trojan Résolu

Question

Bonjour, apres le boot matinal, je vois MSE désactivé, en bon jeune qui se respecte, je lance donc une analyse malwarebytes, qui me trouve deux trojan (BCMiner et MRGGen) hop quarantaine reboot, toujours MSE désactivé, un p'ti combofix, il me trouve plein de bordel, reboot, toujours pas de MSE, un p'ti Ad-remover, reboot, toujours pas ! 
Alors bon, dernier recours, venir ici ^^ 
j'ai zhpdiag si vous voulez tout voir


Configuration: Windows 7 / Firefox 13.0.1

ZeKzU · Answer

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | 2.706 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Mis à jour le 06/07/2012 |08.30 par g3n-h@ckm@n
~ Informations Evolution : https://gen-hackman.kanak.fr/
~ Informations sur les switchs Pre_Script : https://gen-hackman.kanak.fr/
~ Feedback Pre_scan : https://gen-hackman.kanak.fr/#505
~ Merci à C_XX , Slyk & Saachaa pour leur apport à l'évolution de l'outil

~ Utilisateur : GuiGui (Administrateurs) | SID = S-1-5-21-2469631386-82068602-2986095981-1000
~ Ordinateur : GUIGUI-PC

~ Système d'exploitation : Windows 7 Professional (64 bits) Professional Service Pack 1
~ Type d'installation : Client
~ Enregistré sous : GuiGui
~ Processeur : Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz
~ Identification : Intel64 Family 6 Model 42 Stepping 7

Pare-feu windows : Actif
Windows Defender : Inactif

~ Mémoire RAM = Total (KB) : 4177270 | Used (%) : 24 | Free (KB) : 3146510
~ Pagefile = Total (KB) : 8352690 | Free (KB) : 7239240
~ Virtuelle = Total (KB) : 4194180 | Free (KB) : 4025400

¤¤¤¤¤¤¤¤¤¤ | Scripts de boot


¤¤¤¤¤¤¤¤¤¤ | Drives

c:\ -> [Fixed] | [] | Total : 57230 Mo | Free : 15430 Mo -> NTFS
d:\ -> [Fixed] | [] | Total : 953860 Mo | Free : 544820 Mo -> NTFS

Scan : 14:20:35 | 06/07/2012

¤¤¤¤¤¤¤¤¤¤ | Navigateurs

Internet Explorer : 9.0.8112.16421
Mozilla Firefox : 13.0.1 (fr)

¤ Par défaut :

[HKCR\http | command] : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome


¤¤¤¤¤¤¤¤¤¤ | Frameworks

~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.0.3705
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.1.4322
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.0.3705
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.1.4322
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v2.0.50727
~ [14/07/2009 07:32:38] - C:\Windows\Microsoft.net\Framework\v3.0
~ [14/07/2009 07:32:38] - C:\Windows\Microsoft.net\Framework\v3.5
~ [28/07/2011 17:41:53] - C:\Windows\Microsoft.net\Framework\v4.0.30319

¤¤¤¤¤¤¤¤¤¤ | Windows Updates



¤¤¤¤¤¤¤¤¤¤ | Sessions | Profiles | Directories

~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1000] : ProfileImagePath -> C:\Users\GuiGui
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1000] : RefCount -> 3
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1000] : State -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1003] : ProfileImagePath -> C:\Users\UpdatusUser
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1003] : RefCount -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1003] : State -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1004] : ProfileImagePath -> C:\Users\UpdatusUser
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1004] : RefCount -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1004] : State -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1006] : ProfileImagePath -> C:\Users\UpdatusUser
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1006] : RefCount -> 1
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1006] : State -> 0

~ C:\Windows\system32\config\systemprofile
~ C:\Windows\ServiceProfiles\LocalService
~ C:\Windows\ServiceProfiles\NetworkService
~ C:\Users\GuiGui
~ C:\Users\UpdatusUser
~ C:\Users\UpdatusUser
~ C:\Users\UpdatusUser

[HKLM | ProfileLoader\{F5441CBB-AE7D-4495-905B-161047E58936}] : DllName -> userenv.dll

Nouveau point de restauration créé


¤¤¤¤¤¤¤¤¤¤ | Contrôle MD5

[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] - (6.1.7601.17567) - C:\Windows\explorer.exe
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.17567) - C:\Windows\ERDNT\cache86\explorer.exe
[MD5.AC4C51EB24AA95B77F705AB159189E24] - [21/11/2010 05:24:11] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2805 Ko] -  (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.17567) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[MD5.3B69712041F3D63605529BD66DC00C48] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.21669) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[MD5.40D777B7A95E00593EB1568C68514493] - [21/11/2010 05:24:25] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.17514) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.17567) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[MD5.0FB9C74046656D1579A64660AD67B746] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.21669) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. Tous droits réservés. - Processus d'exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) - C:\Windows\System32\csrss.exe
[MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. Tous droits réservés. - Processus d'exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe -> 
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [14/07/2009 01:19:46] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\System32\services.exe
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache64\services.exe
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [14/07/2009 01:19:46] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[MD5.1911A3356FA3F77CCC825CCBAC038C2A] - [14/07/2009 01:19:50] - (.© Microsoft Corporation. Tous droits réservés. - Gestionnaire de sessions Windows.) - [110 Ko] - (6.1.7600.16385) - C:\Windows\System32\smss.exe
[MD5.1911A3356FA3F77CCC825CCBAC038C2A] - [14/07/2009 01:19:50] - (.© Microsoft Corporation. All rights reserved. - Windows Session Manager.) - [110 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [21/11/2010 05:24:28] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\System32\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [21/11/2010 05:23:55] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\SysWOW64\userinit.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache64\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache86\userinit.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [21/11/2010 05:24:28] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [21/11/2010 05:23:55] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\System32\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [14/07/2009 01:36:49] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\SysWOW64\wininit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache64\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache86\wininit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [14/07/2009 01:36:49] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [21/11/2010 05:24:29] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\winlogon.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache64\winlogon.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [21/11/2010 05:24:29] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - [15/02/2012 00:46:32] - (.© Microsoft Corporation. Tous droits réservés. - Ancillary Function Driver for WinSock.) - [487 Ko] - (6.1.7601.17752) - C:\Windows\System32\drivers\afd.sys
[MD5.D31DC7A16DEA4A9BAF179F3D6FBDB38C] - [21/11/2010 05:24:08] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [488 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[MD5.D5B031C308A409A0A576BFF4CF083D30] - [28/07/2011 16:59:53] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7601.17603) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - [15/02/2012 00:46:32] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [487 Ko] - (6.1.7601.17752) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys
[MD5.F4AD06143EAC303F55D0E86C40802976] - [28/07/2011 16:59:53] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7601.21712) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
[MD5.36A14FD1A23F57046361733B792CA8DB] - [15/02/2012 00:46:32] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [486.5 Ko] - (6.1.7601.21887) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [16/12/2011 17:09:39] - (.© Microsoft Corporation. All rights reserved. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache64\atapi.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. All rights reserved. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\System32\drivers\atapi.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. All rights reserved. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
[MD5.F036CE71586E93D94DAB220D7BDF4416] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. All rights reserved. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers\cdrom.sys
[MD5.F036CE71586E93D94DAB220D7BDF4416] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. All rights reserved. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_bdcf6151ba66f48b\cdrom.sys
[MD5.09594D1089C523423B32A4229263F068] - [21/11/2010 05:23:51] - (.© Microsoft Corporation. All rights reserved. - MBT Transport driver.) - [255.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers
etbt.sys
[MD5.09594D1089C523423B32A4229263F068] - [21/11/2010 05:23:51] - (.© Microsoft Corporation. All rights reserved. - MBT Transport driver.) - [255.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6
etbt.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [06/07/2012 12:26:07] - (.© Microsoft Corporation. All rights reserved. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache64	dx.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [21/11/2010 05:24:32] - (.© Microsoft Corporation. All rights reserved. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers	dx.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [21/11/2010 05:24:32] - (.© Microsoft Corporation. All rights reserved. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.1.7601.17514_none_4863cdbaf2b532f8	dx.sys
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. Tous droits réservés. - Pilote de cliché instantané du volume.) - [288.88 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers\volsnap.sys
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. All rights reserved. - Volume Shadow Copy Driver.) - [288.88 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_volume.inf_31bf3856ad364e35_6.1.7601.17514_none_73dcbcf012b4850e\volsnap.sys

14:20:54

¤¤¤¤¤¤¤¤¤¤ | Processus

nvSCPAPISvr.exe (796) -> Processus stoppé 
PresentationFontCache.exe (840) -> Processus stoppé 
WUDFHost.exe (1180) -> Processus stoppé 
spoolsv.exe (1440) -> Processus stoppé 
ooemcgats.exe (1616) -> Processus stoppé 
taskhost.exe (1716) -> Processus stoppé 
GranolaManager.exe (1736) -> Processus stoppé 
hamachi-2.exe (1896) -> Processus stoppé 
explorer.exe (1936) -> Processus stoppé 
oodag.exe (1728) -> Processus stoppé 
TimeMgmtDaemon.exe (1152) -> Processus stoppé 
SolutoService.exe (2044) -> Processus stoppé 
RPMDaemon.exe (2924) -> Processus stoppé 
LCore.exe (2092) -> Processus stoppé 
RAVCpl64.exe (2156) -> Processus stoppé 
SetPoint.exe (2140) -> Processus stoppé 
msseces.exe (2120) -> Processus stoppé 
sidebar.exe (2220) -> Processus stoppé 
granola.exe (2304) -> Processus stoppé 
flux.exe (2264) -> Processus stoppé 
KHALMNPR.exe (2800) -> Processus stoppé 
nusb3mon.exe (2904) -> Processus stoppé 
WMPSideShowGadget.exe (3536) -> Processus stoppé 
wmplayer.exe (3660) -> Processus stoppé 
SearchIndexer.exe (3972) -> Processus stoppé 
wmpnetwk.exe (4060) -> Processus stoppé 
taskhost.exe (3244) -> Processus stoppé 
firefox.exe (2084) -> Processus stoppé 
AlarmClock.exe (4220) -> Processus stoppé 
LMS.exe (4784) -> Processus stoppé 
mbamservice.exe (4812) -> Processus stoppé 
UNS.exe (4936) -> Processus stoppé 
plugin-container.exe (1104) -> Processus stoppé 
FlashPlayerPlugin_11_3_300_262.exe (1708) -> Processus stoppé 
FlashPlayerPlugin_11_3_300_262.exe (4428) -> Processus stoppé 
Steam.exe (4240) -> Processus stoppé 
SteamService.exe (1972) -> Processus stoppé 
Agent.exe (520) -> Processus stoppé 
conhost.exe (3824) -> Processus stoppé 
Diablo III.exe (3264) -> Processus stoppé 
winamp.exe (4400) -> Processus stoppé 
SearchProtocolHost.exe (4480) -> Processus stoppé 

¤¤¤¤¤¤¤¤¤¤ | Processus en cours

Demarrage : Normal  

4652 | D:\Mes documents\winlogon.exe - GuiGui - Normal - "D:\Mes documents\winlogon.exe"  - 2084
1732 | C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe - Système - Normal - "C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe" - 564
3432 | C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe - Système - Normal - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe" - 564
3500 | C:\Pre_Scan\Pv.exe - GuiGui - Normal - C:\Pre_Scan\Pv.exe  -o"%i | %f - %u - %p - %l - %r" - 2460

¤¤¤¤¤¤¤¤¤¤ | Winlogon


¤

[HKLM | Winlogon] | Shell : Explorer.exe
[HKLM | Winlogon] | AutoRestartShell : 1 -> 0
[HKLM | Winlogon] | userinit : C:\Windows\system32\userinit.exe,
[HKLM | Winlogon] | PowerDownAfterShutdown :  -> 1
[HKLM | Winlogon] | System : 

¤¤¤¤¤¤¤¤¤¤ | Associations

[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : ComFile
[comfile | command] : "%1" %*
[.reg] : regfile
[regfile | command] : regedit.exe "%1"
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
[.url] : InternetShortcut
[InternetShortcut | command] : "C:\Windows\System32undll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
[Application.Manifest | command] : rundll32.exe dfshim.dll,ShOpenVerbApplication %1
[Application.Reference | command] : rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2
[Folder | command] : C:\Windows\Explorer.exe -> C:\Windows\explorer.exe

¤

[Firefox | Command] | @ : C:\Program Files (x86)\Mozilla Firefox\firefox.exe -> "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
[Firefox - Safemode | Command] | @ : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode
[IE | Command] | @ : "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
[Assoc | Applications] | @ : http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s -> http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s

¤¤¤¤¤¤¤¤¤¤ | Corrections diverses

[HKLM | HideDesktopIcons\ClassicStartMenu] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {F02C1A0D-BE21-4350-88B0-7367FC96EF3C} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {208D2C60-3AEA-1069-A2D7-08002B30309D} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {871C5380-42A0-1069-A2EA-08002B30309D} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> 0
[HKLM | HideDesktopIcons\NewStartPanel] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 1 -> 0
[HKLM | Advanced\Folder\Hidden\SHOWALL] | CheckedValue : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Desktop] |  Wallpaper : C:\Users\GuiGui\AppData\Roaming\Mozilla\Firefox\Fond d'écran.bmp
[HKU\S-1-5-18 | Desktop] |  Wallpaper : (None)
[HKU\S-1-5-19 | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-20 | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000_Classes | Policies\Explorer] |  NoDesktop :  -> 0
[HKU\S-1-5-18 | Policies\Explorer] |  NoDesktop :  -> 0
[HKLM | CurrentVersion\Explorer] | AlwaysUnloadDll :  -> 1
[HKLM | policies\Explorer] | NoDesktop :  -> 0
[HKU\S-1-5-19 | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-20 | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Explorer\Advanced] |  Hidden : 1 -> 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000_Classes | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-18 | Explorer\Advanced] |  Hidden :  -> 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Policies\Explorer] |  NoDriveTypeAutoRun : 0 -> 145
[HKLM | policies\Explorer] | NoDriveTypeAutoRun  : 0 -> 145
[HKLM | Policies\System] | DisableRegistryTools : 0
[HKLM | Control\SafeBoot] | AlternateShell : cmd.exe

14:20:54


¤¤¤¤¤¤¤¤¤¤ | Services

[RPCSS] | Start : 2 : Actif
[Cmbatt] | Start : 3 : Inactif
[Compbatt] | Start : 3 -> 0 : Inactif
[Ndisuio] | Start : 3 : Inactif
[Power] | Start : 2 : Actif
[Profsvc] | Start : 2 : Actif
[PlugPlay] | Start : 2 : Actif
[PEAUTH] | Start : 2 : Actif
[NVSvc] | Start : 3 -> 2 : Inactif
[nsi] | Start : 2 : Actif
[NLASvc] | Start : 2 : Actif
[MPSsvc] | Start : 2 : Actif
[MMCSS] | Start : 2 : Actif
[luafv] | Start : 2 : Actif
[lltdio] | Start : 2 : Actif
[Iphlpsvc] | Start : 2 : Actif
[IKEEXT] | Start : 2 : Actif
[gpsvc] | Start : 2 : Actif
[lmhosts] | Start : 2 : Actif
[LanmanWorkstation] | Start : 2 : Actif
[LanmanServer] | Start : 2 : Actif
[agp440] | Start : 3 -> 2 : Inactif
[AudioEndpointBuilder] | Start : 2 : Actif
[Audiosrv] | Start : 2 : Actif
[BFE] | Start : 2 : Actif
[Bits] | Start : 3 -> 2 : Inactif
[CryptSvc] | Start : 2 : Actif
[EapHost] | Start : 3 -> 2 : Inactif
[Wlansvc] | Start : 3 -> 2 : Inactif
[SppSvc] | Start : 2 : Inactif
[SharedAccess] | Start : 2 : Inactif
[windefend] | Start : 3 -> 2 : Inactif
[wuauserv] | Start : 2 : Actif
[WerSvc] | Start : 3 -> 2 : Inactif
[wscsvc] | Start : 2 : Actif

14:20:54


¤¤¤¤¤¤¤¤¤¤ | Internet Explorer

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Main] | Start Page : https://www.msn.com/fr-fr -> https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-18 | Main] | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Main] | Local Page : C:\Windows\system32\blank.htm
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKU\S-1-5-18 | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKLM | Search] | SearchAssistant  : https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm -> http://www.google.com/toolbar/ie8/sidebar.html
[HKLM | Main] | Start Page : https://www.msn.com/fr-fr -> https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Local Page : C:\Windows\SysWOW64\blank.htm
[HKLM | Main] | Default_Search_URL : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | Main] | Default_Page_URL : https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Search Page : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | AboutURLs] | Tabs : res://ieframe.dll/tabswelcome.htm

¤

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | PhishingFilter] | Enabled : 2
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | PhishingFilter] | EnabledV8 : 1
[HKU\S-1-5-19 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-20 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | MigrateProxy : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | WarnonBadCertRecving : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | WarnOnHTTPSToHTTPRedirect : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | WarnonZoneCrossing : 1
[HKU\S-1-5-19 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-20 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | AutoConfigProxy : wininet.dll

¤

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\SearchScopes\${searchCLSID}] | (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] | (Bing) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src=IE-SearchBox&FORM=IE8SRC
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\SearchScopes\{8E045791-A32F-41AA-9F81-DED6FF4C7F05}] | (Google) -> https://www.google.com/webhp?hl=en&gws_rd=ssl{searchTerms}

[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] | (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&FORM=IE8SRC

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016000}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016800}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D017600}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}] | () -> 

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046}] | (iexplore.exe) -> C:\Program Files (x86)\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{003B91A6-61E3-4591-891D-01E94C8CB11E}] | (Silverlight.Configuration.exe) -> C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{054aae20-4bea-4347-8a35-64a533254a9d}] | (tabtip.exe) -> C:\Program Files (x86)\Common Files\Microsoft Shared\Ink
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a}] | (wpcer.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}] | (Acrobat Elements.exe) -> C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695}] | (winfxdocobj.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1138506a-b949-46a7-b6c0-ee26499fdeaf}] | (wuapp.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{130c40f0-1bcb-4852-8b63-291cf90a600b}] | (msdt.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}] | (AcroBroker.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{186e0934-aee9-11da-961b-0014223d2a70}] | (dfsvc.exe) -> C:\Windows\microsoft.net\framework\v2.0.50727
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1e7a3a27-8c57-4900-a440-f8fc8e51e0af}] | (BingApp.exe) -> C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1ec76a37-1762-46ff-9b14-765b3e6793be}] | (agcp.exe) -> C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2391d819-9d17-44ec-9ac1-f6aa07549469}] | (wermgr.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26fe7361-bd5a-4dcb-b309-c6f42dde661c}] | (ieinstal.exe) -> C:\Program Files (x86)\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}] | (AcroRd32Info.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}] | (wlcomm.exe) -> C:\Program Files (x86)\Windows Live\Contacts\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}] | (unpack200.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}] | (jp2launcher.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49CF0734-BF9A-4444-BC9F-C26E56AF042F}] | (SonarHost.exe) -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}] | (acrord32.exe) -> C:\Program Files (x86)\adobe\acrobat 7.0eader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}] | (javaws.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}] | (wmplayer.exe) -> %ProgramFiles%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}-32] | (wmplayer.exe) -> %ProgramFiles(x86)%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999}] | (iedw.exe) -> C:\Program Files (x86)\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}] | (AdobeARM.exe) -> C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78c7b664-c9bf-4ce9-8b3a-b05d442e451e}] | (CertEnrollCtrl.exe) -> C:\Windows\SysWOW64\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7aaae723-5fb5-4b2d-9327-75519f336825}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016000}] | (esnlauncher2.exe) -> C:\Program Files (x86)\Battlelog Web Plugins
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016800}] | (esnlauncher3.exe) -> C:\Program Files (x86)\Battlelog Web Plugins
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D017600}] | (esnlauncher3.exe) -> C:\Program Files (x86)\Battlelog Web Plugins
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7eb01fb2-f185-445a-94e4-ec4e1ba2202c}] | (verclsid.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85fc331e-bb64-4c53-ba25-3d8a956c02fd}] | (ctfmon.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}] | (helppane.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}] | (AdobeCollabSync.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}] | (wlstartup.exe) -> C:\Program Files (x86)\Windows Live\Installer\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}] | (acrobat.exe) -> C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}] | (AcroRd32.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}] | (Acrobat Elements.exe) -> C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a1ad1bbb-3b33-4260-a74c-5fd8bc1479fc}] | (splwow64.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a5a2d52a-4944-47c4-a3e0-8bd92e14d953}] | (xpsviewer.exe) -> C:\Windows\SysWOW64\xpsviewer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{aff735eb-cdf9-4894-aa69-3e3131128618}] | (cmd.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01}] | (TSWbPrxy.exe) -> C:\Windows\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BD18A03F-31CC-4CC0-B52D-9E199122923D}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}] | (dfsvc.exe) -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}] | (dfsvc.exe) -> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}] | (ssvagent.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}] | (msnmsgr.exe) -> C:\Program Files (x86)\Windows Live\Messenger\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DB9524B3-24F4-48fa-91C5-B8EEF1C0A14F}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{dc6bf185-7ae4-444e-8c35-e447b0d2bd1e}] | (notepad.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}] | (IDMan.exe) -> D:\Prog\Internet Download Manager
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}] | (acrord32.exe) -> C:\Program Files (x86)\adobe\acrobat 6.0eader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eee261cc-4b3e-46e7-affb-61f297155bf2}] | (presentationhost.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f971150e-a83b-4d57-9c22-9535668d07d8}] | (BingBar.exe) -> C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}] | (FlashUtil32_11_2_202_235_ActiveX.exe) -> C:\Windows\SysWOW64\Macromed\Flash
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}] | (acrobat.exe) -> C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat

¤¤¤¤¤¤¤¤¤¤ | Firefox


Profile : 0gzfg4q2.default

user_pref("browser.startup.homepage_override.buildID", "20120614114901");
user_pref("browser.startup.homepage_override.mstone", "13.0.1");
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | 2.706 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Mis à jour le 06/07/2012 |08.30 par g3n-h@ckm@n
~ Informations Evolution : https://gen-hackman.kanak.fr/
~ Informations sur les switchs Pre_Script : https://gen-hackman.kanak.fr/
~ Feedback Pre_scan : https://gen-hackman.kanak.fr/#505
~ Merci à C_XX , Slyk & Saachaa pour leur apport à l'évolution de l'outil

~ Utilisateur : GuiGui (Administrateurs) | SID = S-1-5-21-2469631386-82068602-2986095981-1000
~ Ordinateur : GUIGUI-PC

~ Système d'exploitation : Windows 7 Professional (64 bits) Professional Service Pack 1
~ Type d'installation : Client
~ Enregistré sous : GuiGui
~ Processeur : Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz
~ Identification : Intel64 Family 6 Model 42 Stepping 7

Pare-feu windows : Actif
Windows Defender : Inactif

~ Mémoire RAM = Total (KB) : 4177270 | Used (%) : 24 | Free (KB) : 3153260
~ Pagefile = Total (KB) : 8352690 | Free (KB) : 7289170
~ Virtuelle = Total (KB) : 4194180 | Free (KB) : 4019420

¤¤¤¤¤¤¤¤¤¤ | Scripts de boot


¤¤¤¤¤¤¤¤¤¤ | Drives

c:\ -> [Fixed] | [] | Total : 57230 Mo | Free : 15430 Mo -> NTFS
d:\ -> [Fixed] | [] | Total : 953860 Mo | Free : 544820 Mo -> NTFS

Scan : 14:27:41 | 06/07/2012

¤¤¤¤¤¤¤¤¤¤ | Navigateurs

Internet Explorer : 9.0.8112.16421
Mozilla Firefox : 13.0.1 (fr)

¤ Par défaut :

[HKCR\http | command] : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome


¤¤¤¤¤¤¤¤¤¤ | Frameworks

~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.0.3705
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.1.4322
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.0.3705
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v1.1.4322
~ [14/07/2009 05:20:10] - C:\Windows\Microsoft.net\Framework\v2.0.50727
~ [14/07/2009 07:32:38] - C:\Windows\Microsoft.net\Framework\v3.0
~ [14/07/2009 07:32:38] - C:\Windows\Microsoft.net\Framework\v3.5
~ [28/07/2011 17:41:53] - C:\Windows\Microsoft.net\Framework\v4.0.30319

¤¤¤¤¤¤¤¤¤¤ | Windows Updates



¤¤¤¤¤¤¤¤¤¤ | Sessions | Profiles | Directories

~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1000] : ProfileImagePath -> C:\Users\GuiGui
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1000] : RefCount -> 4
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1000] : State -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1003] : ProfileImagePath -> C:\Users\UpdatusUser
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1003] : RefCount -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1003] : State -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1004] : ProfileImagePath -> C:\Users\UpdatusUser
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1004] : RefCount -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1004] : State -> 0
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1006] : ProfileImagePath -> C:\Users\UpdatusUser
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1006] : RefCount -> 1
~ [HKLM | ProfileList\S-1-5-21-2469631386-82068602-2986095981-1006] : State -> 0

~ C:\Windows\system32\config\systemprofile
~ C:\Windows\ServiceProfiles\LocalService
~ C:\Windows\ServiceProfiles\NetworkService
~ C:\Users\GuiGui
~ C:\Users\UpdatusUser
~ C:\Users\UpdatusUser
~ C:\Users\UpdatusUser

[HKLM | ProfileLoader\{F5441CBB-AE7D-4495-905B-161047E58936}] : DllName -> userenv.dll

Nouveau point de restauration créé


¤¤¤¤¤¤¤¤¤¤ | Contrôle MD5

[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] - (6.1.7601.17567) - C:\Windows\explorer.exe
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.17567) - C:\Windows\ERDNT\cache86\explorer.exe
[MD5.AC4C51EB24AA95B77F705AB159189E24] - [21/11/2010 05:24:11] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2805 Ko] -  (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.17567) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[MD5.3B69712041F3D63605529BD66DC00C48] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2804.5 Ko] -  (6.1.7601.21669) - C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[MD5.40D777B7A95E00593EB1568C68514493] - [21/11/2010 05:24:25] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.17514) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.17567) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[MD5.0FB9C74046656D1579A64660AD67B746] - [28/07/2011 17:00:03] - (.© Microsoft Corporation. Tous droits réservés. - Explorateur Windows.) - [2555 Ko] -  (6.1.7601.21669) - C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. Tous droits réservés. - Processus d'exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) - C:\Windows\System32\csrss.exe
[MD5.60C2862B4BF0FD9F582EF344C2B1EC72] - [14/07/2009 01:19:49] - (.© Microsoft Corporation. Tous droits réservés. - Processus d'exécution client-serveur.) - [7.5 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe -> 
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [14/07/2009 01:19:46] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\System32\services.exe
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache64\services.exe
[MD5.24ACB7E5BE595468E3B9AA488B9B4FCB] - [14/07/2009 01:19:46] - (.© Microsoft Corporation. Tous droits réservés. - Applications Services et Contrôleur.) - [321 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[MD5.1911A3356FA3F77CCC825CCBAC038C2A] - [14/07/2009 01:19:50] - (.© Microsoft Corporation. Tous droits réservés. - Gestionnaire de sessions Windows.) - [110 Ko] - (6.1.7600.16385) - C:\Windows\System32\smss.exe
[MD5.1911A3356FA3F77CCC825CCBAC038C2A] - [14/07/2009 01:19:50] - (.© Microsoft Corporation. All rights reserved. - Windows Session Manager.) - [110 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [21/11/2010 05:24:28] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\System32\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [21/11/2010 05:23:55] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\SysWOW64\userinit.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache64\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache86\userinit.exe
[MD5.BAFE84E637BF7388C96EF48D4D3FDD53] - [21/11/2010 05:24:28] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [30 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
[MD5.61AC3EFDFACFDD3F0F11DD4FD4044223] - [21/11/2010 05:23:55] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Userinit.) - [26 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\System32\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [14/07/2009 01:36:49] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\SysWOW64\wininit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache64\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache86\wininit.exe
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - [14/07/2009 01:52:37] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [126 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[MD5.B5C5DCAD3899512020D135600129D665] - [14/07/2009 01:36:49] - (.© Microsoft Corporation. Tous droits réservés. - Application de démarrage de Windows.) - [94 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [21/11/2010 05:24:29] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\winlogon.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [16/12/2011 17:09:40] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache64\winlogon.exe
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - [21/11/2010 05:24:29] - (.© Microsoft Corporation. Tous droits réservés. - Application d'ouverture de session Windows.) - [381.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - [15/02/2012 00:46:32] - (.© Microsoft Corporation. Tous droits réservés. - Ancillary Function Driver for WinSock.) - [487 Ko] - (6.1.7601.17752) - C:\Windows\System32\drivers\afd.sys
[MD5.D31DC7A16DEA4A9BAF179F3D6FBDB38C] - [21/11/2010 05:24:08] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [488 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[MD5.D5B031C308A409A0A576BFF4CF083D30] - [28/07/2011 16:59:53] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7601.17603) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - [15/02/2012 00:46:32] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [487 Ko] - (6.1.7601.17752) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17752_none_35e10b89752ee0f5\afd.sys
[MD5.F4AD06143EAC303F55D0E86C40802976] - [28/07/2011 16:59:53] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [487.5 Ko] - (6.1.7601.21712) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
[MD5.36A14FD1A23F57046361733B792CA8DB] - [15/02/2012 00:46:32] - (.© Microsoft Corporation. All rights reserved. - Ancillary Function Driver for WinSock.) - [486.5 Ko] - (6.1.7601.21887) - C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [16/12/2011 17:09:39] - (.© Microsoft Corporation. All rights reserved. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\ERDNT\cache64\atapi.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. All rights reserved. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\System32\drivers\atapi.sys
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - [14/07/2009 01:19:47] - (.© Microsoft Corporation. All rights reserved. - ATAPI IDE Miniport Driver.) - [23.56 Ko] - (6.1.7600.16385) - C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
[MD5.F036CE71586E93D94DAB220D7BDF4416] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. All rights reserved. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers\cdrom.sys
[MD5.F036CE71586E93D94DAB220D7BDF4416] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. All rights reserved. - SCSI CD-ROM Driver.) - [144 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_bdcf6151ba66f48b\cdrom.sys
[MD5.09594D1089C523423B32A4229263F068] - [21/11/2010 05:23:51] - (.© Microsoft Corporation. All rights reserved. - MBT Transport driver.) - [255.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers
etbt.sys
[MD5.09594D1089C523423B32A4229263F068] - [21/11/2010 05:23:51] - (.© Microsoft Corporation. All rights reserved. - MBT Transport driver.) - [255.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6
etbt.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [06/07/2012 12:26:07] - (.© Microsoft Corporation. All rights reserved. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\ERDNT\cache64	dx.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [21/11/2010 05:24:32] - (.© Microsoft Corporation. All rights reserved. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers	dx.sys
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - [21/11/2010 05:24:32] - (.© Microsoft Corporation. All rights reserved. - TDI Translation Driver.) - [116.5 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.1.7601.17514_none_4863cdbaf2b532f8	dx.sys
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. Tous droits réservés. - Pilote de cliché instantané du volume.) - [288.88 Ko] - (6.1.7601.17514) - C:\Windows\System32\drivers\volsnap.sys
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - [21/11/2010 05:23:47] - (.© Microsoft Corporation. All rights reserved. - Volume Shadow Copy Driver.) - [288.88 Ko] - (6.1.7601.17514) - C:\Windows\winsxs\amd64_volume.inf_31bf3856ad364e35_6.1.7601.17514_none_73dcbcf012b4850e\volsnap.sys

14:27:58

¤¤¤¤¤¤¤¤¤¤ | Processus

WUDFHost.exe (1240) -> Processus stoppé 
taskhost.exe (3244) -> Processus stoppé 
PresentationFontCache.exe (4112) -> Processus stoppé 
explorer.exe (684) -> Processus stoppé 
WUDFHost.exe (2024) -> Processus stoppé 
rundll32.exe (1636) -> Processus stoppé 
TimeMgmtDaemon.exe (1732) -> Processus stoppé 
SearchIndexer.exe (3004) -> Processus stoppé 
wmpnetwk.exe (2316) -> Processus stoppé 
LMS.exe (3432) -> Processus stoppé 
spoolsv.exe (1984) -> Processus stoppé 
AlarmClock.exe (3304) -> Processus stoppé 
firefox.exe (3356) -> Processus stoppé 
taskmgr.exe (4476) -> Processus stoppé 
SearchProtocolHost.exe (4572) -> Processus stoppé 
SearchFilterHost.exe (4596) -> Processus stoppé 

¤¤¤¤¤¤¤¤¤¤ | Processus en cours

Demarrage : Normal  

944 | D:\Mes documents\Pre_Scan.pif - GuiGui - High - "D:\Mes documents\Pre_Scan.pif"  - 3356
4472 | C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe - Système - Normal - "C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe" - 564
640 | C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe - Système - Normal - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe" - 564
4244 | C:\Pre_Scan\Pv.exe - GuiGui - Normal - C:\Pre_Scan\Pv.exe  -o"%i | %f - %u - %p - %l - %r" - 4980

¤¤¤¤¤¤¤¤¤¤ | Winlogon


¤

[HKLM | Winlogon] | Shell : Explorer.exe
[HKLM | Winlogon] | AutoRestartShell : 0
[HKLM | Winlogon] | userinit : C:\Windows\system32\userinit.exe,
[HKLM | Winlogon] | PowerDownAfterShutdown : 1
[HKLM | Winlogon] | System : 

¤¤¤¤¤¤¤¤¤¤ | Associations

[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : ComFile
[comfile | command] : "%1" %*
[.reg] : regfile
[regfile | command] : regedit.exe "%1"
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
[.url] : InternetShortcut
[InternetShortcut | command] : "C:\Windows\System32undll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
[Application.Manifest | command] : rundll32.exe dfshim.dll,ShOpenVerbApplication %1
[Application.Reference | command] : rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2
[Folder | command] : C:\Windows\explorer.exe

¤

[Firefox | Command] | @  : "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
[Firefox - Safemode | Command] | @ : "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode
[IE | Command] | @ : "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
[Assoc | Applications] | @ : http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s

¤¤¤¤¤¤¤¤¤¤ | Corrections diverses

[HKLM | HideDesktopIcons\ClassicStartMenu] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {F02C1A0D-BE21-4350-88B0-7367FC96EF3C} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {208D2C60-3AEA-1069-A2D7-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {871C5380-42A0-1069-A2EA-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 0
[HKLM | Advanced\Folder\Hidden\SHOWALL] | CheckedValue : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Desktop] |  Wallpaper : C:\Users\GuiGui\AppData\Roaming\Mozilla\Firefox\Fond d'écran.bmp
[HKU\S-1-5-18 | Desktop] |  Wallpaper : (None)
[HKU\S-1-5-19 | Policies\Explorer] |  NoDesktop : 0
[HKU\S-1-5-20 | Policies\Explorer] |  NoDesktop : 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Policies\Explorer] |  NoDesktop : 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000_Classes | Policies\Explorer] |  NoDesktop : 0
[HKU\S-1-5-18 | Policies\Explorer] |  NoDesktop : 0
[HKLM | CurrentVersion\Explorer] | AlwaysUnloadDll : 1
[HKLM | policies\Explorer] | NoDesktop : 0
[HKU\S-1-5-19 | Explorer\Advanced] |  Hidden : 0
[HKU\S-1-5-20 | Explorer\Advanced] |  Hidden : 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Explorer\Advanced] |  Hidden : 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000_Classes | Explorer\Advanced] |  Hidden : 0
[HKU\S-1-5-18 | Explorer\Advanced] |  Hidden : 0
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Policies\Explorer] |  NoDriveTypeAutoRun : 145
[HKLM | policies\Explorer] | NoDriveTypeAutoRun : 145
[HKLM | Policies\System] | DisableRegistryTools : 0
[HKLM | Control\SafeBoot] | AlternateShell : cmd.exe

14:27:58


¤¤¤¤¤¤¤¤¤¤ | Services

[RPCSS] | Start : 2 : Actif
[Cmbatt] | Start : 3 : Inactif
[Compbatt] | Start : 0 : Inactif
[Ndisuio] | Start : 3 : Inactif
[Power] | Start : 2 : Actif

ZeKzU · Answer

[Profsvc] | Start : 2 : Actif
[PlugPlay] | Start : 2 : Actif
[PEAUTH] | Start : 2 : Actif
[NVSvc] | Start : 3 -> 2 : Inactif
[nsi] | Start : 2 : Actif
[NLASvc] | Start : 2 : Actif
[MPSsvc] | Start : 2 : Actif
[MMCSS] | Start : 2 : Actif
[luafv] | Start : 2 : Actif
[lltdio] | Start : 2 : Actif
[Iphlpsvc] | Start : 2 : Actif
[IKEEXT] | Start : 2 : Actif
[gpsvc] | Start : 2 : Actif
[lmhosts] | Start : 2 : Actif
[LanmanWorkstation] | Start : 2 : Actif
[LanmanServer] | Start : 2 : Actif
[agp440] | Start : 2 : Inactif
[AudioEndpointBuilder] | Start : 2 : Actif
[Audiosrv] | Start : 2 : Actif
[BFE] | Start : 2 : Actif
[Bits] | Start : 2 : Actif
[CryptSvc] | Start : 2 : Actif
[EapHost] | Start : 2 : Actif
[Wlansvc] | Start : 2 : Actif
[SppSvc] | Start : 2 : Inactif
[SharedAccess] | Start : 2 : Inactif
[windefend] | Start : 3 -> 2 : Inactif
[wuauserv] | Start : 2 : Actif
[WerSvc] | Start : 2 : Actif
[wscsvc] | Start : 2 : Actif

14:37:28


¤¤¤¤¤¤¤¤¤¤ | Internet Explorer

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Main] | Start Page : https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-18 | Main] | Start Page : https://www.google.com/?gws_rd=ssl
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Main] | Local Page : C:\Windows\system32\blank.htm
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKU\S-1-5-18 | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKLM | Search] | SearchAssistant : http://www.google.com/toolbar/ie8/sidebar.html
[HKLM | Main] | Start Page : https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Local Page : C:\Windows\SysWOW64\blank.htm
[HKLM | Main] | Default_Search_URL : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | Main] | Default_Page_URL : https://www.msn.com/fr-fr/?ocid=iehp
[HKLM | Main] | Search Page : https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKLM | AboutURLs] | Tabs : res://ieframe.dll/tabswelcome.htm

¤

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | PhishingFilter] | Enabled : 2
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | PhishingFilter] | EnabledV8 : 1
[HKU\S-1-5-19 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-20 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | EnableHttp1_1 : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | MigrateProxy : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | WarnonBadCertRecving : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | WarnOnHTTPSToHTTPRedirect : 1
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | WarnonZoneCrossing : 1
[HKU\S-1-5-19 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-20 | Internet settings] | AutoConfigProxy : wininet.dll
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000 | Internet settings] | AutoConfigProxy : wininet.dll

¤

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\SearchScopes\${searchCLSID}] | (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src={referrer:source?}
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] | (Bing) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&src=IE-SearchBox&FORM=IE8SRC
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\SearchScopes\{8E045791-A32F-41AA-9F81-DED6FF4C7F05}] | (Google) -> https://www.google.com/webhp?hl=en&gws_rd=ssl{searchTerms}

[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] | (@ieframe.dll,-12512) -> https://www.bing.com/?scope=web&mkt=fr-FR{searchTerms}&FORM=IE8SRC

[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016000}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016800}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D017600}] | () -> 
[HKU\S-1-5-21-2469631386-82068602-2986095981-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}] | () -> 

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046}] | (iexplore.exe) -> C:\Program Files (x86)\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{003B91A6-61E3-4591-891D-01E94C8CB11E}] | (Silverlight.Configuration.exe) -> C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{054aae20-4bea-4347-8a35-64a533254a9d}] | (tabtip.exe) -> C:\Program Files (x86)\Common Files\Microsoft Shared\Ink
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a}] | (wpcer.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5}] | (Acrobat Elements.exe) -> C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695}] | (winfxdocobj.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1138506a-b949-46a7-b6c0-ee26499fdeaf}] | (wuapp.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{130c40f0-1bcb-4852-8b63-291cf90a600b}] | (msdt.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}] | (AcroBroker.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{186e0934-aee9-11da-961b-0014223d2a70}] | (dfsvc.exe) -> C:\Windows\microsoft.net\framework\v2.0.50727
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1e7a3a27-8c57-4900-a440-f8fc8e51e0af}] | (BingApp.exe) -> C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1ec76a37-1762-46ff-9b14-765b3e6793be}] | (agcp.exe) -> C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2391d819-9d17-44ec-9ac1-f6aa07549469}] | (wermgr.exe) -> %systemroot%\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{26fe7361-bd5a-4dcb-b309-c6f42dde661c}] | (ieinstal.exe) -> C:\Program Files (x86)\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}] | (AcroRd32Info.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}] | (wlcomm.exe) -> C:\Program Files (x86)\Windows Live\Contacts\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B9A6E32-36C9-4946-B78C-3F58E3785EC1}] | (unpack200.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}] | (jp2launcher.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{49CF0734-BF9A-4444-BC9F-C26E56AF042F}] | (SonarHost.exe) -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}] | (acrord32.exe) -> C:\Program Files (x86)\adobe\acrobat 7.0\reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}] | (javaws.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}] | (wmplayer.exe) -> %ProgramFiles%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}-32] | (wmplayer.exe) -> %ProgramFiles(x86)%\Windows Media Player
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999}] | (iedw.exe) -> C:\Program Files (x86)\Internet Explorer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}] | (AdobeARM.exe) -> C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78c7b664-c9bf-4ce9-8b3a-b05d442e451e}] | (CertEnrollCtrl.exe) -> C:\Windows\SysWOW64\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7aaae723-5fb5-4b2d-9327-75519f336825}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016000}] | (esnlauncher2.exe) -> C:\Program Files (x86)\Battlelog Web Plugins
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D016800}] | (esnlauncher3.exe) -> C:\Program Files (x86)\Battlelog Web Plugins
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AEFE841-DCA1-4A95-80CB-BE935D017600}] | (esnlauncher3.exe) -> C:\Program Files (x86)\Battlelog Web Plugins
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7eb01fb2-f185-445a-94e4-ec4e1ba2202c}] | (verclsid.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85fc331e-bb64-4c53-ba25-3d8a956c02fd}] | (ctfmon.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}] | (helppane.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}] | (AdobeCollabSync.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}] | (wlstartup.exe) -> C:\Program Files (x86)\Windows Live\Installer\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}] | (acrobat.exe) -> C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}] | (AcroRd32.exe) -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}] | (Acrobat Elements.exe) -> C:\Program Files (x86)\adobe\acrobat 7.0\Acrobat Elements
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a1ad1bbb-3b33-4260-a74c-5fd8bc1479fc}] | (splwow64.exe) -> C:\Windows
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a5a2d52a-4944-47c4-a3e0-8bd92e14d953}] | (xpsviewer.exe) -> C:\Windows\SysWOW64\xpsviewer
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{aff735eb-cdf9-4894-aa69-3e3131128618}] | (cmd.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01}] | (TSWbPrxy.exe) -> %systemroot%\system32
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BD18A03F-31CC-4CC0-B52D-9E199122923D}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}] | (dfsvc.exe) -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}] | (dfsvc.exe) -> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}] | (ssvagent.exe) -> C:\Program Files (x86)\Java\jre7\bin
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}] | (msnmsgr.exe) -> C:\Program Files (x86)\Windows Live\Messenger\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DB9524B3-24F4-48fa-91C5-B8EEF1C0A14F}] | () -> 
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{dc6bf185-7ae4-444e-8c35-e447b0d2bd1e}] | (notepad.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}] | (IDMan.exe) -> D:\Prog\Internet Download Manager
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}] | (acrord32.exe) -> C:\Program Files (x86)\adobe\acrobat 6.0\reader
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eee261cc-4b3e-46e7-affb-61f297155bf2}] | (presentationhost.exe) -> C:\Windows\SysWOW64
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f971150e-a83b-4d57-9c22-9535668d07d8}] | (BingBar.exe) -> C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}] | (FlashUtil32_11_2_202_235_ActiveX.exe) -> C:\Windows\SysWOW64\Macromed\Flash
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}] | (acrobat.exe) -> C:\Program Files (x86)\adobe\acrobat 6.0\Acrobat

¤¤¤¤¤¤¤¤¤¤ | Firefox


Profile : 0gzfg4q2.default

user_pref("browser.startup.homepage_override.buildID", "20120614114901");
user_pref("browser.startup.homepage_override.mstone", "13.0.1");

ET le debug 
[Rest_Reg_Tmgr_A]
[Rest_Reg_Tmgr_B]
[Stop_Proc]
[Assoc_Ext]
[List_sess]
[Recup_List_File_sing]
[Recup_List_File_Doub]
[Assoc_net]
[Corr_Exp]
[Corr_Sys]
[Header]
[Nav_srch]
[FMWK_list]
[Head_sess]
[Rest_P_A]
[Rest_P_B]
[1st_MD5]
[Proc_Act_List]
[Modif_winlgn]
[Param_svc]
[Prx]
[Param_IE]
[IE_List | CLSID]
[Perm_Reg]
[Rest_Reg_Tmgr_A]
[Rest_Reg_Tmgr_B]
[Stop_Proc]
[Assoc_Ext]
[List_sess]
[Recup_List_File_sing]
[Recup_List_File_Doub]
[Assoc_net]
[Corr_Exp]
[Corr_Sys]
[Header]
[Nav_srch]
[FMWK_list]
[Head_sess]
[Rest_P_A]
[Rest_P_B]
[1st_MD5]
[Proc_Act_List]
[Modif_winlgn]
[Param_svc]
[Prx]
[Param_IE]
[IE_List | CLSID]
[Perm_Reg]
[Rest_Reg_Tmgr_A]
[Rest_Reg_Tmgr_B]
[Stop_Proc]
[Assoc_Ext]
[List_sess]
[Recup_List_File_sing]
[Recup_List_File_Doub]
[Assoc_net]
[Corr_Exp]
[Corr_Sys]
[Header]
[Nav_srch]
[FMWK_list]
[Head_sess]
[Rest_P_A]
[Rest_P_B]
[1st_MD5]
[Proc_Act_List]
[Modif_winlgn]
[Param_svc]
[Prx]
[Param_IE]
[IE_List | CLSID]

g3n-h@ckm@n · Answer

heuseusement que je dis de pas le poster sur le forum et de l'heberger sur un autre site et de donner le lien ensuite

bref telecharge la version .pif et lance-le en mode sans echec stp

ZeKzU · Answer

j'ai essayé les trois versions sa bloque au meme endroit, et puis tu me dis juste d'héberger, j'ai donc logiquement utilisé le lien d'avant malekal mais ce site lag trop pour esperer upload qqe chose dessus

g3n-h@ckm@n · Answer

ouaip le serveur n'a pas du mettre à jour en temps reel alors....

suis ce tutoriel

https://forums.cnetfrance.fr/tutoriels-securite-informatique/179557-dr-web-cureit-le-tutoriel

ZeKzU · Answer

re ! j'ai fais tourné le scan cette nuit, cependant en voulant vite voir si j'ai vendu des trucs sur diablo 3 j'ai complètement oublié d'enregistrer le rapport il y avais deux virus + plein de fichier texte, qu'il nommais de "script virus" et des sortes de fichier texte "lien" vers le web, j'ai reinstallé MSE et il marche

g3n-h@ckm@n · Answer

ok le rapport est là :

c:\users	a session\DrWeb\CureIt.log

tu vas certainement devoir le zipper , ensuite heberge l'archive sur http://pjjoint.malekal.com puis donne le lien obtenu

ZeKzU · Answer

ton site en plus de lagger ne supporte pas les archives 
donc 1fichier https://9webuk.1fichier.com/ 
et j'ai fais un scan mse il m'a trouvé 3 Sirefef (trojan) mais qui étais dans d'autre zone de quarantaines Qoobox/drweb

g3n-h@ckm@n · Answer

je sais pas ce que c est ton site mais il m'ouvre des pages de pub pourrries

passe par https://www.cjoint.com/

ZeKzU · Answer

c'est 1fichier c'est très simple mais bon c'est pas grave https://www.cjoint.com/?3GhsaTEDSQv

g3n-h@ckm@n · Answer

mets malwarebytes à jour puis fais un complet

ZeKzU · Answer

Malwarebytes Anti-Malware (Essai) 1.61.0.1400
www.malwarebytes.org

Version de la base de données: v2012.07.07.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
GuiGui :: GUIGUI-PC [administrateur]

Protection: Désactivé

07/07/2012 18:26:51
mbam-log-2012-07-07 (18-26-51).txt

Type d'examen: Examen complet
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 602157
Temps écoulé: 1 heure(s), 16 minute(s), 58 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)

(fin)

g3n-h@ckm@n · Answer

c est ok plus de soucis ?

ZeKzU · Answer

je pense pas mais j'ai plein de dossiers de désinfection partout

g3n-h@ckm@n · Answer

ca va partir avec ce final :

https://gen-hackman.kanak.fr/

ZeKzU · Answer

purera :Total space cleaned: 89.51 MB

# DelFix v8.8 - Rapport créé le 07/07/2012 à 21:56:29
# Mis à jour le 12/02/12 par Xplode
# Système d'exploitation : Windows 7 Professional Service Pack 1 (64 bits)
# Nom d'utilisateur : GuiGui - GUIGUI-PC (Administrateur)
# Exécuté depuis : D:\Mes documents\delfix.exe
# Option [Suppression]


~~~~~~ Dossiers(s) ~~~~~~

Supprimé : C:\Qoobox
Supprimé : C:\pre_scan
Supprimé : C:\ZHP
Supprimé : C:\Users\GuiGui\DoctorWeb
Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
Supprimé : C:\Program Files (x86)\ZHPDiag

~~~~~~ Fichier(s) ~~~~~~

Supprimé : C:\Users\GuiGui\Desktop\EntretienPC\gerard.exe <-- Combofix
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\Windows\grep.exe
Supprimé : C:\Windows\PEV.exe
Supprimé : C:\Windows\NIRCMD.exe
Supprimé : C:\Windows\MBR.exe
Supprimé : C:\Windows\SED.exe
Supprimé : C:\Windows\SWREG.exe
Supprimé : C:\Windows\SWSC.exe
Supprimé : C:\Windows\SWXCACLS.exe
Supprimé : C:\Windows\Zip.exe

~~~~~~ Registre ~~~~~~

Clé Supprimée : HKCU\console_combofixbackup
Clé Supprimée : HKCU\Software\Ad-Remover
Clé Supprimée : HKCU\Software\g3n-h@ckm@n
Clé Supprimée : HKCU\Software\IDAVLab
Clé Supprimée : HKLM\SOFTWARE\IDAVLab
Clé Supprimée : HKLM\SOFTWARE\Swearware
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys

~~~~~~ Autres ~~~~~~

-> Prefetch Vidé

*************************

DelFix[S1].txt - [1848 octets] - [07/07/2012 21:56:29]

########## EOF - C:\DelFix[S1].txt - [1972 octets] ##########

j'utilise deja ccleaner avec mes propres configs, je ne défrag pas parceque j'ai un SSD(et je ne cherche pas d'erreur pour la meme raison) et j'ai depuis longtemps tout simplement désactivé la restauration système (j'ai des cd de resto)

g3n-h@ckm@n · Answer

ok lol ^^no souci avec le SSD ^^

ZeKzU · Answer

j'ai deja WOT sur firefox, et sa n'a pas suffit ^^ et j'utilise le parefeu de ma box aussi

ZeKzU · Answer

merci gros

g3n-h@ckm@n · Answer

kkk^^

Trojan

31 réponses

Discussions similaires

Newsletters