Disqudur Protection

Utilisateur anonyme -  
Bonjour,

depuis plus d'une semaine maintenant, je reçois de temps en temps des fenêtres d'avertissement avec écrit d'utiliser Disqudur Protection. Et depuis, Internet Explorer est presque impossible à utiliser pars sa lenteur. Et quand j'ouvre l'explorateur Windows (Mes documents, etc...), il se referme automatiquement et se rouvre.

Merci de m'aider a réparer mon problème.

Cordialement
Configuration: Windows Vista
Firefox 2.0.0.13
et j'ai Internet Explorer 7

29 réponses

Résumé de la discussion

Plus d'une semaine après l'apparition de fenêtres d'avertissement réclamant Disqudur Protection, les utilisateurs constatent une lenteur d'Internet Explorer et des plantages de l'Explorateur Windows lors de l'ouverture de Mes documents. Des conseils techniques préconisent de désactiver temporairement le contrôle des comptes utilisateurs (UAC), puis d'exécuter ComboFix avec antivirus et antispyware désactivés afin d'analyser et de nettoyer le système avant de restaurer la protection. Des solutions complémentaires évoquent Spybot, HijackThis et la consultation des journaux ComboFix, avec des instructions pour quitter Internet pendant le scan et réactiver les protections après le nettoyage. En cas de résultats, le fil mentionne l'utilisation de HijackThis version adaptée à Vista et l'affichage de rapports détaillés comme éléments clés pour identifier les programmes indésirables.

Bobot (l’IA à votre service)
  1. ^^Marie^^
    Coucou

    Je m'y attendais un peu pour le résultat ;;))

    Désactive le contrôle des comptes utilisateurs
    (tu le réactiveras après ta désinfection):

    - Va dans démarrer puis panneau de configuration
    - Double Clique sur l'icône "Comptes d'utilisateurs"
    - Clique ensuite sur désactiver et valide.

    "Exécuter en tant qu'administrateur".

    Télécharges ComboFix à partir d'un de ces liens :
    En premier
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    Et important, enregistre le sur le bureau.

    Avant d'utiliser ComboFix :

    ► Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

    ► Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

    Une fois fait, sur ton bureau double-clic sur Combofix.exe.

    - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

    /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

    - En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

    - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

    ► Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

    ► Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

    + 1 log hijacthis

    A++

    2. minibos
      tout de suite mon ordi bug grave
      au bout d'une seconde, l'ordi se bloque pendant 5 secondes, etc...
      1. minibos
        Ah j'ai pas vu le message

        non le prob de connexion n'etait pas externe car mon ordi de bureau marché...
        mais la c'est bon
        2. minibos
          ha! :s
          c'est deja fait avec LSPFix

          sinon, spybot a trouver 4 infections : cookie ClickBank
          3 Clé du registreVirtumonde

          j'ai "corriger les problemes"

          et pour le 010 c'est grave?
          1. Toufou13190
            Tes coupures internet tu est sur que ce n'est pas exterieur au PC, problème de ligne, microcoupure EDF, antenne de radio amateur pas loin si tu est en Wifi !

            A+
            6. minibos
              la je n'arrive pas a me connecter sur internet
              jai fais le tuto avec LSPFix
              1. Toufou13190
                Regarde ce Tuto sur les Winsock LSP pour le fichier wpclsp.dll ligne 010 et passe un coup d'anti spyware avec spydoctor pour voir ce qu'il dit !

                A+
                1. ^^Marie^^
                  Slt

                  En passant

                  Les 010 sont légitimes donc on ne touche pas.

                  A++

              4. minibos
                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 22:19:58, on 04/04/2008
                Platform: Windows Vista SP1 (WinNT 6.00.1905)
                MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                Boot mode: Normal

                Running processes:
                C:\Windows\system32\taskeng.exe
                C:\Windows\system32\Dwm.exe
                C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe
                C:\Program Files\Windows Defender\MSASCui.exe
                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
                C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
                C:\Program Files\McAfee\Common Framework\UdaterUI.exe
                C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
                C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
                C:\Windows\System32\wpcumi.exe
                C:\Program Files\Synaptics\SynTP\SynTPStart.exe
                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                C:\Program Files\QuickTime\QTTask.exe
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\Program Files\Analog Devices\Core\smax4pnp.exe
                C:\Windows\system32\wbem\unsecapp.exe
                C:\Program Files\McAfee\Common Framework\McTray.exe
                C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
                C:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe
                C:\Windows\system32\conime.exe
                C:\Windows\Explorer.exe
                C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
                C:\HijackThis\HijackThis.exe
                C:\Windows\system32\SearchFilterHost.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                O4 - HKLM\..\Run: [PTHOSTTR] "C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" /Start
                O4 - HKLM\..\Run: [IFXSPMGT] "C:\Windows\system32\ifxspmgt.exe" /NotifyLogon
                O4 - HKLM\..\Run: [CognizanceTS] "rundll32.exe" C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
                O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
                O4 - HKLM\..\Run: [WAWifiMessage] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe"
                O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
                O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
                O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"
                O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
                O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
                O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
                O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
                O4 - HKCU\..\Run: [StartCCC] "C:\Program Files\ATI" Technologies\ATI.ACE\Core-Static\CLIStart.exe
                O4 - HKCU\..\Run: [RunSpySweeperScheduleAtStartup] "C:\Windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{FC46B986-A0CF-471F-AD9C-C57E0D8DF663}
                O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
                O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                O4 - Startup: Eurobarre.lnk = C:\Program Files\Eurobarre\eb.exe
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
                O13 - Gopher Prefix:
                O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                O20 - AppInit_DLLs: APSHook.dll
                O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing)
                O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
                O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
                O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
                O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\Windows\system32\ifxspmgt.exe
                O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\Windows\system32\ifxtcs.exe
                O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
                O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
                O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
                O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
                O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
                O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
                O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
                O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
                O23 - Service: Personal Secure Drive service for encrypted drives (PersonalSecureDriveService) - Infineon Technologies AG - C:\Windows\system32\IfxPsdSv.exe
                O23 - Service: L Ile Noyee Drivers Auto Removal (pr2ajbeb) (pr2ajbeb) - Micro Application - C:\Windows\system32\pr2ajbeb.exe
                O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Unknown owner - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (file missing)
                1. minibos
                  ComboFix 08-04-03.5 - Aymeric 2008-04-04 21:58:02.2 - NTFSx86
                  Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.1.1036.18.851 [GMT 2:00]
                  Endroit: C:\Users\Aymeric\Desktop\ComboFix.exe
                  .
                  TimedOut: Windir.dat
                  TimedOut: progfile.dat

                  ((((((((((((((((((((((((((((( Fichiers créés 2008-03-04 to 2008-04-04 ))))))))))))))))))))))))))))))))))))
                  .

                  2008-04-04 20:48 . 2008-04-04 20:48 <REP> d-------- C:\QUARANTINE
                  2008-04-04 17:47 . 2008-04-04 18:14 <REP> d-------- C:\Program Files\Navilog1
                  2008-04-01 20:39 . 2008-04-01 20:39 <REP> d-------- C:\Program Files\Ankama Games
                  2008-04-01 20:09 . 2008-04-01 20:14 1,601,007 ---hs---- C:\Windows\System32\dsyraofp.ini
                  2008-04-01 20:02 . 2008-04-04 21:15 <REP> d-------- C:\HijackThis
                  2008-04-01 19:58 . 2008-04-01 20:04 1,600,603 ---hs---- C:\Windows\System32\yebpakyk.ini
                  2008-04-01 19:40 . 2008-04-01 19:40 <REP> d-------- C:\Program Files\Trend Micro
                  2008-04-01 19:40 . 2008-04-01 19:40 812,344 --a------ C:\hijackthis.exe
                  2008-04-01 17:37 . 2008-04-01 20:23 <REP> d-------- C:\Program Files\Dofus-Arena beta 2
                  2008-04-01 17:11 . 2008-04-01 17:15 <REP> d-------- C:\Program Files\Ankama
                  2008-04-01 16:24 . 2008-04-01 16:24 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
                  2008-03-30 22:17 . 2008-03-30 23:58 1,585,837 ---hs---- C:\Windows\System32\vwgnacyu.ini
                  2008-03-30 22:12 . 2008-04-04 17:42 <REP> d-------- C:\Users\All Users\Avira
                  2008-03-30 22:12 . 2008-04-04 17:42 <REP> d-------- C:\ProgramData\Avira
                  2008-03-30 22:12 . 2008-03-30 22:12 <REP> d-------- C:\Program Files\Avira
                  2008-03-30 21:23 . 2008-03-30 21:23 <REP> d-------- C:\Program Files\Sophos
                  2008-03-30 20:17 . 2008-03-30 22:17 1,585,425 ---hs---- C:\Windows\System32\jwcpwjbr.ini
                  2008-03-30 18:38 . 2006-11-15 11:29 1,712,128 --a------ C:\Windows\System32\GDIPLUS.DLL
                  2008-03-30 18:38 . 2005-07-12 14:25 401,408 --a------ C:\Windows\System32\pvmjpg30.dll
                  2008-03-30 18:38 . 2003-04-21 16:11 44,544 --a------ C:\Windows\System32\msxml4a.dll
                  2008-03-30 18:34 . 2006-04-11 15:03 233,472 --------- C:\Windows\System32\DiskIO.dll
                  2008-03-30 18:34 . 2006-04-11 15:03 184,320 --------- C:\Windows\System32\RALMain.dll
                  2008-03-30 18:34 . 2004-01-02 12:28 126,976 --------- C:\Windows\System32\AVIPrAx.dll
                  2008-03-30 18:34 . 2001-12-11 22:21 73,728 --------- C:\Windows\System32\MMAviAx.dll
                  2008-03-30 18:34 . 2007-03-06 18:53 41,984 --a------ C:\Windows\System32\cacheX.dll
                  2008-03-30 18:34 . 2005-12-12 15:57 32,768 --------- C:\Windows\System32\MLPagAx.dll
                  2008-03-30 18:20 . 2004-07-02 17:28 89,088 --a------ C:\Windows\System32\atl71.dll
                  2008-03-30 18:20 . 2004-07-02 17:28 84,992 --a------ C:\Windows\System32\ATL70.DLL
                  2008-03-30 18:20 . 2006-05-16 12:54 57,344 --a------ C:\Windows\System32\Mfc42loc.dll
                  2008-03-30 18:19 . 2007-01-26 02:04 196,096 --a------ C:\Windows\System32\macd32.dll
                  2008-03-30 18:19 . 2007-01-26 02:04 138,752 --a------ C:\Windows\System32\mase32.dll
                  2008-03-30 18:19 . 2007-01-26 02:04 136,192 --a------ C:\Windows\System32\mamc32.dll
                  2008-03-30 18:19 . 2007-01-26 02:04 57,856 --a------ C:\Windows\System32\masd32.dll
                  2008-03-30 18:19 . 2007-01-26 02:04 27,648 --a------ C:\Windows\System32\ma32.dll
                  2008-03-30 18:15 . 2005-02-09 12:59 14,165 --a------ C:\Windows\System32\drivers\Pclepci.sys
                  2008-03-30 18:12 . 2008-03-30 20:09 1,584,617 ---hs---- C:\Windows\System32\ddlnjuvi.ini
                  2008-03-30 18:09 . 2007-01-04 10:07 171,520 --a------ C:\Windows\System32\drivers\MarvinBus.sys
                  2008-03-30 18:09 . 2004-02-24 13:04 41,219 --a------ C:\Windows\RSETPATH.exe
                  2008-03-30 18:02 . 2008-03-30 18:41 <REP> d-------- C:\Users\All Users\Pinnacle Studio
                  2008-03-30 18:02 . 2008-03-30 18:41 <REP> d-------- C:\ProgramData\Pinnacle Studio
                  2008-03-30 18:02 . 2008-03-30 18:33 <REP> d-------- C:\Program Files\Pinnacle
                  2008-03-28 21:10 . 2008-03-28 21:10 <REP> d-------- C:\Users\Aymeric\AppData\Roaming\Webroot
                  2008-03-28 21:10 . 2008-03-28 21:10 <REP> d-------- C:\Users\All Users\Webroot
                  2008-03-28 21:10 . 2008-03-28 21:10 <REP> d-------- C:\ProgramData\Webroot
                  2008-03-28 03:05 . 2008-03-28 03:05 <REP> dr------- C:\Users\Public\Downloads
                  2008-03-28 01:21 . 2008-03-28 00:20 152,576 --a------ C:\Windows\System32\SPWizUI.dll
                  2008-03-28 01:21 . 2008-03-28 00:20 47,560 --a------ C:\Windows\System32\SPReview.exe
                  2008-03-28 00:51 . 2008-01-19 00:33 193,024 --a------ C:\Windows\System32\recdisc.exe
                  2008-03-28 00:51 . 2008-01-19 00:36 6,656 --a------ C:\Windows\System32\sdspres.dll
                  2008-03-28 00:47 . 2008-01-19 00:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
                  2008-03-28 00:46 . 2008-01-19 00:36 142,336 --a------ C:\Windows\System32\spp.dll
                  2008-03-28 00:46 . 2008-01-19 00:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
                  2008-03-28 00:39 . 2008-01-19 00:33 5,714,432 --a------ C:\Windows\System32\logon.scr
                  2008-03-28 00:37 . 2008-01-19 00:36 2,153,472 --a------ C:\Windows\System32\oobefldr.dll
                  2008-03-28 00:36 . 2008-01-19 00:38 4,595,712 --a------ C:\Windows\System32\AuthFWSnapin.dll
                  2008-03-28 00:35 . 2008-01-19 00:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
                  2008-03-28 00:33 . 2008-01-18 22:46 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
                  2008-03-28 00:31 . 2008-01-19 00:36 2,588,160 --a------ C:\Windows\System32\UIHub.dll
                  2008-03-28 00:21 . 2008-01-19 00:33 44,032 --a------ C:\Windows\System32\cbsra.exe
                  2008-03-27 22:53 . 2008-04-04 21:05 54,156 --ah----- C:\Windows\QTFont.qfn
                  2008-03-27 22:53 . 2008-03-27 22:53 1,409 --a------ C:\Windows\QTFont.for
                  2008-03-27 22:51 . 2008-03-27 22:51 <REP> d-------- C:\Program Files\Bonjour
                  2008-03-27 22:48 . 2008-03-27 22:50 <REP> d-------- C:\Program Files\QuickTime
                  2008-03-27 22:45 . 2008-03-27 22:45 <REP> d-------- C:\Users\All Users\Apple
                  2008-03-27 22:45 . 2008-03-27 22:45 <REP> d-------- C:\ProgramData\Apple
                  2008-03-27 18:26 . 2008-03-27 18:26 <REP> d-------- C:\Windows\System32\Kaspersky Lab
                  2008-03-27 18:05 . 2008-03-27 18:05 <REP> d-------- C:\Users\Aymeric\AppData\Roaming\Talkback
                  2008-03-27 18:04 . 2008-03-27 18:04 0 --a------ C:\Windows\nsreg.dat
                  2008-03-26 20:20 . 2008-03-26 20:20 <REP> d-------- C:\Users\Aymeric\AppData\Roaming\Infineon
                  2008-03-24 22:14 . 2008-03-24 22:14 <REP> d-------- C:\Users\Aymeric\AppData\Roaming\Apple Computer
                  2008-03-24 22:11 . 2008-03-27 22:52 <REP> d-------- C:\Program Files\iTunes
                  2008-03-24 22:11 . 2008-03-27 22:52 <REP> d-------- C:\Program Files\iPod
                  2008-03-24 22:01 . 2008-03-27 22:48 <REP> d-------- C:\Users\All Users\Apple Computer
                  2008-03-24 22:01 . 2008-03-27 22:48 <REP> d-------- C:\ProgramData\Apple Computer
                  2008-03-24 22:01 . 2008-03-24 22:07 <REP> d-------- C:\Program Files\QuickTime(115)
                  2008-03-24 21:57 . 2008-03-27 22:46 <REP> d-------- C:\Program Files\Apple Software Update
                  2008-03-24 21:52 . 2008-03-24 21:52 <REP> d-------- C:\Program Files\Common Files\Apple
                  2008-03-24 21:44 . 2008-03-24 23:39 <REP> d--h----- C:\Windows\msdownld.tmp
                  2008-03-24 15:30 . 2008-03-24 15:30 <REP> d-------- C:\Program Files\Antipub
                  2008-03-24 14:03 . 2008-03-30 18:40 <REP> d-------- C:\Users\All Users\Pinnacle
                  2008-03-24 14:03 . 2008-03-30 18:40 <REP> d-------- C:\ProgramData\Pinnacle
                  2008-03-24 11:35 . 2008-03-24 11:35 0 --ah----- C:\ProgramData.LOG2
                  2008-03-24 11:35 . 2008-03-24 11:35 0 --ah----- C:\ProgramData.LOG1
                  2008-03-23 22:03 . 2008-03-28 01:23 196,608 --a------ C:\Windows\SPInstall.etl
                  2008-03-22 19:30 . 2008-03-23 14:21 1,545,467 ---hs---- C:\Windows\System32\ybgslqiu.ini
                  2008-03-22 12:59 . 2008-03-22 19:16 1,544,575 ---hs---- C:\Windows\System32\xcsuavft.ini
                  2008-03-21 21:47 . 2008-03-22 12:59 1,650 ---hs---- C:\Windows\System32\bhujteer.ini
                  2008-03-20 18:40 . 2008-03-20 18:40 <REP> d-------- C:\Users\Aymeric\{652d6f79-5a1f-47c5-8c87-10e40b972f29}
                  2008-03-20 18:35 . 2008-03-20 18:35 <REP> d-------- C:\Users\All Users\Logishrd
                  2008-03-20 18:35 . 2008-03-20 18:35 <REP> d-------- C:\ProgramData\Logishrd
                  2008-03-20 18:34 . 2008-03-20 18:34 <REP> d-------- C:\Users\All Users\Logitech
                  2008-03-20 18:34 . 2008-03-20 18:34 <REP> d-------- C:\ProgramData\Logitech
                  2008-03-20 18:08 . 2008-03-20 18:35 <REP> d-------- C:\Program Files\Common Files\LogiShrd
                  2008-03-19 20:57 . 2008-03-20 22:23 1,546,724 ---hs---- C:\Windows\System32\qmmxgkcg.ini
                  2008-03-19 20:46 . 2008-03-27 00:00 <REP> d-------- C:\Users\Aymeric\AppData\Roaming\Lavasoft
                  2008-03-19 20:43 . 2008-03-24 16:06 <REP> d-a------ C:\Users\All Users\TEMP
                  2008-03-19 20:43 . 2008-03-24 16:06 <REP> d-a------ C:\ProgramData\TEMP
                  2008-03-19 20:42 . 2008-03-30 16:20 <REP> d-------- C:\Program Files\Spyware Doctor
                  2008-03-19 20:42 . 2007-12-10 15:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
                  2008-03-19 20:42 . 2007-12-10 15:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2008-04-01 21:02 --------- d-----w C:\Users\Aymeric\AppData\Roaming\foobar2000
                  2008-04-01 17:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
                  2008-04-01 15:29 --------- d-----w C:\ProgramData\Roxio
                  2008-03-31 16:35 --------- d-----w C:\Users\Aymeric\AppData\Roaming\LimeWire
                  2008-03-30 14:20 --------- d-----w C:\Program Files\Messenger Plus! Live
                  2008-03-28 01:05 174 --sha-w C:\Program Files\desktop.ini
                  2008-03-28 00:47 --------- d-----w C:\Program Files\Windows Sidebar
                  2008-03-28 00:47 --------- d-----w C:\Program Files\Windows Photo Gallery
                  2008-03-28 00:47 --------- d-----w C:\Program Files\Windows Mail
                  2008-03-28 00:47 --------- d-----w C:\Program Files\Windows Defender
                  2008-03-28 00:47 --------- d-----w C:\Program Files\Windows Collaboration
                  2008-03-28 00:47 --------- d-----w C:\Program Files\Windows Calendar
                  2008-03-27 23:35 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
                  2008-03-27 23:34 82,432 ----a-w C:\Windows\System32\axaltocm.dll
                  2008-03-26 22:00 --------- d-----w C:\Users\Aymeric\AppData\Roaming\U3
                  2008-03-26 21:59 --------- d-----w C:\Program Files\DivX
                  2008-03-15 20:53 --------- d-----w C:\ProgramData\eMule
                  2008-03-11 21:51 --------- d-----w C:\Program Files\Dofus
                  2008-03-09 16:56 --------- d-----w C:\Program Files\Common Files\Steam
                  2008-03-01 22:04 --------- d-----w C:\Program Files\CDex_170b2
                  2008-02-25 20:52 --------- d-----w C:\Users\Aymeric\AppData\Roaming\Roxio
                  2008-02-22 21:48 --------- d-----w C:\Program Files\Toon Boom Animation
                  2008-02-22 21:30 --------- d-----w C:\Program Files\Common Files\Adobe
                  2008-02-16 19:15 6,656 ----a-w C:\Windows\System32\kbd106n.dll
                  2008-02-16 19:01 --------- d-----w C:\ProgramData\Media Center Programs
                  2008-02-08 20:45 --------- d-----w C:\Program Files\Audacity
                  2008-02-07 20:09 115,279,753 ----a-w C:\Windows\DUMP3b15.tmp
                  2008-01-18 22:44 986,680 ----a-w C:\Windows\System32\winload.exe
                  2008-01-18 22:44 926,776 ----a-w C:\Windows\System32\winresume.exe
                  2008-01-18 22:43 614,968 ----a-w C:\Windows\System32\ci.dll
                  2008-01-18 22:43 376,376 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
                  2008-01-18 22:43 3,600,440 ----a-w C:\Windows\System32\ntkrnlpa.exe
                  2008-01-18 22:43 3,548,728 ----a-w C:\Windows\System32\ntoskrnl.exe
                  2008-01-18 22:43 247,352 ----a-w C:\Windows\System32\clfs.sys
                  2008-01-18 22:42 94,776 ----a-w C:\Windows\System32\MigAutoPlay.exe
                  2008-01-18 22:42 51,768 ----a-w C:\Windows\System32\PSHED.DLL
                  2008-01-18 22:42 177,208 ----a-w C:\Windows\System32\halmacpi.dll
                  2008-01-18 22:42 141,880 ----a-w C:\Windows\System32\halacpi.dll
                  2008-01-18 22:41 24,120 ----a-w C:\Windows\System32\BOOTVID.DLL
                  2008-01-18 22:41 21,560 ----a-w C:\Windows\System32\kdusb.dll
                  2008-01-18 22:41 19,512 ----a-w C:\Windows\System32\kdcom.dll
                  2008-01-18 22:38 46,080 ----a-w C:\Windows\System32\NAPCRYPT.DLL
                  2008-01-18 22:38 242,744 ----a-w C:\Windows\System32\rsaenh.dll
                  2008-01-18 22:38 155,704 ----a-w C:\Windows\System32\dssenh.dll
                  2008-01-18 22:38 131,640 ----a-w C:\Windows\System32\basecsp.dll
                  2008-01-18 22:38 103,936 ----a-w C:\Windows\System32\NAPHLPR.DLL
                  2008-01-18 22:38 1,203,792 ----a-w C:\Windows\System32\ntdll.dll
                  2008-01-18 22:36 99,840 ----a-w C:\Windows\System32\ulib.dll
                  2008-01-18 22:35 98,304 ----a-w C:\Windows\System32\mssitlb.dll
                  2008-01-18 22:34 98,816 ----a-w C:\Windows\System32\mfps.dll
                  2008-01-18 22:33 98,304 ----a-w C:\Windows\System32\makecab.exe
                  2008-01-18 22:32 258,048 ----a-w C:\Windows\System32\winspool.drv
                  2008-01-18 22:32 21,504 ----a-w C:\Windows\System32\msacm32.drv
                  2008-01-18 22:32 166,912 ----a-w C:\Windows\System32\wdmaud.drv
                  2008-01-18 22:32 1,370,624 ----a-w C:\Windows\System32\Aurora.scr
                  2008-01-18 22:31 7,680 ----a-w C:\Windows\System32\spwizres.dll
                  2008-01-18 22:31 57,856 ----a-w C:\Windows\System32\nlsbres.dll
                  2008-01-18 22:31 118,272 ----a-w C:\Windows\System32\RDPENCDD.dll
                  2008-01-18 22:30 17,920 ----a-w C:\Windows\System32\netevent.dll
                  2008-01-18 22:29 705,536 ----a-w C:\Windows\System32\imagesp1.dll
                  2008-01-18 22:29 58,880 ----a-w C:\Windows\System32\msobjs.dll
                  2008-01-18 22:28 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
                  2008-01-18 22:26 36,864 ----a-w C:\Windows\System32\cdd.dll
                  2008-01-18 21:06 8,147,456 ----a-w C:\Windows\System32\wmploc.DLL
                  2008-01-18 21:01 14,336 ----a-w C:\Windows\System32\tsddd.dll
                  2008-01-18 21:01 134,656 ----a-w C:\Windows\System32\rdpdd.dll
                  2008-01-18 20:52 56,320 ----a-w C:\Windows\System32\vga256.dll
                  2008-01-18 20:52 21,504 ----a-w C:\Windows\System32\vga64k.dll
                  2008-01-18 20:52 11,776 ----a-w C:\Windows\System32\framebuf.dll
                  2008-01-18 20:52 10,752 ----a-w C:\Windows\System32\vga.dll
                  2008-01-18 20:50 14,848 ----a-w C:\Windows\System32\iscsilog.dll
                  2008-01-18 20:48 20,992 ----a-w C:\Windows\System32\msdtcVSp1res.dll
                  2008-01-18 20:48 1,291,264 ----a-w C:\Windows\System32\comres.dll
                  2008-01-18 20:39 13,312 ----a-w C:\Windows\System32\WsmRes.dll
                  2008-01-18 20:37 2,031,616 ----a-w C:\Windows\System32\win32k.sys
                  2008-01-18 20:36 289,792 ----a-w C:\Windows\System32\atmfd.dll
                  2008-01-18 20:33 56,320 ----a-w C:\Windows\System32\graftabl.com
                  2008-01-18 20:31 8,322,048 ----a-w C:\Windows\System32\spwizimg.dll
                  2008-01-18 20:27 8,704 ----a-w C:\Windows\System32\kd1394.dll
                  2008-01-18 20:26 605,696 ----a-w C:\Windows\System32\adtschema.dll
                  2008-01-18 18:17 100,043 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
                  2008-01-05 02:36 195,122 ----a-w C:\Windows\System32\winrm.vbs
                  2008-01-05 02:35 80,047 ----a-w C:\Windows\System32\slmgr.vbs
                  2008-01-05 02:34 15,181 ----a-w C:\Windows\System32\gatherWirelessInfo.vbs
                  2008-01-05 02:27 96,760 ----a-w C:\Windows\System32\dfshim.dll
                  2008-01-05 02:27 84,480 ----a-w C:\Windows\System32\mscories.dll
                  2008-01-05 02:27 282,112 ----a-w C:\Windows\System32\mscoree.dll
                  2008-01-05 02:27 158,720 ----a-w C:\Windows\System32\mscorier.dll
                  2008-01-05 02:21 779,800 ----a-w C:\Windows\System32\PresentationNative_v0300.dll
                  2008-01-05 02:21 579,584 ----a-w C:\Windows\System32\icardagt.exe
                  2008-01-05 02:21 350,744 ----a-w C:\Windows\System32\PresentationHost.exe
                  2008-01-05 02:21 33,304 ----a-w C:\Windows\System32\PresentationHostProxy.dll
                  2008-01-05 02:21 28,672 ----a-w C:\Windows\System32\TsWpfWrp.exe
                  2008-01-05 02:21 12,198 ----a-w C:\Windows\System32\gatherWiredInfo.vbs
                  2008-01-05 02:21 11,776 ----a-w C:\Windows\System32\icardres.dll
                  2008-01-05 02:21 106,520 ----a-w C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
                  .

                  ((((((((((((((((((((((((((((( snapshot@2008-04-04_21.08.33.16 )))))))))))))))))))))))))))))))))))))))))
                  .
                  - 2008-04-04 19:00:50 67,584 --s-a-w C:\Windows\bootstat.dat
                  + 2008-04-04 19:13:21 67,584 --s-a-w C:\Windows\bootstat.dat
                  - 2008-04-04 18:44:56 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
                  + 2008-04-04 19:16:06 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
                  - 2008-04-04 18:50:39 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
                  + 2008-04-04 19:15:54 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
                  - 2008-04-04 15:40:52 104,940 ----a-w C:\Windows\System32\perfc009.dat
                  + 2008-04-04 19:10:01 104,940 ----a-w C:\Windows\System32\perfc009.dat
                  - 2008-04-04 15:40:52 128,004 ----a-w C:\Windows\System32\perfc00C.dat
                  + 2008-04-04 19:10:01 128,004 ----a-w C:\Windows\System32\perfc00C.dat
                  - 2008-04-04 15:40:52 595,506 ----a-w C:\Windows\System32\perfh009.dat
                  + 2008-04-04 19:10:01 595,506 ----a-w C:\Windows\System32\perfh009.dat
                  - 2008-04-04 15:40:52 678,968 ----a-w C:\Windows\System32\perfh00C.dat
                  + 2008-04-04 19:10:01 678,968 ----a-w C:\Windows\System32\perfh00C.dat
                  - 2008-04-04 15:39:24 411,634 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
                  + 2008-04-04 19:13:24 412,404 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
                  .
                  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  REGEDIT4
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
                  "RunSpySweeperScheduleAtStartup"="C:\Windows\system32\msfeedssync.exe" [2008-01-19 00:33 12800]
                  "LaunchList"="C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" [2007-03-21 15:41 145496]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 00:38 1008184]
                  "PTHOSTTR"="C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.exe" [2007-01-09 15:52 145184]
                  "IFXSPMGT"="C:\Windows\system32\ifxspmgt.exe" [2007-05-23 16:04 677408]
                  "CognizanceTS"="rundll32.exe" [2006-11-02 11:45 44544 C:\Windows\System32\rundll32.exe]
                  "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 13:18 472776]
                  "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 16:12 317128]
                  "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
                  "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]
                  "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
                  "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-07 09:47 159744]
                  "WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:34 176128]
                  "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 03:29 102400]
                  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 03:50 1021224]
                  "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
                  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
                  "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 18:14 1183744]

                  C:\Users\Aymeric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
                  Eurobarre.lnk - C:\Program Files\Eurobarre\eb.exe [2007-12-14 22:25:40 113664]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                  "EnableLUA"= 0 (0x0)
                  "EnableUIADesktopToggle"= 0 (0x0)

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
                  "LogonHoursAction"= 2 (0x2)
                  "DontDisplayLogonHoursWarnings"= 1 (0x1)

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "VIDC.I420"= vdrcodec.dll
                  "VIDC.YV12"= yv12vfw.dll
                  "msacm.ac3acm"= ac3acm.acm
                  "msacm.lameacm"= lameACM.acm
                  "MSVideo"= vfwwdm32.dll
                  "MSVideo8"= VfWWDM32.dll
                  "msacm.enc"= ITIG726.acm
                  "VIDC.MJPG"= Pvmjpg30.dll

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4085715606-2862175576-2489681671-1009]
                  "EnableNotificationsRef"=dword:00000001

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
                  "{578C9A76-32AD-4C0C-BA1E-ECC27F111513}"= UDP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service
                  "{CE130053-D91B-4E7C-BD52-20D714E9960D}"= TCP:C:\Program Files\McAfee\Common Framework\FrameworkService.exe:McAfee Framework Service
                  "{753C29C0-FB8C-47E1-BB91-DDBF3920DC67}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
                  "TCP Query User{0FB35268-0579-4199-B003-02B72B9AB7B0}C:\\program files\\ankama games\\dofus\\dofus.exe"= UDP:C:\program files\ankama games\dofus\dofus.exe:Dofus Client
                  "UDP Query User{CCE93CB4-C800-49F8-B998-2A9A9C81456F}C:\\program files\\ankama games\\dofus\\dofus.exe"= TCP:C:\program files\ankama games\dofus\dofus.exe:Dofus Client
                  "TCP Query User{1E167111-5100-4564-8433-ABFE3A619AB8}C:\\windows\\system32\\java.exe"= UDP:C:\windows\system32\java.exe:Java(TM) Platform SE binary
                  "UDP Query User{675F49F4-C4A8-4698-B554-5FAAB7C546C2}C:\\windows\\system32\\java.exe"= TCP:C:\windows\system32\java.exe:Java(TM) Platform SE binary
                  "TCP Query User{BA1772DB-35EF-4D10-B629-10832B145889}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
                  "UDP Query User{BC25E83F-7AB1-46AA-A1AD-2164E1C31B36}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
                  "{B76C8075-A6B5-4DC8-8A6C-888CFE52AA50}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
                  "{673EC545-2452-464C-B872-26A9DE6CAAD6}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
                  "TCP Query User{2FDC7B6D-74AA-49D6-941F-77537F298F5B}C:\\program files\\dofus-arena beta 2\\dofusarena.exe"= UDP:C:\program files\dofus-arena beta 2\dofusarena.exe:Dofus Arena Client
                  "UDP Query User{B17EC13F-1467-4757-9D4C-B007B7DE172A}C:\\program files\\dofus-arena beta 2\\dofusarena.exe"= TCP:C:\program files\dofus-arena beta 2\dofusarena.exe:Dofus Arena Client
                  "TCP Query User{E9253B8C-E4C8-4732-8EE5-BBFDE99244A2}C:\\users\\aymeric\\appdata\\locallow\\powerchallenge\\powersoccer\\powersoccer.exe"= UDP:C:\users\aymeric\appdata\locallow\powerchallenge\powersoccer\powersoccer.exe:powersoccer.exe
                  "UDP Query User{54D8501F-7C04-45DE-A720-F4BAB8D511E8}C:\\users\\aymeric\\appdata\\locallow\\powerchallenge\\powersoccer\\powersoccer.exe"= TCP:C:\users\aymeric\appdata\locallow\powerchallenge\powersoccer\powersoccer.exe:powersoccer.exe
                  "TCP Query User{5C310060-7301-4F62-8C1C-BFF32D45277A}C:\\program files\\ankama games\\dofusarenabeta2\\dofusarena.exe"= UDP:C:\program files\ankama games\dofusarenabeta2\dofusarena.exe:Dofus Arena Client
                  "UDP Query User{B821BA6A-6B3C-4900-8D27-52E27C7DF6F3}C:\\program files\\ankama games\\dofusarenabeta2\\dofusarena.exe"= TCP:C:\program files\ankama games\dofusarenabeta2\dofusarena.exe:Dofus Arena Client
                  "TCP Query User{2B502449-12F2-485B-929D-CCAB9FA03D5C}C:\\windows\\system32\\java.exe"= UDP:C:\windows\system32\java.exe:Java(TM) Platform SE binary
                  "UDP Query User{6BE506BA-4D2A-4C3C-B100-4032B149C73A}C:\\windows\\system32\\java.exe"= TCP:C:\windows\system32\java.exe:Java(TM) Platform SE binary
                  "TCP Query User{26E7C397-3281-4BBB-88D6-992A1C7AE4D2}C:\\program files\\ankama games\\dofusarenabeta2\\dofusarena.exe"= UDP:C:\program files\ankama games\dofusarenabeta2\dofusarena.exe:Dofus Arena Client
                  "UDP Query User{52EB282E-110F-4373-BB12-F3E79CA883D0}C:\\program files\\ankama games\\dofusarenabeta2\\dofusarena.exe"= TCP:C:\program files\ankama games\dofusarenabeta2\dofusarena.exe:Dofus Arena Client
                  "TCP Query User{E5F15A2A-4C01-4EED-B288-172F9832B04F}C:\\program files\\dofus-arena beta 2\\dofusarena.exe"= UDP:C:\program files\dofus-arena beta 2\dofusarena.exe:Dofus Arena Client
                  "UDP Query User{B2489612-3873-4743-8BAB-CDF9B44E96CD}C:\\program files\\dofus-arena beta 2\\dofusarena.exe"= TCP:C:\program files\dofus-arena beta 2\dofusarena.exe:Dofus Arena Client
                  "TCP Query User{510E1568-BC18-4442-B252-A1780A6FA675}C:\\program files\\counter-strike\\hl.exe"= UDP:C:\program files\counter-strike\hl.exe:Half-Life Launcher
                  "UDP Query User{8C4290F5-CCCD-4171-A9C3-DB9E27623EA4}C:\\program files\\counter-strike\\hl.exe"= TCP:C:\program files\counter-strike\hl.exe:Half-Life Launcher
                  "TCP Query User{F4255656-3505-41C2-86FD-239215312725}C:\\program files\\counter-strike\\hlds.exe"= UDP:C:\program files\counter-strike\hlds.exe:HLDS Launcher
                  "UDP Query User{C938A2E4-D865-464B-9993-AC5999D7F98C}C:\\program files\\counter-strike\\hlds.exe"= TCP:C:\program files\counter-strike\hlds.exe:HLDS Launcher
                  "TCP Query User{BD9BF138-093C-4A49-8334-274D81A96B57}C:\\program files\\assaultcube\\bin_win32\\ac_server.exe"= UDP:C:\program files\assaultcube\bin_win32\ac_server.exe:ac_server
                  "UDP Query User{AF5DB29F-ED6F-4465-A04F-38CF770CA7F2}C:\\program files\\assaultcube\\bin_win32\\ac_server.exe"= TCP:C:\program files\assaultcube\bin_win32\ac_server.exe:ac_server
                  "TCP Query User{2799C0F8-BE69-4034-A56A-4F64305F1091}C:\\program files\\hp\\hp software update\\hpwucli.exe"= UDP:C:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
                  "UDP Query User{9FBE5492-C7B8-4063-80E9-03BCE3D88CEC}C:\\program files\\hp\\hp software update\\hpwucli.exe"= TCP:C:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
                  "TCP Query User{EA1766A1-E9D7-4C60-AB14-0B024C17BDFE}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
                  "UDP Query User{EA0AF132-5ADB-4D9B-A5F2-2DFC3C924BAD}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
                  "TCP Query User{0C440FA1-DB21-44ED-A2C0-932F06F7EBCB}C:\\program files\\shareaza\\shareaza.exe"= UDP:C:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
                  "UDP Query User{14B8933C-AA71-4658-B68E-6D48EBD47241}C:\\program files\\shareaza\\shareaza.exe"= TCP:C:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
                  "TCP Query User{4581B1C2-F1C9-4411-B458-3F3A2C5FFBF0}C:\\program files\\adsltv\\adsltv.exe"= UDP:C:\program files\adsltv\adsltv.exe:adsltv
                  "UDP Query User{64B07E16-1280-4BAD-9076-F7098FB47345}C:\\program files\\adsltv\\adsltv.exe"= TCP:C:\program files\adsltv\adsltv.exe:adsltv
                  "TCP Query User{F0BEA671-ABB3-4333-81AD-B178E8CBCD2D}C:\\program files\\adsltv\\vlc.exe"= UDP:C:\program files\adsltv\vlc.exe:VLC media player
                  "UDP Query User{0B1E6B58-304A-4A08-9B86-465831188EB2}C:\\program files\\adsltv\\vlc.exe"= TCP:C:\program files\adsltv\vlc.exe:VLC media player
                  "TCP Query User{6FB79227-A74F-4630-BE89-4D32D0DD263E}C:\\program files\\homeplayer1.5.3.1\\homeplayer.exe"= UDP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer
                  "UDP Query User{A6F280B6-8613-4016-88DA-6311ED577370}C:\\program files\\homeplayer1.5.3.1\\homeplayer.exe"= TCP:C:\program files\homeplayer1.5.3.1\homeplayer.exe:HomePlayer
                  "TCP Query User{2579AF1C-028A-417F-84E3-BAC6ED20D03E}C:\\program files\\orbitdownloader\\orbitnet.exe"= UDP:C:\program files\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader
                  "UDP Query User{65B04A09-AFEE-4E2D-8655-C4A8E52656A8}C:\\program files\\orbitdownloader\\orbitnet.exe"= TCP:C:\program files\orbitdownloader\orbitnet.exe:P2P service of Orbit Downloader
                  "TCP Query User{DF1BB203-9708-4693-BD57-353941D9DFAF}C:\\kav\\kav7.0\\french\\setup.exe"= UDP:C:\kav\kav7.0\french\setup.exe:Programme d'installation de Kaspersky Anti-Virus 7.0
                  "UDP Query User{8D47FC90-9E08-46BC-97D8-F756B71B2700}C:\\kav\\kav7.0\\french\\setup.exe"= TCP:C:\kav\kav7.0\french\setup.exe:Programme d'installation de Kaspersky Anti-Virus 7.0
                  "{2C8109F7-FFFB-4E92-8F49-EE34C23C3FD7}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
                  "{21FCEAFB-C13B-48EE-9EFE-77A834EBCF19}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
                  "{9634683A-A916-4593-B860-AA0EE2E72056}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
                  "{04DE8F03-CA60-4AAE-B66F-B291584863A1}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
                  "{9AAB36AC-E735-460B-9A63-EE46635EF2E3}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
                  "{8EBEED32-0096-4D25-9527-4E7D1CB13D9E}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
                  "{7A5636C2-0585-4A44-A1F0-4E33E1CB1970}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
                  "{DFE86BFD-6F63-4343-8C5C-ECAFD6E0170B}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
                  "{3FA072B5-14F8-45E1-BFAA-73E622DF79A3}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
                  "{BD96BED6-4BFC-44D5-AB36-02CDCADF34D0}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
                  "{47BB0087-350D-47C7-941C-3B3083B6F200}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
                  "{45D4124F-8958-4CA8-9A20-59F09FF46B43}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
                  "{461F6CA1-D6FF-486E-90DB-C59311D64B60}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

                  R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 13:23]
                  R0 pe3ajbeb;L Ile Noyee Environment Driver (pe3ajbeb);C:\Windows\system32\drivers\pe3ajbeb.sys [2007-08-22 18:31]
                  R0 ps7ajbeb;L Ile Noyee Synchronization Driver (ps7ajbeb);C:\Windows\system32\drivers\ps7ajbeb.sys [2007-08-22 18:30]
                  R0 SbAlg;SbAlg;C:\Windows\system32\drivers\SbAlg.sys [2006-10-09 13:31]
                  R0 SbFsLock;SbFsLock;C:\Windows\system32\drivers\SbFsLock.sys [2007-03-29 16:54]
                  R1 PersonalSecureDrive;PersonalSecureDrive;C:\Windows\system32\drivers\psd.sys [2007-04-18 21:32]
                  R1 RsvLock;RsvLock;C:\Windows\system32\drivers\RsvLock.sys [2007-04-22 16:25]
                  R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-06 11:44]
                  R2 ASBroker;Courtier de session de connexion;C:\Windows\System32\svchost.exe [2008-01-19 00:33]
                  R2 ASChannel;Canal de communication local;C:\Windows\System32\svchost.exe [2008-01-19 00:33]
                  R2 HpFkCryptService;Drive Encryption Service;"C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe" [2007-04-22 16:32]
                  R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe [2007-01-05 03:00]
                  R2 pdfcDispatcher;PDF Document Manager;C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 08:38]
                  R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-26 14:52]
                  R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-02-02 18:09]
                  S2 pr2ajbeb;L Ile Noyee Drivers Auto Removal (pr2ajbeb);C:\Windows\system32\pr2ajbeb.exe svc []
                  S3 PID_0920;Logitech QuickCam Express(PID_0920);C:\Windows\system32\DRIVERS\LV532AV.SYS [2005-01-31 11:13]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                  LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
                  Cognizance REG_MULTI_SZ ASBroker ASChannel
                  GPSvcGroup REG_MULTI_SZ GPSvc

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
                  \shell\AutoRun\command - F:\LaunchU3.exe -a

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b037e69d-b17f-11dc-9bef-001a4b708b81}]
                  \shell\AutoRun\command - F:\LaunchU3.exe -a

                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
                  msiexec /fums {990BA001-D69F-9DB2-56CE-88E0399B30FB} /qb
                  .
                  Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                  "2008-04-04 18:09:34 C:\Windows\Tasks\User_Feed_Synchronization-{FC46B986-A0CF-471F-AD9C-C57E0D8DF663}.job"
                  - C:\Windows\system32\msfeedssync.exe
                  .
                  **************************************************************************

                  catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-04-04 22:04:25
                  Windows 6.0.6001 Service Pack 1 NTFS

                  Balayage processus cachés ...

                  Balayage caché autostart entries ...

                  Balayage des fichiers cachés ...

                  Scan terminé avec succès
                  Les fichiers cachés: 0

                  **************************************************************************
                  .
                  Temps d'accomplissement: 2008-04-04 22:06:47
                  ComboFix-quarantined-files.txt 2008-04-04 20:06:28
                  ComboFix2.txt 2008-04-04 19:10:36
                  Pre-Run: 34,343,510,016 octets libres
                  Post-Run: 34,315,804,672 octets libres
                  .
                  2008-03-23 18:54:15 --- E O F ---
                  1. minibos
                    sur le bureau, oui

                    mais je n'est qu'une session sur mon pc, donc je ne suis pas admin?
                    1. ^^Marie^^
                      Relance ComboFix encore un coup
                      Stp

                      Et important, enregistre le sur le bureau.
                      Tu t'es mis en administrateur ??

                      • 1
                      • 2

                      Discussions similaires

                      comment enlever les DRM sur captvty
                      alcion6465

                      1 réponse
                      comment contourner le drm ?
                      flyblue

                      2 réponses
                      OTER PROTECTION DRM
                      ALASKA3003

                      1 réponse
                      desactiver la protection des cartouches HP
                      JCB40

                      2 réponses
                      comment enlever la protection en écriture
                      daloudu13180

                      17 réponses