demande d'analyse

Section d'analyse de rapports et de désinfection : malwares en tous genre et autres indésirables. Demandes de nettoyage uniquement. Prise en charge restreinte : équipe spécialisée.

Modérateur: Modérateurs

Règles du forum :arrow: Les désinfections sont prises en charge par un groupe spécifique, tout le monde ne peut pas intervenir pour désinfecter les machines (règles).
:arrow: Les procédures sont sur-mesure, ne faites pas la même chose chez vous (explications).
:arrow: Un topic par machine, chacun crée le sien. ;)

demande d'analyse

Messagepar twilight50 » 08 Juin 2011 17:30

bonjour,
je vient a vous pour l'ordi de ma mère qui lui pose problème...de 1 elle n'a plus accès a internet et plusieurs programme s'ouvre pour lui offrir des analyses et tout..
pouvez vous simplement vérifier sont analyse et voir si tout va bien,....
un gros merci d'avance


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:07, on 2011-06-08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Zune\ZuneBusEnum.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
E:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.distributel.net/distributel-portail_fr.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.distributel.net/distributel-portail_fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.distributel.net/distributel-portail_fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2542115
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.distributel.net/distributel-portail_fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.distributel.net/distributel-portail_fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.distributel.net/distributel-portail_fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.distributel.net/distributel-portail_fr.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.distributel.net/distributel-portail_fr.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Distributel
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} - C:\Program Files\Softonic_France\prxtbSof0.dll
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Softonic_France - {4daac69c-cba7-45e2-9bc8-1044483d3352} - C:\Program Files\Softonic_France\prxtbSof0.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} - C:\Program Files\Softonic_France\prxtbSof0.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 9484 bytes
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 09 Juin 2011 17:59

Bonsoir,
Pour faire un premier diagnostic, applique les deux propositions ci-dessous.

1- Image Télécharge et installe Malwarebytes Anti-Malware de RubbeR DuckY

Image Double-clique sur le fichier mbam-setup-1.50.exe (sous Vista et 7 autorise les modifications)
A la fin de l'installation, veille à ce que les options suivantes soient cochées
    -Mettre à jour Malwarebytes' Anti-Malware
    -Exécuter Malwarebytes' Anti-Malware
Image Clique sur Terminer
Une fenêtre Mise à jour de Malwarebytes' Anti-Malware va s'ouvrir avec une barre de progression.
Puis une autre annonçant le succès de la mise à jour de la base de données. Clique sur OK.
Le programme s'ouvre sur l'onglet Recherche.
Coche Image Exécuter un examen rapide, clique sur le bouton Image

Image A la fin du scan, sélectionne tout et clique sur Supprimer la sélection

Image Poste le rapport qui s'ouvre après cette suppression.
Redémarre le pc si cela est demandé
Tu peux retrouver le rapport dans l'onglet Rapports/Logs avec la date et l'heure d'exécution.

2- Image Télécharge ZHPDiag de Nicolas Coolman sur ton bureau.

Explication en images

3- ImageTélécharge AD-Remover sur ton bureau.

Image Double clique sur AD-R.exe
Clique sur le bouton Nettoyer.
Image Poste le rapport qui va s'ouvrir en fin de scan.
Le rapport est sauvegardé sous C:\Ad-report-SCAN[1].txt
Ferme le programme par Quitter.

Si besoin est, nous ferons appel à d'autres outils.

@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: demande d'analyse

Messagepar twilight50 » 10 Juin 2011 14:54

bonjour,
merci a vous pour votre aide...comme je n'est pas accès a internet (du moins avec le laptop a problème) malwarebytes dit qu'il est périmé depuis 12jour mais il y a un code d'erreur lorsque je veut le mettre a jour...j'espere que cela ne fausse pas le résultat...
voici les rapport...tu ne me demande pas de poster celui de ZHPDiag ? toute facon il faudrais que je poste en 2 message parcequ'il y a trop de caractere...
--------------------------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Version de la base de données: 6705

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2011-06-09 23:19:43
mbam-log-2011-06-09 (23-19-42).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 183670
Temps écoulé: 49 minute(s), 36 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\documents and settings\administrateur\application data\microsoft\internet explorer\quick launch\security central.lnk (Rogue.SecurityCentral) -> Quarantined and deleted successfully.
---------------------------------------------------------------------------------------------------------------------------------------------------------
======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 09:24:18 le 10/06/2011, Mode normal

Microsoft Windows XP Professionnel Service Pack 3 (X86)
Administrateur@ORDI-XPSP2 ( )

============== ACTION(S) ==============


Fichier supprimé: C:\WINDOWS\system32\ConduitEngine.tmp
Dossier supprimé: C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit
Dossier supprimé: C:\Program Files\Conduit
Dossier supprimé: C:\Documents and Settings\Administrateur\Local Settings\Application Data\ConduitEngine
Dossier supprimé: C:\Program Files\ConduitEngine
Dossier supprimé: C:\Documents and Settings\Administrateur\Application Data\PriceGong

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé supprimée: HKLM\Software\Classes\CLSID\{88E6890B-85C9-498A-A2C7-A2C9283D5C4F}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{88E6890B-85C9-498A-A2C7-A2C9283D5C4F}
Clé supprimée: HKLM\Software\Classes\Conduit.Engine
Clé supprimée: HKLM\Software\Classes\Toolbar.CT2542115
Clé supprimée: HKLM\Software\Conduit
Clé supprimée: HKLM\Software\conduitEngine
Clé supprimée: HKLM\Software\PopCap
Clé supprimée: HKCU\Software\Conduit
Clé supprimée: HKCU\Software\conduitEngine
Clé supprimée: HKCU\Software\PriceGong
Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F282DD50-2A78-4BF7-8CF5-45EE0467E15B}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{502358FB-0718-45BC-B142-7511F1694D58}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}

Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{30F9B915-B755-4826-820B-08FBA6BD249D}


============== SCAN ADDITIONNEL ==============

**** Internet Explorer Version [8.0.6001.18702] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM_Main|First Home Page - hxxp://www.distributel.net/distributel-portail_fr.htm
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{4daac69c-cba7-45e2-9bc8-1044483d3352} - "Softonic_France Toolbar" (C:\Program Files\Softonic_France\prxtbSof0.dll)
HKCU_SearchScopes\{AC854C16-CA1E-43f1-8513-0D2F36C726ED} - "Google" (hxxp://www.samenc.com/search/?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&rls=MuFhUKW...)
HKCU_Toolbar\ShellBrowser|{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} (x)
HKCU_Toolbar\WebBrowser|{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} (x)
HKCU_Toolbar\WebBrowser|{4DAAC69C-CBA7-45E2-9BC8-1044483D3352} (C:\Program Files\Softonic_France\prxtbSof0.dll)
HKLM_Toolbar|{4daac69c-cba7-45e2-9bc8-1044483d3352} (C:\Program Files\Softonic_France\prxtbSof0.dll)
HKLM_Toolbar|{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
HKLM_ElevationPolicy\{F4D49A84-20BF-4700-AD9E-E03C39CB965B} - C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit\CT2542115\Softonic_FranceAutoUpdaterHelper.exe (x)
HKLM_Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - "?" (?)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\{4daac69c-cba7-45e2-9bc8-1044483d3352} - "Softonic_France Toolbar" (C:\Program Files\Softonic_France\prxtbSof0.dll)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)
BHO\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - "avast! WebRep" (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 135 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 13 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 10/06/2011 09:24:32 (4487 Octet(s))

Fin à: 09:28:00, 10/06/2011

============== E.O.F ==============
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 10 Juin 2011 15:29

Bonjour,
Peux-tu envoyer le rapport ZHPDiag ?
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: demande d'analyse

Messagepar twilight50 » 10 Juin 2011 15:40

Rapport de ZHPDiag v1.27.228 par Nicolas Coolman, Update du 09/06/2011
Run by Administrateur at 2011-06-10 08:49:04
Web site : http://www.premiumorange.com/zeb-help-p ... pdiag.html


---\\ Web Browser
MSIE: Internet Explorer v8.0.6001.18702 (Defaut)

---\\ System Information
Windows XP Professional Service Pack 3 (Build 2600)
Processor: x86 Family 15 Model 2 Stepping 4, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 511 MB (30% free)
System Restore: Activé (Enable)
System drive C: has 15 GB (40%) free of 37 GB

---\\ Logged in mode
Computer Name: ORDI-XPSP2
User Name: Administrateur
All Users Names: SUPPORT_388945a0, pas bon, HelpAssistant, Administrateur,
Unselected Option: O45,O61,O62,O65,O66,O82
Logged in as Administrator

---\\ Environnement Variables
%AppData%=C:\Documents and Settings\Administrateur\Application Data
%LocalAppData%=C:\Documents and Settings\Administrateur\Local Settings\Application Data
%StartMenu%=C:\Documents and Settings\Administrateur\Menu Démarrer

---\\ DOS/Devices
A:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
C:\ Hard drive, Flash drive, Thumb drive (Free 15 Go of 37 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Floppy drive, Flash card reader, USB Key (Free 1 Go of 2 Go)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK



---\\ Recherche particulière de fichiers génériques
[MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.2008-04-13 21:34:03.) -- C:\WINDOWS\Explorer.exe [1037824]
[MD5.77C66BD5CED4E555919A5FB713322CDD] - (.Microsoft Corporation - Internet Extensions for Win32.) (.2011-02-22 18:05:48.) -- C:\WINDOWS\system32\wininet.dll [916480]
[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.2008-04-13 21:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.2008-04-13 13:40:30.) -- C:\WINDOWS\system32\drivers\atapi.sys [96512]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.2008-04-13 14:15:53.) -- C:\WINDOWS\system32\drivers\ntfs.sys [574976]



---\\ Processus lancés
[MD5.1A198D2182ED39470A70C54C5078BD4D] - (.Lavasoft - Ad-Aware 2007 Service.) -- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [607576]
[MD5.7DE3EE7DBEE14C1F8375CB82466C9321] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [42184]
[MD5.4B5AE15E5C73EB4DC8DBEC2788230D41] - (.Apple Inc. - Apple Mobile Device Service.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [144672]
[MD5.3F56903E124E820AEECE6D471583C6C1] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [238888]
[MD5.EC60491A5FF57700F10FE0403F7DCAD4] - (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [366640]
[MD5.1A3DFAAD625FAF0614C7392AA86A6267] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 32.40.) -- C:\WINDOWS\system32\nvsvc32.exe [61440]
[MD5.DEE869820C3483EC7B92A9FD9BA332A7] - (.Microsoft Corporation - Zune Bus Enumerator Service.) -- c:\Program Files\Zune\ZuneBusEnum.exe [57072]
[MD5.70DE314A16E5A486A0EF2425014685B2] - (.Sun Microsystems, Inc. - Java(TM) 2 Platform Standard Edition binary.) -- C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe [36975]
[MD5.640074569E4B258BD419A4ECB2B49FD1] - (.MacroGaming LTD. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\Macrogaming\SweetIM\SweetIM.exe [103712]
[MD5.8DC7685764B22DB97891012026FA7ED1] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [141608]
[MD5.4048F9DA4BA3036A994185CE6A2B6C55] - (.Microsoft Corporation - Zune Auto-Launcher.) -- C:\Program Files\Zune\ZuneLauncher.exe [159472]
[MD5.4C6898F15701AE7C41775C14E423FE25] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe [3459712]
[MD5.F06CA6475B7A538DB9DC3F7B896B97E4] - (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [449584]
[MD5.07CF2A39D930C4C1C873B233BFDEAAAF] - (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe [1661304]
[MD5.DB9012564169875F5B2AA7F5FC4905E4] - (...) -- C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [16423]
[MD5.B21412B5F63F59D55DCEBA799AAC96B7] - (.Eastman Kodak Company - Kodak EasyShare Software.) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [282624]
[MD5.1E6F080D5EDB4C3B4C4EB787A0848DCC] - (.Apple Inc. - iPodService Module (32-bit).) -- C:\Program Files\iPod\bin\iPodService.exe [545576]
[MD5.F67EC3958F269301717E23D8EF08E409] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [657920]



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
P2 - FPN: [HKLM] [@google.com/npPicasa3,version=3.0.0] - (.Google, Inc. - Picasa plugin.) -- C:\Program Files\Google\Picasa3\npPicasa3.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.60310.0.) -- c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/OfficeLive,version=1.3] - (.Microsoft Corp. - Office Live Update v1.3.) -- C:\Program Files\Microsoft\Office Live\npOLW.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.distributel.net
R0 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.distributel.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.distributel.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.distributel.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.distributel.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
R1 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (8.00.6001.19048 (longhorn_ie8_gdr.110221-1700)) -- C:\WINDOWS\system32\ieframe.dll
R3 - URLSearchHook: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) (6.3.2.0) -- C:\Program Files\Softonic_France\prxtbSof0.dll



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll



---\\ ---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"



---\\ Redirection du fichier Hosts (O1)
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Softonic_France - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\Softonic_France\prxtbSof0.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Clé orpheline
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} . (.Microsoft Corporation - Search Helper for Internet Explorer.) -- C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - avast! WebRep Plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} . (.Microsoft Corporation - Windows Live Toolbar Core.) -- C:\Program Files\Windows Live\Toolbar\wltcore.dll



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\Softonic_France\prxtbSof0.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} . (.Microsoft Corporation - Windows Live Toolbar Core.) -- C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - avast! WebRep Plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll



---\\ ---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [NvCplDaemon] NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] . (.NVIDIA Corporation - NVIDIA nView Wizard, Version 32.40.) -- C:\Windows\System32\nwiz.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) 2 Platform Standard Edition binary.) -- C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SweetIM] . (.MacroGaming LTD. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Zune Launcher] . (.Microsoft Corporation - Zune Auto-Launcher.) -- c:\Program Files\Zune\ZuneLauncher.exe
O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe (.not file.)
O4 - HKCU\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
O4 - HKCU\..\Run: [SweetIM] . (.MacroGaming LTD. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (.not file.)
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe (.not file.)
O4 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
O4 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\..\Run: [SweetIM] . (.MacroGaming LTD. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (.not file.)
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Démarrage\KODAK Software Updater.lnk . (...) -- C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logiciel Kodak EasyShare.lnk . (.Eastman Kodak Company.) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe



---\\ ---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Apple Software Update.lnk . (...) -- C:\WINDOWS\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Encore plus de jeux.lnk - Clé orpheline
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Jouer à Mes jeux.lnk . (...) -- C:\Program Files\bfgclient\bfgclient.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Windows Movie Maker.lnk . (.Microsoft Corporation.) -- C:\Program Files\Movie Maker\moviemk.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Assistance à distance.lnk . (.Microsoft Corporation.) -- C:\WINDOWS\system32\rcimlby.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Outlook Express.lnk . (.Microsoft Corporation.) -- C:\Program Files\Outlook Express\msimn.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Windows Media Player.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Media Player\wmplayer.exe



---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Add to Google Photos Screensa&ver . (.Google Inc. - Google Photos Screensaver.) -- C:\WINDOWS\system32\GPhotos.scr
O8 - Extra context menu item: E&xporter vers Microsoft Excel . (.Microsoft Corporation - Microsoft Office Excel.) -- C:\PROGRA~1\Microsoft Office\Office12\EXCEL.exe
O8 - Extra context menu item: Google Sidewiki... . (.Google Inc. - Google Toolbar for Internet Explorer.) -- C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -- Clé orpheline
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\PROGRA~1\Microsoft Office\Office12\REFBARH.ICO
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} . (...) -- C:\PROGRA~1\Microsoft Office\Office12\REFBARH.ICO
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\MSMSGS.exe



---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Service client pour le fournisseur NetWare et DLL d'authentification.) -- C:\WINDOWS\system32\nwprovau.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files\Bonjour\mdnsNSP.dll



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\Windows\System32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\Windows\System32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\Windows\System32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\System32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\Windows\System32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll
O20 - Winlogon Notify: WgaLogon . (.Microsoft Corporation - Notifications Windows Genuine Advantage.) -- C:\Windows\System32\WgaLogon.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll



---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS\system32\stobject.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll



---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (aawservice) . (.Lavasoft - Ad-Aware 2007 Service.) - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: (Apple Mobile Device) . (.Apple Inc. - Apple Mobile Device Service.) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: (dmadmin) . (.Microsoft Corp., Veritas Software - Processus du service Gestionnaire de disque.) - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: (gupdatem) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: (gusvc) . (.Google - gusvc.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: (iPod Service) . (.Apple Inc. - iPodService Module (32-bit).) - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: (MBAMService) . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: (NVSvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 32.40.) - C:\WINDOWS\system32\nvsvc32.exe



---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Office Word.) - C:\Program Files\Microsoft Office\Office12\WINWORD.exe



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[MD5.7B43567B4C32AD7ADED537CD3B1342B9] [APT] [AppleSoftwareUpdate] (.Apple Inc..) -- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe



---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS\System32\DRIVERS\tcpip.sys
O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys
O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS\System32\DRIVERS\cdrom.sys
O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\WINDOWS\System32\DRIVERS\i8042prt.sys
O41 - Driver: (Imapi) . (.Microsoft Corporation - IMAPI Kernel Driver.) - C:\WINDOWS\System32\DRIVERS\imapi.sys
O41 - Driver: (InCDPass) . (. - .) - C:\WINDOWS\System32\drivers\InCDPass.sys (.not file.)
O41 - Driver: (InCDRm) . (. - .) - C:\WINDOWS\System32\drivers\InCDRm.sys (.not file.)
O41 - Driver: (intelppm) . (.Microsoft Corporation - Pilote de périphérique processeur.) - C:\WINDOWS\System32\DRIVERS\intelppm.sys
O41 - Driver: (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS\System32\DRIVERS\ipsec.sys
O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\WINDOWS\System32\DRIVERS\kbdclass.sys
O41 - Driver: (Mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\WINDOWS\System32\DRIVERS\mouclass.sys
O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\System32\DRIVERS\netbios.sys
O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\System32\DRIVERS\netbt.sys
O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS\System32\DRIVERS\rasacd.sys
O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS\System32\DRIVERS\rdbss.sys
O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
O41 - Driver: (redbook) . (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) - C:\WINDOWS\System32\DRIVERS\redbook.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS\System32\DRIVERS\termdd.sys
O41 - Driver: Carte vidéo VGA. (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS\system32\drivers\vga.sys



---\\ Logiciels installés (O42)
O42 - Logiciel: Ad-Aware 2007 - (.Lavasoft.) [HKLM] -- {DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Aloha Solitaire - (.Pas de propriétaire.) [HKLM] -- Aloha Solitaire_is1
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM] -- {3FA365DF-2D68-45ED-8F83-8C8A33E65143}
O42 - Logiciel: Apple Mobile Device Support - (.Apple Inc..) [HKLM] -- {AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM] -- {6956856F-B6B3-4BE0-BA0B-8F495BE32033}
O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
O42 - Logiciel: Bejeweled 2 Deluxe - (.Pas de propriétaire.) [HKLM] -- Bejeweled 2 Deluxe
O42 - Logiciel: Big Fish Games Client - (.Pas de propriétaire.) [HKLM] -- BFGC
O42 - Logiciel: Bonjour - (.Apple Inc..) [HKLM] -- {07287123-B8AC-41CE-8346-3D777245C35B}
O42 - Logiciel: CCScore - (.EASTMAN KODAK Company.) [HKLM] -- {B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}
O42 - Logiciel: Canon PhotoRecord - (.Pas de propriétaire.) [HKLM] -- PhotoRecord
O42 - Logiciel: Canon Utilities ZoomBrowser EX - (.Pas de propriétaire.) [HKLM] -- ZoomBrowserEXDeInstall
O42 - Logiciel: Conduit Engine - (.Conduit Ltd..) [HKLM] -- conduitEngine
O42 - Logiciel: ESSCDBK - (.EASTMAN KODAK Company.) [HKLM] -- {AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
O42 - Logiciel: ESSPCD - (.EASTMAN KODAK Company.) [HKLM] -- {14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
O42 - Logiciel: ESSSONIC - (.EASTMAN KODAK Company.) [HKLM] -- {073F22CE-9A5B-4A40-A604-C7270AC6BF34}
O42 - Logiciel: ESSTOOLS - (.EASTMAN KODAK Company.) [HKLM] -- {8A502E38-29C9-49FA-BCFA-D727CA062589}
O42 - Logiciel: ESScore - (.Nom de votre société.) [HKLM] -- {9D8FEE90-0377-49A9-AEFB-525BDE549BA4}
O42 - Logiciel: ESSgui - (.EASTMAN KODAK Company.) [HKLM] -- {91517631-A9F3-4B7C-B482-43E0068FD55A}
O42 - Logiciel: ESSini - (.Nom de votre société.) [HKLM] -- {8E92D746-CD9F-4B90-9668-42B74C14F765}
O42 - Logiciel: Fishdom H2O: Hidden Odyssey ™ - (.Pas de propriétaire.) [HKLM] -- BFG-Fishdom H2O - Hidden Odyssey
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {1EE04769-91C4-4A06-92B7-FCAFE6BABDD9}
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {18455581-E099-4BA8-BC6B-F34B2F06600C}
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
O42 - Logiciel: Hotfix for Windows Media Format 11 SDK (KB929399) - (.Microsoft Corporation.) [HKLM] -- KB929399
O42 - Logiciel: Hotfix for Windows Media Format 11 SDK (KB973442) - (.Microsoft Corporation.) [HKLM] -- KB973442_WM11
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3
O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {133742BA-6F46-4D3E-85AF-78631D9AD8B8}
O42 - Logiciel: J2SE Runtime Environment 5.0 Update 1 - (.Sun Microsystems, Inc..) [HKLM] -- {3248F0A8-6813-11D6-A77B-00B0D0150010}
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {8E5233E1-7495-44FB-8DEB-4BE906D59619}
O42 - Logiciel: K-Lite Codec Pack 5.7.0 (Full) - (.Pas de propriétaire.) [HKLM] -- KLiteCodecPack_is1
O42 - Logiciel: KSU - (.Nom de votre société.) [HKLM] -- {B997C2A0-4383-41BF-B76E-9B8B7ECFB267}
O42 - Logiciel: Lecteur Windows Media 11 - (.Pas de propriétaire.) [HKLM] -- Windows Media Player
O42 - Logiciel: Logiciel Kodak EasyShare - (.Eastman Kodak Company.) [HKLM] -- {D32470A1-B10C-4059-BA53-CF0486F68EBC}
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
O42 - Logiciel: MSXML 6 Service Pack 2 (KB973686) - (.Microsoft Corporation.) [HKLM] -- {56EA8BC0-3751-4B93-BC9D-6651CC36E5AA}
O42 - Logiciel: Macrogaming SweetIM 2.1 - (.Macrogaming LTD..) [HKLM] -- {502358FB-0718-45BC-B142-7511F1694D58}
O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.0.1200 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 SP1
O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
O42 - Logiciel: Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 - (.Microsoft Corporation.) [HKLM] -- Wdf01009
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0015-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0016-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0018-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0019-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001A-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001B-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-0044-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-006E-040C-0000-0000000FF1CE}_PROPLUS_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
O42 - Logiciel: Microsoft Office Access MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0015-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Excel MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0016-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office InfoPath MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0044-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Live Add-in 1.3 - (.Microsoft Corporation.) [HKLM] -- {57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
O42 - Logiciel: Microsoft Office Outlook Connector - (.Microsoft Corporation.) [HKLM] -- {95120000-0122-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Outlook MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001A-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office PowerPoint MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0018-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Professional Plus 2007 - (.Microsoft Corporation.) [HKLM] -- PROPLUS
O42 - Logiciel: Microsoft Office Professional Plus 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Arabic) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0401-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Dutch) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0413-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (English) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (German) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0407-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Spanish) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001F-0C0A-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-002C-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0401-0000-0000000FF1CE}_PROPLUS_{14809F99-C601-4D4A-9391-F1E8FAA964C5}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{A0516415-ED61-419A-981D-93596DA74165}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0413-0000-0000000FF1CE}_PROPLUS_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM] -- {90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}
O42 - Logiciel: Microsoft Office Publisher MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-0019-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Shared MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-006E-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Word MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-001B-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Search Enhancement Pack - (.Microsoft Corporation.) [HKLM] -- {4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Microsoft Sync Framework Runtime Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {8A74E887-8F0F-4017-AF53-CBA42211AAA5}
O42 - Logiciel: Microsoft Sync Framework Services Native v1.0 (x86) - (.Microsoft Corporation.) [HKLM] -- {BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.9 - (.Microsoft Corporation.) [HKLM] -- Wudf01009
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 - (.Microsoft Corporation.) [HKLM] -- {86CE85E6-DBAC-3FFD-B977-E4B79F83C909}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Microsoft WinUsb 1.0 - (.Microsoft Corporation.) [HKLM] -- winusb0100
O42 - Logiciel: NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up - (.Pas de propriétaire.) [HKLM] -- Eset NOD32 v3.0.642 FiX1.2 by TemDono_is1
O42 - Logiciel: NVIDIA Windows 2000/XP Display Drivers - (.Pas de propriétaire.) [HKLM] -- NVIDIA
O42 - Logiciel: Notifier - (.EASTMAN KODAK Company.) [HKLM] -- {0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}
O42 - Logiciel: OfotoXMI - (.EASTMAN KODAK Company.) [HKLM] -- {B162D0A6-9A1D-4B7C-91A5-88FB48113C45}
O42 - Logiciel: Outil de téléchargement Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}
O42 - Logiciel: PCDADDIN - (.EASTMAN KODAK Company.) [HKLM] -- {65D85050-5610-4A91-A3B1-D5C744291AD4}
O42 - Logiciel: PCDHELP - (.EASTMAN KODAK Company.) [HKLM] -- {C99DCDA4-7407-4F72-A77E-C81C551D0C4E}
O42 - Logiciel: Parlons Anglais 7.0 - (.Pas de propriétaire.) [HKLM] -- Parlons Anglais 7.0
O42 - Logiciel: Picasa 3 - (.Google, Inc..) [HKLM] -- Picasa 3
O42 - Logiciel: Project64 1.6 - (.Project64.) [HKLM] -- {9559F7CA-5E34-4237-A2D9-D856464AD727}
O42 - Logiciel: QuickTime - (.Apple Inc..) [HKLM] -- {1451DE6B-ABE1-4F62-BE9A-B363A17588A2}
O42 - Logiciel: SFR - (.Eastman Kodak Company.) [HKLM] -- {DB02F716-6275-42E9-B8D2-83BA2BF5100B}
O42 - Logiciel: SHASTA - (.EASTMAN KODAK Company.) [HKLM] -- {605A4E39-613C-4A12-B56F-DEFBE6757237}
O42 - Logiciel: SKIN0001 - (.EASTMAN KODAK Company.) [HKLM] -- {FDF9943A-3D5C-46B3-9679-586BD237DDEE}
O42 - Logiciel: SKINXSDK - (.EASTMAN KODAK Company.) [HKLM] -- {F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2288621) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{5C497F0B-2061-4CC9-A61C-6B45B867354D}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2288931) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{CD769337-C8AC-46DB-A7DC-643E50089263}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2345043) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{536FB502-775F-4494-BACE-C02CC90B7A5B}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2466156) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{CEF209AB-F96D-404F-B5CC-44057C057CA3}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2509488) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{AD0DE453-0804-4495-9C91-33D0F9AA5463}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB969559) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB976321) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{7F207DCA-3399-40CB-A968-6E5991B1421A}
O42 - Logiciel: Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB2416473
O42 - Logiciel: Security Update for Microsoft Office Access 2007 (KB979440) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{1142CCEC-ACA9-484B-BA90-C3A5CA1988C5}
O42 - Logiciel: Security Update for Microsoft Office Access 2007 (KB979440) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{5A4E43D5-858F-49BD-BA72-8F30E1793060}
O42 - Logiciel: Security Update for Microsoft Office Excel 2007 (KB2464583) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{151E2FEA-C3A6-4CB6-BE6B-16651FDF04BE}
O42 - Logiciel: Security Update for Microsoft Office InfoPath 2007 (KB979441) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{1109D0B3-EFA3-4553-AAED-4C3E9AD130E8}
O42 - Logiciel: Security Update for Microsoft Office InfoPath 2007 (KB979441) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
O42 - Logiciel: Security Update for Microsoft Office PowerPoint 2007 (KB2535818) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{8588DD11-6BD7-4400-B55C-DD5AB74B43E1}
O42 - Logiciel: Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{D75E6D0C-BADF-4F41-98B2-0C0F02C15062}
O42 - Logiciel: Security Update for Microsoft Office Publisher 2007 (KB2284697) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3A4CDE54-2403-483D-8D9A-15E3264410DF}
O42 - Logiciel: Security Update for Microsoft Office Visio Viewer 2007 (KB973709) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
O42 - Logiciel: Security Update for Microsoft Office Word 2007 (KB2344993) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48}
O42 - Logiciel: Security Update for Microsoft Office system 2007 (972581) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}
O42 - Logiciel: Security Update for Microsoft Office system 2007 (KB974234) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{FCD742B9-7A55-44BC-A776-F795F21FEDDC}
O42 - Logiciel: Segoe UI - (.Microsoft Corp.) [HKLM] -- {A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
O42 - Logiciel: Softonic_France Toolbar - (.Softonic_France.) [HKLM] -- Softonic_France Toolbar
O42 - Logiciel: Solitaire 2 - (.Pas de propriétaire.) [HKLM] -- Solitaire 2_is1
O42 - Logiciel: The Game Of Life - (.Pas de propriétaire.) [HKLM] -- The Game Of Life
O42 - Logiciel: Update for 2007 Microsoft Office System (KB967642) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
O42 - Logiciel: Update for Microsoft .NET Framework 3.5 SP1 (KB963707) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707
O42 - Logiciel: Update for Microsoft Office Outlook 2007 (KB2509470) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{1365864D-4C58-489D-9982-844D75691CCC}
O42 - Logiciel: Update for Outlook 2007 Junk Email Filter (KB2536413) - (.Microsoft.) [HKLM] -- {90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{95DF5260-331D-4FFD-A2D5-C64164751945}
O42 - Logiciel: VPRINTOL - (.EASTMAN KODAK Company.) [HKLM] -- {999D43F4-9709-4887-9B1A-83EBB15A8370}
O42 - Logiciel: WIRELESS - (.EASTMAN KODAK Company.) [HKLM] -- {F9593CFB-D836-49BC-BFF1-0E669A411D9F}
O42 - Logiciel: Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray - (.Microsoft Corporation.) [HKLM] -- KB952011
O42 - Logiciel: Windows Genuine Advantage Notifications (KB905474) - (.Microsoft Corporation.) [HKLM] -- WgaNotify
O42 - Logiciel: Windows Genuine Advantage Validation Tool (KB892130) - (.Microsoft Corporation.) [HKLM] -- KB892130
O42 - Logiciel: Windows Imaging Component - (.Microsoft Corporation.) [HKLM] -- WIC
O42 - Logiciel: Windows Internet Explorer 8 - (.Microsoft Corporation.) [HKLM] -- ie8
O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {B3B487E7-6171-4376-9074-B28082CEB504}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3175E049-F9A9-4A3D-8F19-AC9FB04514D1}
O42 - Logiciel: Windows Live Contrôle parental - (.Microsoft Corporation.) [HKLM] -- {9FF9FDF7-F84A-4F99-B4BB-066B6F95F33D}
O42 - Logiciel: Windows Live FolderShare - (.Microsoft Corporation.) [HKLM] -- {76810709-A7D3-468D-9167-A1780C1E766C}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {5DD76286-9BE7-4894-A990-E905E91AC818}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {445B183D-F4F1-45C8-B9DB-F11355CA657B}
O42 - Logiciel: Windows Live OneCare safety scanner - (.Pas de propriétaire.) [HKLM] -- Windows Live OneCare safety scanner
O42 - Logiciel: Windows Live Toolbar - (.Microsoft Corporation.) [HKLM] -- {9D6524E6-15CF-4852-BF70-04FE973A3DE1}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {4634B21A-CC07-4396-890C-2B8168661FEA}
O42 - Logiciel: Windows Media Format 11 runtime - (.Microsoft Corporation.) [HKLM] -- WMFDist11
O42 - Logiciel: Windows Media Format 11 runtime - (.Pas de propriétaire.) [HKLM] -- Windows Media Format Runtime
O42 - Logiciel: Windows Media Player 11 - (.Microsoft Corporation.) [HKLM] -- wmp11
O42 - Logiciel: Windows Messenger 5.1 - (.Microsoft Corporation.) [HKLM] -- {F709B922-E62D-4FF3-8E3A-D7D93C93FC35}
O42 - Logiciel: Windows Mobile Device Updater Component - (.Microsoft Corporation.) [HKLM] -- {2C4E2E4E-A7C9-4CCB-BF03-FE6EBD5D4AB7}
O42 - Logiciel: Windows XP Service Pack 3 - (.Microsoft Corporation.) [HKLM] -- Windows XP Service
O42 - Logiciel: Zune - (.Microsoft Corporation.) [HKLM] -- Zune
O42 - Logiciel: Zune - (.Microsoft Corporation.) [HKLM] -- {7006ED29-58F2-40C3-AE87-039287AD20B6}
O42 - Logiciel: Zune Language Pack (DEU) - (.Microsoft Corporation.) [HKLM] -- {BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}
O42 - Logiciel: Zune Language Pack (ESP) - (.Microsoft Corporation.) [HKLM] -- {6B33492E-FBBC-4EC3-8738-09E16E395A10}
O42 - Logiciel: Zune Language Pack (FRA) - (.Microsoft Corporation.) [HKLM] -- {C68D33B1-0204-4EBE-BC45-A6E432B1D13A}
O42 - Logiciel: Zune Language Pack (ITA) - (.Microsoft Corporation.) [HKLM] -- {C5D37FFA-7483-410B-982B-91E93FD3B7DA}
O42 - Logiciel: Zune Language Pack (NLD) - (.Microsoft Corporation.) [HKLM] -- {6740BCB0-5863-47F4-80F4-44F394DE4FE2}
O42 - Logiciel: Zune Language Pack (PTB) - (.Microsoft Corporation.) [HKLM] -- {07EEE598-5F21-4B57-B40B-46592625B3D9}
O42 - Logiciel: Zune Language Pack (PTG) - (.Microsoft Corporation.) [HKLM] -- {5C93E291-A1CC-4E51-85C6-E194209FCDB4}
O42 - Logiciel: avast! Free Antivirus - (.AVAST Software.) [HKLM] -- avast
O42 - Logiciel: essvatgt - (.EASTMAN KODAK Company.) [HKLM] -- {2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}
O42 - Logiciel: iTunes - (.Apple Inc..) [HKLM] -- {F439D7AF-03F3-4F8E-AEC4-571BFE977C61}
O42 - Logiciel: kgcbaby - (.EASTMAN KODAK Company.) [HKLM] -- {E18B549C-5D15-45DA-8D8F-8FD2BD946344}
O42 - Logiciel: kgcbase - (.EASTMAN KODAK Company.) [HKLM] -- {F22C222C-3CE2-4A4B-A83F-AF4681371ABE}
O42 - Logiciel: kgchday - (.EASTMAN KODAK Company.) [HKLM] -- {11F3F858-4131-4FFA-A560-3FE282933B6E}
O42 - Logiciel: kgchlwn - (.EASTMAN KODAK Company.) [HKLM] -- {03EDED24-8375-407D-A721-4643D9768BE1}
O42 - Logiciel: kgcinvt - (.EASTMAN KODAK Company.) [HKLM] -- {9BD54685-1496-46A5-AB62-357CD140ED8B}
O42 - Logiciel: kgckids - (.EASTMAN KODAK Company.) [HKLM] -- {693C08A7-9E76-43FF-B11E-9A58175474C4}
O42 - Logiciel: kgcmove - (.EASTMAN KODAK Company.) [HKLM] -- {A1588373-1D86-4D44-86C9-78ABD190F9CC}
O42 - Logiciel: kgcvday - (.EASTMAN KODAK Company.) [HKLM] -- {8A8664E1-84C8-4936-891C-BC1F07797549}
O42 - Logiciel: netbrdg - (.EASTMAN KODAK Company.) [HKLM] -- {56AB063D-1450-4BDE-9F0D-E9C693429C51}
O42 - Logiciel: staticcr - (.EASTMAN KODAK Company.) [HKLM] -- {8943CE61-53BD-475E-90E1-A580869E98A2}
O42 - Logiciel: tooltips - (.EASTMAN KODAK Company.) [HKLM] -- {E79987F0-0E34-42CC-B8FF-6C860AEEB26A}
O42 - Logiciel: µTorrent - (.Pas de propriétaire.) [HKLM] -- uTorrent

---\\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\AVAST Software]
[HKCU\Software\Ahead audio RAW convertor]
[HKCU\Software\Ahead]
[HKCU\Software\Apple Computer, Inc.]
[HKCU\Software\AudioPluginManager]
[HKCU\Software\Aurigma]
[HKCU\Software\Battle.net]
[HKCU\Software\Big Fish Games]
[HKCU\Software\BitTorrent]
[HKCU\Software\Blizzard Entertainment]
[HKCU\Software\CISRA]
[HKCU\Software\Canon]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\Conduit]
[HKCU\Software\CoreVorbis]
[HKCU\Software\Cyberlink]
[HKCU\Software\DivXNetworks]
[HKCU\Software\ESET]
[HKCU\Software\Emulators]
[HKCU\Software\GNU]
[HKCU\Software\Gabest]
[HKCU\Software\GameHouse]
[HKCU\Software\Google]
[HKCU\Software\Haali]
[HKCU\Software\HookNetwork]
[HKCU\Software\IM Providers]
[HKCU\Software\Intel]
[HKCU\Software\JEDI-VCL]
[HKCU\Software\JaboSoft]
[HKCU\Software\JavaSoft]
[HKCU\Software\Kodak]
[HKCU\Software\Lavasoft]
[HKCU\Software\Licenses]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\MONOGRAM]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MediaChance]
[HKCU\Software\MediaInfo]
[HKCU\Software\Monitored]
[HKCU\Software\N64 Emulation]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Nero Digital Audio (HE-AAC)]
[HKCU\Software\Netscape]
[HKCU\Software\Norton]
[HKCU\Software\ODBC]
[HKCU\Software\Policies]
[HKCU\Software\PriceGong]
[HKCU\Software\SWEETIE]
[HKCU\Software\Softonic]
[HKCU\Software\Softonic_France]
[HKCU\Software\Windows Media Audio]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\conduitEngine]
[HKCU\Software\indii.org]
[HKCU\Software\madFlac]
[HKCU\Software\mp3PRO]
[HKCU\Software\settings]
[HKLM\Software\781]
[HKLM\Software\ALWIL Software]
[HKLM\Software\AVAST Software]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\BackWeb]
[HKLM\Software\Big Fish Games]
[HKLM\Software\C07ft5Y]
[HKLM\Software\CISRA]
[HKLM\Software\Canon]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Codec Tweak Tool]
[HKLM\Software\Conduit]
[HKLM\Software\ConfigBuilder]
[HKLM\Software\Cyberlink]
[HKLM\Software\DivXNetworks]
[HKLM\Software\ESET]
[HKLM\Software\GEAR Software]
[HKLM\Software\GNU]
[HKLM\Software\Gabest]
[HKLM\Software\Gemplus]
[HKLM\Software\GenericSoftModemUninstallInfo]
[HKLM\Software\Google]
[HKLM\Software\HaaliMkx]
[HKLM\Software\Hasbro Interactive]
[HKLM\Software\InterVideo]
[HKLM\Software\JavaSoft]
[HKLM\Software\KLCodecPack]
[HKLM\Software\KasperskyLab]
[HKLM\Software\Kodak]
[HKLM\Software\Lavasoft]
[HKLM\Software\Licenses]
[HKLM\Software\Macrogaming]
[HKLM\Software\Macromedia]
[HKLM\Software\Magnet]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\McAfee.com]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Norton]
[HKLM\Software\ODBC]
[HKLM\Software\Policies]
[HKLM\Software\PopCap]
[HKLM\Software\Program Groups]
[HKLM\Software\ReflexiveArcade]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\Schlumberger]
[HKLM\Software\Secure]
[HKLM\Software\Silver]
[HKLM\Software\Softonic_France]
[HKLM\Software\Symantec]
[HKLM\Software\TOSHIBA]
[HKLM\Software\TrendMicro]
[HKLM\Software\Uniblue]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\Wow6432Node]
[HKLM\Software\ahead]
[HKLM\Software\indii.org]
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar twilight50 » 10 Juin 2011 15:41

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2008-02-16 - 18:59:28 - [8973270] ----D- C:\Program Files\Aloha Solitaire
O43 - CFD: 2010-02-04 - 17:39:06 - [0] ----D- C:\Program Files\Alwil Software
O43 - CFD: 2009-11-04 - 10:35:00 - [2221118] ----D- C:\Program Files\Apple Software Update
O43 - CFD: 2011-06-08 - 12:27:32 - [158270863] ----D- C:\Program Files\AVAST Software
O43 - CFD: 2008-02-16 - 19:39:08 - [20738419] ----D- C:\Program Files\Bejeweled 2 Deluxe
O43 - CFD: 2010-01-02 - 23:04:16 - [6921688] ----D- C:\Program Files\bfgclient
O43 - CFD: 2009-11-04 - 10:39:02 - [392881] ----D- C:\Program Files\Bonjour
O43 - CFD: 2008-11-28 - 01:36:04 - [77378558] ----D- C:\Program Files\Canon
O43 - CFD: 2008-02-16 - 06:53:08 - [0] ----D- C:\Program Files\ComPlus Applications
O43 - CFD: 2010-08-07 - 12:18:02 - [1807648] ----D- C:\Program Files\Conduit
O43 - CFD: 2011-04-10 - 15:48:40 - [8446093] ----D- C:\Program Files\ConduitEngine
O43 - CFD: 2010-02-08 - 17:42:50 - [1780351] ----D- C:\Program Files\ESET
O43 - CFD: 2010-02-28 - 18:59:52 - [963434342] ----D- C:\Program Files\Fichiers communs
O43 - CFD: 2010-01-02 - 23:10:58 - [124896761] ----D- C:\Program Files\Fishdom H2O - Hidden Odyssey
O43 - CFD: 2010-02-05 - 12:02:22 - [96453901] ----D- C:\Program Files\Google
O43 - CFD: 2010-08-02 - 15:28:00 - [74833] ----D- C:\Program Files\Hasbro Interactive
O43 - CFD: 2010-08-07 - 12:40:24 - [0] ----D- C:\Program Files\indii.org
O43 - CFD: 2011-04-15 - 15:43:12 - [5716696] ----D- C:\Program Files\Internet Explorer
O43 - CFD: 2010-02-13 - 14:55:54 - [1582195] ----D- C:\Program Files\iPod
O43 - CFD: 2010-02-13 - 14:58:02 - [113894907] ----D- C:\Program Files\iTunes
O43 - CFD: 2008-02-16 - 19:44:44 - [60756259] ----D- C:\Program Files\Java
O43 - CFD: 2010-02-05 - 21:15:22 - [47359186] ----D- C:\Program Files\K-Lite Codec Pack
O43 - CFD: 2010-02-28 - 19:00:44 - [102491964] ----D- C:\Program Files\Kodak
O43 - CFD: 2008-02-16 - 18:08:06 - [25673639] ----D- C:\Program Files\Lavasoft
O43 - CFD: 2011-06-08 - 12:30:34 - [0] ----D- C:\Program Files\LimeWire
O43 - CFD: 2008-03-07 - 23:09:18 - [557269] ----D- C:\Program Files\LSEF7
O43 - CFD: 2010-02-05 - 10:47:06 - [25215987] ----D- C:\Program Files\Macrogaming
O43 - CFD: 2011-06-09 - 22:25:56 - [7566874] ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD: 2010-02-06 - 01:24:56 - [3258382] ----D- C:\Program Files\Messenger
O43 - CFD: 2009-01-07 - 14:19:54 - [1544075] ----D- C:\Program Files\Microsoft
O43 - CFD: 2008-02-16 - 06:58:38 - [0] ----D- C:\Program Files\microsoft frontpage
O43 - CFD: 2008-02-16 - 18:34:22 - [561454552] ----D- C:\Program Files\Microsoft Office
O43 - CFD: 2009-11-09 - 22:26:24 - [1559148] ----D- C:\Program Files\Microsoft Office Outlook Connector
O43 - CFD: 2011-04-22 - 12:04:40 - [38388859] ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD: 2009-01-07 - 14:22:04 - [1829877] ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD: 2009-02-21 - 11:50:24 - [2188837] ----D- C:\Program Files\Microsoft Sync Framework
O43 - CFD: 2008-02-16 - 18:34:12 - [14904] ----D- C:\Program Files\Microsoft Visual Studio
O43 - CFD: 2010-01-25 - 17:33:24 - [3726168] ----D- C:\Program Files\Microsoft Works
O43 - CFD: 2010-08-13 - 12:28:30 - [10374874] ----D- C:\Program Files\Movie Maker
O43 - CFD: 2010-01-23 - 18:41:56 - [26521] ----D- C:\Program Files\MSBuild
O43 - CFD: 2010-02-06 - 01:20:54 - [19278399] ----D- C:\Program Files\msn
O43 - CFD: 2008-02-16 - 06:52:28 - [8745735] ----D- C:\Program Files\MSN Gaming Zone
O43 - CFD: 2010-03-13 - 11:30:04 - [0] ----D- C:\Program Files\MSXML 4.0
O43 - CFD: 2010-01-23 - 18:19:22 - [6849] ----D- C:\Program Files\MSXML 6.0
O43 - CFD: 2008-02-16 - 18:00:44 - [1053508] ----D- C:\Program Files\Nero
O43 - CFD: 2010-02-06 - 00:50:22 - [3285523] ----D- C:\Program Files\NetMeeting
O43 - CFD: 2010-12-16 - 21:48:48 - [4379321] ----D- C:\Program Files\Outlook Express
O43 - CFD: 2010-07-21 - 19:50:40 - [3790140] ----D- C:\Program Files\Project64 1.6
O43 - CFD: 2010-03-30 - 17:08:42 - [277] ----D- C:\Program Files\Qualcomm
O43 - CFD: 2010-02-05 - 14:36:46 - [80087795] ----D- C:\Program Files\QuickTime
O43 - CFD: 2010-01-23 - 18:41:04 - [36400897] ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 2009-03-01 - 15:56:02 - [1936760] ----D- C:\Program Files\ReflexiveArcade
O43 - CFD: 2008-02-16 - 06:55:28 - [1025] ----D- C:\Program Files\Services en ligne
O43 - CFD: 2011-04-10 - 15:48:44 - [10761399] ----D- C:\Program Files\Softonic_France
O43 - CFD: 2008-02-16 - 19:06:40 - [5547416] ----D- C:\Program Files\Solitaire 2
O43 - CFD: 2008-02-16 - 07:03:56 - [0] --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 2010-02-06 - 10:08:10 - [319280] ----D- C:\Program Files\uTorrent
O43 - CFD: 2011-01-26 - 23:29:36 - [141906346] ----D- C:\Program Files\Windows Live
O43 - CFD: 2008-04-01 - 20:43:10 - [24660907] ----D- C:\Program Files\Windows Live Safety Center
O43 - CFD: 2009-01-07 - 14:19:32 - [245112] ----D- C:\Program Files\Windows Live SkyDrive
O43 - CFD: 2009-01-08 - 01:34:54 - [3581070] ----D- C:\Program Files\Windows Media Connect 2
O43 - CFD: 2010-02-06 - 00:49:54 - [8750087] ----D- C:\Program Files\Windows Media Player
O43 - CFD: 2008-02-16 - 06:52:12 - [3352831] ----D- C:\Program Files\Windows NT
O43 - CFD: 2008-02-16 - 06:55:36 - [0] --H-D- C:\Program Files\WindowsUpdate
O43 - CFD: 2008-02-16 - 06:58:38 - [0] ----D- C:\Program Files\xerox
O43 - CFD: 2011-06-10 - 08:49:26 - [3900877] ----D- C:\Program Files\ZHPDiag
O43 - CFD: 2010-12-03 - 18:37:36 - [73337116] ----D- C:\Program Files\Zune
O43 - CFD: 2010-02-04 - 22:40:42 - [5482496] ----D- C:\Program Files\Fichiers Communs\Ahead
O43 - CFD: 2009-11-04 - 10:42:16 - [107060614] ----D- C:\Program Files\Fichiers Communs\Apple
O43 - CFD: 2010-02-21 - 14:44:52 - [0] ----D- C:\Program Files\Fichiers Communs\Blizzard Entertainment
O43 - CFD: 2008-02-16 - 18:34:12 - [92976] ----D- C:\Program Files\Fichiers Communs\DESIGNER
O43 - CFD: 2008-11-08 - 19:15:02 - [5310] ----D- C:\Program Files\Fichiers Communs\DirectX
O43 - CFD: 2008-02-16 - 17:44:32 - [1183733] ----D- C:\Program Files\Fichiers Communs\InstallShield
O43 - CFD: 2008-02-16 - 19:44:02 - [22090293] ----D- C:\Program Files\Fichiers Communs\Java
O43 - CFD: 2010-02-28 - 18:59:52 - [683684] ----D- C:\Program Files\Fichiers Communs\Kodak
O43 - CFD: 2011-05-17 - 18:47:30 - [220853709] ----D- C:\Program Files\Fichiers Communs\Microsoft Shared
O43 - CFD: 2008-02-16 - 06:54:38 - [935936] ----D- C:\Program Files\Fichiers Communs\MSSoap
O43 - CFD: 2008-02-16 - 07:46:12 - [0] ----D- C:\Program Files\Fichiers Communs\ODBC
O43 - CFD: 2008-02-16 - 06:54:42 - [8106] ----D- C:\Program Files\Fichiers Communs\Services
O43 - CFD: 2008-02-16 - 07:46:08 - [3787229] ----D- C:\Program Files\Fichiers Communs\SpeechEngines
O43 - CFD: 2010-02-06 - 00:49:24 - [46273995] ----D- C:\Program Files\Fichiers Communs\System
O43 - CFD: 2009-01-07 - 14:09:32 - [536857093] ----D- C:\Program Files\Fichiers Communs\Windows Live
O43 - CFD: 2008-02-16 - 18:07:26 - [18119168] ----D- C:\Program Files\Fichiers Communs\Wise Installation Wizard
O43 - CFD: 2008-02-16 - 18:39:44 - [2812702] ----D- C:\Documents and Settings\Administrateur\Application Data\Adobe
O43 - CFD: 2008-02-16 - 18:02:58 - [33696] ----D- C:\Documents and Settings\Administrateur\Application Data\Ahead
O43 - CFD: 2010-02-21 - 17:28:40 - [8719265] ----D- C:\Documents and Settings\Administrateur\Application Data\Apple Computer
O43 - CFD: 2010-02-05 - 12:19:18 - [7530] ----D- C:\Documents and Settings\Administrateur\Application Data\Google
O43 - CFD: 2008-02-23 - 18:21:48 - [0] ----D- C:\Documents and Settings\Administrateur\Application Data\Help
O43 - CFD: 2008-02-16 - 07:04:04 - [0] ----D- C:\Documents and Settings\Administrateur\Application Data\Identities
O43 - CFD: 2010-02-21 - 15:05:16 - [5533477] ----D- C:\Documents and Settings\Administrateur\Application Data\LimeWire
O43 - CFD: 2008-02-16 - 18:39:44 - [2027448] ----D- C:\Documents and Settings\Administrateur\Application Data\Macromedia
O43 - CFD: 2011-06-09 - 22:26:02 - [3978] ----D- C:\Documents and Settings\Administrateur\Application Data\Malwarebytes
O43 - CFD: 2010-02-06 - 21:36:52 - [169] ----D- C:\Documents and Settings\Administrateur\Application Data\Media Player Classic
O43 - CFD: 2010-12-03 - 19:49:44 - [17205804] -S--D- C:\Documents and Settings\Administrateur\Application Data\Microsoft
O43 - CFD: 2010-03-30 - 17:08:42 - [376] ----D- C:\Documents and Settings\Administrateur\Application Data\Mozilla
O43 - CFD: 2010-01-02 - 23:23:06 - [36612] ----D- C:\Documents and Settings\Administrateur\Application Data\Playrix Entertainment
O43 - CFD: 2011-06-08 - 11:54:02 - [1954952] ----D- C:\Documents and Settings\Administrateur\Application Data\PriceGong
O43 - CFD: 2008-03-28 - 23:45:28 - [7536] ----D- C:\Documents and Settings\Administrateur\Application Data\Stellarium
O43 - CFD: 2008-02-27 - 22:30:34 - [4508104] ----D- C:\Documents and Settings\Administrateur\Application Data\Sun
O43 - CFD: 2010-08-17 - 15:24:56 - [3604480] ----D- C:\Documents and Settings\Administrateur\Application Data\U3
O43 - CFD: 2010-01-04 - 14:49:46 - [443534] ----D- C:\Documents and Settings\Administrateur\Application Data\Uniblue
O43 - CFD: 2010-02-17 - 14:46:46 - [981558] ----D- C:\Documents and Settings\Administrateur\Application Data\uTorrent
O43 - CFD: 2008-02-16 - 18:07:14 - [3121527] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Ahead
O43 - CFD: 2009-11-04 - 10:35:12 - [0] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Apple
O43 - CFD: 2010-12-03 - 18:12:50 - [19799907] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Apple Computer
O43 - CFD: 2011-03-09 - 09:22:46 - [3272578] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit
O43 - CFD: 2011-06-02 - 15:04:24 - [8794145] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\ConduitEngine
O43 - CFD: 2010-02-15 - 10:23:16 - [169871] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\ESET
O43 - CFD: 2011-02-27 - 14:47:08 - [167068441] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Google
O43 - CFD: 2008-02-23 - 18:21:48 - [0] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Help
O43 - CFD: 2010-02-28 - 19:03:26 - [0] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\KodakGallery
O43 - CFD: 2011-04-05 - 16:42:30 - [1792561932] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft
O43 - CFD: 2008-02-16 - 18:26:20 - [0] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft Help
O43 - CFD: 2011-06-05 - 16:23:12 - [15307598] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Softonic_France
O43 - CFD: 2011-05-02 - 07:22:30 - [0] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Temp
O43 - CFD: 2008-02-16 - 19:43:40 - [11212800] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150010}



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.3D2C13377763EEAC0CA6FB46F57217ED] - 2011-05-29 - 08:11:20 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbam.sys [22712]
O44 - LFC:[MD5.B309912717C29FC67E1BA4730A82B6DD] - 2011-05-29 - 08:11:30 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [39984]
O44 - LFC:[MD5.E4817F0E0D9074C1A37688D987276C89] - 2011-06-08 - 10:50:47 ---A- . (...) -- C:\WINDOWS\setupact.log [7997]
O44 - LFC:[MD5.D67AEA43F61F230D130C7507DA696566] - 2011-06-08 - 10:52:46 ---A- . (...) -- C:\WINDOWS\ModemLog_Toshiba Soft Modem AMR.txt [8538]
O44 - LFC:[MD5.9FA50D2207D1572B0964F00AA4F89109] - 2011-06-08 - 11:03:01 ---A- . (...) -- C:\WINDOWS\setupapi.log [168756]
O44 - LFC:[MD5.A4FF904203B176D2D7498AA7CECAFE0C] - 2011-06-08 - 11:28:13 ---A- . (.AVAST Software - avast! start-up scanner.) -- C:\WINDOWS\System32\aswBoot.exe [199304]
O44 - LFC:[MD5.B8576757416F471C9D7F83B2B04B1F9D] - 2011-06-08 - 11:28:14 ---A- . (.AVAST Software - avast! Screen Saver stub.) -- C:\WINDOWS\avastSS.scr [40112]
O44 - LFC:[MD5.3F6884EFF406238D39AAA892218F1DF7] - 2011-06-08 - 11:28:53 ---A- . (.AVAST Software - avast! Base Kernel-Mode Device Driver for W.) -- C:\WINDOWS\System32\drivers\aavmker4.sys [30808]
O44 - LFC:[MD5.FF028BFF4FE4E5CE35C797FBF1B21609] - 2011-06-08 - 11:28:54 ---A- . (.AVAST Software - avast! File System Filter Driver for Window.) -- C:\WINDOWS\System32\drivers\aswmon.sys [96344]
O44 - LFC:[MD5.C2181EF6B54752273A0759A968C59279] - 2011-06-08 - 11:28:54 ---A- . (.AVAST Software - avast! File System Filter Driver for Window.) -- C:\WINDOWS\System32\drivers\aswmon2.sys [102616]
O44 - LFC:[MD5.39E974E98E4709B318E384310A0E10C3] - 2011-06-08 - 11:28:56 ---A- . (...) -- C:\WINDOWS\System32\CONFIG.NT [3133]
O44 - LFC:[MD5.B64134316FCD1F20E0F10EF3E65BD522] - 2011-06-08 - 11:28:56 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\WINDOWS\System32\drivers\aswSnx.sys [441176]
O44 - LFC:[MD5.4D100C45517809439C7B6DD98997FA00] - 2011-06-08 - 11:28:57 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\WINDOWS\System32\drivers\aswTdi.sys [49240]
O44 - LFC:[MD5.AC48BDD4CD5D44AF33087C06D6E9511C] - 2011-06-08 - 11:28:58 ---A- . (.AVAST Software - avast! TDI RDR Driver.) -- C:\WINDOWS\System32\drivers\aswRdr.sys [25432]
O44 - LFC:[MD5.7F08D9C504B015D81A8ABD75C80028C5] - 2011-06-08 - 11:29:04 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [19544]
O44 - LFC:[MD5.D6788E3211AFA9951ED7A4D617F68A4F] - 2011-06-08 - 11:29:04 ---A- . (.AVAST Software - avast! self protection module.) -- C:\WINDOWS\System32\drivers\aswSP.sys [307928]
O44 - LFC:[MD5.CCEE1200F915817C00FCFD7FA0EF1200] - 2011-06-08 - 12:41:46 ---A- . (...) -- C:\WINDOWS\SchedLgU.Txt [32450]
O44 - LFC:[MD5.6A2CB42966136854F4464516FBB4AE72] - 2011-06-10 - 07:25:32 -S-A- . (...) -- C:\WINDOWS\bootstat.dat [2048]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 2011-06-10 - 07:25:36 ---A- . (...) -- C:\WINDOWS\0.log [0]
O44 - LFC:[MD5.CCEE1200F915817C00FCFD7FA0EF1200] - 2011-06-10 - 07:25:55 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50]
O44 - LFC:[MD5.CCEE1200F915817C00FCFD7FA0EF1200] - 2011-06-10 - 07:25:57 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159]
O44 - LFC:[MD5.66F2F2BE173A86A85304349AE2C3E5D1] - 2011-06-10 - 07:26:00 ---A- . (...) -- C:\WINDOWS\System32\wpa.dbl [2206]
O44 - LFC:[MD5.CCEE1200F915817C00FCFD7FA0EF1200] - 2011-06-10 - 07:28:12 ---A- . (...) -- C:\WINDOWS\WindowsUpdate.log [1199066]
O44 - LFC:[MD5.96E166DAEFF852001748C2B2C40BC3A5] - 2011-06-10 - 07:33:44 ---A- . (...) -- C:\logfile [378664]



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll



---\\ Export de clé d'application autorisée (O47)
O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessmgr.exe
O47 - AAKE:Key Export SP - "C:\Program Files\MSN Messenger\livecall.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) -- C:\Program Files\MSN Messenger\livecall.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" [Enabled] .(.Microsoft Corporation - Microsoft Office Outlook.) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.exe
O47 - AAKE:Key Export SP - "C:\Program Files\LimeWire\LimeWire.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) -- C:\Program Files\LimeWire\LimeWire.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\Messenger\Msmsgs.exe" [Enabled] .(.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\Msmsgs.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Bonjour\mDNSResponder.exe" [Enabled] .(.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe
O47 - AAKE:Key Export SP - "C:\Program Files\uTorrent\uTorrent.exe" [Enabled] .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe
O47 - AAKE:Key Export SP - "%windir%\Network Diagnostic\xpnetdiag.exe" [Enabled] .(.Microsoft Corporation - Network Diagnostic for Windows XP.) -- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O47 - AAKE:Key Export SP - "C:\Program Files\iTunes\iTunes.exe" [Enabled] .(.Apple Inc. - iTunes.) -- C:\Program Files\iTunes\iTunes.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" [Enabled] .(.Eastman Kodak Company - Kodak EasyShare Software.) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [Enabled] .(.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" [Enabled] .(.Microsoft Corporation - Windows Live Sync.) -- C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\rundll32.exe" [Enabled] Clé orpheline
O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessmgr.exe
O47 - AAKE:Key Export DP - "C:\Program Files\MSN Messenger\livecall.exe" [Enabled] .(.Pas de propriétaire - Pas de description.) -- C:\Program Files\MSN Messenger\livecall.exe (.not file.)
O47 - AAKE:Key Export DP - "%windir%\Network Diagnostic\xpnetdiag.exe" [Enabled] .(.Microsoft Corporation - Network Diagnostic for Windows XP.) -- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [Enabled] .(.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" [Enabled] .(.Microsoft Corporation - Windows Live Sync.) -- C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d



---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{405743f1-5c04-11e0-8ba8-00023f7a4c16}\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\DigitalPhotoKeychain.exe (.not file.)
O51 - MPSK:{44296fb0-b8b3-11dd-9203-00023f7a4c16}\AutoRun\command. (.Pas de propriétaire - Pas de description.) -- E:\LaunchU3.exe (.not file.)



---\\ Trojan Driver Search Data (HKLM) (O52)
O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - Codec audio TrueSpeech(TM) DSP Group pour MSACM V3.50.) -- C:\WINDOWS\System32\tssoft32.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS\System32\iccvid.dll
O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv41"="ir41_32.ax" . (.Intel Corporation - Intel Indeo® Video 4.5.) -- C:\WINDOWS\System32\ir41_32.ax
O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\System32\sl_anet.acm
O52 - TDSD: \Drivers32\"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax
O52 - TDSD: \Drivers32\"vidc.iv50"="ir50_32.dll" . (.Intel Corporation - Intel Indeo® video 5.10.) -- C:\WINDOWS\System32\ir50_32.dll
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\system32\l3codeca.acm
O52 - TDSD: \Drivers32\"VIDC.XVID"="xvidvfw.dll" . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\xvidvfw.dll
O52 - TDSD: \Drivers32\"VIDC.YV12"="yv12vfw.dll" . (.www.helixcommunity.org - Helix YV12 YUV Codec.) -- C:\WINDOWS\System32\yv12vfw.dll
O52 - TDSD: \Drivers32\"msacm.ac3acm"="ac3acm.acm" . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\System32\ac3acm.acm
O52 - TDSD: \Drivers32\"msacm.lameacm"="lameACM.acm" . (.http://www.mp3dev.org/ - Lame MP3 codec engine.) -- C:\WINDOWS\System32\lameACM.acm
O52 - TDSD: \Drivers32\"VIDC.FFDS"="ff_vfw.dll" . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\ff_vfw.dll
O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\System32\sl_anet.acm
O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\iac25_32.ax"="Indeo® audio software" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax
O52 - TDSD: \drivers.desc\"ir50_32.dll"="Indeo® video 5.10" . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\system32\l3codeca.acm
O52 - TDSD: \drivers.desc\"xvidvfw.dll"="Xvid MPEG-4 Video Codec 1.2.2" . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O52 - TDSD: \drivers.desc\"lameACM.acm"="Lame ACM MP3 CODEC v3.98.2" . (.Pas de propriétaire - Pas de description.) -- (.not file.)
O52 - TDSD: \drivers.desc\"ac3acm.acm"="AC-3 ACM Codec" . (.fccHandler - AC-3 ACM Codec.) -- C:\WINDOWS\System32\ac3acm.acm
O52 - TDSD: \drivers.desc\"ff_vfw.dll"="ffdshow video encoder" . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\System32\ff_vfw.dll



---\\ Microsoft Control Security Providers (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS\system32\digest.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS\system32\digest.dll



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1



---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=145
O56 - MWPE:[HKCU\...\policies\Explorer] - "ClearDocsOnExit"=64
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsMenu"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoCDBurning"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoStartBanner"=
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMHelp"=0
O56 - MWPE:[HKCU\...\policies\Explorer] - "ClearRecentDocsOnExit"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "MemCheckBoxInRunDlg"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMBalloonTip"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDesktopCleanupWizard"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoWelcomeScreen"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoAutoUpdate"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=1



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.3F6884EFF406238D39AAA892218F1DF7] - 2011-05-10 - 06:59:37 ---A- . (.AVAST Software - avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP.) -- C:\WINDOWS\system32\drivers\aavmker4.sys [30808]
O58 - SDL:[MD5.0F2D66D5F08EBE2F77BB904288DCF6F0] - 2001-08-17 - 15:20:04 ---A- . (.Intel Corporation - Intel(r) Integrated Controller Hub Audio Driver.) -- C:\WINDOWS\system32\drivers\ac97intc.sys [96256]
O58 - SDL:[MD5.7F08D9C504B015D81A8ABD75C80028C5] - 2011-05-10 - 06:59:35 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys [19544]
O58 - SDL:[MD5.FF028BFF4FE4E5CE35C797FBF1B21609] - 2011-05-10 - 07:02:22 ---A- . (.AVAST Software - avast! File System Filter Driver for Windows NT/2000.) -- C:\WINDOWS\system32\drivers\aswmon.sys [96344]
O58 - SDL:[MD5.C2181EF6B54752273A0759A968C59279] - 2011-05-10 - 07:02:25 ---A- . (.AVAST Software - avast! File System Filter Driver for Windows XP.) -- C:\WINDOWS\system32\drivers\aswmon2.sys [102616]
O58 - SDL:[MD5.AC48BDD4CD5D44AF33087C06D6E9511C] - 2011-05-10 - 06:59:56 ---A- . (.AVAST Software - avast! TDI RDR Driver.) -- C:\WINDOWS\system32\drivers\aswRdr.sys [25432]
O58 - SDL:[MD5.B64134316FCD1F20E0F10EF3E65BD522] - 2011-05-10 - 07:03:54 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\WINDOWS\system32\drivers\aswSnx.sys [441176]
O58 - SDL:[MD5.D6788E3211AFA9951ED7A4D617F68A4F] - 2011-05-10 - 07:03:44 ---A- . (.AVAST Software - avast! self protection module.) -- C:\WINDOWS\system32\drivers\aswSP.sys [307928]
O58 - SDL:[MD5.4D100C45517809439C7B6DD98997FA00] - 2011-05-10 - 07:02:37 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\WINDOWS\system32\drivers\aswTdi.sys [49240]
O58 - SDL:[MD5.EC018602809B28520CAA132CD616BB2A] - 2007-06-04 - 15:14:56 ---A- . (.Lavasoft AB - Driver for Ad-Watch Real-Time Process protection.) -- C:\WINDOWS\system32\drivers\AWRTPD.sys [6272]
O58 - SDL:[MD5.10D3F81B955CD10D6464B1B922E5AC68] - 2008-03-23 - 21:16:06 ---A- . (.Lavasoft AB - Driver for Ad-Watch Real-Time Registry Protection.) -- C:\WINDOWS\system32\drivers\AWRTRD.sys [8320]
O58 - SDL:[MD5.BF79E659C506674C0497CC9C61F1A165] - 2006-10-18 - 03:00:00 ---A- . (.Sonic Solutions - CDR4 CD and DVD Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\drivers\cdr4_xp.sys [2432]
O58 - SDL:[MD5.2C41CD49D82D5FD85C72D57B6CA25471] - 2006-10-18 - 03:00:00 ---A- . (.Sonic Solutions - CDRAL Place Holder Driver (see PxHelp).) -- C:\WINDOWS\system32\drivers\cdralw2k.sys [2560]
O58 - SDL:[MD5.C9B25AE9B8ABD983C5AD3F8CBFAB0F9C] - 2001-08-24 - 07:00:00 ---A- . (.RAVISENT Technologies Inc. - Pilote principal CineMaster C 1.2 WDM.) -- C:\WINDOWS\system32\drivers\cinemst2.sys [262528]
O58 - SDL:[MD5.9624293E55AD405415862B504CA95B73] - 2001-08-24 - 07:00:00 ---A- . (.Compaq Computer Corporation - Compaq PA-1 Player Driver.) -- C:\WINDOWS\system32\drivers\cpqdap01.sys [11776]
O58 - SDL:[MD5.8182FF89C65E4D38B2DE4BB0FB18564E] - 2009-05-18 - 14:17:00 ---A- . (.GEAR Software Inc. - CD DVD Filter.) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys [26600]
O58 - SDL:[MD5.E088EE80DD64A7106FBDDC5498CFED2F] - 2001-08-17 - 16:28:12 ---A- . (.LT - SoftModem Device Driver.) -- C:\WINDOWS\system32\drivers\LTSMT.sys [797500]
O58 - SDL:[MD5.3D2C13377763EEAC0CA6FB46F57217ED] - 2011-05-29 - 08:11:20 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\system32\drivers\mbam.sys [22712]
O58 - SDL:[MD5.B309912717C29FC67E1BA4730A82B6DD] - 2011-05-29 - 08:11:30 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys [39984]
O58 - SDL:[MD5.BE984D604D91C217355CDD3737AAD25D] - 2001-08-24 - 07:00:00 ---A- . (.S3/Diamond Multimedia Systems - NikeDrv Usb Driver.) -- C:\WINDOWS\system32\drivers\nikedrv.sys [12032]
O58 - SDL:[MD5.05BDD706A847BBFA9FD5948CD636EB1A] - 2008-03-23 - 21:16:06 ---A- . (.Lavasoft AB - Driver for Ad-Watch network monitoring.) -- C:\WINDOWS\system32\drivers\NSDriver.sys [9344]
O58 - SDL:[MD5.630A48BBD27F8E43A0378B636A5C40D3] - 2002-11-27 - 15:44:00 ---A- . (.NVIDIA Corporation - NVIDIA Compatible Windows 2000 Miniport Driver, Version 32.40.) -- C:\WINDOWS\system32\drivers\nv4_mini.sys [1005866]
O58 - SDL:[MD5.80D317BD1C3DBC5D4FE7B1678C60CADD] - 2001-08-24 - 07:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\drivers\ptilink.sys [17792]
O58 - SDL:[MD5.49452BFCEC22F36A7A9B9C2181BC3042] - 2008-07-31 - 17:17:04 ---A- . (.Sonic Solutions - Px Engine Device Driver for Windows 2000/XP.) -- C:\WINDOWS\system32\drivers\pxhelp20.sys [43872]
O58 - SDL:[MD5.A56FE08EC7473E8580A390BB1081CDD7] - 2001-08-24 - 07:00:00 ---A- . (.S3/Diamond Multimedia Systems - Rio8Drv.sys Usb Driver.) -- C:\WINDOWS\system32\drivers\rio8drv.sys [12032]
O58 - SDL:[MD5.0A854DF84C77A0BE205BFEAB2AE4F0EC] - 2001-08-24 - 07:00:00 ---A- . (.S3/Diamond Multimedia Systems - RioDrv Usb Driver.) -- C:\WINDOWS\system32\drivers\riodrv.sys [12032]
O58 - SDL:[MD5.D507C1400284176573224903819FFDA3] - 2004-08-03 - 17:31:34 ---A- . (.Realtek Semiconductor Corporation - Realtek RTL8139 NDIS 5.0 Driver.) -- C:\WINDOWS\system32\drivers\RTL8139.sys [20992]
O58 - SDL:[MD5.90A3935D05B494A5A39D37E71F09A677] - 2007-11-13 - 05:25:54 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS\system32\drivers\secdrv.sys [20480]
O58 - SDL:[MD5.039F7B892AD78FD836CD56F0551DAB33] - 2001-08-23 - 12:21:42 ---A- . (.SMC - Pilote de périphérique infrarouge SMC IrCC NDIS 5.0 IrDA FIR.) -- C:\WINDOWS\system32\drivers\smcirda.sys [36937]
O58 - SDL:[MD5.D74A8EC75305F1D3CFDE7C7FC1BD62A9] - 2001-08-24 - 07:00:00 ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINDOWS\system32\drivers\tsbvcap.sys [21376]
O58 - SDL:[MD5.1DF89C499BF45D878B87EBD4421D462D] - 2009-08-28 - 19:42:52 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\WINDOWS\system32\drivers\usbaapl.sys [40448]
O58 - SDL:[MD5.55E01061C74A8CEFFF58DC36114A8D3F] - 2001-08-24 - 07:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\drivers\vdmindvd.sys [58112]
O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097]
O58 - SDL:[MD5.C6D29F29DE7427B1B0775E53E577B623] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4912]
O58 - SDL:[MD5.582BCDD47CF4B68B5CB528F18E3CB808] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 2004-08-03 - 15:46:56 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537]
O58 - SDL:[MD5.7D30A74B5FB9FE3B245A6CE5FBCD71D5] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27916]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 2001-08-24 - 07:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146]
O58 - SDL:[MD5.CAAA108FD7BF71989946B39704323455] - 2004-08-03 - 15:45:26 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [34000]
O58 - SDL:[MD5.6F73F50162DEF60C84B725C18CD9140F] - 2004-08-03 - 15:45:16 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560]
O58 - SDL:[MD5.0FDD5E69C1FF3B58043D44F2CC743D45] - 2004-08-03 - 15:45:12 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648]
O58 - SDL:[MD5.8842837C4D8311BF8E72BEE8CCC42217] - 2004-08-03 - 15:45:16 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424]
O58 - SDL:[MD5.6B56CEB3C6F9D5CD7293DBD9FE23B311] - 2004-08-03 - 15:45:14 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560]



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: HijackThis 2.0.2 - (.TrendMicro.) [HKLM] -- HijackThis
O63 - Logiciel: ZHPDiag 1.27 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1



---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\AAVMKER4.sys - (.not file.) - avast! Asynchronous Virus Monitor (Aavmker4) .(...) - LEGACY_AAVMKER4
O64 - Services: CurCS - 2008-03-23 - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe - Ad-Aware 2007 Service(aawservice) .(.Lavasoft - Ad-Aware 2007 Service.) - LEGACY_AAWSERVICE
O64 - Services: CurCS - 2009-08-28 - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe - Apple Mobile Device(Apple Mobile Device) .(.Apple Inc. - Apple Mobile Device Service.) - LEGACY_APPLE_MOBILE_DEVICE
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\ASWFSBLK.sys - (.not file.) - aswFsBlk (aswFsBlk) .(...) - LEGACY_ASWFSBLK
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\ASWMON2.sys - (.not file.) - avast! Standard Shield Support (aswMon2) .(...) - LEGACY_ASWMON2
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\ASWRDR.sys - (.not file.) - aswRdr (aswRdr) .(...) - LEGACY_ASWRDR
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\ASWSNX.sys - (.not file.) - aswSnx (aswSnx) .(...) - LEGACY_ASWSNX
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\ASWSP.sys - (.not file.) - aswSP (aswSP) .(...) - LEGACY_ASWSP
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\ASWTDI.sys - (.not file.) - avast! Network Shield Support (aswTdi) .(...) - LEGACY_ASWTDI
O64 - Services: CurCS - 2011-05-10 - C:\Program Files\AVAST Software\Avast\AvastSvc.exe - avast! Antivirus(avast! Antivirus) .(.AVAST Software - avast! Service.) - LEGACY_AVAST!_ANTIVIRUS
O64 - Services: CurCS - (.not file.) - avast! Mail Scanner (avast! Mail Scanner) .(...) - LEGACY_AVAST!_MAIL_SCANNER
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\BEEP.sys - Beep (Beep) .(...) - LEGACY_BEEP
O64 - Services: CurCS - 2008-12-12 - C:\Program Files\Bonjour\mDNSResponder.exe - Service Bonjour(Bonjour Service) .(.Apple Inc. - Bonjour Service.) - LEGACY_BONJOUR_SERVICE
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\CDFS.sys - cdfs (cdfs) .(...) - LEGACY_CDFS
O64 - Services: CurCS - (.not file.) - (.not file.) - Application système COM+ (COMSysApp) .(...) - LEGACY_COMSYSAPP
O64 - Services: CurCS - (.not file.) - (.not file.) - Lanceur de processus serveur DCOM (DcomLaunch) .(...) - LEGACY_DCOMLAUNCH
O64 - Services: CurCS - 2008-04-13 - C:\WINDOWS\System32\drivers\dmboot.sys - dmboot(dmboot) .(.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disq.) - LEGACY_DMBOOT
O64 - Services: CurCS - 2001-08-24 - C:\WINDOWS\System32\drivers\dmload.sys - dmload(dmload) .(.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD
O64 - Services: CurCS - (.not file.) - eamon (eamon) .(...) - LEGACY_EAMON
O64 - Services: CurCS - (.not file.) - easdrv (easdrv) .(...) - LEGACY_EASDRV
O64 - Services: CurCS - (.not file.) - Symantec Eraser Control driver (eeCtrl) .(...) - LEGACY_EECTRL
O64 - Services: CurCS - (.not file.) - ehdrv (ehdrv) .(...) - LEGACY_EHDRV
O64 - Services: CurCS - (.not file.) - epfwtdir (epfwtdir) .(...) - LEGACY_EPFWTDIR
O64 - Services: CurCS - (.not file.) - EraserUtilDrvI7 (EraserUtilDrvI7) .(...) - LEGACY_ERASERUTILDRVI7
O64 - Services: CurCS - (.not file.) - EraserUtilRebootDrv (EraserUtilRebootDrv) .(...) - LEGACY_ERASERUTILREBOOTDRV
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\FASTFAT.sys - fastfat (fastfat) .(...) - LEGACY_FASTFAT
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\FIPS.sys - Fips (Fips) .(...) - LEGACY_FIPS
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\FS_REC.sys - Fs_Rec (Fs_Rec) .(...) - LEGACY_FS_REC
O64 - Services: CurCS - 2010-02-05 - C:\Program Files\Google\Update\GoogleUpdate.exe - Service Google Update (gupdate)(gupdate) .(.Google Inc. - Programme d'installation de Google.) - LEGACY_GUPDATE
O64 - Services: CurCS - 2010-02-05 - C:\Program Files\Google\Update\GoogleUpdate.exe - Service Google Update (gupdatem)(gupdatem) .(.Google Inc. - Programme d'installation de Google.) - LEGACY_GUPDATEM
O64 - Services: CurCS - 2010-02-05 - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe - Google Software Updater(gusvc) .(.Google - gusvc.) - LEGACY_GUSVC
O64 - Services: CurCS - 2010-01-22 - C:\Program Files\iPod\bin\iPodService.exe - Service de l’iPod(iPod Service) .(.Apple Inc. - iPodService Module (32-bit).) - LEGACY_IPOD_SERVICE
O64 - Services: CurCS - (.not file.) - Kl1 (kl1) .(...) - LEGACY_KL1
O64 - Services: CurCS - (.not file.) - Kaspersky Lab Driver (KLIF) .(...) - LEGACY_KLIF
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\KSECDD.sys - ksecdd (ksecdd) .(...) - LEGACY_KSECDD
O64 - Services: CurCS - 2011-05-29 - C:\WINDOWS\system32\drivers\mbam.sys - MBAMProtector(MBAMProtector) .(.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - LEGACY_MBAMPROTECTOR
O64 - Services: CurCS - 2011-05-29 - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe - MBAMService(MBAMService) .(.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - LEGACY_MBAMSERVICE
O64 - Services: CurCS - 2011-05-29 - C:\WINDOWS\system32\drivers\mbamswissarmy.sys - MBAMSwissArmy(MBAMSwissArmy) .(.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - LEGACY_MBAMSWISSARMY
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\MNMDD.sys - mnmdd (mnmdd) .(...) - LEGACY_MNMDD
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\MOUNTMGR.sys - (.not file.) - mountmgr (mountmgr) .(...) - LEGACY_MOUNTMGR
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\MSFS.sys - Msfs (Msfs) .(...) - LEGACY_MSFS
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\MUP.sys - (.not file.) - Mup (Mup) .(...) - LEGACY_MUP
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\NDIS.sys - (.not file.) - Pilote système NDIS (NDIS) .(...) - LEGACY_NDIS
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\NDPROXY.sys - NDProxy (NDProxy) .(...) - LEGACY_NDPROXY
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\NPFS.sys - Npfs (Npfs) .(...) - LEGACY_NPFS
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\NTFS.sys - ntfs (ntfs) .(...) - LEGACY_NTFS
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\NULL.sys - Null (Null) .(...) - LEGACY_NULL
O64 - Services: CurCS - 2002-11-27 - C:\WINDOWS\system32\nvsvc32.exe - NVIDIA Driver Helper Service(NVSvc) .(.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 32.40.) - LEGACY_NVSVC
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\PARTMGR.sys - (.not file.) - PartMgr (PartMgr) .(...) - LEGACY_PARTMGR
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\PARVDM.sys - ParVdm (ParVdm) .(...) - LEGACY_PARVDM
O64 - Services: CurCS - (.not file.) - RDPNP (RDPNP) .(...) - LEGACY_RDPNP
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\RDPWD.sys - RDPWD (RDPWD) .(...) - LEGACY_RDPWD
O64 - Services: CurCS - (.not file.) - (.not file.) - Appel de procédure distante (RPC) (RpcSs) .(...) - LEGACY_RPCSS
O64 - Services: CurCS - (.not file.) - sbiosdrv (sbiosdrv) .(...) - LEGACY_SBIOSDRV
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\SERIAL.sys - Serial (Serial) .(...) - LEGACY_SERIAL
O64 - Services: CurCS - (.not file.) - SYMDNS (SYMDNS) .(...) - LEGACY_SYMDNS
O64 - Services: CurCS - (.not file.) - Symantec Extended File Attributes (SymEFA) .(...) - LEGACY_SYMEFA
O64 - Services: CurCS - (.not file.) - SymEvent (SymEvent) .(...) - LEGACY_SYMEVENT
O64 - Services: CurCS - (.not file.) - SYMFW (SYMFW) .(...) - LEGACY_SYMFW
O64 - Services: CurCS - (.not file.) - SYMIDS (SYMIDS) .(...) - LEGACY_SYMIDS
O64 - Services: CurCS - (.not file.) - SYMNDIS (SYMNDIS) .(...) - LEGACY_SYMNDIS
O64 - Services: CurCS - (.not file.) - SYMREDRV (SYMREDRV) .(...) - LEGACY_SYMREDRV
O64 - Services: CurCS - (.not file.) - SYMTDI (SYMTDI) .(...) - LEGACY_SYMTDI
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\TDTCP.sys - TDTCP (TDTCP) .(...) - LEGACY_TDTCP
O64 - Services: CurCS - (.not file.) - (.not file.) - Services Terminal Server (TermService) .(...) - LEGACY_TERMSERVICE
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\UDFS.sys - Udfs (Udfs) .(...) - LEGACY_UDFS
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\VGA.sys - vga (vga) .(...) - LEGACY_VGA
O64 - Services: CurCS - C:\WINDOWS\system32\Drivers\VOLSNAP.sys - VolSnap (VolSnap) .(...) - LEGACY_VOLSNAP



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll
O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe
O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe
O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll
O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] "%1" %* (.not file.)
O67 - Shell Spawning: <.html> <htmlfile>[HKCR\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe
O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe



---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {AC854C16-CA1E-43f1-8513-0D2F36C726ED} - (Google) - http://www.samenc.com
O69 - SBI: SearchScopes [HKCU] {afdbddaa-5d3f-42ee-b79c-185a7020515b} - (Softonic_France Customized Web Search) - http://search.conduit.com



---\\ Scan Additionnel (O88)
Database Version : 8609 - (09/06/2011)
Clés trouvées (Keys found) : 28
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 7
Fichiers trouvés (Files found) : 0

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkCrawler\Objects\WorkgroupCrawler] =>Toolbar.Crawler
[HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine] =>Toolbar.Conduit
[HKLM\Software\Classes\Conduit.Engine] =>Toolbar.Conduit
[HKLM\Software\Classes\Toolbar.CT2542115] =>Adware.Hotbar
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}] =>Toolbar.Conduit
[HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] =>Toolbar.Conduit
[HKLM\Software\Classes\TypeLib\{4d3b167e-5fd8-4276-8fd7-9df19c1e4d19}] =>Toolbar.SweetIM
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4daac69c-cba7-45e2-9bc8-1044483d3352}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4daac69c-cba7-45e2-9bc8-1044483d3352}] =>Toolbar.Conduit
[HKLM\Software\Classes\CLSID\{4daac69c-cba7-45e2-9bc8-1044483d3352}] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}] =>Toolbar.Conduit
[HKLM\Software\Classes\CLSID\{72B3882F-453A-4633-AAC9-8C3DCED62AFF}] =>Toolbar.Crawler
[HKLM\Software\Classes\CLSID\{82ac53b4-164c-4b07-a016-437a8388b81a}] =>Toolbar.SweetIM
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}] =>Toolbar.Conduit
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKLM\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\conduitEngine] =>Toolbar.Conduit
[HKLM\Software\conduitEngine] =>Toolbar.Conduit
[HKLM\Software\PopCap] =>Adware.PopCap
[HKCU\Software\PriceGong] =>Adware.PriceGong
[HKCU\Software\Softonic_France] =>Toolbar.Conduit
[HKLM\Software\Softonic_France] =>Toolbar.Conduit
[HKCU\Software\SWEETIE] =>Toolbar.SweetIM
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Toolbar] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Softonic_France Toolbar] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{30F9B915-B755-4826-820B-08FBA6BD249D} =>Toolbar.Conduit
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]:{bc4ffe41-de9f-46fa-b455-aad49b9f9938} =>Toolbar.SweetIM
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{bc4ffe41-de9f-46fa-b455-aad49b9f9938} =>Toolbar.SweetIM
C:\Program Files\Conduit =>Toolbar.Conduit
C:\Program Files\ConduitEngine =>Toolbar.Conduit
C:\Program Files\Softonic_France =>Toolbar.Conduit
C:\Documents and Settings\Administrateur\Application Data\PriceGong =>Adware.PriceGong
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit =>Toolbar.Conduit
C:\Documents and Settings\Administrateur\Local Settings\Application Data\ConduitEngine =>Toolbar.Conduit
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Softonic_France =>Toolbar.Conduit



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 2008-03-23 607576 | (aawservice) . (.Lavasoft.) - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
SR - | Auto 2009-08-28 144672 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
SR - | Auto 2011-05-10 42184 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 2008-12-12 238888 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SS - | Demand 2008-04-13 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\System32\dmadmin.exe
SS - | Auto 2010-02-05 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 2010-02-05 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 2010-02-05 182768 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SR - | Demand 2010-01-22 545576 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 2011-05-29 366640 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 2002-11-27 61440 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Administrateur at 2011-06-10 08:52:17

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR



End of the scan (1108 lines in 03mn 15s)(0)
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 10 Juin 2011 16:54

Bonjour

Merci d’héberger un nouveau rapport ZHPDiag sur ce site :
http://cjoint.com/
Et de copier/coller le lien obtenu.
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: demande d'analyse

Messagepar twilight50 » 10 Juin 2011 18:18

twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 10 Juin 2011 21:36

Bonsoir,

Lance ZHPFix par l'icône sur le bureau
Le tutoriel http://rue-du-montceau.pagesperso-orang ... hpfix.html
Coche les lignes suivantes :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R0 - HKUS\S-1-5-21-515967899-1606980848-1343024091-500\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R3 - URLSearchHook: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) (6.3.2.0) -- C:\Program Files\Softonic_France\prxtbSof0.dll
O2 - BHO: Softonic_France - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\Softonic_France\prxtbSof0.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\Softonic_France\prxtbSof0.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\ConduitEngine\prxConduitEngine.dll
O42 - Logiciel: Conduit Engine - (.Conduit Ltd..) [HKLM] -- conduitEngine
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Logiciel: Softonic_France Toolbar - (.Softonic_France.) [HKLM] -- Softonic_France Toolbar
O43 - CFD: 2010-08-07 - 12:18:02 - [1807648] ----D- C:\Program Files\Conduit
O43 - CFD: 2011-04-10 - 15:48:40 - [8446093] ----D- C:\Program Files\ConduitEngine
O43 - CFD: 2011-04-10 - 15:48:44 - [10761399] ----D- C:\Program Files\Softonic_France
O43 - CFD: 2011-06-08 - 11:54:02 - [1954952] ----D- C:\Documents and Settings\Administrateur\Application Data\PriceGong
O43 - CFD: 2011-03-09 - 09:22:46 - [3272578] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit
O43 - CFD: 2011-06-02 - 15:04:24 - [8794145] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\ConduitEngine
O43 - CFD: 2011-06-05 - 16:23:12 - [15307598] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\Softonic_France
O43 - CFD: 2008-02-16 - 19:43:40 - [11212800] ----D- C:\Documents and Settings\Administrateur\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150010}
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkCrawler\Objects\WorkgroupCrawler]
[HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine]
[HKLM\Software\Classes\Conduit.Engine]
[HKLM\Software\Classes\Toolbar.CT2542115]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
[HKLM\Software\Classes\TypeLib\{4d3b167e-5fd8-4276-8fd7-9df19c1e4d19}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKLM\Software\Classes\CLSID\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
[HKLM\Software\Classes\CLSID\{72B3882F-453A-4633-AAC9-8C3DCED62AFF}]
[HKLM\Software\Classes\CLSID\{82ac53b4-164c-4b07-a016-437a8388b81a}]
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[HKCU\Software\Conduit]
[HKLM\Software\Conduit]
[HKCU\Software\conduitEngine]
[HKLM\Software\conduitEngine]
[HKLM\Software\PopCap]
[HKCU\Software\PriceGong]
[HKCU\Software\Softonic_France]
[HKLM\Software\Softonic_France]
[HKCU\Software\SWEETIE]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Toolbar]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Softonic_France Toolbar]
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{30F9B915-B755-4826-820B-08FBA6BD249D}
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]:{bc4ffe41-de9f-46fa-b455-aad49b9f9938}
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{bc4ffe41-de9f-46fa-b455-aad49b9f9938}
C:\Program Files\Conduit
C:\Program Files\ConduitEngine
C:\Program Files\Softonic_France
C:\Documents and Settings\Administrateur\Application Data\PriceGong
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit
C:\Documents and Settings\Administrateur\Local Settings\Application Data\ConduitEngine
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Softonic_France

Clique sur le bouton Nettoyer .
Poste le rapport obtenu.

Télécharge MyHosts de jeanmimigab
http://sites.google.com/site/jeanmimiga ... -myhosts-1
Double clique sur l'icône de MyHosts qui se trouve sur votre bureau.
Le rapport " MyHosts.txt " s'ouvre quelques secondes après, copie son contenu et poste-le sur le forum.

Le rapport sera enregistré en : C:\MyHosts.txt .

IMPORTANT :
MyHosts doit être lancé sur une session ayant des droits "administrateur".
Toute exécution sur un compte "limité" entraînera l'apparition d'une fenêtre DOS demandant de le relancer à partir d'un compte administrateur.

@+
Dernière édition par nardino le 14 Juin 2011 15:12, édité 1 fois.
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: demande d'analyse

Messagepar twilight50 » 10 Juin 2011 23:40

bonjour,
petit problème je n'arrive pas a faire le ZHPFix...j'ai tout cocher ensuite je clique nettoyer et il n'est pas terminer qu'il m'ouvre une fenêtre explorer pour que j'accepte de supprimer définitivement les toolbar (comme je n'est pas accès a internet je ne peu que la fermer) le nettoyage repart et quelque seconde plus tard m'ouvre un carré qui dit :
impossible d'exporter c: ZHPRreg.txt : erreur d'écriture sur le fichier, peu etre due a une erreur de disque ou de systeme de fichiers
je clique ok, sa continu un peu ensuite :
violation d'acces a l'adresse 0042326c dans le module `ZHIPFIX.exe, L'ecture de L'adresse 2032345f
et la même si je clique ok il revient toujours....
???
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar twilight50 » 14 Juin 2011 12:46

es-ce-qu'on m'aurais oublier ? hihihi
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 14 Juin 2011 15:10

Bonjour
Le fait que tu n'aies pas accès à Internet ne joue pas dans le problème que tu rencontres.
Peux-tu essayer en mode sans échec après avoir passé MyHosts.

@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: demande d'analyse

Messagepar twilight50 » 15 Juin 2011 15:09

haaa la nouille lol
je pensais que le sans-fil capterais automatique, la j'ai brancher le fil directement et l'internet fonctionne j'ai eu par exemple quelque fois le violation d'acces a l'adresse 0042326c dans le module `ZHIPFIX.exe, L'ecture de L'adresse 2032345f
mais je ne croit pas que cela ai changer quelque chose parce que le test a fini...

Rapport de ZHPFix 1.12.3312 par Nicolas Coolman, Update du 15/06/2011
Fichier d'export Registre :
Run by Administrateur at 2011-06-15 09:45:42
Windows XP Professional Service Pack 3 (Build 2600)
Web site : http://www.premiumorange.com/zeb-help-p ... hpfix.html

========== Logiciel(s) ==========
ABSENT Software Key: conduitEngine
ABSENT Software Key: {2318C2B1-4965-11d4-9B18-009027A5CD4F}
ABSENT Software Key: Softonic_France Toolbar

========== Clé(s) du Registre ==========
ABSENT Key: CLSID BHO: {30F9B915-B755-4826-820B-08FBA6BD249D}
ABSENT Key: CLSID BHO: {4daac69c-cba7-45e2-9bc8-1044483d3352}
ABSENT Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkCrawler\Objects\WorkgroupCrawler
ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
ABSENT Key: HKLM\Software\Classes\Conduit.Engine
ABSENT Key: HKLM\Software\Classes\Toolbar.CT2542115
ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
ABSENT Key: HKLM\Software\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
ABSENT Key: HKLM\Software\Classes\TypeLib\{4d3b167e-5fd8-4276-8fd7-9df19c1e4d19}
ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4daac69c-cba7-45e2-9bc8-1044483d3352}
ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4daac69c-cba7-45e2-9bc8-1044483d3352}
ABSENT Key: HKLM\Software\Classes\CLSID\{4daac69c-cba7-45e2-9bc8-1044483d3352}
ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}
ABSENT Key: HKLM\Software\Classes\CLSID\{72B3882F-453A-4633-AAC9-8C3DCED62AFF}
ABSENT Key: HKLM\Software\Classes\CLSID\{82ac53b4-164c-4b07-a016-437a8388b81a}
ABSENT Key: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
ABSENT Key: HKCU\Software\Conduit
ABSENT Key: HKLM\Software\Conduit
ABSENT Key: HKCU\Software\conduitEngine
ABSENT Key: HKLM\Software\conduitEngine
ABSENT Key: HKLM\Software\PopCap
ABSENT Key: HKCU\Software\PriceGong
ABSENT Key: HKCU\Software\Softonic_France
ABSENT Key: HKLM\Software\Softonic_France
ABSENT Key: HKCU\Software\SWEETIE
ABSENT Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Toolbar
ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Softonic_France Toolbar

========== Valeur(s) du Registre ==========
ABSENT R3 - URLSearchHook: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} . (.Conduit Ltd. - Conduit Toolbar.) (6.3.2.0) -- C:\Program Files\Softonic_France\prxtbSof0.dll
ABSENT [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{30F9B915-B755-4826-820B-08FBA6BD249D}
ABSENT [HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]:{bc4ffe41-de9f-46fa-b455-aad49b9f9938}
ABSENT [HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{bc4ffe41-de9f-46fa-b455-aad49b9f9938}

========== Dossier(s) ==========
ABSENT C:\Program Files\Conduit
ABSENT C:\Program Files\ConduitEngine
ABSENT C:\Program Files\Softonic_France
ABSENT C:\Documents and Settings\Administrateur\Application Data\PriceGong
ABSENT C:\Documents and Settings\Administrateur\Local Settings\Application Data\Conduit
ABSENT C:\Documents and Settings\Administrateur\Local Settings\Application Data\ConduitEngine
SUPPRIME C:\Documents and Settings\Administrateur\Local Settings\Application Data\Softonic_France
ABSENT C:\Documents and Settings\Administrateur\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150010}

========== Fichier(s) ==========
ABSENT File: c:\program files\softonic_france\prxtbsof0.dll
ABSENT File: c:\program files\conduitengine\prxconduitengine.dll
ABSENT Folder/File: c:\program files\conduit
ABSENT Folder/File: c:\program files\conduitengine
ABSENT Folder/File: c:\program files\softonic_france
ABSENT Folder/File: c:\documents and settings\administrateur\application data\pricegong
ABSENT Folder/File: c:\documents and settings\administrateur\local settings\application data\conduit
ABSENT Folder/File: c:\documents and settings\administrateur\local settings\application data\conduitengine
ABSENT Folder/File: c:\documents and settings\administrateur\local settings\application data\softonic_france


========== Récapitulatif ==========
30 : Clé(s) du Registre
4 : Valeur(s) du Registre
8 : Dossier(s)
9 : Fichier(s)
3 : Logiciel(s)


========== Chemin du fichier rapport ==========
C:\Program Files\ZHPDiag\ZHPFixReport.txt
End of the scan
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
** Rapport MyHosts.txt **

MyHosts V.1.0.0.2 de jeanmimigab

Merci à la team MH, W-T ,C_XX, Laddy et à Batch_man pour leurs aides

Résultat de l'opération:restauration du fichier hosts réussi...

** Fin du rapport **
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 15 Juin 2011 19:34

Bonsoir,
Je pense que les choses sont résolues ?
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02

Re: demande d'analyse

Messagepar twilight50 » 15 Juin 2011 20:40

haa et bien merci si vous voyez que tout est ok cela doit être vrai :-D elle n'est plus tres jeune et n'a que 256mb de memoire je ne m'attend pas a grand chose :xpdr:

dite moi j'ai remarque que dans mon ordi a moi pratiquement neuve, j'ai aussi conduit engine dans mes programmes es-ce-que cela serais préférable de le retirer ?

merci
twilight50
 
Messages: 10
Inscription: 08 Juin 2011 17:15

Re: demande d'analyse

Messagepar nardino » 15 Juin 2011 23:14

Bonjour.
Bien sûr que tu peux supprimer cette barre d'outils.
Un peu de lecture : http://forum.pcastuces.com/sujet.asp?f=31&s=64
@+
Image
Avatar de l’utilisateur
nardino
Super Libellulien
Super Libellulien
 
Messages: 1103
Inscription: 03 Avr 2009 22:02


Retourner vers Désinfections et demandes d'analyse

Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 0 invités