kolchok

bonjour, la machine se porte très bien. J'ai pu réinstaler kaspersky. Merci pour tout, je ni serais jamais arrivé sans vous. Encore une fois je vous remercie d'avoir passé du temps sur les problèmes de mon pc. Amicalement, kolchok

bonsoir, voila le rapport de combofix ComboFix 11-02-15.04 - kolchok 17/02/2011 20:03:55.2.4 - x64 Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1033.18.2750.2029 [GMT 1:00] Lancé depuis: c:\users\kolchok\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\kolchok\Desktop\CFScript.txt.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FILE :: "c:\program files\\Bonjour\\mDNSResponder.exe" "c:\program files\Google\Update\GoogleUpdate.exe" "c:\windows\Tasks\GoogleUpdateTaskMachineCore.job" . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Tasks\GoogleUpdateTaskMachineCore.job . --------------- FCopy --------------- c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll --> c:\windows\SysWOW64\user32.dll c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll --> c:\windows\System32\user32.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gupdate ((((((((((((((((((((((((((((( Fichiers créés du 2011-01-17 au 2011-02-17 )))))))))))))))))))))))))))))))))))) . 2011-02-17 19:10 . 2011-02-17 19:10 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-02-16 23:10 . 2011-02-17 03:27 -------- d-----w- c:\program files (x86)\EA GAMES 2011-02-16 23:09 . 2004-10-22 01:18 749568 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll 2011-02-16 23:09 . 2004-10-22 01:17 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll 2011-02-16 23:09 . 2004-10-22 01:17 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll 2011-02-16 23:09 . 2004-10-22 01:16 180224 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll 2011-02-16 23:09 . 2004-10-22 01:16 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe 2011-02-16 23:09 . 2011-02-16 23:09 323716 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll 2011-02-16 23:09 . 2011-02-16 23:09 192644 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll 2011-02-16 02:05 . 2011-02-17 17:18 270856 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2011-02-16 02:05 . 2011-02-17 04:00 -------- d-----w- c:\users\kolchok\AppData\Local\PunkBuster 2011-02-15 20:58 . 2011-02-15 20:58 -------- d-----w- c:\users\kolchok\AppData\Local\Electronic Arts 2011-02-14 20:32 . 2011-02-14 20:32 -------- d-----w- c:\users\kolchok\AppData\Roaming\Hi-Rez Studios 2011-02-14 20:32 . 2011-02-14 20:32 -------- d--h--w- c:\windows\msdownld.tmp 2011-02-14 20:32 . 2011-02-14 20:32 -------- d-----w- c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP 2011-02-14 20:31 . 2011-02-14 20:31 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard 2011-02-14 04:50 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll 2011-02-13 20:05 . 2011-02-13 20:05 -------- d-----w- c:\program files (x86)\Ad-Remover 2011-02-13 07:27 . 2011-02-13 07:27 -------- d--h--r- c:\users\kolchok\AppData\Roaming\SecuROM 2011-02-13 04:11 . 2011-02-13 04:11 -------- d-sh--w- c:\programdata\DSS 2011-02-13 03:48 . 2011-02-13 03:51 -------- d-----w- c:\users\kolchok\AppData\Roaming\DAEMON Tools Lite 2011-02-13 03:48 . 2011-02-13 03:51 -------- d-----w- c:\programdata\DAEMON Tools Lite 2011-02-12 09:24 . 2011-02-12 09:24 -------- d-----w- c:\programdata\Steam 2011-02-12 09:24 . 2011-02-12 09:25 -------- d-----w- c:\programdata\PopCap Games 2011-02-09 02:01 . 2010-12-18 03:35 2381824 ----a-w- c:\windows\system32\mshtml.tlb 2011-02-09 02:01 . 2010-12-18 03:15 2381824 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-02-09 02:01 . 2010-12-18 03:39 1502208 ----a-w- c:\windows\system32\inetcpl.cpl 2011-02-09 02:01 . 2010-12-18 03:19 1448448 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-02-08 23:45 . 2011-01-13 10:20 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EF044FD4-7991-4B48-85D4-200BCD6D3DE3}\mpengine.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-30 10:59 . 2011-01-11 11:01 2690280 ----a-w- c:\windows\system32\drivers\RTKVHD64.sys 2010-12-30 00:35 . 2010-10-05 20:09 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2010-12-29 13:30 . 2011-01-11 11:01 2828904 ----a-w- c:\windows\system32\RtkAPO64.dll 2010-12-28 14:51 . 2011-01-11 11:01 608768 ----a-w- c:\windows\system32\RCoRes64.dat 2010-12-22 10:28 . 2011-01-11 11:01 2328168 ----a-w- c:\windows\system32\RtPgEx64.dll 2010-12-20 17:08 . 2010-11-14 18:03 24152 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-12-14 02:12 . 2010-12-14 02:13 521448 ----a-w- c:\windows\system32\deployJava1.dll 2010-11-29 17:47 . 2011-01-11 11:01 2578576 ----a-w- c:\windows\system32\WavesGUILib.dll 2010-11-29 17:47 . 2011-01-11 11:01 1868944 ----a-w- c:\windows\system32\MaxxAudioRealtek.dll 2010-11-23 17:45 . 2011-01-11 11:01 1247848 ----a-w- c:\windows\system32\RTCOM64.dll 2010-11-22 10:39 . 2011-01-11 11:01 626792 ----a-w- c:\windows\system32\RtkApi64.dll . ((((((((((((((((((((((((((((( SnapShot@2011-02-16_11.33.28 ))))))))))))))))))))))))))))))))))))))))) . + 2011-02-15 20:50 . 2011-02-17 03:47 75136 c:\windows\SysWOW64\PnkBstrA.exe - 2011-02-15 20:50 . 2011-02-16 02:13 75136 c:\windows\SysWOW64\PnkBstrA.exe + 2010-10-05 20:28 . 2011-02-17 17:18 37618 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-02-17 17:18 31924 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2010-10-05 20:17 . 2011-02-17 17:18 11106 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1832532766-817392245-452576883-1000_UserData.bin - 2009-07-14 05:30 . 2011-02-13 21:16 86016 c:\windows\system32\DriverStore\infpub.dat + 2009-07-14 05:30 . 2011-02-16 19:58 86016 c:\windows\system32\DriverStore\infpub.dat - 2011-02-16 11:32 . 2011-02-16 11:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-02-17 19:13 . 2011-02-17 19:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-02-17 19:13 . 2011-02-17 19:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-02-16 11:32 . 2011-02-16 11:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-02-15 20:50 . 2011-02-17 17:18 270856 c:\windows\SysWOW64\PnkBstrB.exe - 2011-02-15 20:50 . 2011-02-16 02:13 270856 c:\windows\SysWOW64\PnkBstrB.exe + 2009-07-14 05:30 . 2011-02-16 19:58 143360 c:\windows\system32\DriverStore\infstrng.dat - 2009-07-14 05:30 . 2011-02-13 21:16 143360 c:\windows\system32\DriverStore\infstrng.dat - 2009-07-14 05:30 . 2011-02-13 21:16 143360 c:\windows\system32\DriverStore\infstor.dat + 2009-07-14 05:30 . 2011-02-16 19:58 143360 c:\windows\system32\DriverStore\infstor.dat - 2009-07-14 05:01 . 2011-02-16 11:30 226136 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-02-17 19:11 226136 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2010-10-16 07:20 . 2011-02-13 04:24 348368 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1832532766-817392245-452576883-1000-12288.dat + 2010-10-16 07:20 . 2011-02-17 16:15 348368 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1832532766-817392245-452576883-1000-12288.dat - 2010-12-14 07:41 . 2011-02-16 03:36 1239048 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1832532766-817392245-452576883-1000-8192.dat + 2010-12-14 07:41 . 2011-02-17 16:15 1239048 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1832532766-817392245-452576883-1000-8192.dat - 2009-07-14 02:34 . 2011-02-16 08:27 10485760 c:\windows\system32\SMI\Store\Machine\schema.dat + 2009-07-14 02:34 . 2011-02-17 16:31 10485760 c:\windows\system32\SMI\Store\Machine\schema.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-10-5 1207312] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\klogon] [bU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] [bU] [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-06 1255736] S0 videX64;videX64;c:\windows\system32\DRIVERS\videX64.sys [2010-02-11 15000] S0 xfiltx64;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfiltx64.sys [2010-02-11 26776] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256] S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 22408] S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 16008] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-09-07 155752] S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [2009-07-23 52736] . --------- x86-64 ----------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "combofix"="c:\combofix\CF15493.cfxxe" [X] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576] "Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-08-03 415816] "Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-08-03 2412616] "Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-08-03 4725320] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-12-23 11725928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_Dlls"=0x0 . ------- Examen supplémentaire ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm FF - ProfilePath - c:\users\kolchok\AppData\Roaming\Mozilla\Firefox\Profiles\je2z1rt4.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\html5video FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\wpa FF - Ext: Battlefield Heroes Updater: [email protected] - %profile%\extensions\[email protected] . . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-1832532766-817392245-452576883-1000\Software\SecuROM\License information*] "datasecu"=hex:e2,35,9d,5a,62,2a,75,4c,38,87,7b,de,c9,7e,57,b4,44,85,a9,2a,ac, 60,8a,42,81,70,d8,7f,08,cc,5b,05,e0,54,73,e4,f4,d9,77,37,50,84,84,52,bd,c8,\ "rkeysecu"=hex:c2,af,b8,dc,a2,ec,ac,41,f0,cd,ed,17,ee,98,77,f4 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Autres processus actifs ------------------------ . c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Google\Update\GoogleUpdate.exe c:\program files\Logitech\SetPoint\x86\SetPoint32.exe c:\program files (x86)\Windows Media Player\wmplayer.exe . ************************************************************************** . Heure de fin: 2011-02-17 20:19:04 - La machine a redémarré ComboFix-quarantined-files.txt 2011-02-17 19:19 ComboFix2.txt 2011-02-16 11:38 Avant-CF: 367 655 145 472 octets libres Après-CF: 367 411 519 488 octets libres - - End Of File - - 2F0D0B0DA000AECF16BE217C50212EE2

bonjour, ComboFix 11-02-15.04 - kolchok 16/02/2011 12:24:32.1.4 - x64 Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1033.18.2750.1765 [GMT 1:00] Lancé depuis: c:\users\kolchok\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\install.exe c:\programdata\Desktop c:\users\kolchok\AppData\Roaming\Local c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\.ddr c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\Megamind.2010.FRENCH.DVDSCR.LD.REPACK.1CD.XviD-SERENiTY-UNDERGROUNDDDL.COM.avi.ddr c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2) c:\users\kolchok\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Megamind.2010.FRENCH.DVDSCR.LD.REPACK.1CD.XviD-SERENiTY-UNDERGROUNDDDL.COM.avi.ddp c:\windows\system32\rockers.reg c:\windows\SysWow64\rockers.reg . ((((((((((((((((((((((((((((( Fichiers créés du 2011-01-16 au 2011-02-16 )))))))))))))))))))))))))))))))))))) . 2011-02-16 11:30 . 2011-02-16 11:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-02-16 02:05 . 2011-02-16 02:13 270856 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2011-02-16 02:05 . 2011-02-16 02:05 -------- d-----w- c:\users\kolchok\AppData\Local\PunkBuster 2011-02-15 13:29 . 2011-02-15 13:29 -------- d-----w- c:\program files (x86)\SEAF 2011-02-14 20:32 . 2011-02-14 20:32 -------- d-----w- c:\users\kolchok\AppData\Roaming\Hi-Rez Studios 2011-02-14 20:32 . 2011-02-14 20:32 -------- d--h--w- c:\windows\msdownld.tmp 2011-02-14 20:32 . 2011-02-14 20:32 -------- d-----w- c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP 2011-02-14 20:31 . 2011-02-14 20:31 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard 2011-02-14 04:50 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll 2011-02-13 20:05 . 2011-02-13 20:05 -------- d-----w- c:\program files (x86)\Ad-Remover 2011-02-13 07:27 . 2011-02-13 07:27 -------- d--h--r- c:\users\kolchok\AppData\Roaming\SecuROM 2011-02-13 04:11 . 2011-02-13 04:11 -------- d-sh--w- c:\programdata\DSS 2011-02-13 03:48 . 2011-02-13 03:51 -------- d-----w- c:\users\kolchok\AppData\Roaming\DAEMON Tools Lite 2011-02-13 03:48 . 2011-02-13 03:51 -------- d-----w- c:\programdata\DAEMON Tools Lite 2011-02-12 09:24 . 2011-02-12 09:24 -------- d-----w- c:\programdata\Steam 2011-02-12 09:24 . 2011-02-12 09:25 -------- d-----w- c:\programdata\PopCap Games 2011-02-09 02:01 . 2010-12-18 03:35 2381824 ----a-w- c:\windows\system32\mshtml.tlb 2011-02-09 02:01 . 2010-12-18 03:15 2381824 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-02-09 02:01 . 2010-12-18 03:39 1502208 ----a-w- c:\windows\system32\inetcpl.cpl 2011-02-09 02:01 . 2010-12-18 03:19 1448448 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2011-02-08 23:45 . 2011-01-13 10:20 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EF044FD4-7991-4B48-85D4-200BCD6D3DE3}\mpengine.dll 2011-01-18 09:18 . 2011-02-14 08:38 -------- d-----w- c:\users\kolchok\AppData\Roaming\DivX 2011-01-18 09:18 . 2011-01-18 09:18 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine 2011-01-18 09:18 . 2011-01-18 09:18 -------- d-----w- c:\program files\DivX 2011-01-18 09:17 . 2011-01-18 09:18 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-30 10:59 . 2011-01-11 11:01 2690280 ----a-w- c:\windows\system32\drivers\RTKVHD64.sys 2010-12-30 00:35 . 2010-10-05 20:09 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll 2010-12-29 13:30 . 2011-01-11 11:01 2828904 ----a-w- c:\windows\system32\RtkAPO64.dll 2010-12-28 14:51 . 2011-01-11 11:01 608768 ----a-w- c:\windows\system32\RCoRes64.dat 2010-12-22 10:28 . 2011-01-11 11:01 2328168 ----a-w- c:\windows\system32\RtPgEx64.dll 2010-12-20 17:08 . 2010-11-14 18:03 24152 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-12-14 02:12 . 2010-12-14 02:13 521448 ----a-w- c:\windows\system32\deployJava1.dll 2010-11-29 17:47 . 2011-01-11 11:01 2578576 ----a-w- c:\windows\system32\WavesGUILib.dll 2010-11-29 17:47 . 2011-01-11 11:01 1868944 ----a-w- c:\windows\system32\MaxxAudioRealtek.dll 2010-11-23 17:45 . 2011-01-11 11:01 1247848 ----a-w- c:\windows\system32\RTCOM64.dll 2010-11-22 10:39 . 2011-01-11 11:01 626792 ----a-w- c:\windows\system32\RtkApi64.dll . ------- Sigcheck ------- [-] 2010-10-06 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7600.16385] . . c:\windows\SysWOW64\user32.dll [7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] . . c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] . . c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [-] 2010-10-06 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7600.16385] . . c:\windows\system32\user32.dll [-] 2010-10-06 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7600.16385] . . c:\windows\SysWOW64\user32.dll [7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] . . c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] . . c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [-] 2010-10-06 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7600.16385] . . c:\windows\system32\user32.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-10-5 1207312] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-18 136176] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-06 1255736] S0 videX64;videX64;c:\windows\system32\DRIVERS\videX64.sys [2010-02-11 15000] S0 xfiltx64;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfiltx64.sys [2010-02-11 26776] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256] S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 22408] S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 16008] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-09-07 155752] S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver;c:\windows\system32\DRIVERS\Rtnic64.sys [2009-07-23 52736] . Contenu du dossier 'Tâches planifiées' 2011-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-18 20:51] . --------- x86-64 ----------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576] "Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-08-03 415816] "Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-08-03 2412616] "Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-08-03 4725320] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-12-23 11725928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Examen supplémentaire ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm FF - ProfilePath - c:\users\kolchok\AppData\Roaming\Mozilla\Firefox\Profiles\je2z1rt4.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/firefox FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\html5video FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files (x86)\DivX\DivX Plus Web Player\firefox\wpa . - - - - ORPHELINS SUPPRIMES - - - - Notify-klogon - (no file) Notify-LBTWlgn - (no file) AddRemove-installer - c:\program files (x86)\Installer\un_installer_21627.exe AddRemove-Magelo Sync - c:\program files (x86)\Magelo\Magelo Sync\UnInstall.exe AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_moh.exe . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-1832532766-817392245-452576883-1000\Software\SecuROM\License information*] "datasecu"=hex:e2,35,9d,5a,62,2a,75,4c,38,87,7b,de,c9,7e,57,b4,44,85,a9,2a,ac, 60,8a,42,81,70,d8,7f,08,cc,5b,05,e0,54,73,e4,f4,d9,77,37,50,84,84,52,bd,c8,\ "rkeysecu"=hex:c2,af,b8,dc,a2,ec,ac,41,f0,cd,ed,17,ee,98,77,f4 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Autres processus actifs ------------------------ . c:\windows\SysWOW64\PnkBstrA.exe c:\program files\Logitech\SetPoint\x86\SetPoint32.exe c:\program files (x86)\Windows Media Player\wmplayer.exe . ************************************************************************** . Heure de fin: 2011-02-16 12:38:38 - La machine a redémarré ComboFix-quarantined-files.txt 2011-02-16 11:38 Avant-CF: 374 985 760 768 octets libres Après-CF: 374 742 278 144 octets libres - - End Of File - - 654941B1AFEDE1CE408A8031A8218979

bonsoir, Après avoir cherché comment mettre les fichiers cachés (merci google) voici le rapport : File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis: MD5: df7501a91a7c99cc3f0269080748ee61 Date first seen: 2010-11-08 10:48:02 (UTC) Date last seen: 2011-02-15 18:05:05 (UTC) Detection ratio: 0/42

bonjour, voici le rapport : 1. ========================= SEAF 1.0.1.0 - C_XX 2. 3. Commencé à: 14:30:45 le 15/02/2011 4. 5. Valeur(s) recherchée(s): 6. fs4ro8rf.exe 7. 8. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès 9. 10. (!) --- Calcul du Hash "MD5" 11. (!) --- Informations supplémentaires 12. (!) --- Recherche registre 13. 14. ====== Fichier(s) ====== 15. 16. 17. "C:\Users\kolchok\Desktop\fs4ro8rf.exe" [ ARCHIVE | 296 Ko ] 18. TC: 14/02/2011,10:56:09 | TM: 14/02/2011,10:56:09 | DA: 14/02/2011,10:56:07 19. 20. Hash MD5: DF7501A91A7C99CC3F0269080748EE61 21. 22. FileVersion: 1, 0, 15, 15530 23. 24. ========================= 25. 26. 27. "C:\Windows\Prefetch\FS4RO8RF.EXE-E9B2CAF4.pf" [ NOT_CONTENT_INDEXED|ARCHIVE | 90 Ko ] 28. TC: 14/02/2011,11:00:31 | TM: 14/02/2011,18:13:53 | DA: 14/02/2011,11:00:31 29. 30. Hash MD5: 2F5CF39E23BC90A4A03B091D04410EF0 31. 32. 33. ========================= 34. 35. 36. 37. ====== Entrée(s) du registre ====== 38. 39. Aucun élément dans le registre trouvé 40. 41. ========================= 42. 43. Fin à: 14:33:37 le 15/02/2011 44. 508148 Éléments analysés 45. 46. ========================= 47. E.O.F

bonsoir, désolé de mettre su temps avant de répondre, mais il n'y à pas que mon pc qui à un virus. Enfin bref, voici le rapport GMER : GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover Rootkit scan 2011-02-14 18:09:49 Windows 6.1.7600 Running: fs4ro8rf.exe ---- Modules - GMER 1.0.15 ---- Module \SystemRoot\system32\DRIVERS\viaide.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) 00FF5000-00FFD000 (32768 bytes) Module \SystemRoot\system32\DRIVERS\videX64.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) 00C6C000-00C74000 (32768 bytes) Module \SystemRoot\system32\DRIVERS\amdxata.sys (Storage Filter Driver/Advanced Micro Devices) 00DF3000-00DFE000 (45056 bytes) Module \SystemRoot\system32\DRIVERS\xfiltx64.sys (ATA/ATAPI devices Hot-Plug/DIPM monitor/VIA Technologies, Inc.) 01147000-01151000 (40960 bytes) Module \SystemRoot\system32\DRIVERS\nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 260.99 /NVIDIA Corporation) 0481A000-053F4000 (12427264 bytes) Module \SystemRoot\system32\DRIVERS\nvBridge.kmd (NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 260.99 /NVIDIA Corporation) 053F4000-053F6000 (8192 bytes) Module \SystemRoot\system32\DRIVERS\Rtnic64.sys (Realtek 10/100 X64 Driver /Realtek Semiconductor Corporation ) 04267000-04279000 (73728 bytes) Module \SystemRoot\system32\drivers\LGBusEnum.sys (Logitech WingMan Virtual Bus Enumerator Driver/Logitech Inc.) 043F6000-043FA000 (16384 bytes) Module \SystemRoot\system32\drivers\nvhda64v.sys (NVIDIA HDMI Audio Driver/NVIDIA Corporation) 05753000-0577C000 (167936 bytes) Module \SystemRoot\system32\drivers\RTKVHD64.sys (Realtek® High Definition Audio Function Driver/Realtek Semiconductor Corp.) 0586B000-05AFB000 (2686976 bytes) Module \SystemRoot\system32\DRIVERS\LHidFilt.Sys (Logitech HID Filter Driver./Logitech, Inc.) 05BE0000-05BF3000 (77824 bytes) Module \SystemRoot\system32\DRIVERS\LMouFilt.Sys (Logitech Mouse Filter Driver./Logitech, Inc.) 05800000-05814000 (81920 bytes) Module \SystemRoot\System32\Drivers\secdrv.SYS (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) 05D0B000-05D16000 (45056 bytes) Module \SystemRoot\system32\drivers\LGVirHid.sys (Logitech GamePanel Virtual Hid Device Driver/Logitech Inc.) 05EE6000-05EE9000 (12288 bytes) Module \Windows\System32\usp10.dll (Uniscribe Unicode script processor/Microsoft Corporation) FF5B0000-FF67A000 (827392 bytes) ---- Processes - GMER 1.0.15 ---- Process fs4ro8rf.exe 600 Process nvvsvc.exe (NVIDIA Driver Helper Service, Version 260.99/NVIDIA Corporation) 760 Process NvXDSync.exe 1152 Process nvvsvc.exe (NVIDIA Driver Helper Service, Version 260.99/NVIDIA Corporation) 1164 Process KHALMNPR.exe (Logitech KHAL Main Process/Logitech, Inc.) 1580 Process nvSCPAPISvr.exe 1648 Process GoogleUpdate.exe 1708 Process SetPoint32.exe 2576 Process LGDevAgt.exe 2580 Process LCDMon.exe 2588 Process LGDCore.exe 2596 Process RAVCpl64.exe 2608 Process jusched.exe 2708 Process SetPoint.exe 2740 Process DivXUpdate.exe 2772 Process DDMService.exe 2780 Process LCDClock.exe 2888 Process LCDCountdown.exe 2932 Process LCDMedia.exe 2940 Process LCDPop3.exe 2948 Process LCDRSS.exe 2956 Process WMPSideShowGadget.exe 3512 Process wmplayer.exe 3640 ---- Services - GMER 1.0.15 ---- Service system32\DRIVERS\adp94xx.sys (Adaptec Windows SAS/SATA Storport Driver/Adaptec, Inc.) [MANUAL] adp94xx Service system32\DRIVERS\adpahci.sys (Adaptec Windows SATA Storport Driver/Adaptec, Inc.) [MANUAL] adpahci Service system32\DRIVERS\adpu320.sys (Adaptec StorPort Ultra320 SCSI Driver (X64)/Adaptec, Inc.) [MANUAL] adpu320 Service system32\DRIVERS\aliide.sys (ALi mini IDE Driver/Acer Laboratories Inc.) [MANUAL] aliide Service system32\DRIVERS\amdsata.sys (AHCI 1.2 Device Driver/Advanced Micro Devices) [MANUAL] amdsata Service system32\DRIVERS\amdsbs.sys (AMD Technology AHCI Compatible Controller Driver for Windows - AMD64 platform/AMD Technologies Inc.) [MANUAL] amdsbs Service system32\DRIVERS\amdxata.sys (Storage Filter Driver/Advanced Micro Devices) [bOOT] amdxata Service system32\DRIVERS\arc.sys (Adaptec RAID Storport Driver/Adaptec, Inc.) [MANUAL] arc Service system32\DRIVERS\arcsas.sys (Adaptec SAS RAID WS03 Driver/Adaptec, Inc.) [MANUAL] arcsas Service system32\DRIVERS\bxvbda.sys (Broadcom NetXtreme II GigE VBD/Broadcom Corporation) [MANUAL] b06bdrv Service system32\DRIVERS\b57nd60a.sys (Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver./Broadcom Corporation) [MANUAL] b57nd60a Service system32\DRIVERS\BrFiltLo.sys (Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver/Brother Industries, Ltd.) [MANUAL] BrFiltLo Service system32\DRIVERS\BrFiltUp.sys (Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver/Brother Industries, Ltd.) [MANUAL] BrFiltUp Service System32\Drivers\Brserid.sys (Pilote Brother Série I/F (WDM)/Brother Industries Ltd.) [MANUAL] Brserid Service System32\Drivers\BrSerWdm.sys (Brother Serial driver (WDM version)/Brother Industries Ltd.) [MANUAL] BrSerWdm Service System32\Drivers\BrUsbMdm.sys (Brother USB MDM Driver /Brother Industries Ltd.) [MANUAL] BrUsbMdm Service System32\Drivers\BrUsbSer.sys (Brother USB Serial Driver/Brother Industries Ltd.) [MANUAL] BrUsbSer Service system32\DRIVERS\cmdide.sys (CMD PCI IDE Bus Driver/CMD Technology, Inc.) [MANUAL] cmdide Service system32\DRIVERS\evbda.sys (Broadcom NetXtreme II 10 GigE VBD/Broadcom Corporation) [MANUAL] ebdrv Service system32\DRIVERS\elxstor.sys (Storport Miniport Driver for LightPulse HBAs/Emulex) [MANUAL] elxstor Service C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Programme d'installation de Google/Google Inc.) [AUTO] gupdate Service system32\drivers\hcw85cir.sys (Hauppauge WinTV 885 Consumer IR Driver for eHome/Hauppauge Computer Works, Inc.) [MANUAL] hcw85cir Service system32\DRIVERS\HpSAMD.sys (Smart Array SAS/SATA Controller Media Driver/Hewlett-Packard Company) [MANUAL] HpSAMD Service system32\DRIVERS\iaStorV.sys (Intel Matrix Storage Manager driver - x64/Intel Corporation) [MANUAL] iaStorV Service system32\DRIVERS\iirsp.sys (Intel/ICP Raid Storport Driver/Intel Corp./ICP vortex GmbH) [MANUAL] iirsp Service system32\drivers\RTKVHD64.sys (Realtek® High Definition Audio Function Driver/Realtek Semiconductor Corp.) [MANUAL] IntcAzAudAddService Service C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech Bluetooth Service/Logitech, Inc.) [MANUAL] LBTServ Service system32\drivers\LGBusEnum.sys (Logitech WingMan Virtual Bus Enumerator Driver/Logitech Inc.) [MANUAL] LGBusEnum Service system32\drivers\LGVirHid.sys (Logitech GamePanel Virtual Hid Device Driver/Logitech Inc.) [MANUAL] LGVirHid Service system32\DRIVERS\LHidFilt.Sys (Logitech HID Filter Driver./Logitech, Inc.) [MANUAL] LHidFilt Service system32\DRIVERS\LMouFilt.Sys (Logitech Mouse Filter Driver./Logitech, Inc.) [MANUAL] LMouFilt Service system32\DRIVERS\lsi_fc.sys (LSI Fusion-MPT FC Driver (StorPort)/LSI Corporation) [MANUAL] LSI_FC Service system32\DRIVERS\lsi_sas.sys (LSI Fusion-MPT SAS Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SAS Service system32\DRIVERS\lsi_sas2.sys (LSI SAS Gen2 Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SAS2 Service system32\DRIVERS\lsi_scsi.sys (LSI Fusion-MPT SCSI Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SCSI Service system32\DRIVERS\megasas.sys (MEGASAS RAID Controller Driver for Windows 7\Server 2008 R2 for x64/LSI Corporation) [MANUAL] megasas Service system32\DRIVERS\MegaSR.sys (LSI MegaRAID Software RAID Driver/LSI Corporation, Inc.) [MANUAL] MegaSR Service MSDTC Bridge 3.0.0.0 Service MSDTC Bridge 4.0.0.0 Service system32\DRIVERS\nfrd960.sys (IBM ServeRAID Controller Driver/IBM Corporation) [MANUAL] nfrd960 Service system32\drivers\nvhda64v.sys (NVIDIA HDMI Audio Driver/NVIDIA Corporation) [MANUAL] NVHDA Service system32\DRIVERS\nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 260.99 /NVIDIA Corporation) [MANUAL] nvlddmkm Service system32\DRIVERS\nvraid.sys (NVIDIA® nForce RAID Driver/NVIDIA Corporation) [MANUAL] nvraid Service system32\DRIVERS\nvstor.sys (NVIDIA® nForce Sata Performance Driver/NVIDIA Corporation) [MANUAL] nvstor Service C:\Windows\system32\nvvsvc.exe (NVIDIA Driver Helper Service, Version 260.99/NVIDIA Corporation) [AUTO] nvsvc Service system32\DRIVERS\ql2300.sys (QLogic Fibre Channel Stor Miniport Driver/QLogic Corporation) [MANUAL] ql2300 Service system32\DRIVERS\ql40xx.sys (QLogic iSCSI Storport Miniport Driver/QLogic Corporation) [MANUAL] ql40xx Service system32\DRIVERS\Rtnic64.sys (Realtek 10/100 X64 Driver /Realtek Semiconductor Corporation ) [MANUAL] RTL8023x64 Service (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [AUTO] secdrv Service ServiceModelEndpoint 3.0.0.0 Service ServiceModelOperation 3.0.0.0 Service ServiceModelService 3.0.0.0 Service system32\DRIVERS\SiSRaid2.sys (SiS RAID Stor Miniport Driver/Silicon Integrated Systems Corp.) [MANUAL] SiSRaid2 Service system32\DRIVERS\sisraid4.sys (SiS AHCI Stor-Miniport Driver/Silicon Integrated Systems) [MANUAL] SiSRaid4 Service SMSvcHost 3.0.0.0 Service SMSvcHost 4.0.0.0 Service C:\Program [MANUAL] Steam Client Service Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Stereo Vision Control Panel API Server/NVIDIA Corporation) [AUTO] Stereo Service Service system32\DRIVERS\stexstor.sys (Promise SuperTrak EX Series Driver for Windows /Promise Technology) [MANUAL] stexstor Service TCPIP6TUNNEL Service TCPIPTUNNEL Service system32\DRIVERS\viaide.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) [bOOT] viaide Service system32\DRIVERS\videX64.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) [bOOT] videX64 Service system32\DRIVERS\vsmraid.sys (VIA RAID DRIVER FOR AMD-X86-64/VIA Technologies Inc.,Ltd) [MANUAL] vsmraid Service Windows Workflow Foundation 3.0.0.0 Service C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe [MANUAL] WMPNetworkSvc Service WSearchIdxPi Service system32\DRIVERS\xfiltx64.sys (ATA/ATAPI devices Hot-Plug/DIPM monitor/VIA Technologies, Inc.) [bOOT] xfiltx64 ---- EOF - GMER 1.0.15 ---- merci encore de prendre de vôtre temps et de vous penchez sur mon problème. A bientôt.

bonsoir, voici les rapports ======= REPORT FROM AD-REMOVER 2.0.0.2,E | ONLY XP/VISTA/7 ======= Updated by TeamXscript on 08/02/11 Contact: AdRemover[DOT]contact[AT]gmail[DOT]com website: TeamXscript : AD-Remover - FindyKill - UsbFix - SEAF C:\Program Files (x86)\Ad-Remover\main.exe (SCAN [1]) -> Launched at 21:05:01 on 13/02/2011, Normal boot Microsoft Windows 7 Édition Intégrale (X64) kolchok@LOKI (Packard Bell BV iXtreme X9777) ============== SEARCH ============== Service: "sdmBackupIP" Service found File found: C:\Windows\SysWOW64\Utils.dll Key found: HKLM\Software\Install Pedia Limited ============== ADDITIONNAL SCAN ============== **** Mozilla Firefox Version [3.6.13 (fr)] **** HKLM_MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0 (x) HKLM_MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0 (x) HKLM_MozillaPlugins\@nvidia.com/3DVision (x) HKLM_MozillaPlugins\@nvidia.com/3DVisionStreaming (x) HKLM_MozillaPlugins\@pandonetworks.com/PandoWebPlugin (x) HKCU_MozillaPlugins\pandonetworks.com/PandoWebPlugin (x) Extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} (Skype extension for Firefox ) HKLM_Extensions|[email protected] - C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ (x) HKLM_Extensions|{23fcfd51-4958-4f00-80a3-ae97e717ed8b} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video HKLM_Extensions|{6904342A-8307-11DF-A508-4AE2DFD72085} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa -- C:\Users\kolchok\AppData\Roaming\Mozilla\FireFox\Profiles\je2z1rt4.default -- Searchplugins\daemon-search.xml (hxxp://www.daemon-search.com/search/web?q={searchTerms}/) Prefs.js - browser.download.lastDir, C:\\Users\\kolchok\\Pictures Prefs.js - browser.startup.homepage, hxxp://my.daemon-search.com/startpage|resource:/browserconfig.properties Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13 ======================================== **** Internet Explorer Version [9.0.7930.16406] **** HKCU_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896 HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157 HKLM_Main|Default_Search_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896 HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896 HKLM_Main|Start Page - hxxp://go.microsoft.com/fwlink/?LinkId=69157 HKCU_SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} - "DAEMON Search" (hxxp://www.daemon-search.com/search/web?q={searchTerms}) HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x) HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x) HKLM_ElevationPolicy\{5F17E524-3447-4c7d-8E5F-4EFF31CDE3B7} - C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe (DivX, LLC) HKLM_ElevationPolicy\{64903E32-AE0B-408D-909C-09A08791F28D} - C:\Program Files (x86)\DivX\DivX Plus Web Player\dwpBroker.exe (DivX, LLC) HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x) HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x) HKLM_ElevationPolicy\{D802E3EF-2513-4661-972E-BAD737EFBA88} - C:\Program Files (x86)\DivX\DivX OVS Helper\OVSHelperBroker.exe (DivX, LLC.) BHO\{326E768D-4182-46FD-9C16-1449A49795F4} - "DivX Plus Web Player HTML5 <video>" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll) BHO\{593DDEC6-7468-4cdd-90E1-42DADAA222E9} - "DivX HiQ" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll) ======================================== C:\Program Files (x86)\Ad-Remover\Quarantine: 0 File(s) C:\Program Files (x86)\Ad-Remover\Backup: 1 File(s) C:\Ad-Report-SCAN[1].txt - 13/02/2011 (3743 Byte(s)) End at: 21:05:42, 13/02/2011 ============== E.O.F ============== ======= REPORT FROM AD-REMOVER 2.0.0.2,E | ONLY XP/VISTA/7 ======= Updated by TeamXscript on 08/02/11 Contact: AdRemover[DOT]contact[AT]gmail[DOT]com website: TeamXscript : AD-Remover - FindyKill - UsbFix - SEAF C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 22:03:18 on 13/02/2011, Normal boot Microsoft Windows 7 Édition Intégrale (X64) kolchok@LOKI (Packard Bell BV iXtreme X9777) ============== ACTION(S) ============== Service: "sdmBackupIP" Service stopped and deleted File deleted: C:\Windows\SysWOW64\Utils.dll (!) -- Temporary files deleted. Key deleted: HKLM\Software\Install Pedia Limited ============== ADDITIONNAL SCAN ============== **** Mozilla Firefox Version [3.6.13 (fr)] **** HKLM_MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0 (x) HKLM_MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0 (x) HKLM_MozillaPlugins\@nvidia.com/3DVision (x) HKLM_MozillaPlugins\@nvidia.com/3DVisionStreaming (x) HKLM_MozillaPlugins\@pandonetworks.com/PandoWebPlugin (x) HKCU_MozillaPlugins\pandonetworks.com/PandoWebPlugin (x) Extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} (Skype extension for Firefox ) HKLM_Extensions|[email protected] - C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ (x) HKLM_Extensions|{23fcfd51-4958-4f00-80a3-ae97e717ed8b} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video HKLM_Extensions|{6904342A-8307-11DF-A508-4AE2DFD72085} - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa -- C:\Users\kolchok\AppData\Roaming\Mozilla\FireFox\Profiles\je2z1rt4.default -- Searchplugins\daemon-search.xml (hxxp://www.daemon-search.com/search/web?q={searchTerms}/) Prefs.js - browser.download.lastDir, C:\\Users\\kolchok\\Pictures Prefs.js - browser.startup.homepage, hxxp://my.daemon-search.com/startpage|resource:/browserconfig.properties Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13 ======================================== **** Internet Explorer Version [9.0.7930.16406] **** HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896 HKCU_Main|Start Page - hxxp://fr.msn.com/ HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896 HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM_Main|Start Page - hxxp://fr.msn.com/ HKCU_SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} - "DAEMON Search" (hxxp://www.daemon-search.com/search/web?q={searchTerms}) HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x) HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x) HKLM_ElevationPolicy\{5F17E524-3447-4c7d-8E5F-4EFF31CDE3B7} - C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe (DivX, LLC) HKLM_ElevationPolicy\{64903E32-AE0B-408D-909C-09A08791F28D} - C:\Program Files (x86)\DivX\DivX Plus Web Player\dwpBroker.exe (DivX, LLC) HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x) HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x) HKLM_ElevationPolicy\{D802E3EF-2513-4661-972E-BAD737EFBA88} - C:\Program Files (x86)\DivX\DivX OVS Helper\OVSHelperBroker.exe (DivX, LLC.) BHO\{326E768D-4182-46FD-9C16-1449A49795F4} - "DivX Plus Web Player HTML5 <video>" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll) BHO\{593DDEC6-7468-4cdd-90E1-42DADAA222E9} - "DivX HiQ" (C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll) ======================================== C:\Program Files (x86)\Ad-Remover\Quarantine: 1 File(s) C:\Program Files (x86)\Ad-Remover\Backup: 16 File(s) C:\Ad-Report-CLEAN[1].txt - 13/02/2011 (4095 Byte(s)) C:\Ad-Report-SCAN[1].txt - 13/02/2011 (3872 Byte(s)) End at: 22:04:24, 13/02/2011 ============== E.O.F ============== RogueKiller V3.10.0 by Tigzy contact at Forum Sciences / Forum Informatique - Sur la Toile (SLT) mail: tigzyRK<at>gmail<dot>com Feedback: [RogueKiller] Remontées (1/9) Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: kolchok [Admin rights] Mode: HOSTSFix -- Time : 13/02/2011 21:09:03 Bad processes: HOSTS File: ÿþ1 Resetted HOSTS: 127.0.0.1 localhost Finished RogueKiller V3.10.0 by Tigzy contact at Forum Sciences / Forum Informatique - Sur la Toile (SLT) mail: tigzyRK<at>gmail<dot>com Feedback: [RogueKiller] Remontées (1/9) Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: kolchok [Admin rights] Mode: Scan -- Time : 13/02/2011 21:09:35 Bad processes: Found: HOSTS File: 127.0.0.1 localhost Finished RogueKiller V3.10.0 by Tigzy contact at Forum Sciences / Forum Informatique - Sur la Toile (SLT) mail: tigzyRK<at>gmail<dot>com Feedback: [RogueKiller] Remontées (1/9) Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: kolchok [Admin rights] Mode: Scan -- Time : 13/02/2011 22:00:55 Bad processes: Found: HOSTS File: 127.0.0.1 localhost Finished mbam n'a toujours rien trouvé.

bonjour, je ne peux pas lancer kaspersky. j'ai pensé qu'il avait un raté donc du coup, je l'ai désinstallé puis j'ai relancé l'installation mais kaspersky ne s'ouvre même plus. j'ai tenté une restauration système mais impossible. j'ai lancé malwarebytes mais il n'a rien trouvé. j'ai aussi lancé zhpdiag pour voir ce que ça donnais mais je ne sais pas le lire. si vous pourriez m'aider car mes connaissance sont très limitées. je vous remercie par avance du temps que vous passerez à lire mon post, et de l'aide que vous pourrez m'apporter. voici donc les rapports : Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Version de la base de données: 5751 Windows 6.1.7600 Internet Explorer 9.0.7930.16406 13/02/2011 07:50:39 mbam-log-2011-02-13 (07-50-39).txt Type d'examen: Examen complet (C:\|) Elément(s) analysé(s): 327714 Temps écoulé: 48 minute(s), 19 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté) et voici zhpdiag : Rapport de ZHPDiag v1.27.1600 par Nicolas Coolman, Update du 10/02/2011 Run by kolchok at 13/02/2011 07:57:10 Web site : ZHPDiag Outil de diagnostic Contact : [email protected] ---\\ Web Browser MSIE: Internet Explorer v9.0.7930.16406 ---\\ System Information Windows 7 Ultimate Edition, 64-bit (Build 7600) Processor: Intel64 Family 6 Model 15 Stepping 11, GenuineIntel Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 2750 MB (53% free) System Restore: Activé (Enable) System drive C: has 367 GB (78%) free of 466 GB ---\\ Logged in mode Computer Name: LOKI User Name: kolchok All Users Names: kolchok, Guest, Administrator, Unselected Option: O45,O61,O62,O65,O66,O82 Logged in as Administrator ---\\ Environnement Variables %AppData%=C:\Users\kolchok\AppData\Roaming %LocalAppData%=C:\Users\kolchok\AppData\Local %StartMenu%=C:\Users\kolchok\AppData\Roaming\Microsoft\Windows\Start Menu ---\\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 367 Go of 466 Go) D:\ CD-ROM drive (Free 0 Go of 0 Go) E:\ Floppy drive, Flash card reader, USB Key (Not Inserted) F:\ Floppy drive, Flash card reader, USB Key (Not Inserted) G:\ Floppy drive, Flash card reader, USB Key (Not Inserted) H:\ Floppy drive, Flash card reader, USB Key (Not Inserted) I:\ CD-ROM drive (Not Inserted) ---\\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK ---\\ Recherche particulière de fichiers génériques [MD5.9AAAEC8DAC27AA17B053E6352AD233AE] - (.Microsoft Corporation - Explorateur Windows.) (.31/10/2009 07:34:59.) -- C:\Windows\Explorer.exe [2870272] [MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256] ---\\ Processus lancés [MD5.93DB1FF92B03D24738A71E6E4992DFD3] - (.Sun Microsystems, Inc. - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552] [MD5.A58E05767687E1E636D160ECEA9BC8ED] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1226608] [MD5.57D8C4ED26DFD7EF0E2CB196FB8BFB54] - (.DivX, LLC - DivX Download Manager Service.) -- C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe [63360] [MD5.205E6E08B4921CE48B8E80A2D2FDE6F2] - (.Logitech Inc. - Logitech G-series Media Display.) -- C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe [522824] [MD5.A0F1DFC9E47B2524213AFF32E26BE92D] - (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe [164864] [MD5.C316AFAE719B1C1CE1B903673BC6A641] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe [77824] [MD5.0E20A3213ED010FC4997D1EF48082ABC] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [912344] [MD5.BA9A09CF1B9503C363617F3748F6D791] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [16856] [MD5.3A4C97796130037CBB555F5BC8419F28] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [630272] [MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe [7168] ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) M3 - MFPP: Plugins - [kolchok] -- C:\Users\kolchok\AppData\Roaming\Mozilla\Firefox\Profiles\je2z1rt4.default\searchplugins\daemon-search.xml P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_22 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll P2 - FPN: [HKCU] [pandonetworks.com/PandoWebPlugin] - (.Pando Networks - Pando Web Plugin.) -- C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll M0 - MFSP: prefs.js [kolchok - je2z1rt4.default] http://my.daemon-search.com/startpage|resource:/browserconfig.properties ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook (R0,R1,R3) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport R0 - HKUS\S-1-5-21-1832532766-817392245-452576883-1000\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Search Microsoft.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Search Microsoft.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Search Microsoft.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Search Microsoft.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R1 - HKUS\S-1-5-21-1832532766-817392245-452576883-1000\Software\Microsoft\Internet Explorer\Main,Search Page = Search Microsoft.com R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (9.00.7930.16406 (WIN7_IE9_Beta.100831-2345)) -- C:\Windows\System32\ieframe.dll ---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2) F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe ---\\ Browser Helper Objects de navigateur (O2) O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} . (.Kaspersky Lab ZAO - IE Virtual Keyboard.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\ievkbd.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} . (.Kaspersky Lab ZAO - WebToolBar component.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\x64\klwtbbho.dll ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} . (.Pas de propriétaire - ToolBand Module.) -- C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ---\\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] . (.Logitech, Inc. - Logitech KHAL Main Process.) -- C:\Windows\KHALMNPR.exe O4 - HKLM\..\Run: [Launch LgDeviceAgent] . (.Logitech Inc. - Logitech GamePanel Agent.) -- C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe O4 - HKLM\..\Run: [Launch LCDMon] . (.Logitech Inc. - Logitech LCD Manager.) -- C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe O4 - HKLM\..\Run: [Launch LGDCore] . (.Logitech Inc. - Logitech G-series Profiler.) -- C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe O4 - HKLM\..\Wow6432Node\Run: [sunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe O4 - HKLM\..\Wow6432Node\Run: [DivX Download Manager] . (.DivX, LLC - DivX Download Manager Service.) -- C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe O4 - HKLM\..\Wow6432Node\Run: [AVP] . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe O4 - HKLM\..\Wow6432Node\RunOnce: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe O4 - HKUS\S-1-5-18\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe O4 - HKUS\S-1-5-18\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-21-1832532766-817392245-452576883-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.) O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.) O4 - Global Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk . (.Logitech, Inc..) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe ---\\ Autres liens utilisateurs (O4) O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - Global Startup: C:\Users\kolchok\Desktop\DivX Movies.lnk . (.Pas de propriétaire.) -- C:\Users\kolchok\Videos\DivX Movies O4 - Global Startup: C:\Users\kolchok\Desktop\Wow Cartographe.lnk . (.Pas de propriétaire.) -- C:\Program Files (x86)\WowCartographe\WowCartographe.exe O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk . (.LIGHTNING UK!.) -- C:\Program Files (x86)\ImgBurn\ImgBurn.exe O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Magelo Sync.lnk . (.Pas de propriétaire.) -- C:\Program Files (x86)\Magelo\Magelo Sync\MageloSync.exe O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk . (.Mozilla Corporation.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - Clé orpheline O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - Clé orpheline O4 - Global Startup: C:\Users\kolchok\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk . (.BitTorrent, Inc..) -- C:\Program Files (x86)\uTorrent\uTorrent.exe ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\kbrd.ico O9 - Extra button: Clavier &virtuel - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (.Pas de propriétaire - Pas de description.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\logo.ico ---\\ Winsock hijacker (Layered Service Provider) (O10) O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d’affectation de noms de messagerie.) -- C:\Windows\system32\napinsp.dll O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d’espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d’espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\Windows\system32\wshbth.dll ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{8D0F607F-762B-4B93-9EBF-C2E7BB310AB9}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{8D0F607F-762B-4B93-9EBF-C2E7BB310AB9}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{8D0F607F-762B-4B93-9EBF-C2E7BB310AB9}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: klogon . (.Pas de propriétaire - Pas de description.) -- C:\Windows\System32\klogon.dll (.not file.) O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - AppInit_DLLs: . (.Kaspersky Lab ZAO - Kaspersky OE plugin loader.) - C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll ---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: (AVP) . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe O23 - Service: (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: (nvsvc) - Clé orpheline O23 - Service: (sdmBackupIP) - Clé orpheline O23 - Service: (Stereo Service) . (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe ---\\ Enumération Active Desktop & MHTML Editor (O24) O24 - Default MHTML Editor: Last - .(.Pas de propriétaire - Pas de description.) - (.not file.) ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [MD5.00000000000000000000000000000000] [APT] [secunia PSI Logon Task] (.Pas de propriétaire.) -- C:\Program Files (x86)\Secunia\PSI\psi.exe (.not file.) [MD5.6FBBB73BE9FB38389AB73F38828A9CAC] [APT] [{B41DF29A-980A-4266-92B4-52026DDD2B50}] (.Skype Technologies S.A..) -- C:\Program Files (x86)\Skype\Phone\Skype.exe ---\\ Pilotes lancés au démarrage (O41) O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys O41 - Driver: C:\Windows\system32\cscsvc.dll (CSC) . (.Microsoft Corporation - Windows Client Side Caching Driver.) - C:\Windows\System32\drivers\csc.sys O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys O41 - Driver: (dtsoftbus01) . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) - C:\Windows\System32\DRIVERS\dtsoftbus01.sys O41 - Driver: (kl2) . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) - C:\Windows\System32\DRIVERS\kl2.sys O41 - Driver: (KLIF) . (.Kaspersky Lab - Klif Mini-Filter [fre_wlh_AMD64].) - C:\Windows\System32\DRIVERS\klif.sys O41 - Driver: (KLIM6) . (.Kaspersky Lab ZAO - Kaspersky Lab Intermediate Network Driver.) - C:\Windows\System32\DRIVERS\klim6.sys O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys O41 - Driver: C:\Windows\system32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys O41 - Driver: C:\Windows\system32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERS\rdbss.sys O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys O41 - Driver: C:\Windows\system32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys O41 - Driver: C:\Windows\system32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\Windows\system32\DRIVERS\serial.sys ---\\ Logiciels installés (O42) O42 - Logiciel: 7-Zip 9.20 (x64 edition) - (.Igor Pavlov.) [HKLM] -- {23170F69-40C1-2702-0920-000001000000} O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player ActiveX O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player Plugin O42 - Logiciel: CDDRV_Installer - (.Logitech.) [HKLM] -- {0C826C5B-B131-423A-A229-C71B3CACCD6A} O42 - Logiciel: Cisco EAP-FAST Module - (.Cisco Systems, Inc..) [HKLM][64Bits] -- {64BF0187-F3D2-498B-99EA-163AF9AE6EC9} O42 - Logiciel: Cisco LEAP Module - (.Cisco Systems, Inc..) [HKLM][64Bits] -- {51C7AD07-C3F6-4635-8E8A-231306D810FE} O42 - Logiciel: Cisco PEAP Module - (.Cisco Systems, Inc..) [HKLM][64Bits] -- {ED5776D5-59B4-46B7-AF81-5F2D94D7C640} O42 - Logiciel: Configuration DivX - (.DivX, LLC.) [HKLM][64Bits] -- DivX Setup.divx.com O42 - Logiciel: Counter-Strike: Source - (.Valve.) [HKLM][64Bits] -- {9580813D-94B1-4C28-9426-A441E2BB29A5} O42 - Logiciel: Counter-Strike: Source Beta - (.Pas de propriétaire.) [HKLM][64Bits] -- Steam App 260 O42 - Logiciel: Curse Client - (.Curse.) [HKCU] -- 090215de958f1060 O42 - Logiciel: DAEMON Tools Lite - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Lite O42 - Logiciel: DAEMON Tools Toolbar - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Toolbar O42 - Logiciel: Day of Defeat: Source - (.Valve.) [HKLM][64Bits] -- Steam App 300 O42 - Logiciel: Feedback Tool - (.Microsoft Corporation.) [HKLM][64Bits] -- {90024193-9F13-4877-89D5-A1CDF0CBBF28} O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} O42 - Logiciel: Google Earth - (.Google.) [HKLM][64Bits] -- {4286E640-B5FB-11DF-AC4B-005056C00008} O42 - Logiciel: ImgBurn - (.LIGHTNING UK!.) [HKLM][64Bits] -- ImgBurn O42 - Logiciel: Java 6 Update 22 (64-bit) - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F86416022FF} O42 - Logiciel: Java 6 Update 23 - (.Oracle.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216023FF} O42 - Logiciel: Kane & Lynch 2: Dog Days Demo - (.IO Interactive.) [HKLM][64Bits] -- Steam App 28020 O42 - Logiciel: Kaspersky Internet Security 2011 - (.Kaspersky Lab.) [HKLM][64Bits] -- InstallWIX_{66F1F013-008F-4875-B283-5A814B820347} O42 - Logiciel: Kaspersky Internet Security 2011 - (.Kaspersky Lab.) [HKLM][64Bits] -- {66F1F013-008F-4875-B283-5A814B820347} O42 - Logiciel: KhalInstallWrapper - (.Logitech.) [HKLM] -- {F3F18612-7B5D-4C05-86C9-AB50F6F71727} O42 - Logiciel: League of Legends - (.Riot Games.) [HKLM][64Bits] -- {918A9082-6287-4D25-9002-5E5D5E4971CB} O42 - Logiciel: Left 4 Dead 2 - (.Valve.) [HKLM][64Bits] -- Steam App 550 O42 - Logiciel: Logitech GamePanel Software 3.06.109 - (.Logitech Inc..) [HKLM] -- {A1E85B9A-AFAD-4D38-AF01-6B020DD5213A} O42 - Logiciel: Logitech SetPoint - (.Logitech.) [HKLM][64Bits] -- {F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E} O42 - Logiciel: Magelo Sync (uninstall only) - (.Pas de propriétaire.) [HKLM][64Bits] -- Magelo Sync O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes' Anti-Malware_is1 O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable (x64) - (.Microsoft Corporation.) [HKLM] -- {071c9b48-7c32-4621-a0ac-3f809523288f} O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM][64Bits] -- {7299052b-02a4-4627-81f2-1818da5d550d} O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {8220EEFE-38CD-377E-8595-13398D740ACE} O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 - (.Microsoft Corporation.) [HKLM][64Bits] -- {FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4} O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM][64Bits] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475} O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM][64Bits] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} O42 - Logiciel: Mozilla Firefox (3.6.13) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox (3.6.13) O42 - Logiciel: Mumble and Murmur - (.Mumble.) [HKLM][64Bits] -- Mumble O42 - Logiciel: NVIDIA Logiciel système PhysX 9.10.0514 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B9DB4C76-01A4-46D5-8910-F7AA6376DBAF} O42 - Logiciel: NVIDIA Pilote 3D Vision 260.99 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision O42 - Logiciel: NVIDIA Pilote audio HD : 1.1.9.0 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver O42 - Logiciel: NVIDIA Pilote graphique 260.99 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver O42 - Logiciel: NVIDIA Stereoscopic 3D Driver - (.NVIDIA Corporation.) [HKLM][64Bits] -- NVIDIAStereo O42 - Logiciel: OpenAL - (.Pas de propriétaire.) [HKLM][64Bits] -- OpenAL O42 - Logiciel: PVSonyDll - (.NVIDIA Corporation.) [HKLM] -- {3D3E663D-4E7E-4577-A560-7ECDDD45548A} O42 - Logiciel: Pando Media Booster - (.Pando Networks Inc..) [HKLM][64Bits] -- {980A182F-E0A2-4A40-94C1-AE0C1235902E} O42 - Logiciel: REALTEK Wireless LAN Driver - (.REALTEK Semiconductor Corp..) [HKLM][64Bits] -- {9D3D8C60-A55F-4fed-B2B9-173F09590E16} O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC} O42 - Logiciel: Realtek PCI Fast Ethernet Controller Driver For Vista and Win7 - (.Realtek.) [HKLM][64Bits] -- {AE46ABD3-D625-467F-B5A7-8D3FFF077F0D} O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2160841 O42 - Logiciel: Skype™ 4.2 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {D103C4BA-F905-437A-8049-DB24763BBE36} O42 - Logiciel: Steam - (.Valve Corporation.) [HKLM][64Bits] -- {048298C9-A4D3-490B-9FF9-AB023A9238F3} O42 - Logiciel: TeamSpeak 3 Client - (.TeamSpeak Systems GmbH.) [HKLM] -- TeamSpeak 3 Client O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2473228) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228 O42 - Logiciel: VC80CRTRedist - 8.0.50727.4053 - (.DivX, Inc.) [HKLM][64Bits] -- {5EE7D259-D137-4438-9A5F-42F432EC0421} O42 - Logiciel: VIA Gestionnaire de périphériques de plate-forme - (.VIA Technologies, Inc..) [HKLM][64Bits] -- InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169} O42 - Logiciel: VLC media player 1.1.5 - (.VideoLAN.) [HKLM][64Bits] -- VLC media player O42 - Logiciel: World of Warcraft - (.Blizzard Entertainment.) [HKLM][64Bits] -- World of Warcraft O42 - Logiciel: Wow Cartographe 1.20 - (.Pas de propriétaire.) [HKLM][64Bits] -- Wow Cartographe O42 - Logiciel: erLT - (.Logitech, Inc..) [HKLM][64Bits] -- {A498D9EB-927B-459B-85D6-DD6EF8C2C564} O42 - Logiciel: installer - (.Install Pedia Limited.) [HKLM][64Bits] -- installer O42 - Logiciel: µTorrent - (.Pas de propriétaire.) [HKLM][64Bits] -- uTorrent ---\\ HKCU & HKLM Software Keys [HKCU\Software\ALWIL Software] [HKCU\Software\AVG] [HKCU\Software\AppDataLow\Software\Microsoft] [HKCU\Software\AppDataLow\Software] [HKCU\Software\AppDataLow] [HKCU\Software\BitDefender] [HKCU\Software\BitTorrent] [HKCU\Software\Blizzard Entertainment] [HKCU\Software\Bugsplat] [HKCU\Software\ClassesB] [HKCU\Software\Classes] [HKCU\Software\Clients] [HKCU\Software\CyberStep] [HKCU\Software\DSS] [HKCU\Software\DT Soft] [HKCU\Software\DivXNetworks] [HKCU\Software\DivX] [HKCU\Software\Foxit Software] [HKCU\Software\Froggie] [HKCU\Software\Google] [HKCU\Software\HookNetwork] [HKCU\Software\IO Interactive] [HKCU\Software\ImgBurn] [HKCU\Software\JavaSoft] [HKCU\Software\KasperskyLab] [HKCU\Software\Leadertech] [HKCU\Software\Local AppWizard-Generated Applications] [HKCU\Software\Logitech] [HKCU\Software\LowRegistry] [HKCU\Software\Macromedia] [HKCU\Software\Malwarebytes' Anti-Malware] [HKCU\Software\MozillaPlugins] [HKCU\Software\Mozilla] [HKCU\Software\Mumble] [HKCU\Software\NDOORS] [HKCU\Software\NVIDIA Corporation] [HKCU\Software\Netscape] [HKCU\Software\Pando Networks] [HKCU\Software\Policies] [HKCU\Software\Realtek] [HKCU\Software\Safer Networking Limited] [HKCU\Software\Secunia] [HKCU\Software\Skype] [HKCU\Software\SteamPopCap] [HKCU\Software\Trolltech] [HKCU\Software\Valve] [HKCU\Software\WinRAR SFX] [HKCU\Software\Wow6432Node] [HKCU\Software\YahooPartnerToolbar] [HKCU\Software\cacaoweb] [HKCU\Software\ej-technologies] [HKCU\Software\ijji] [HKLM\Software\7-Zip] [HKLM\Software\AGEIA Technologies] [HKLM\Software\ATI Technologies] [HKLM\Software\Classes] [HKLM\Software\Clients] [HKLM\Software\DTS] [HKLM\Software\DivX] [HKLM\Software\Dolby] [HKLM\Software\InfoWatch] [HKLM\Software\Installer] [HKLM\Software\Intel] [HKLM\Software\JavaSoft] [HKLM\Software\JreMetrics] [HKLM\Software\KasperskyLab] [HKLM\Software\Khronos] [HKLM\Software\Logitech] [HKLM\Software\MidasHeurScanner] [HKLM\Software\MozillaPlugins] [HKLM\Software\NVIDIA Corporation] [HKLM\Software\ODBC] [HKLM\Software\Policies] [HKLM\Software\RTLSetup] [HKLM\Software\Realtek] [HKLM\Software\RegisteredApplications] [HKLM\Software\SRS Labs] [HKLM\Software\SonicFocus] [HKLM\Software\Sonic] [HKLM\Software\Waves Audio] [HKLM\Software\Wow6432Node] ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 05/10/2010 - 22:17:42 ----D- C:\Program Files\BitDefender O43 - CFD: 05/10/2010 - 22:17:42 ----D- C:\Program Files\Common Files O43 - CFD: 18/01/2011 - 10:18:20 ----D- C:\Program Files\DivX O43 - CFD: 06/10/2010 - 02:19:24 ----D- C:\Program Files\DVD Maker O43 - CFD: 14/12/2010 - 03:09:00 ----D- C:\Program Files\Internet Explorer O43 - CFD: 14/12/2010 - 03:12:44 ----D- C:\Program Files\Java O43 - CFD: 09/10/2010 - 18:17:26 ----D- C:\Program Files\Logitech O43 - CFD: 14/07/2009 - 08:46:54 ----D- C:\Program Files\Microsoft Games O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\MSBuild O43 - CFD: 10/12/2010 - 17:25:04 ----D- C:\Program Files\NVIDIA Corporation O43 - CFD: 06/10/2010 - 16:08:16 ----D- C:\Program Files\Realtek O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\Reference Assemblies O43 - CFD: 26/11/2010 - 09:16:08 ----D- C:\Program Files\TeamSpeak 3 Client O43 - CFD: 14/07/2009 - 06:09:28 --H-D- C:\Program Files\Uninstall Information O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Defender O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Journal O43 - CFD: 17/12/2010 - 03:02:14 ----D- C:\Program Files\Windows Mail O43 - CFD: 14/10/2010 - 02:19:38 ----D- C:\Program Files\Windows Media Player O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\Windows NT O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Photo Viewer O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files\Windows Portable Devices O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Windows Sidebar O43 - CFD: 05/10/2010 - 22:17:46 ----D- C:\Program Files\Common Files\BitDefender O43 - CFD: 05/10/2010 - 21:40:10 ----D- C:\Program Files\Common Files\Logishrd O43 - CFD: 05/10/2010 - 22:17:14 ----D- C:\Program Files\Common Files\Microsoft Shared O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\Services O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\SpeechEngines O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Common Files\System O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Application Data O43 - CFD: 05/10/2010 - 23:33:02 ----D- C:\ProgramData\BitDefender O43 - CFD: 06/10/2010 - 03:54:28 ----D- C:\ProgramData\Blizzard O43 - CFD: 16/10/2010 - 09:15:12 ----D- C:\ProgramData\Blizzard Entertainment O43 - CFD: 13/02/2011 - 04:51:42 ----D- C:\ProgramData\DAEMON Tools Lite O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Desktop O43 - CFD: 18/01/2011 - 10:19:04 ----D- C:\ProgramData\DivX O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Documents O43 - CFD: 13/02/2011 - 05:11:32 -SH-D- C:\ProgramData\DSS O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Favorites O43 - CFD: 13/02/2011 - 07:57:16 ----D- C:\ProgramData\Kaspersky Lab O43 - CFD: 13/02/2011 - 06:47:04 ----D- C:\ProgramData\Kaspersky Lab Setup Files O43 - CFD: 05/10/2010 - 21:40:22 ----D- C:\ProgramData\LogiShrd O43 - CFD: 09/10/2010 - 18:17:26 ----D- C:\ProgramData\Logitech O43 - CFD: 11/01/2011 - 10:54:18 ----D- C:\ProgramData\ma-config.com O43 - CFD: 14/11/2010 - 19:03:40 ----D- C:\ProgramData\Malwarebytes O43 - CFD: 21/10/2010 - 06:34:14 ----D- C:\ProgramData\McAfee O43 - CFD: 06/10/2010 - 00:06:54 -S--D- C:\ProgramData\Microsoft O43 - CFD: 13/02/2011 - 06:54:40 ----D- C:\ProgramData\NVIDIA O43 - CFD: 05/10/2010 - 21:10:26 ----D- C:\ProgramData\NVIDIA Corporation O43 - CFD: 14/10/2010 - 20:32:06 ----D- C:\ProgramData\PMB Files O43 - CFD: 12/02/2011 - 10:25:20 ----D- C:\ProgramData\PopCap Games O43 - CFD: 06/10/2010 - 06:45:50 ----D- C:\ProgramData\Skype O43 - CFD: 14/12/2010 - 02:37:30 ----D- C:\ProgramData\Spybot - Search & Destroy O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Start Menu O43 - CFD: 12/02/2011 - 10:24:50 ----D- C:\ProgramData\Steam O43 - CFD: 05/10/2010 - 21:09:46 ----D- C:\ProgramData\Sun O43 - CFD: 12/12/2010 - 05:32:22 ---AD- C:\ProgramData\TEMP O43 - CFD: 14/07/2009 - 06:08:58 -SH-D- C:\ProgramData\Templates O43 - CFD: 05/10/2010 - 20:59:08 ----D- C:\Users\kolchok\AppData\Roaming\Adobe O43 - CFD: 19/11/2010 - 20:02:08 ----D- C:\Users\kolchok\AppData\Roaming\AVG O43 - CFD: 05/10/2010 - 22:17:50 ----D- C:\Users\kolchok\AppData\Roaming\BitDefender O43 - CFD: 13/02/2011 - 04:51:42 ----D- C:\Users\kolchok\AppData\Roaming\DAEMON Tools Lite O43 - CFD: 19/01/2011 - 09:33:44 ----D- C:\Users\kolchok\AppData\Roaming\DivX O43 - CFD: 11/01/2011 - 10:46:26 ----D- C:\Users\kolchok\AppData\Roaming\Easeware O43 - CFD: 05/10/2010 - 20:56:14 ----D- C:\Users\kolchok\AppData\Roaming\Identities O43 - CFD: 05/10/2010 - 21:40:14 ----D- C:\Users\kolchok\AppData\Roaming\Leadertech O43 - CFD: 18/01/2011 - 10:19:02 ----D- C:\Users\kolchok\AppData\Roaming\Local O43 - CFD: 05/10/2010 - 21:40:22 ----D- C:\Users\kolchok\AppData\Roaming\Logitech O43 - CFD: 14/10/2010 - 22:01:02 ----D- C:\Users\kolchok\AppData\Roaming\LolClient O43 - CFD: 05/10/2010 - 20:59:08 ----D- C:\Users\kolchok\AppData\Roaming\Macromedia O43 - CFD: 14/11/2010 - 19:03:52 ----D- C:\Users\kolchok\AppData\Roaming\Malwarebytes O43 - CFD: 14/07/2009 - 08:45:16 ----D- C:\Users\kolchok\AppData\Roaming\Media Center Programs O43 - CFD: 15/11/2010 - 03:25:56 -S--D- C:\Users\kolchok\AppData\Roaming\Microsoft O43 - CFD: 18/12/2010 - 15:57:36 ----D- C:\Users\kolchok\AppData\Roaming\Mozilla O43 - CFD: 12/02/2011 - 18:07:44 ----D- C:\Users\kolchok\AppData\Roaming\Mumble O43 - CFD: 10/12/2010 - 17:25:06 ----D- C:\Users\kolchok\AppData\Roaming\QuickScan O43 - CFD: 07/02/2011 - 04:29:04 ----D- C:\Users\kolchok\AppData\Roaming\Skype O43 - CFD: 07/02/2011 - 02:25:58 ----D- C:\Users\kolchok\AppData\Roaming\skypePM O43 - CFD: 26/11/2010 - 09:15:44 ----D- C:\Users\kolchok\AppData\Roaming\TS3Client O43 - CFD: 13/02/2011 - 06:30:04 ----D- C:\Users\kolchok\AppData\Roaming\uTorrent O43 - CFD: 13/02/2011 - 06:30:04 ----D- C:\Users\kolchok\AppData\Roaming\vlc O43 - CFD: 18/12/2010 - 16:23:00 ----D- C:\Program Files (x86)\7-Zip O43 - CFD: 06/10/2010 - 01:03:54 ----D- C:\Program Files (x86)\AVG O43 - CFD: 06/10/2010 - 14:36:44 ----D- C:\Program Files (x86)\Cisco O43 - CFD: 13/02/2011 - 06:30:08 ----D- C:\Program Files (x86)\Common Files O43 - CFD: 13/02/2011 - 06:30:08 ----D- C:\Program Files (x86)\DAEMON Tools Lite O43 - CFD: 13/02/2011 - 06:30:08 ----D- C:\Program Files (x86)\DAEMON Tools Toolbar O43 - CFD: 18/01/2011 - 10:19:04 ----D- C:\Program Files (x86)\DivX O43 - CFD: 14/12/2010 - 03:00:40 ----D- C:\Program Files (x86)\Feedback Tool O43 - CFD: 11/01/2011 - 10:20:54 ----D- C:\Program Files (x86)\FileHippo.com O43 - CFD: 18/12/2010 - 15:55:30 ----D- C:\Program Files (x86)\Google O43 - CFD: 05/10/2010 - 20:54:56 ----D- C:\Program Files (x86)\ImgBurn O43 - CFD: 11/01/2011 - 12:01:24 --H-D- C:\Program Files (x86)\InstallShield Installation Information O43 - CFD: 14/12/2010 - 03:09:00 ----D- C:\Program Files (x86)\Internet Explorer O43 - CFD: 30/12/2010 - 01:35:32 ----D- C:\Program Files (x86)\Java O43 - CFD: 13/02/2011 - 06:48:28 ----D- C:\Program Files (x86)\Kaspersky Lab O43 - CFD: 09/10/2010 - 18:17:26 ----D- C:\Program Files (x86)\Logitech O43 - CFD: 24/11/2010 - 23:18:14 ----D- C:\Program Files (x86)\Magelo O43 - CFD: 13/02/2011 - 07:01:40 ----D- C:\Program Files (x86)\Malwarebytes' Anti-Malware O43 - CFD: 18/12/2010 - 01:36:24 ----D- C:\Program Files (x86)\Microsoft.NET O43 - CFD: 18/12/2010 - 15:57:24 ----D- C:\Program Files (x86)\Mozilla Firefox O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files (x86)\MSBuild O43 - CFD: 22/11/2010 - 14:24:04 ----D- C:\Program Files (x86)\Mumble O43 - CFD: 10/12/2010 - 17:24:16 ----D- C:\Program Files (x86)\NVIDIA Corporation O43 - CFD: 20/10/2010 - 22:11:54 ----D- C:\Program Files (x86)\OpenAL O43 - CFD: 14/10/2010 - 20:28:30 ----D- C:\Program Files (x86)\Pando Networks O43 - CFD: 17/11/2010 - 03:27:12 ----D- C:\Program Files (x86)\REACTOR O43 - CFD: 11/01/2011 - 12:01:26 ----D- C:\Program Files (x86)\Realtek O43 - CFD: 06/10/2010 - 14:36:22 ----D- C:\Program Files (x86)\REALTEK PCIE Wireless LAN Driver O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files (x86)\Reference Assemblies O43 - CFD: 14/12/2010 - 02:57:44 R---D- C:\Program Files (x86)\Skype O43 - CFD: 14/12/2010 - 02:37:32 ----D- C:\Program Files (x86)\Spybot - Search & Destroy O43 - CFD: 13/02/2011 - 06:30:06 ----D- C:\Program Files (x86)\Steam O43 - CFD: 11/01/2011 - 12:02:36 --H-D- C:\Program Files (x86)\Temp O43 - CFD: 14/07/2009 - 05:57:08 --H-D- C:\Program Files (x86)\Uninstall Information O43 - CFD: 13/02/2011 - 06:30:06 ----D- C:\Program Files (x86)\uTorrent O43 - CFD: 05/10/2010 - 21:24:10 ----D- C:\Program Files (x86)\VIA O43 - CFD: 06/10/2010 - 04:14:46 ----D- C:\Program Files (x86)\VideoLAN O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files (x86)\Windows Defender O43 - CFD: 17/12/2010 - 03:02:14 ----D- C:\Program Files (x86)\Windows Mail O43 - CFD: 14/10/2010 - 02:19:38 ----D- C:\Program Files (x86)\Windows Media Player O43 - CFD: 14/07/2009 - 06:32:40 ----D- C:\Program Files (x86)\Windows NT O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files (x86)\Windows Photo Viewer O43 - CFD: 14/07/2009 - 06:32:42 ----D- C:\Program Files (x86)\Windows Portable Devices O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files (x86)\Windows Sidebar O43 - CFD: 13/02/2011 - 06:30:06 ----D- C:\Program Files (x86)\World of Warcraft O43 - CFD: 10/12/2010 - 17:25:04 ----D- C:\Program Files (x86)\WowCartographe O43 - CFD: 13/02/2011 - 07:57:16 ----D- C:\Program Files (x86)\ZHPDiag O43 - CFD: 05/10/2010 - 22:17:46 ----D- C:\Program Files\Common Files\BitDefender O43 - CFD: 05/10/2010 - 21:40:10 ----D- C:\Program Files\Common Files\Logishrd O43 - CFD: 05/10/2010 - 22:17:14 ----D- C:\Program Files\Common Files\Microsoft Shared O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\Services O43 - CFD: 14/07/2009 - 04:20:10 ----D- C:\Program Files\Common Files\SpeechEngines O43 - CFD: 06/10/2010 - 02:28:22 ----D- C:\Program Files\Common Files\System ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.6E6AB42B1E46515E74F4B174EE301133] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\PerfStringBackup.INI [1549700] O44 - LFC:[MD5.09C4D7263A582415887DFB85C56CE9FE] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfc009.dat [106190] O44 - LFC:[MD5.1B6566646D9386D0FA3A4084953783C3] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfc00C.dat [130068] O44 - LFC:[MD5.2DEFBD5D5B5C7007305612987CE8BB6D] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfh009.dat [615810] O44 - LFC:[MD5.A417B7FEAFB73ED5E7F90E70E4326FE3] - 13/02/2011 - 06:59:44 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\perfh00C.dat [702362] O44 - LFC:[MD5.05000000000000000000000088ED1800] - 13/02/2011 - 06:57:58 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\WindowsUpdate.log [2054767] O44 - LFC:[MD5.96F0D920EB5C0D5410172989BCAE0B2A] - 13/02/2011 - 06:54:29 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\setupact.log [5604] O44 - LFC:[MD5.633A96C2BFF6469084C564A640027134] - 13/02/2011 - 06:54:18 -S-A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\bootstat.dat [67584] O44 - LFC:[MD5.55DF0BB289FDC8FF2D50424B4F8D9C7A] - 13/02/2011 - 06:42:34 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\PFRO.log [38792] O44 - LFC:[MD5.B26A8BFA9D56E1959EF0FA108E0163AA] - 13/02/2011 - 05:00:14 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\DirectX.log [24866] O44 - LFC:[MD5.7CE5DA32084FB3098D1D3C052B4E4315] - 09/02/2011 - 12:24:11 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\FNTCACHE.DAT [274464] O44 - LFC:[MD5.158D85C26868E8A9903A726CE145F66B] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\Windows\SysNative\atmlib.dll [46080] O44 - LFC:[MD5.158D85C26868E8A9903A726CE145F66B] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\Windows\System32\atmlib.dll [34304] O44 - LFC:[MD5.BF973CEDCD012D23F194BBF0A9B218E6] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\Windows\SysNative\atmfd.dll [366080] O44 - LFC:[MD5.BF973CEDCD012D23F194BBF0A9B218E6] - 09/02/2011 - 00:51:03 ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\Windows\System32\atmfd.dll [294400] O44 - LFC:[MD5.31EC5484E49027D8718FA3C4EA9A148A] - 07/02/2011 - 22:54:59 --HA- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [16848] O44 - LFC:[MD5.31EC5484E49027D8718FA3C4EA9A148A] - 07/02/2011 - 22:54:59 --HA- . (.Pas de propriétaire - Pas de description.) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [16848] ---\\ Trojan Driver Search Data (HKLM) (O52) O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm ---\\ Microsoft Control Security Providers (O54) O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll ---\\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5 O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3 O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1 O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1 O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0 O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0 O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"= O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"= O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0 O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1 O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "VerboseStatus"=1 ---\\ Microsoft Windows Policies Explorer (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "LinkResolveIgnoreLinkInfo"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoResolveSearch"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoResolveTrack"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInternetOpenWith"=1 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=255 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMBalloonTip"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktop"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "ForceActiveDesktopOn"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveTypeAutoRun"=255 ---\\ Liste des Drivers Système (O58) O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\system32\drivers\adp94xx.sys [491088] O58 - SDL:[MD5.597F78224EE9224EA1A13D6350CED962] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SATA Storport Driver.) -- C:\Windows\system32\drivers\adpahci.sys [339536] O58 - SDL:[MD5.E109549C90F62FB570B9540C4B148E54] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec StorPort Ultra320 SCSI Driver (X64).) -- C:\Windows\system32\drivers\adpu320.sys [182864] O58 - SDL:[MD5.5812713A477A3AD7363C7438CA2EE038] - 14/07/2009 - 02:52:21 ---A- . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\Windows\system32\drivers\aliide.sys [15440] O58 - SDL:[MD5.7A4B413614C055935567CF88A9734D38] - 14/07/2009 - 02:52:21 ---A- . (.Advanced Micro Devices - AHCI 1.2 Device Driver.) -- C:\Windows\system32\drivers\amdsata.sys [106576] O58 - SDL:[MD5.F67F933E79241ED32FF46A4F29B5120B] - 14/07/2009 - 02:52:20 ---A- . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller Driver for Windows -.) -- C:\Windows\system32\drivers\amdsbs.sys [194128] O58 - SDL:[MD5.B4AD0CACBAB298671DD6F6EF7E20679D] - 14/07/2009 - 02:52:21 ---A- . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\system32\drivers\amdxata.sys [28752] O58 - SDL:[MD5.C484F8CEB1717C540242531DB7845C4E] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec RAID Storport Driver.) -- C:\Windows\system32\drivers\arc.sys [87632] O58 - SDL:[MD5.019AF6924AEFE7839F61C830227FE79C] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\system32\drivers\arcsas.sys [97856] O58 - SDL:[MD5.B5ACE6968304A3900EEB1EBFD9622DF2] - 10/06/2009 - 21:34:23 ---A- . (.Broadcom Corporation - Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver..) -- C:\Windows\system32\drivers\b57nd60a.sys [270848] O58 - SDL:[MD5.F09EEE9EDC320B5E1501F749FDE686C8] - 10/06/2009 - 21:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver.) -- C:\Windows\system32\drivers\BrFiltLo.sys [18432] O58 - SDL:[MD5.B114D3098E9BDB8BEA8B053685831BE6] - 10/06/2009 - 21:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver.) -- C:\Windows\system32\drivers\BrFiltUp.sys [8704] O58 - SDL:[MD5.43BEA8D483BF1870F018E2D02E06A5BD] - 14/07/2009 - 02:19:07 ---A- . (.Brother Industries Ltd. - Pilote Brother Série I/F (WDM).) -- C:\Windows\system32\drivers\BrSerId.sys [286720] O58 - SDL:[MD5.A6ECA2151B08A09CACECA35C07F05B42] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother Serial driver (WDM version).) -- C:\Windows\system32\drivers\BrSerWdm.sys [47104] O58 - SDL:[MD5.B79968002C277E869CF38BD22CD61524] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother USB MDM Driver.) -- C:\Windows\system32\drivers\BrUsbMdm.sys [14976] O58 - SDL:[MD5.A87528880231C54E75EA7A44943B38BF] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother USB Serial Driver.) -- C:\Windows\system32\drivers\BrUsbSer.sys [14720] O58 - SDL:[MD5.3E5B191307609F7514148C6832BB0842] - 10/06/2009 - 21:34:28 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\system32\drivers\bxvbda.sys [468480] O58 - SDL:[MD5.E19D3F095812725D88F9001985B94EDD] - 14/07/2009 - 02:52:31 ---A- . (.CMD Technology, Inc. - CMD PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\cmdide.sys [17488] O58 - SDL:[MD5.AB1201F8DE199E764DA9A32ABF71049C] - 14/12/2009 - 11:44:24 ---A- . (.Infowatch - Cryptographic Algorithm Lib Driver..) -- C:\Windows\system32\drivers\CSCrySec.sys [85048] O58 - SDL:[MD5.A6EED705BB510FA6B0F9F097165A3395] - 14/12/2009 - 11:44:24 ---A- . (.Infowatch - Virtual Volume Container Driver (wnet).) -- C:\Windows\system32\drivers\CSVirtualDiskDrv.sys [66104] O58 - SDL:[MD5.FB9BEF3401EE5ECC2603311B9C64F44A] - 13/02/2011 - 04:49:37 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\system32\drivers\dtsoftbus01.sys [254528] O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\system32\drivers\elxstor.sys [530496] O58 - SDL:[MD5.DC5D737F51BE844D8C82C695EB17372F] - 10/06/2009 - 21:34:33 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\system32\drivers\evbda.sys [3286016] O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\system32\drivers\hcw85cir.sys [31232] O58 - SDL:[MD5.0886D440058F203EBA0E1825E4355914] - 14/07/2009 - 02:47:48 ---A- . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Driver.) -- C:\Windows\system32\drivers\HpSAMD.sys [77888] O58 - SDL:[MD5.D83EFB6FD45DF9D55E9A1AFC63640D50] - 14/07/2009 - 02:48:04 ---A- . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\system32\drivers\iaStorV.sys [410688] O58 - SDL:[MD5.5C18831C61933628F5BB0EA2675B9D21] - 14/07/2009 - 02:48:04 ---A- . (.Intel Corp./ICP vortex GmbH - Intel/ICP Raid Storport Driver.) -- C:\Windows\system32\drivers\iirsp.sys [44112] O58 - SDL:[MD5.8D7120743A0973CEAB548B475C9D4289] - 09/06/2010 - 17:43:56 ---A- . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) -- C:\Windows\system32\drivers\kl1.sys [460888] O58 - SDL:[MD5.CD146D8E525D6EEBDCAF24120A8AB9CE] - 09/06/2010 - 17:44:00 ---A- . (.Kaspersky Lab ZAO - Kaspersky Unified Driver.) -- C:\Windows\system32\drivers\kl2.sys [11864] O58 - SDL:[MD5.AC8EEDF4D19A9A346EAB696FCE3C36B3] - 13/02/2011 - 06:48:17 ---A- . (.Kaspersky Lab - Klif Mini-Filter [fre_wlh_AMD64].) -- C:\Windows\system32\drivers\klif.sys [563288] O58 - SDL:[MD5.2A64B3A9EED93A2E96537B67C079FC96] - 22/04/2010 - 19:07:36 ---A- . (.Kaspersky Lab ZAO - Kaspersky Lab Intermediate Network Driver.) -- C:\Windows\system32\drivers\klim6.sys [27736] O58 - SDL:[MD5.9468D07E91BA136D82415F5DFC1FE168] - 02/11/2009 - 20:27:10 ---A- . (.Kaspersky Lab - KLMOUFLT Mouse Device Filter [fre_wlh_AMD64].) -- C:\Windows\system32\drivers\klmouflt.sys [22544] O58 - SDL:[MD5.FA529FB35694C24BF98A9EF67C1CD9D0] - 23/11/2009 - 16:37:50 ---A- . (.Logitech Inc. - Logitech WingMan Virtual Bus Enumerator Driver.) -- C:\Windows\system32\drivers\LGBusEnum.sys [22408] O58 - SDL:[MD5.94B29CE153765E768F004FB3440BE2B0] - 23/11/2009 - 16:38:00 ---A- . (.Logitech Inc. - Logitech GamePanel Virtual Hid Device Driver.) -- C:\Windows\system32\drivers\LGVirHid.sys [16008] O58 - SDL:[MD5.B6552D382FF070B4ED34CBD6737277C0] - 17/06/2009 - 17:54:22 ---A- . (.Logitech, Inc. - Logitech HID Filter Driver..) -- C:\Windows\system32\drivers\LHidFilt.Sys [55312] O58 - SDL:[MD5.73C1F563AB73D459DFFE682D66476558] - 17/06/2009 - 17:54:30 ---A- . (.Logitech, Inc. - Logitech Mouse Filter Driver..) -- C:\Windows\system32\drivers\LMouFilt.Sys [57872] O58 - SDL:[MD5.1A93E54EB0ECE102495A51266DCDB6A6] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT FC Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_fc.sys [114752] O58 - SDL:[MD5.1047184A9FDC8BDBFF857175875EE810] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas.sys [106560] O58 - SDL:[MD5.30F5C0DE1EE8B5BC9306C1F0E4A75F93] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas2.sys [65600] O58 - SDL:[MD5.0504EACAFF0D3C8AED161C4B0D369D4A] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SCSI Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_scsi.sys [115776] O58 - SDL:[MD5.3D3C4B63F11F63F50253E734F0ACE9F2] - 20/12/2010 - 18:08:40 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\system32\drivers\mbam.sys [24152] O58 - SDL:[MD5.A55805F747C6EDB6A9080D7C633BD0F4] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows 7\Server 2008 R2 for.) -- C:\Windows\system32\drivers\megasas.sys [35392] O58 - SDL:[MD5.BAF74CE0072480C3B6B7C13B2A94D6B3] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\system32\drivers\MegaSR.sys [284736] O58 - SDL:[MD5.77889813BE4D166CDAB78DDBA990DA92] - 14/07/2009 - 02:48:26 ---A- . (.IBM Corporation - IBM ServeRAID Controller Driver.) -- C:\Windows\system32\drivers\nfrd960.sys [51264] O58 - SDL:[MD5.ED9380F201C8126425C09BED96DBE1E5] - 07/09/2010 - 21:08:55 ---A- . (.NVIDIA Corporation - NVIDIA HDMI Audio Driver.) -- C:\Windows\system32\drivers\nvhda64v.sys [155752] O58 - SDL:[MD5.BBE872A814B00798C2D568D46C42A71B] - 22/10/2010 - 07:23:15 ---A- . (.NVIDIA Corporation - NVIDIA Windows Kernel Mode Driver, Version 260.99.) -- C:\Windows\system32\drivers\nvlddmkm.sys [12432616] O58 - SDL:[MD5.3E38712941E9BB4DDBEE00AFFE3FED3D] - 14/07/2009 - 02:48:27 ---A- . (.NVIDIA Corporation - NVIDIA® nForce RAID Driver.) -- C:\Windows\system32\drivers\nvraid.sys [149056] O58 - SDL:[MD5.477DC4D6DEB99BE37084C9AC6D013DA1] - 14/07/2009 - 02:45:45 ---A- . (.NVIDIA Corporation - NVIDIA® nForce Sata Performance Driver.) -- C:\Windows\system32\drivers\nvstor.sys [167488] O58 - SDL:[MD5.A53A15A11EBFD21077463EE2C7AFEEF0] - 14/07/2009 - 02:45:46 ---A- . (.QLogic Corporation - QLogic Fibre Channel Stor Miniport Driver.) -- C:\Windows\system32\drivers\ql2300.sys [1524816] O58 - SDL:[MD5.4F6D12B51DE1AAEFF7DC58C4D75423C8] - 14/07/2009 - 02:45:45 ---A- . (.QLogic Corporation - QLogic iSCSI Storport Miniport Driver.) -- C:\Windows\system32\drivers\ql40xx.sys [128592] O58 - SDL:[MD5.0B21B66574E5478FA10CCA2D36694C2D] - 30/12/2010 - 11:59:18 ---A- . (.Realtek Semiconductor Corp. - Realtek® High Definition Audio Function Driver.) -- C:\Windows\system32\drivers\RTKVHD64.sys [2690280] O58 - SDL:[MD5.183C4139EC67E7506927DE5EAD28CAAE] - 06/10/2010 - 14:34:28 ---A- . (.Realtek Semiconductor Corporation - Realtek RTL81892SE NDIS Driverr.) -- C:\Windows\system32\drivers\rtl8192se.sys [1108000] O58 - SDL:[MD5.04C2D5BD8D0776320230978A0AEC3BD0] - 23/07/2009 - 21:03:10 ---A- . (.Realtek Semiconductor Corporation - Realtek 10/100 X64 Driver.) -- C:\Windows\system32\drivers\Rtnic64.sys [52736] O58 - SDL:[MD5.3EA8A16169C26AFBEB544E0E48421186] - 10/06/2009 - 21:37:19 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\Windows\system32\drivers\secdrv.sys [23040] O58 - SDL:[MD5.843CAF1E5FDE1FFD5FF768F23A51E2E1] - 14/07/2009 - 02:45:45 ---A- . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\system32\drivers\sisraid2.sys [43584] O58 - SDL:[MD5.6A6C106D42E9FFFF8B9FCB4F754F6DA4] - 14/07/2009 - 02:45:46 ---A- . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\system32\drivers\sisraid4.sys [80464] O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\system32\drivers\stexstor.sys [24656] O58 - SDL:[MD5.E5689D93FFE4E5D66C0178761240DD54] - 14/07/2009 - 02:45:55 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\viaide.sys [17488] O58 - SDL:[MD5.FB2643A01A538C2E4625CDE64E51680F] - 11/02/2010 - 11:00:22 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\videX64.sys [15000] O58 - SDL:[MD5.5E2016EA6EBACA03C04FEAC5F330D997] - 14/07/2009 - 02:45:55 ---A- . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\Windows\system32\drivers\vsmraid.sys [161872] O58 - SDL:[MD5.FE48AE43D06C1CF6EC1244FA3562D203] - 11/02/2010 - 11:01:20 ---A- . (.VIA Technologies, Inc. - ATA/ATAPI devices Hot-Plug/DIPM monitor.) -- C:\Windows\system32\drivers\xfiltx64.sys [26776] O58 - SDL:[MD5.D68E165C3123ABA3B1282EDDB4213BD8] - 20/12/2010 - 18:09:00 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\SysWOW64\drivers\mbamswissarmy.sys [38224] ---\\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 1.27 - (.Nicolas Coolman.) [HKLM][64Bits] -- ZHPDiag_is1 ---\\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.html> <ChromeHTML>[HKLM\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\Windows\regedit.exe O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCU\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] "%1" %* (.not file.) O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCR\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\Windows\regedit.exe ---\\ Start Menu Internet (O68) O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe ---\\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - Bing O69 - SBI: SearchScopes [HKCU] {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} [DefaultScope] - (DAEMON Search) - DAEMON-Search.com :: EXPLORE ---\\ Firewall Active Exception List (FirewallRules) (O87) O87 - FAEL: "FPS-SpoolSvc-In-TCP-NoScope" |In - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\spoolsv.exe (.not file.) O87 - FAEL: "FPS-SpoolSvc-In-TCP" |In - Public - P6 - FALSE | .(...) -- C:\Windows\system32\spoolsv.exe (.not file.) O87 - FAEL: "CoreNet-GP-LSASS-Out-TCP" |Out - Domain - P6 - TRUE | .(...) -- C:\Windows\system32\lsass.exe (.not file.) O87 - FAEL: "RemoteSvcAdmin-In-TCP-NoScope" |In - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\services.exe (.not file.) O87 - FAEL: "RemoteSvcAdmin-In-TCP" |In - Public - P6 - FALSE | .(...) -- C:\Windows\system32\services.exe (.not file.) O87 - FAEL: "NetPres-In-TCP-NoScope" |In - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.) O87 - FAEL: "NetPres-Out-TCP-NoScope" |Out - Domain - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.) O87 - FAEL: "NetPres-WSD-In-UDP" |In - None - P17 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.) O87 - FAEL: "NetPres-WSD-Out-UDP" |Out - None - P17 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.) O87 - FAEL: "NetPres-In-TCP" |In - Public - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.) O87 - FAEL: "NetPres-Out-TCP" |Out - Public - P6 - FALSE | .(...) -- C:\Windows\system32\netproj.exe (.not file.) O87 - FAEL: "MCX-Prov-Out-TCP" | Out - None - P6 - FALSE | .(.Microsoft Corporation - MCX2 Provisioning library.) -- C:\Windows\ehome\mcx2prov.exe O87 - FAEL: "MCX-McrMgr-Out-TCP" | Out - None - P6 - FALSE | .(.Microsoft Corporation - Media Center Extender Manager.) -- C:\Windows\ehome\mcrmgr.exe O87 - FAEL: "{8226F8FC-1EF9-45B8-A528-ED7463CE3DE7}" | In - None - P6 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe O87 - FAEL: "{80DD08FC-AB3E-402B-A344-6EE05AA49D05}" | In - None - P17 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe O87 - FAEL: "{816932D7-6388-4B9A-B5CE-A812F91E3B45}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{D65BEE89-49A0-484E-9A59-6E5A3C9DD37D}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{BB8B5F75-B581-4C65-AD88-CE1279CA6DDA}" | In - Domain - P17 - TRUE | .(.Skype Technologies - Skype Extras Manager.) -- C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe O87 - FAEL: "{B91E3B28-0137-4571-913C-178849AEE400}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{4864F99A-C150-48F2-92AA-BA880B8ACD59}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{419B3769-1057-4B54-B166-26E160056FF8}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{FB8A6CA6-55B0-4DFF-BD6A-6E5066339210}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{B13FA055-828A-44A7-A4E3-CA12F002FCEA}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{9571BD49-B29A-43B0-88A8-D2CE930104C8}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{7C889E97-7570-4112-ACDE-EE5BEC3E7466}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{887948E1-0EC8-4D37-BC80-90EE6AB1E71E}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{12552D8C-3B68-4E69-B041-0E4B2BCFBA20}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{CAF43C23-9FDE-4686-93BF-2D3E99E4EF9F}" | In - Domain - P6 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O87 - FAEL: "{55D0A426-256A-4FAF-A420-27838F58EA7F}" | In - Domain - P17 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O87 - FAEL: "{51A06FB7-74A8-44D0-9062-C7372BDD0D90}" | In - Private - P6 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O87 - FAEL: "{8124EB78-9C20-49E8-8AD7-9548B61916FC}" | In - Private - P17 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O87 - FAEL: "{7935A6D6-B921-414A-8876-73AA209DC65A}" | In - None - P17 - TRUE | .(.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O87 - FAEL: "{06498012-F5CE-4B32-83AE-4D70A9CF71B1}" | In - Public - P6 - TRUE | .(.Adobe Systems Inc. - Adobe AIR Debug Launcher.) -- C:\Riot Games\League of Legends\air\LolClient.exe O87 - FAEL: "{676ED253-51E2-44D4-8163-5EA3A05DE596}" | In - Public - P17 - TRUE | .(.Adobe Systems Inc. - Adobe AIR Debug Launcher.) -- C:\Riot Games\League of Legends\air\LolClient.exe O87 - FAEL: "{0782F6F4-D750-40C6-AAB3-ED27AC358398}" | In - Public - P6 - TRUE | .(.Pas de propriétaire - League of Legends Client.) -- C:\Riot Games\League of Legends\game\League of Legends.exe O87 - FAEL: "{125EED06-EF83-4F4C-B33B-901A7AA6C7C3}" | In - Public - P17 - TRUE | .(.Pas de propriétaire - League of Legends Client.) -- C:\Riot Games\League of Legends\game\League of Legends.exe O87 - FAEL: "{018C3AF2-9AD4-4A17-A5DC-D563CD98CA66}" | In - Public - P6 - TRUE | .(.Valve Corporation - Steam.) -- C:\Program Files (x86)\Steam\Steam.exe O87 - FAEL: "{E3C67465-44C7-4944-B2D1-F6BEED19AFFF}" | In - Public - P17 - TRUE | .(.Valve Corporation - Steam.) -- C:\Program Files (x86)\Steam\Steam.exe O87 - FAEL: "{705E3883-0961-430F-A57B-78449F23F0FE}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{3E55B250-BD09-4471-89A5-AE3B42E445A6}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{205FE13D-4BAC-4BBF-A8C8-F1F31796768F}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{CCA7BE9A-2EC4-4799-BB78-1872B7F4927D}" | In - Public - P6 - TRUE | .(.Io Interactive A/S - Kane & Lynch 2: Dog Days.) -- C:\Program Files (x86)\Steam\SteamApps\common\kane & lynch 2 - dog days demo\kl2.exe O87 - FAEL: "{989FCCC8-D09E-42D9-8569-834857C195FC}" | In - Public - P17 - TRUE | .(.Io Interactive A/S - Kane & Lynch 2: Dog Days.) -- C:\Program Files (x86)\Steam\SteamApps\common\kane & lynch 2 - dog days demo\kl2.exe O87 - FAEL: "{4FF8B30C-EE6A-48D1-B20E-1A130CA16B26}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{B824D521-FA78-4A8A-8212-E9F7F72D9A85}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{6BE36013-A091-43D5-98D3-A6B7B90333A1}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{E68B9DBE-03E3-4731-89CB-F1152854A808}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{443CA10C-F050-48AD-AAC9-1157FFA1CEE4}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{B615AAE5-9D3C-43AD-AADD-9160F01BEB83}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{F00E58C9-4413-4677-84B1-97C0A9DD28CD}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{8BFB8740-9288-49DE-9184-06A0C9E21062}" | In - None - P17 - TRUE | .(.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O87 - FAEL: "{C4B7101A-38F5-4192-AA70-CFB540C77CC2}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\ma-config.com\x64\maconfservice.exe (.not file.) O87 - FAEL: "{AC8680A1-26D7-47DD-A584-81FC574C348A}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\ma-config.com\x64\maconfservice.exe (.not file.) O87 - FAEL: "{DA6A5838-8D11-40CA-962C-A10E10F14370}" | In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\alshimiste\counter-strike source\hl2.exe O87 - FAEL: "{02AA838A-0E59-45DE-BFA4-D2BA187A91C3}" | In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\alshimiste\counter-strike source\hl2.exe O87 - FAEL: "{24A24142-5057-4246-B029-BDBAFEC07079}" | In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe O87 - FAEL: "{D9EA94CE-6204-45C4-AA51-7B59661E18AA}" | In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Steam\SteamApps\common\left 4 dead 2\left4dead2.exe ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Auto 18/11/2010 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 20/07/2009 160784 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe SR - | Auto 20/07/2009 0 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe SS - | Auto 20/07/2009 0 | (sdmBackupIP) . (.Pas de propriétaire.) - C:\Windows\BackupIP\service.exe SS - | Demand 12/02/2011 407336 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe SR - | Auto 16/10/2010 369256 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe SR - | Auto 14/07/2009 20992 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\system32\svchost.exe ---\\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.1 by Gmer, GMER - Rootkit Detector and Remover Run by kolchok at 13/02/2011 07:58:16 device: opened successfully user: error reading MBR Disk trace: error: Read Descripteur non valide kernel: error reading MBR ---\\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by kolchok at 13/02/2011 07:58:16 Use the desktop link 'MBRCheck' to have full report ---\\ Liste des émulateurs de CD/DVD (Hook du MBR) O42 - Logiciel: DAEMON Tools Lite - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Lite O42 - Logiciel: DAEMON Tools Toolbar - (.DT Soft Ltd.) [HKLM][64Bits] -- DAEMON Tools Toolbar End of the scan (779 lines in 01mn 06s)(0)

Et bien merci pour tous, j'ai fait tous ce que vous m'avez conseillez sauf pour PC Pitstop, simplement par ce que je ne comprend strictement rien a l'anglais. je vous remercie encore une fois de plus (vous le méritez bien)d'avoir passé du temps sur mon problème. Amicalement, kolchok.

Alors après deux jours, plus aucun problème. plus de page internet qui flood mon écran. un vrai plaisir. merci beaucoup de m'avoir réglé ce problème. Juste trois petites questions : d'où venais le problème? Comment éviter que cela recommence ? Quelle navigateur internet utilisé pour plus de sécurité, sachant que j'utilise pour le moment google chrome ? encore merci de m'avoir apporté ton aide. kolchok

j'ai suivi exactement ce que vous m'avez indiqué, j'ai donc refait la même chose voici le rapport All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\installer deleted successfully. File C:\Program Files (x86)\Installer\lnetworker.exe not found. Unable to delete ADS C:\ProgramData\TEMP:5C321E34 . Unable to delete ADS C:\ProgramData\TEMP:0B4227B4 . ========== FILES ========== File\Folder C:\ProgramData\Alwil Software not found. File\Folder C:\Program Files\Alwil Software not found. File\Folder C:\Users\kolchok\AppData\Local\networker not found. File\Folder C:\Users\kolchok\AppData\Local\assembly not found. File\Folder C:\Program Files\Installer not found. File\Folder C:\Program Files (x86)\Installer not found. File\Folder C:\Windows\BackupIP not found. File\Folder C:\Windows\SysWow64\Ionic.Zip.Reduced.dll not found. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: kolchok ->Temp folder emptied: 21993 bytes ->Temporary Internet Files folder emptied: 104055 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 10292538 bytes ->Flash cache emptied: 343 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 52432 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 10,00 mb [EMPTYFLASH] User: All Users User: Default User: Default User User: kolchok ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0,00 mb C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.17.3 log created on 12142010_103609 Files\Folders moved on Reboot... C:\Users\kolchok\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot...

Alors, comme un imbécile j'ai oublié de fermé kaspersky. j'ai donc retiré mon câble ethernet et fermé le logiciel. voici le bon rapport. NB: C:\Users\kolchok\AppData\Local\networker C:\Users\kolchok\AppData\Local\assembly C:\Program Files\Installer C:\Program Files (x86)\Installer C:\Windows\BackupIP C:\Windows\SysWow64\Ionic.Zip.Reduced.dll ont été effacé la première fois. All processes killed ========== OTL ========== Unable to delete ADS C:\ProgramData\TEMP:5C321E34 . Unable to delete ADS C:\ProgramData\TEMP:0B4227B4 . ========== FILES ========== File\Folder C:\ProgramData\Alwil Software not found. File\Folder C:\Program Files\Alwil Software not found. File\Folder C:\Users\kolchok\AppData\Local\networker not found. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\e019e7d6\de4dbbe4_5e92cb01 scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\e019e7d6 scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\cddf1342\00a2baa1_c58ccb01 scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\cddf1342 scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly\dl3 scheduled to be moved on reboot. Folder move failed. C:\Users\kolchok\AppData\Local\assembly scheduled to be moved on reboot. File\Folder C:\Program Files\Installer not found. File\Folder C:\Program Files (x86)\Installer not found. Folder move failed. C:\Windows\BackupIP scheduled to be moved on reboot. File\Folder C:\Windows\SysWow64\Ionic.Zip.Reduced.dll not found. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: kolchok ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 573574 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 18105 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,00 mb [EMPTYFLASH] User: All Users User: Default User: Default User User: kolchok ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0,00 mb C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.17.3 log created on 12142010_084055 Files\Folders moved on Reboot... File\Folder C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\e019e7d6\de4dbbe4_5e92cb01 not found! C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\e019e7d6 folder moved successfully. File\Folder C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\cddf1342\00a2baa1_c58ccb01 not found! C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO\cddf1342 folder moved successfully. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C\3HWK4NV5.3YO folder moved successfully. C:\Users\kolchok\AppData\Local\assembly\dl3\TTAPR1NJ.P4C folder moved successfully. C:\Users\kolchok\AppData\Local\assembly\dl3 folder moved successfully. C:\Users\kolchok\AppData\Local\assembly folder moved successfully. File\Folder C:\Windows\BackupIP not found! File\Folder C:\Users\kolchok\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found! File\Folder C:\Windows\temp\kls51F2.tmp not found! File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot. Registry entries deleted on Reboot...

et bien, à mon grand regret le problème persiste.

bonjour j'ai fait les modification que vous m'avez conseillé, et voici le rapport demandé. Error: Unable to interpret < [RESETHOSTS]> in the current context! Error: Unable to interpret < [REBOOT]> in the current context! OTL by OldTimer - Version 3.2.17.3 log created on 12142010_032009 voila, je vous tiens au courant si le problème est résolu.

sinon pour ce que j'ai viré, bas c'était la vérif de maj de google chrome. mais ça na rien changé. je pensais que la description était fausse mais le problème persiste.