.exe   [2838912]
[MD5.93DB1FF92B03D24738A71E6E4992DFD3] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe   [248552]
[MD5.7DD08FB42F74784EC4855AE3A7197254] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe   [153136]
[MD5.16DCC8ACC504A6662BB04A0ED9454A4D] - (.SFR - Propriétés de la connexion SFR.) -- C:\Program Files\SFR\Kit\9props.exe   [959808]
[MD5.1AF1360E070BD8EA402F793EF6FBAAEB] - (.Macrovision Corporation - Macrovision Software Manager.) -- C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe   [222128]
[MD5.F441E401B71C4E6087B6F23E1C35FA3A] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe   [1209904]
[MD5.DE8C5AB7EE56A7DA0166B2E2B0E496A2] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe   [103720]
[MD5.61EDBCE47ADF3E52AB0B9F49EE4AEBB8] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe   [673040]
[MD5.31585527E4B9D92A6E32BBD1DA2EAD3F] - (.Secure Digital Services Limited - OfferBox.) -- C:\Program Files\OfferBox\OfferBox.exe   [1973592]
[MD5.F7A3A63FF10DBC263E4410EC9667C238] - (.Uniblue Systems Limited - Uniblue RegistryBooster.) -- C:\Program Files\Uniblue\RegistryBoosteregistrybooster.exe   [53096]
[MD5.5C55A5017CB4352CCC77D05CDDC93E54] - (.Uniblue Systems Limited - Uniblue RegistryBooster Monitor.) -- C:\Program Files\Uniblue\RegistryBoosterbmonitor.exe   [25976]
[MD5.175115D592758937DD8DE850656BE47B] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [620032]


---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2)
P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_22 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll


---\ Internet Explorer, Démarrage,Recherche,URSearchHook (R0,R1,R3)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (8.00.7600.16385 (win7_rtm.090713-1255)) -- C:\Windows\System32\ieframe.dll
R3 - URLSearchHook: (no name) - {9bb815eb-3f9f-4e11-9150-cb70e29b40fc} Clé orpheline


---\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe


---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} . (.SFR - Aide à la navigation SFR.) -- C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: OfferBox - {FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C} . (.Secure Digital Services Limited - OfferBox.) -- C:\Program Files\OfferBox\OfferBoxBHO.dll


---\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe 
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe 
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe 
O4 - HKLM\..\Run: [NeroFilterCheck] . (.Nero AG - NeroCheck.) -- C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe 
O4 - HKLM\..\Run: [RemoteControl10] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe 
O4 - HKLM\..\Run: [BDRegion] . (.cyberlink - brs.) -- C:\Program Files\Cyberlink\Shared files\brs.exe 
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe 
O4 - HKLM\..\Run: [Skytel] . (.Realtek Semiconductor Corp. - Realtek Voice  Manager.) -- C:\Program Files\Realtek\Audio\HDA\Skytel.exe 
O4 - HKLM\..\Run: [BtTray] . (.IVT Corporation - Bluetooth Application.) -- C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe 
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe (.not file.) 
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
O4 - HKLM\..\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- F:\avast\avastUI.exe 
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe 
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- F:\programme file\Malwarebytes' Anti-Malware\mbam.exe 
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe 
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] . (.SFR - Propriétés de la connexion SFR.) -- C:\Program Files\SFR\Kit\9props.exe 
O4 - HKCU\..\Run: [ISUSPM] . (.Macrovision Corporation - Macrovision Software Manager.) -- C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe 
O4 - HKCU\..\Run: [RegistryBooster] . (.Uniblue Systems Limited - Uniblue Launcher.) -- C:\Program Files\Uniblue\RegistryBooster\launcher.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-21-2789567077-2640352481-2444775924-1000\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe 
O4 - HKUS\S-1-5-21-2789567077-2640352481-2444775924-1000\..\Run: [Connexion SFR 9props.exe] . (.SFR - Propriétés de la connexion SFR.) -- C:\Program Files\SFR\Kit\9props.exe 
O4 - HKUS\S-1-5-21-2789567077-2640352481-2444775924-1000\..\Run: [ISUSPM] . (.Macrovision Corporation - Macrovision Software Manager.) -- C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe 
O4 - HKUS\S-1-5-21-2789567077-2640352481-2444775924-1000\..\Run: [RegistryBooster] . (.Uniblue Systems Limited - Uniblue Launcher.) -- C:\Program Files\Uniblue\RegistryBooster\launcher.exe 
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
O4 - Global Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk . (.Microsoft Corporation.)  -- F:\programme file\Office XP Pro\Office10\OSA.EXE


---\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\Utilizador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Utilizador\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Utilizador\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk . (.Nero AG.)  -- C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe
O4 - Global Startup: C:\Users\Utilizador\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - Clé orpheline
O4 - Global Startup: C:\Users\Utilizador\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Uniblue RegistryBooster.lnk . (.Uniblue Systems Limited.)  -- C:\Program Files\Uniblue\RegistryBooster\Launcher.exe
O4 - Global Startup: C:\Users\Utilizador\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - Clé orpheline


---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xportar para o Microsoft Excel - (.not file.) - C:\PROGRA~1\MICROS~2\Office12\EXCEL.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - (.not file.) - F:\OFFICE~1\Office10\EXCEL.exe
O8 - Extra context menu item: Envoyer via Bluetooth . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE	sinfo.htm
O8 - Extra context menu item: Envoyer via message(&M)... . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE	ssms.htm


---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32
apinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\Windows\system32\wshbth.dll


---\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab


---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{41401C52-A75F-4FB0-A59E-F9C507E20FBF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B00D00F1-C581-4C4F-9E6F-8B2E8662E076}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{41401C52-A75F-4FB0-A59E-F9C507E20FBF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{B00D00F1-C581-4C4F-9E6F-8B2E8662E076}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{41401C52-A75F-4FB0-A59E-F9C507E20FBF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{B00D00F1-C581-4C4F-9E6F-8B2E8662E076}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1


---\ Protocole additionnel et piratage de protocole (O18)
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\Windows\system32\skype4com.dll


---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll


---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.


---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service:  (avast! Antivirus) . (.AVAST Software - avast! Service.) - F:\avast\AvastSvc.exe
O23 - Service:  (BlueSoleilCS) . (.IVT Corporation - Bluetooth Application.) - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe
O23 - Service:  (BsMobileCS) . (.IVT Corporation - Bluetooth Application.) - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) . (.Syntek America Inc. - Syntek Hardware Snapshot Launch Application.) - C:\Windows\System32\StkCSrv.exe
O23 - Service:  (TeamViewer5) . (.TeamViewer GmbH - TeamViewer Remote Control Application.) - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service:  ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}) . (.CyberLink Corp. - Pas de description.) - C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl


---\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) -  (.not file.)


---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\RegistryBooster.job
[MD5.5C55A5017CB4352CCC77D05CDDC93E54] [APT] [RegistryBooster] (.Uniblue Systems Limited.) -- C:\Program Files\Uniblue\RegistryBoosterbmonitor.exe
[MD5.00000000000000000000000000000000] [APT] [{92C998CB-64DB-47D8-BF96-6B5152C1449F}] (.Pas de propriétaire.) -- C:\Program Files\Alwil Software\Avast5\aswRundll.exe (.not file.)


---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\binegutils.dll
O40 - ASIC: Macromedia Shockwave Director 8.0 - {166B1BCA-3F9C-11CF-8075-444553540000} . (.Macromedia, Inc. - Shockwave ActiveX Control.) -- C:\Windows\System32\Macromed\Director\SwDir.dll
O40 - ASIC: Microsoft Windows - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Pas de propriétaire - Pas de description.) -- "C:\Program Files\Windows Mail\WinMail.exe
O40 - ASIC: Macromedia Flash Player 8 - {D27CDB6E-AE6D-11CF-96B8-444553540000} . (.Adobe Systems, Inc. - Adobe Flash Player 10.1 r102.) -- C:\Windows\system32\Macromed\Flash\Flash10l.ocx


---\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver:  (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver:  (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver:  (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS
etbios.sys
O41 - Driver: C:\Windows\system32\drivers
etbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS
etbt.sys
O41 - Driver: C:\Windows\system32\drivers
siproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers
siproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERSdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\driversdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\driversdprefmp.sys
O41 - Driver: C:\Windows\system32	cpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS	dx.sys
O41 - Driver:  (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS	ermdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: C:\Windows\system32ascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver:  (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys


---\ Logiciels installés (O42)
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Reader 9 - Português - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1046-7B44-A90000000001}
O42 - Logiciel: Alice's Biscuit Light 2.20 - (.Kayenko.) [HKLM] -- {8E8C3547-641B-4AB3-BB17-6ABF9FCEB77F}_is1
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
O42 - Logiciel: AuthenTec TrueSuite - (.AuthenTec, Inc..) [HKLM] -- {E6C44758-FF49-47D1-8182-65E3818ACE23}
O42 - Logiciel: AuthenTec TrueSuite - (.AuthenTec, Inc..) [HKLM] -- {EE2F4820-1E1F-4E2A-8C4C-A3C2D9EFDBB4}
O42 - Logiciel: Bluesoleil 6.4.261.0 - (.IVT Corporation.) [HKLM] -- {9D397C40-8C75-47B5-8F9F-D526A5198DC9}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: CyberLink PowerDVD 10 - (.CyberLink Corp..) [HKLM] -- InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}
O42 - Logiciel: CyberLink PowerDVD 10 - (.CyberLink Corp..) [HKLM] -- {DEC235ED-58A4-4517-A278-C41E8DAEAB3B}
O42 - Logiciel: Ferramenta de Carregamento do Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {133742BA-6F46-4D3E-85AF-78631D9AD8B8}
O42 - Logiciel: Intel(R) Graphics Media Accelerator Driver - (.Intel Corporation.) [HKLM] -- HDMI
O42 - Logiciel: Java(TM) 6 Update 22 - (.Sun Microsystems, Inc..) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216020FF}
O42 - Logiciel: KTP Ware PS/2-x86 5.0.3.13 - (.Pas de propriétaire.) [HKLM] -- Elantech
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}
O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
O42 - Logiciel: Microsoft Office XP Professional avec FrontPage - (.Microsoft Corporation.) [HKLM] -- {9028040C-6000-11D3-8CFE-0050048383C9}
O42 - Logiciel: Microsoft Picture It! Photo 2001 - (.Microsoft.) [HKLM] -- {D28FDA7D-15C6-48A2-9868-6BCB28BE6254}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {837b34e3-7c30-493c-8f6a-2b0f04e2912c}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Nero 7 Ultra Edition - (.Nero AG.) [HKLM] -- {4F2CE68F-EDBB-4592-BF07-5AC930A51036}
O42 - Logiciel: OfferBox - (.Secure Digital Services.) [HKLM] -- {2C8574B5-6935-4FCE-860E-F4E8602378FF}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: SFR - Kit de connexion - (.SFR.) [HKLM] -- SFR_Kit
O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- KB931906
O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- {0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
O42 - Logiciel: Shockwave - (.Pas de propriétaire.) [HKLM] -- Shockwave
O42 - Logiciel: Shutdown-IT - (.Pas de propriétaire.) [HKLM] -- Shutdown-IT
O42 - Logiciel: Synaptics Pointing Device Driver - (.Synaptics Incorporated.) [HKLM] -- SynTPDeinstKey
O42 - Logiciel: TeamViewer 5 - (.TeamViewer GmbH.) [HKLM] -- TeamViewer 5
O42 - Logiciel: USB2.0 350K WebCam - (.Bisont Electrocnics. Inc..) [HKLM] -- {4A57592C-FF92-4083-97A9-92783BD5AFB4}
O42 - Logiciel: USB2.0 VGA WebCam - (.Pas de propriétaire.) [HKLM] -- USB2.0 VGA WebCam
O42 - Logiciel: Uniblue RegistryBooster - (.Uniblue Systems Ltd.) [HKLM] -- Uniblue RegistryBooster
O42 - Logiciel: Uniblue RegistryBooster - (.Uniblue Systems Ltd.) [HKLM] -- {09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}
O42 - Logiciel: VLC media player 1.1.4 - (.VideoLAN.) [HKLM] -- VLC media player
O42 - Logiciel: Vodafone Mobile Connect Lite - (.Vodafone.) [HKLM] -- {B5761811-28F3-4257-B537-815C5EEF472C}
O42 - Logiciel: WinRAR archiver - (.Pas de propriétaire.) [HKLM] -- WinRAR archiver
O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {B3B487E7-6171-4376-9074-B28082CEB504}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3175E049-F9A9-4A3D-8F19-AC9FB04514D1}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {445B183D-F4F1-45C8-B9DB-F11355CA657B}
O42 - Logiciel: adsl TV - (.adsl TV / FM.) [HKLM] -- {3AFDD2C6-8663-46B5-B195-6CEB00D44768}
O42 - Logiciel: avast! Free Antivirus - (.Alwil Software.) [HKLM] -- avast5
O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}

---\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\Adobe]
[HKCU\Software\Ahead]
[HKCU\Software\AppDataLow\Avg]
[HKCU\Software\AppDataLow\Software\Conduit]
[HKCU\Software\AppDataLow\Software\DigitalPersona]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software\Mp3Tube]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\Avg]
[HKCU\Software\Classes]
[HKCU\Software\CyberLink]
[HKCU\Software\FissaSearch]
[HKCU\Software\Froggie]
[HKCU\Software\GNU]
[HKCU\Software\Gabest]
[HKCU\Software\Haali]
[HKCU\Software\IM Providers]
[HKCU\Software\InstallShield]
[HKCU\Software\Intel]
[HKCU\Software\JavaSoft]
[HKCU\Software\Kayenko]
[HKCU\Software\Lake]
[HKCU\Software\Lavalys]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\LogiShrd]
[HKCU\Software\Macromedia]
[HKCU\Software\Macrovision]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\Netscape]
[HKCU\Software\Neuf]
[HKCU\Software\ODBC]
[HKCU\Software\OfferBox]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\Softonic]
[HKCU\Software\Spointer]
[HKCU\Software\Symbian-Toys]
[HKCU\Software\Synaptics]
[HKCU\Software\TeamViewer]
[HKCU\Software\Trolltech]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\Vodafone]
[HKCU\Software\WideStream]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\freeTVRadio]
[HKLM\Software\ALWIL Software]
[HKLM\Software\ATI Technologies]
[HKLM\Software\Adobe]
[HKLM\Software\Ahead]
[HKLM\Software\Audible]
[HKLM\Software\AuthenTec]
[HKLM\Software\Avg]
[HKLM\Software\BSProductManage]
[HKLM\Software\BisonCam]
[HKLM\Software\Bisont Electrocnics. Inc.]
[HKLM\Software\BrowserChoice]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Conduit]
[HKLM\Software\CyberLink]
[HKLM\Software\Dell]
[HKLM\Software\Driver-Soft]
[HKLM\Software\FUJIFILM]
[HKLM\Software\GNU]
[HKLM\Software\Gabest]
[HKLM\Software\Google]
[HKLM\Software\HaaliMkx]
[HKLM\Software\IVT Corporation]
[HKLM\Software\InstalledOptions]
[HKLM\Software\Intel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\Kayenko]
[HKLM\Software\Lake]
[HKLM\Software\LogiShrd]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MimarSinan]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\Nero]
[HKLM\Software\Neuf]
[HKLM\Software\Nokia]
[HKLM\Software\ODBC]
[HKLM\Software\OfferBox]
[HKLM\Software\Policies]
[HKLM\Software\Realtek Semiconductor Corp.]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SRS Labs]
[HKLM\Software\SecureDigitalServices]
[HKLM\Software\Sonic]
[HKLM\Software\Synaptics]
[HKLM\Software\TeamViewer]
[HKLM\Software\TrueSuite]
[HKLM\Software\Uniblue]
[HKLM\Software\VideoLAN]
[HKLM\Software\Vodafone]
[HKLM\Software\Volatile]
[HKLM\Software\Waves Audio]
[HKLM\Software\WebCam]
[HKLM\Software\WinRAR]
[HKLM\Software\Windows]


---\ Contenu des dossiers ProgramFiles/ProgramData (O43)
O43 - CFD: 23/06/2010 - 12:54:04 ----D- C:\Program Files\Adobe
O43 - CFD: 10/08/2010 - 18:37:00 ----D- C:\Program Files\Alice's Biscuit Light
O43 - CFD: 06/08/2010 - 06:09:24 ----D- C:\Program Files\Alwil Software
O43 - CFD: 23/06/2010 - 12:45:14 ----D- C:\Program Files\AVG
O43 - CFD: 11/09/2010 - 19:10:00 ----D- C:\Program Files\Common Files
O43 - CFD: 25/06/2010 - 09:35:32 ----D- C:\Program Files\CyberLink
O43 - CFD: 25/06/2010 - 14:38:40 ----D- C:\Program Files\DIFX
O43 - CFD: 23/06/2010 - 15:16:04 ----D- C:\Program Files\DVD Maker
O43 - CFD: 09/07/2010 - 09:56:30 ----D- C:\Program Files\Elantech
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\Program Files\Ficheiros comuns
O43 - CFD: 03/11/2010 - 21:42:36 ----D- C:\Program Files\Fluendo
O43 - CFD: 25/06/2010 - 15:00:16 --H-D- C:\Program Files\InstallShield Installation Information
O43 - CFD: 25/06/2010 - 14:32:08 ----D- C:\Program Files\Intel
O43 - CFD: 25/11/2010 - 16:20:40 ----D- C:\Program Files\Internet Explorer
O43 - CFD: 25/06/2010 - 14:40:12 ----D- C:\Program Files\IVT Corporation
O43 - CFD: 24/10/2010 - 21:43:18 ----D- C:\Program Files\Java
O43 - CFD: 09/09/2010 - 09:24:00 ----D- C:\Program Files\Kanguru
O43 - CFD: 08/11/2010 - 05:44:26 ----D- C:\Program Files\Logitech
O43 - CFD: 06/09/2010 - 16:38:24 ----D- C:\Program Files\Microsoft
O43 - CFD: 02/07/2010 - 17:31:46 ----D- C:\Program Files\Microsoft CAPICOM 2.1.0.2
O43 - CFD: 14/07/2009 - 09:56:22 ----D- C:\Program Files\Microsoft Games
O43 - CFD: 09/09/2010 - 09:32:28 ----D- C:\Program Files\Microsoft Office
O43 - CFD: 11/08/2010 - 06:27:52 ----D- C:\Program Files\Microsoft Picture It! PhotoPub
O43 - CFD: 09/09/2010 - 09:32:28 ----D- C:\Program Files\Microsoft.NET
O43 - CFD: 09/09/2010 - 09:31:08 ----D- C:\Program Files\MSBuild
O43 - CFD: 19/09/2010 - 08:16:06 ----D- C:\Program Files\MSECache
O43 - CFD: 25/06/2010 - 13:41:06 ----D- C:\Program Files\MSXML 4.0
O43 - CFD: 25/06/2010 - 09:12:04 ----D- C:\Program Files\Nero
O43 - CFD: 03/11/2010 - 21:22:42 ----D- C:\Program Files\OfferBox
O43 - CFD: 25/06/2010 - 13:32:20 ----D- C:\Program Files\Realtek
O43 - CFD: 14/07/2009 - 05:52:32 ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 18/09/2010 - 08:53:40 ----D- C:\Program Files\SFR
O43 - CFD: 09/07/2010 - 10:49:10 ----D- C:\Program Files\Synaptics
O43 - CFD: 25/11/2010 - 16:02:34 ----D- C:\Program Files\TeamViewer
O43 - CFD: 25/06/2010 - 13:34:46 --H-D- C:\Program Files\Temp
O43 - CFD: 10/09/2010 - 08:21:02 ----D- C:\Program Files\TrueSuite
O43 - CFD: 02/12/2010 - 09:42:08 ----D- C:\Program Files\Uniblue
O43 - CFD: 14/07/2009 - 05:53:24 --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 25/11/2010 - 15:49:46 ----D- C:\Program Files\VideoLAN
O43 - CFD: 19/10/2010 - 17:27:06 ----D- C:\Program Files\Vodafone
O43 - CFD: 23/06/2010 - 15:16:02 ----D- C:\Program Files\Windows Defender
O43 - CFD: 23/06/2010 - 15:16:04 ----D- C:\Program Files\Windows Journal
O43 - CFD: 06/09/2010 - 16:38:20 ----D- C:\Program Files\Windows Live
O43 - CFD: 25/06/2010 - 13:01:42 ----D- C:\Program Files\Windows Live SkyDrive
O43 - CFD: 23/06/2010 - 15:16:04 ----D- C:\Program Files\Windows Mail
O43 - CFD: 17/10/2010 - 16:41:30 ----D- C:\Program Files\Windows Media Player
O43 - CFD: 23/06/2010 - 09:38:08 ----D- C:\Program Files\Windows NT
O43 - CFD: 23/06/2010 - 15:16:04 ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 05:52:34 ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 23/06/2010 - 15:16:04 ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 03/08/2010 - 09:34:42 ----D- C:\Program Files\WinRAR
O43 - CFD: 02/12/2010 - 09:48:58 ----D- C:\Program Files\ZHPDiag
O43 - CFD: 23/06/2010 - 12:54:16 ----D- C:\Program Files\Common Files\Adobe
O43 - CFD: 25/06/2010 - 09:13:04 ----D- C:\Program Files\Common Files\Ahead
O43 - CFD: 25/06/2010 - 09:34:56 ----D- C:\Program Files\Common Files\CyberLink
O43 - CFD: 09/09/2010 - 14:27:14 ----D- C:\Program Files\Common Files\Designer
O43 - CFD: 25/06/2010 - 13:32:00 ----D- C:\Program Files\Common Files\InstallShield
O43 - CFD: 11/09/2010 - 19:10:00 ----D- C:\Program Files\Common Files\Java
O43 - CFD: 09/09/2010 - 14:27:22 ----D- C:\Program Files\Common Files\microsoft shared
O43 - CFD: 14/07/2009 - 03:37:06 ----D- C:\Program Files\Common Files\Services
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\Program Files\Common Files\Sistema
O43 - CFD: 14/07/2009 - 03:37:06 ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 09/09/2010 - 09:28:30 ----D- C:\Program Files\Common Files\System
O43 - CFD: 25/06/2010 - 12:58:32 ----D- C:\Program Files\Common Files\Windows Live
O43 - CFD: 10/09/2010 - 06:07:10 ----D- C:\Program Files\Common Files\Wise Installation Wizard
O43 - CFD: 23/06/2010 - 12:54:50 ----D- C:\ProgramData\Adobe
O43 - CFD: 06/08/2010 - 06:09:24 ----D- C:\ProgramData\Alwil Software
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\ProgramData\Ambiente de trabalho
O43 - CFD: 14/07/2009 - 05:53:56 -SH-D- C:\ProgramData\Application Data
O43 - CFD: 06/08/2010 - 06:36:06 ----D- C:\ProgramData\avg9
O43 - CFD: 09/07/2010 - 05:41:54 ----D- C:\ProgramData\CyberLink
O43 - CFD: 14/07/2009 - 05:53:56 -SH-D- C:\ProgramData\Desktop
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\ProgramData\Documentos
O43 - CFD: 14/07/2009 - 05:53:56 -SH-D- C:\ProgramData\Documents
O43 - CFD: 10/09/2010 - 08:19:24 ----D- C:\ProgramData\Downloaded Installations
O43 - CFD: 14/07/2009 - 05:53:56 -SH-D- C:\ProgramData\Favorites
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\ProgramData\Favoritos
O43 - CFD: 09/07/2010 - 05:41:54 ----D- C:\ProgramData\Installations
O43 - CFD: 10/09/2010 - 07:28:12 ----D- C:\ProgramData\Macrovision
O43 - CFD: 25/11/2010 - 14:33:10 ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\ProgramData\Menu Iniciar
O43 - CFD: 09/09/2010 - 10:41:16 -S--D- C:\ProgramData\Microsoft
O43 - CFD: 09/09/2010 - 09:32:56 ----D- C:\ProgramData\Microsoft Help
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\ProgramData\Modelos
O43 - CFD: 09/07/2010 - 05:41:58 ----D- C:\ProgramData\Nero
O43 - CFD: 14/07/2009 - 05:53:56 -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 25/06/2010 - 12:47:22 ----D- C:\ProgramData\Sun
O43 - CFD: 09/07/2010 - 05:41:58 ----D- C:\ProgramData\Temp
O43 - CFD: 14/07/2009 - 05:53:56 -SH-D- C:\ProgramData\Templates
O43 - CFD: 23/06/2010 - 13:09:38 ----D- C:\ProgramData\TrueSuite
O43 - CFD: 23/06/2010 - 12:54:16 ----D- C:\Program Files\Common Files\Adobe
O43 - CFD: 25/06/2010 - 09:13:04 ----D- C:\Program Files\Common Files\Ahead
O43 - CFD: 25/06/2010 - 09:34:56 ----D- C:\Program Files\Common Files\CyberLink
O43 - CFD: 09/09/2010 - 14:27:14 ----D- C:\Program Files\Common Files\Designer
O43 - CFD: 25/06/2010 - 13:32:00 ----D- C:\Program Files\Common Files\InstallShield
O43 - CFD: 11/09/2010 - 19:10:00 ----D- C:\Program Files\Common Files\Java
O43 - CFD: 09/09/2010 - 14:27:22 ----D- C:\Program Files\Common Files\microsoft shared
O43 - CFD: 14/07/2009 - 03:37:06 ----D- C:\Program Files\Common Files\Services
O43 - CFD: 23/06/2010 - 09:38:08 -SH-D- C:\Program Files\Common Files\Sistema
O43 - CFD: 14/07/2009 - 03:37:06 ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 09/09/2010 - 09:28:30 ----D- C:\Program Files\Common Files\System
O43 - CFD: 25/06/2010 - 12:58:32 ----D- C:\Program Files\Common Files\Windows Live
O43 - CFD: 10/09/2010 - 06:07:10 ----D- C:\Program Files\Common Files\Wise Installation Wizard


---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.38000000000000000000000008EF1200] - 02/12/2010 - 09:48:46 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\WindowsUpdate.log   [1252681]
O44 - LFC:[MD5.3874C39AB255C759379BDFD14B03F835] - 02/12/2010 - 09:44:54 --HA- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0   [16112]
O44 - LFC:[MD5.3874C39AB255C759379BDFD14B03F835] - 02/12/2010 - 09:44:54 --HA- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0   [16112]
O44 - LFC:[MD5.12E325F86D6B9C5A7D1D6D882D1A4895] - 02/12/2010 - 09:37:39 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\bscs.ini   [876]
O44 - LFC:[MD5.BF87BA4A3E3A805A3C40819E0A0D455B] - 02/12/2010 - 09:37:24 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\setupact.log   [1692]
O44 - LFC:[MD5.E8251153F7C3DBD0ADAF6F3D10BF9BDE] - 02/12/2010 - 09:37:23 -S-A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\bootstat.dat   [67584]
O44 - LFC:[MD5.30B5F6E5B6F671A7A55E9ED7181D1975] - 02/12/2010 - 06:47:32 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\PFRO.log   [3726]
O44 - LFC:[MD5.FDAFD8A0F386E2DB6552C294480253DC] - 01/12/2010 - 15:05:11 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\DPINST.LOG   [10070]
O44 - LFC:[MD5.E74DC2F3F9675A6025A4AA020EDD4341] - 29/11/2010 - 17:42:18 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\System32\drivers\mbamswissarmy.sys   [38224]
O44 - LFC:[MD5.9B5CC6C481BDD00A963829B892623247] - 29/11/2010 - 17:42:06 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\System32\drivers\mbam.sys   [20952]
O44 - LFC:[MD5.35BF9BC47031CC4813EFF8AADD33B002] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\PerfStringBackup.INI   [2343498]
O44 - LFC:[MD5.9D64E1DAD12BB76FDF88354CC5D2BC9C] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\perfc009.dat   [105512]
O44 - LFC:[MD5.07FC7D9B429009353E5FAC9871DEC669] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\perfc00C.dat   [129764]
O44 - LFC:[MD5.25A190C2105E8BB2E30F68D7EDAC5279] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\perfh009.dat   [611332]
O44 - LFC:[MD5.27E2F6C245E87728EBE1103D55F8AE49] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\perfh00C.dat   [699376]
O44 - LFC:[MD5.EDBC6688C080BC7962393594D6BF1F1A] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\prfc0816.dat   [132770]
O44 - LFC:[MD5.32A25CD6F37794B8B4E5F4687B75563C] - 27/11/2010 - 06:44:07 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\prfh0816.dat   [674246]
O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 25/11/2010 - 15:55:18 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\config.nt   [2577]


---\ Déni du service (Local Security Authority) (LSA) (O48)
O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll
O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Moteur du client de l'Éditeur de configuration de sécurité Windows.) -- C:\Windows\System32\scecli.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll


---\ MountPoints2 Shell Key (MPSK) (O51)
O51 - MPSK:{7fb734af-8676-11df-95ad-001b7714afd0}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- G:\AutoRun.exe (.not file.)
O51 - MPSK:{837fdccf-8b22-11df-bb65-806e6f6e6963}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{837fdcf2-8b22-11df-bb65-001b7714afd0}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{bdb259a7-8672-11df-9658-001b7714afd0}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ded16b00-ac22-11df-8b6f-00030d000001}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ded16b08-ac22-11df-8b6f-00030d000001}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{e0715f12-8650-11df-85f7-001a92c84fe4}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{e0715f16-8650-11df-85f7-001a92c84fe4}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{e0715f18-8650-11df-85f7-001a92c84fe4}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{e0715f1c-8650-11df-85f7-001a92c84fe4}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{e3d7b61e-db66-11df-b7d1-00030d000001}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\StartVMCLite.exe (.not file.)
O51 - MPSK:{e3d7b62a-db66-11df-b7d1-00030d000001}\Shell\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\StartVMCLite.exe (.not file.)


---\ Trojan Driver Search Data (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"VIDC.I420"="MSh263.drv" . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Codec Cinepak®.) -- C:\Windows\System32\iccvid.dll
O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm


---\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll


---\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3
O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1
O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0


---\ Liste des Drivers Système (SDL) (O58)
O58 - SDL:[MD5.21E785EBD7DC90A06391141AAC7892FB] - 14/07/2009 - 02:26:15 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\system32\drivers\adp94xx.sys
O58 - SDL:[MD5.0C676BC278D5B59FF5ABD57BBE9123F2] - 14/07/2009 - 02:26:17 ---A- . (.Adaptec, Inc. - Adaptec Windows SATA Storport Driver.) -- C:\Windows\system32\drivers\adpahci.sys
O58 - SDL:[MD5.7C7B5EE4B7B822EC85321FE23A27DB33] - 14/07/2009 - 02:26:15 ---A- . (.Adaptec, Inc. - Adaptec StorPort Ultra320 SCSI Driver.) -- C:\Windows\system32\drivers\adpu320.sys
O58 - SDL:[MD5.0D40BCF52EA90FC7DF2AEAB6503DEA44] - 14/07/2009 - 02:26:15 ---A- . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\Windows\system32\drivers\aliide.sys
O58 - SDL:[MD5.2101A86C25C154F8314B24EF49D7FBC2] - 14/07/2009 - 02:26:15 ---A- . (.Advanced Micro Devices - AHCI 1.2 Device Driver.) -- C:\Windows\system32\drivers\amdsata.sys
O58 - SDL:[MD5.EA43AF0C423FF267355F74E7A53BDABA] - 14/07/2009 - 02:26:15 ---A- . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller Driver for Windows fa.) -- C:\Windows\system32\drivers\amdsbs.sys
O58 - SDL:[MD5.B81C2B5616F6420A9941EA093A92B150] - 14/07/2009 - 02:26:15 ---A- . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\system32\drivers\amdxata.sys
O58 - SDL:[MD5.2932004F49677BD84DBC72EDB754FFB3] - 14/07/2009 - 02:26:15 ---A- . (.Adaptec, Inc. - Adaptec RAID Storport Driver.) -- C:\Windows\system32\drivers\arc.sys
O58 - SDL:[MD5.5D6F36C46FD283AE1B57BD2E9FEB0BC7] - 14/07/2009 - 02:26:15 ---A- . (.Adaptec, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\system32\drivers\arcsas.sys
O58 - SDL:[MD5.A0D86B8AC93EF95620420C7A24AC5344] - 07/09/2010 - 15:47:07 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\Windows\system32\drivers\aswFsBlk.sys
O58 - SDL:[MD5.BD9119468C32B7ECD1E0544D3F286A73] - 07/09/2010 - 15:47:30 ---A- . (.AVAST Software - avast! File System Minifilter for Windows 2003/Vista.) -- C:\Windows\system32\drivers\aswMonFlt.sys
O58 - SDL:[MD5.69823954BBD461A73D69774928C9737E] - 07/09/2010 - 15:47:46 ---A- . (.AVAST Software - avast! TDI RDR Driver.) -- C:\Windows\system32\drivers\aswRdr.sys
O58 - SDL:[MD5.7ECC2776638B04553F9A85BD684C3ABF] - 07/09/2010 - 15:52:03 ---A- . (.AVAST Software - avast! self protection module.) -- C:\Windows\system32\drivers\aswSP.sys
O58 - SDL:[MD5.095ED820A926AA8189180B305E1BCFC9] - 07/09/2010 - 15:52:25 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\Windows\system32\drivers\aswTdi.sys
O58 - SDL:[MD5.97AFFA9D95FFE20EEE6229BC6BE166CF] - 31/07/2007 - 01:39:00 ---A- . (.ATK0100 - ATK0100 ACPI Utility.) -- C:\Windows\system32\drivers\ATKACPI.sys
O58 - SDL:[MD5.7C9E8F49ABF92176A11539001E2D24D5] - 01/09/2009 - 08:44:44 ---A- . (.AuthenTec, Inc. - AuthenTec Swipe Sensor WBF WDF USB Driver.) -- C:\Windows\system32\drivers\ATSwpWDF.sys
O58 - SDL:[MD5.BD8869EB9CDE6BBE4508D869929869EE] - 13/07/2009 - 23:02:49 ---A- . (.Broadcom Corporation - Pilote unifié NDIS6.x Broadcom NetXtreme Gigabit Ethernet..) -- C:\Windows\system32\drivers\b57nd60x.sys
O58 - SDL:[MD5.B990976940E0E93B4932CCCB536F446D] - 19/03/2007 - 09:59:16 ---A- . (.Broadcom Corporation - USB Driver for Bluetooth Adapter.) -- C:\Windows\system32\drivers\bcbthub.sys
O58 - SDL:[MD5.232D5686AA08E8ACD3C3203C86559ACE] - 20/11/2006 - 17:49:56 ---A- . (.Bison Electronics. Inc. - Universal Serial Bus Camera Driver.) -- C:\Windows\system32\drivers\BisonCam.sys
O58 - SDL:[MD5.BC0E1C15E6FB3E20CD558F496EA684A0] - 25/11/2008 - 14:23:30 ---A- . (.IVT Corporation. - Bluelet Audio Driver.) -- C:\Windows\system32\drivers\blueletaudio.sys
O58 - SDL:[MD5.5F81A2D1ABC1E480C6152F7B9E446BFA] - 25/11/2008 - 14:23:38 ---A- . (.IVT Corporation. - Bluelet Audio Driver.) -- C:\Windows\system32\drivers\BlueletSCOAudio.sys
O58 - SDL:[MD5.9F9ACC7F7CCDE8A15C282D3F88B43309] - 13/07/2009 - 23:53:28 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver.) -- C:\Windows\system32\drivers\BrFiltLo.sys
O58 - SDL:[MD5.56801AD62213A41F6497F96DEE83755A] - 13/07/2009 - 23:53:28 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver.) -- C:\Windows\system32\drivers\BrFiltUp.sys
O58 - SDL:[MD5.845B8CE732E67F3B4133164868C666EA] - 14/07/2009 - 01:57:25 ---A- . (.Brother Industries Ltd. - Pilote Brother Série I/F (WDM).) -- C:\Windows\system32\drivers\BrSerId.sys
O58 - SDL:[MD5.203F0B1E73ADADBBB7B7B1FABD901F6B] - 13/07/2009 - 23:53:32 ---A- . (.Brother Industries Ltd. - Brother Serial driver (WDM version).) -- C:\Windows\system32\drivers\BrSerWdm.sys
O58 - SDL:[MD5.BD456606156BA17E60A04E18016AE54B] - 13/07/2009 - 23:53:33 ---A- . (.Brother Industries Ltd. - Brother USB MDM Driver.) -- C:\Windows\system32\drivers\BrUsbMdm.sys
O58 - SDL:[MD5.AF72ED54503F717A43268B3CC5FAEC2E] - 13/07/2009 - 23:53:33 ---A- . (.Brother Industries Ltd. - Brother USB Serial Driver.) -- C:\Windows\system32\drivers\BrUsbSer.sys
O58 - SDL:[MD5.942C602296119D758547808221C85A2C] - 03/01/2009 - 15:40:12 ---A- . (.IVT Corporation. - Bluetooth USB Device Driver.) -- C:\Windows\system32\drivers\btcusb.sys
O58 - SDL:[MD5.CE441CCD98C5ECB10CB12FCAF97322EC] - 07/01/2009 - 22:39:36 ---A- . (.IVT Corporation. - Bluetooth HID BUS Driver.) -- C:\Windows\system32\drivers\BtHidBus.sys
O58 - SDL:[MD5.D3C277A51EF9E2EC972D6221F99C0B6D] - 07/12/2008 - 11:44:54 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\system32\drivers\btnetBus.sys
O58 - SDL:[MD5.28D6D39B98EECBB6DFFBCEC2A740FF89] - 07/12/2008 - 11:44:50 ---A- . (.IVT Corporation. - Bluetooth PAN Network Adapter Driver.) -- C:\Windows\system32\drivers\btnetdrv.sys
O58 - SDL:[MD5.4F26303BECBB7CC5CA8FF39593124CF2] - 22/11/2006 - 12:41:18 ---A- . (.IVT Corporation. - Bluetooth Network Filter Driver.) -- C:\Windows\system32\drivers\BTNetFilter.sys
O58 - SDL:[MD5.1A231ABEC60FD316EC54C66715543CEC] - 13/07/2009 - 23:02:48 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\system32\drivers\bxvbdx.sys
O58 - SDL:[MD5.C537B1DB64D495B9B4717B4D6D9EDBF2] - 14/07/2009 - 02:26:21 ---A- . (.CMD Technology, Inc. - CMD PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\cmdide.sys
O58 - SDL:[MD5.8B30250D573A8F6B4BD23195160D8707] - 14/07/2009 - 02:20:28 ---A- . (.Adaptec, Inc. - Adaptec Ultra SCSI miniport.) -- C:\Windows\system32\drivers\djsvs.sys
O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\system32\drivers\elxstor.sys
O58 - SDL:[MD5.024E1B5CAC09731E4D868E64DBFB4AB0] - 13/07/2009 - 23:02:48 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\system32\drivers\evbdx.sys
O58 - SDL:[MD5.84FD5702D136098E91B2770BA058DEDA] - 15/10/2007 - 16:27:10 ---A- . (.Huawei Technologies Co., Ltd. - USB Modem/Serial Device Driver.) -- C:\Windows\system32\drivers\ewusbmdm.sys
O58 - SDL:[MD5.4198F23618E7C8BCD24CC108C36F93A3] - 19/03/2007 - 09:59:18 ---A- . (.Broadcom - BBTFW_2_15_007.) -- C:\Windows\system32\drivers\fw203x.sys
O58 - SDL:[MD5.C44E3C2BAB6837DB337DDEE7544736DB] - 13/07/2009 - 23:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\system32\drivers\hcw85cir.sys
O58 - SDL:[MD5.295FDC419039090EB8B49FFDBB374549] - 14/07/2009 - 02:20:28 ---A- . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Driver.) -- C:\Windows\system32\drivers\HpSAMD.sys
O58 - SDL:[MD5.934AF4D7C5F457B9F0743F4299B77B67] - 14/07/2009 - 02:20:36 ---A- . (.Intel Corporation - Intel Matrix Storage Manager driver - ia32.) -- C:\Windows\system32\drivers\iaStorV.sys
O58 - SDL:[MD5.9467514EA189475A6E7FDC5D7BDE9D3F] - 23/09/2009 - 18:18:14 ---A- . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\Windows\system32\drivers\igdkmd32.sys
O58 - SDL:[MD5.4173FF5708F3236CF25195FECD742915] - 14/07/2009 - 02:20:36 ---A- . (.Intel Corp./ICP vortex GmbH - Intel/ICP Raid Storport Driver.) -- C:\Windows\system32\drivers\iirsp.sys
O58 - SDL:[MD5.71E1FC547CC488D5CD7BF0860C96F5AF] - 02/07/2008 - 13:58:48 ---A- . (.IVT Corporation. - IVT Bluetooth Bus Device Driver.) -- C:\Windows\system32\drivers\IvtBtBus.sys
O58 - SDL:[MD5.69E35A38E573E12E2D20634233403D8D] - 18/11/2006 - 09:55:26 ---A- . (.ELANTECH Devices Corp. - KTP Ware Filter Driver.) -- C:\Windows\system32\drivers\Ktp.sys
O58 - SDL:[MD5.EB119A53CCF2ACC000AC71B065B78FEF] - 14/07/2009 - 02:20:36 ---A- . (.LSI Corporation - LSI Fusion-MPT FC Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_fc.sys
O58 - SDL:[MD5.8ADE1C877256A22E49B75D1CC9161F9C] - 14/07/2009 - 02:20:37 ---A- . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas.sys
O58 - SDL:[MD5.DC9DC3D3DAA0E276FD2EC262E38B11E9] - 14/07/2009 - 02:20:36 ---A- . (.LSI Corporation - LSI SAS Ge

claztum · Answer

re,

j'ai un peu du mal a suivre, je pense avoir compris, voici le lien de l'analyse



http://www.cijoint.fr/cjlink.php?file=cj201012/cijjlAlZXa.txt

anthony5151 · Answer

Je n'avais pas vu que tu avais ouvert un autre sujet, je te laisse continuer avec Tigzy : https://forums.commentcamarche.net/forum/affich-20017231-dossiers-disparus

claztum · Answer

Ne pourrions nous pas poursuivre, se sera un peu laborieux, mais je ferais de mon mieux

anthony5151 · Answer

Non, ça ne sert à rien qu'on soit deux à t'aider pour désinfecter ton ordinateur. Tigzy fera ça très bien, ne t'inquiète pas ;)

claztum · Answer

Cher anthony5151

Je ne voudrais pas insister, mais les deux probleme ne sont pas les memes, cela concerne deux PC differents.
1 PC est windows 7 avec virus en quarantaine,  et l'autre est windows XP avec dossiers disparus

anthony5151 · Answer

Je n'avais pas compris que c'était pour deux ordinateurs différents, dans ce cas je peux t'aider ;)


Ton ordinateur est infecté par l'adware OfferBox. Cet adware s'installe soit via des publicités (il ne faut jamais installer un programme proposé dans une pub), soit il est proposé en complément lors de l'installation d'un autre programme (pour éviter ça, il faut tout lire attentivement lorsque tu installes un programme gratuit, et décocher tous les programmes additionnels qui sont proposés).
Plus d'infos ici

Pour t'en débarrasser :

* Télécharge AD-Remover (de C_XX) sur ton Bureau.
/!\ Déconnecte toi et ferme toutes les applications en cours /!\
* Double-clique sur l'icône AD-Remover
* Au menu principal, clique sur "Nettoyer"
* Confirme le lancement de l'analyse et laisse l'outil travailler
* Poste le rapport qui apparait à la fin (il est aussi sauvegardé sous C:\Ad-report.log )


Ensuite, lance Malwarebytes' Anti-Malware, mets le à jour et lance un examen rapide.


Enfin, fais redémarrer ton ordinateur et poste un nouveau rapport ZHPDiag stp.

claztum · Answer

======= REPORT FROM AD-REMOVER 2.0.0.2,B | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 11/11/10 at 11:40
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 16:03:34 on 02/12/2010, Normal boot

Microsoft Windows 7 Édition Familiale Premium   (X86) 
Utilizador@UTILISATEUR-PC (Packard Bell BV EasyNote_BU45) 
 
============== ACTION(S) ==============


File deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OfferBox Browser.lnk
Folder deleted: C:\Users\Utilizador\AppData\Roaming\FissaSearch
Folder deleted: C:\Users\Utilizador\AppData\Roaming\freeTVRadio
Folder deleted: C:\Users\Utilizador\AppData\Roaming\OfferBox
Folder deleted: C:\Program Files\OfferBox

(!) -- Temporary files deleted.


Key deleted: HKLM\Software\Classes\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}
Key deleted: HKLM\Software\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Key deleted: HKLM\Software\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}
Key deleted: HKLM\Software\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}
Key deleted: HKLM\Software\Classes\OfferBox.OfferBoxServer
Key deleted: HKLM\Software\Classes\OfferBox.OfferBoxServer.1
Key deleted: HKLM\Software\Classes\Toolbar.CT2405727
Key deleted: HKLM\Software\OfferBox
Key deleted: HKLM\Software\Conduit
Key deleted: HKCU\Software\OfferBox
Key deleted: HKCU\Software\FissaSearch
Key deleted: HKCU\Software\freeTVRadio
Key deleted: HKCU\Software\Spointer
Key deleted: HKCU\Software\AppDataLow\Software\Conduit
Key deleted: HKLM\Software\Classes\Installer\Products\5B4758C25396ECF468E04F8E063287FF
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\5B4758C25396ECF468E04F8E063287FF
Key deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{b41306c6-96d0-442a-bcc4-b0f621e82ce9}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2C8574B5-6935-4FCE-860E-F4E8602378FF}
Key deleted: HKLM\Software\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom

Value deleted: HKLM\Software\Mozilla\Firefox\Extensions|offerboxffx@offerbox.com


============== ADDITIONNAL SCAN ==============

** Internet Explorer Version [8.0.7600.16385] **

[HKCU\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main] 
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS] 
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 21 File(s)
C:\Program Files\Ad-Remover\Backup: 13 File(s)

C:\Ad-Report-CLEAN[1].txt - 02/12/2010 (4050 Byte(s)) 

End at: 16:06:29, 02/12/2010 
 
============== E.O.F ============== 

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 5233

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

02/12/2010 16:24:53
mbam-log-2010-12-02 (16-24-53).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 130527
Temps écoulé: 4 minute(s), 30 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


Lien ZHPDiag


http://www.cijoint.fr/cjlink.php?file=cj201012/cijlfrYOjh.txt

anthony5151 · Answer

Il y a une infection de disques amovibles :

* Télécharge USBFix (de El desaparecido et C_XX) sur ton Bureau
* Branche tes sources de données externes à ton PC (clé USB, disque dur externe, lecteur mp3 etc...) sans les ouvrir
* Fais un clic droit sur le programme USBFix et choisis 'Exécuter en tant qu'administrateur'.
* Au menu principal, clique sur "Suppression"
* Ton Bureau va disparaitre, puis l'ordinateur va redémarrer : c'est normal
* Laisse travailler l'outil jusqu'au bout
* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse stp

Aide en images : Nettoyage


Ce script va cibler certains éléments à supprimer :

* Ouvre ce lien, sélectionne le script en entier et copie le (Edition --> Copier)
* Fais un clic-droit sur le raccourci de ZHPFix et choisis "Exécuter en temps qu'administrateur"
* Clique sur l'icone représentant la lettre H (« coller les lignes Helper »). Le script doit automatiquement apparaitre dans ZHPFix.
* Clique sur « Tous », puis sur « Nettoyer »
* L'outil va travailler et va notamment lancer la désinstallation de "Uniblue RegistryBooster" --> mène la jusqu'au bout (ce programme est litigieux)
* Copie/colle la totalité du rapport dans ta prochaine réponse.


Enfin, fais redémarrer ton ordinateur et poste un nouveau rapport ZHPDiag (sans doute le dernier avant les conseils de finition)

claztum · Answer

re, voici le rapport USB


############################## | UsbFix 7.035 | [Deletion]

User: Utilizador (Administrator) # UTILISATEUR-PC [Packard Bell BV EasyNote_BU45]
Updated 22/11/10 by El Desaparecido / C_XX
Started at 03:40:54 | 04/12/2010
Website: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Intel(R) Core(TM)2 CPU T5300 @ 1.73GHz
CPU 2: Intel(R) Core(TM)2 CPU T5300 @ 1.73GHz
Microsoft Windows 7 Édition Familiale Premium  (6.1.7600 32-Bit) # 
Internet Explorer 8.0.7600.16385

Windows Firewall: Enabled
RAM -> 1015 Mb 
C:\ (%systemdrive%) -> Fixed drive # 83 Gb (63 Mb free - 76%) [Windows 7] # NTFS
D:\ -> CD-ROM
E:\ -> Removable drive # 982 Mb (977 Mb free - 99%) [CARTE SD 1G] # FAT
F:\ -> Fixed drive # 66 Gb (62 Mb free - 94%) [Programmes & Logiciels] # NTFS
G:\ -> CD-ROM
H:\ -> Removable drive # 4 Gb (4 Mb free - 100%) [TDK- 4GB] # FAT32

################## | Files # Infected Folders |


Deleted ! C:\$RECYCLE.BIN\S-1-5-21-2789567077-2640352481-2444775924-1000
Deleted ! F:\$RECYCLE.BIN\S-1-5-21-2789567077-2640352481-2444775924-1000
Not deleted ! G:\AUTORUN.INF

################## | Registry |

Deleted ! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{775d0c95-ff1f-11df-85e8-806e6f6e6963}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{837fdccf-8b22-11df-bb65-806e6f6e6963}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{bdb259a7-8672-11df-9658-001b7714afd0}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{ded16b08-ac22-11df-8b6f-00030d000001}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{e0715f16-8650-11df-85f7-001a92c84fe4}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{e0715f1c-8650-11df-85f7-001a92c84fe4}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{e3d7b61e-db66-11df-b7d1-00030d000001}

################## | Listing |

[04/12/2010 - 03:42:19 | SHD ] 	C:\$Recycle.Bin
[23/06/2010 - 13:39:47 | D ] 	C:\2c6c7fe5e26117ec1a151ee53a
[02/12/2010 - 16:06:30 | N | 4180] 	C:\Ad-Report-CLEAN[1].txt
[02/12/2010 - 16:14:19 | N | 1995] 	C:\Ad-Report-SCAN[1].txt
[10/06/2009 - 22:42:20 | N | 24] 	C:\autoexec.bat
[25/06/2010 - 13:41:38 | D ] 	C:\cd0f3179c0ec8856520b1f1e4add
[03/12/2010 - 18:07:35 | D ] 	C:\Config.Msi
[10/06/2009 - 22:42:20 | N | 10] 	C:\config.sys
[14/07/2009 - 05:53:55 | SHD ] 	C:\Documents and Settings
[25/06/2010 - 14:02:15 | D ] 	C:\drivers
[04/12/2010 - 03:16:00 | ASH | 798466048] 	C:\hiberfil.sys
[05/07/2010 - 17:34:14 | D ] 	C:\hp
[25/06/2010 - 14:31:31 | D ] 	C:\Intel
[04/12/2010 - 03:16:09 | ASH | 1073741824] 	C:\pagefile.sys
[14/07/2009 - 03:37:05 | D ] 	C:\PerfLogs
[03/12/2010 - 18:07:35 | D ] 	C:\Program Files
[23/06/2010 - 09:38:06 | D ] 	C:\Programas
[03/12/2010 - 21:54:11 | HD ] 	C:\ProgramData
[23/06/2010 - 09:38:06 | SHD ] 	C:\Recovery
[04/12/2010 - 03:25:11 | SHD ] 	C:\System Volume Information
[02/12/2010 - 06:45:15 | D ] 	C:\Temp
[04/12/2010 - 03:42:19 | D ] 	C:\UsbFix
[04/12/2010 - 03:40:59 | A | 3008] 	C:\UsbFix.txt
[23/06/2010 - 09:38:52 | D ] 	C:\Users
[01/12/2010 - 15:05:06 | D ] 	C:\Windows
[27/11/2010 - 09:51:28 | D ] 	E:\DCIM
[04/12/2010 - 03:42:19 | SHD ] 	F:\$RECYCLE.BIN
[09/09/2010 - 10:49:12 | D ] 	F:\avast
[02/12/2010 - 06:03:42 | D ] 	F:\programme file
[04/12/2010 - 03:22:58 | SHD ] 	F:\System Volume Information
[04/04/2007 - 18:02:54 | R | 102400] 	G:\AutoRun.exe
[17/04/2007 - 10:47:36 | R | 46] 	G:\AUTORUN.INF
[04/04/2007 - 18:05:04 | R | 106496] 	G:\DataCard_Setup.exe
[26/04/2007 - 16:50:16 | R | 143360] 	G:\DataCard_Setup64.exe
[24/04/2007 - 12:12:34 | D ] 	G:\Drivers
[10/04/2007 - 17:08:34 | D ] 	G:\Mobile Connect
[19/07/2006 - 18:23:06 | R | 6144] 	G:\ResetDevice.exe
[31/08/2006 - 19:04:48 | R | 1406] 	G:\Signal.ico
[06/10/2006 - 13:55:48 | R | 364] 	G:\SysConfig.dat
[02/12/2010 - 05:04:46 | N | 11004] 	H:\index.htm
[02/12/2010 - 05:04:36 | N | 111104] 	H:\index.xls
[02/12/2010 - 05:13:12 | D ] 	H:\index_fichiers
[02/12/2010 - 04:59:12 | N | 105042] 	H:\construction.gif

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
E:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
F:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
G:\Autorun.inf -> Folder created by Panda USB Vaccine
H:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_UTILISATEUR-PC.zip
http://www.teamxscript.org/Upload.php
Thank you for your contribution.

################## | E.O.F |

claztum · Answer

lien ZHPDiag


http://www.cijoint.fr/cjlink.php?file=cj201012/cijVcplbsQ.txt

anthony5151 · Answer

As-tu encore des problèmes ? Avast détecte-t-il quelque chose ? (si oui quel fichier et à quel endroit ?)
Sinon on pourra passer aux conseils de finition ;)

claztum · Answer

salut anthony5151

A chaque fois que je viens sur le site de CCM j'ai une attaque de "LSASS" 
je te marque ce qui est affiché:
objet: 75.92.23.227;445/tcp
          LSASS Exploit (E2K)
          A été bloqué par avast
Il y a juste les chiffres qui changent, a part ça, tout va bien.

Virus en quarantaine

14 réponses

Discussions similaires

Newsletters