rapport HijackThis pb svchost 100%

[Thanos]

salut,

 

Ok ca marche! Poste aussi un rappport DiagHelp avec l'option 2 pour en voir plus sur les processus.

 

@+

[nybenit]

salut

 

voici déjà le rapport panda qui n'a pas l'air fameux ...

 

 

Incident Statut Analyse

 

Spyware:spyware/virtumonde No Désinfecté Registre Windows

Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.doubleclick.net/]

Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.bluestreak.com/]

Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.weborama.fr/]

Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.xiti.com/]

Spyware:Cookie/WebtrendsLive No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[statse.webtrendslive.com/]

Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.adtech.de/]

Spyware:Cookie/Advertising No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.advertising.com/]

Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.serving-sys.com/]

Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.bs.serving-sys.com/]

Spyware:Cookie/Serving-sys No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-1.txt[.serving-sys.com/]

Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.2o7.net/]

Spyware:Cookie/Bluestreak No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.bluestreak.com/]

Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.2o7.net/]

Spyware:Cookie/Doubleclick No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.doubleclick.net/]

Spyware:Cookie/Overture No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.overture.com/]

Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.xiti.com/]

Spyware:Cookie/Smartadserver No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.smartadserver.com/]

Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.adtech.de/]

Spyware:Cookie/Server.iad.Liveperson No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[server.iad.liveperson.net/hc/65768308]

Spyware:Cookie/Server.iad.Liveperson No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[server.iad.liveperson.net/]

Spyware:Cookie/Server.iad.Liveperson No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[server.iad.liveperson.net/hc/65768308]

Spyware:Cookie/Hitbox No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.hitbox.com/]

Spyware:Cookie/Comclick No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[fl01.ct2.comclick.com/]

Spyware:Cookie/Tradedoubler No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.tradedoubler.com/]

Spyware:Cookie/2o7 No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.112.2o7.net/]

Spyware:Cookie/Atlas DMT No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.atdmt.com/]

Spyware:Cookie/Weborama No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.weborama.fr/]

Spyware:Cookie/RealMedia No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.247realmedia.com/]

Spyware:Cookie/Mediaplex No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.mediaplex.com/]

Spyware:Cookie/FastClick No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.fastclick.net/]

Spyware:Cookie/QuestionMarket No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-2.txt[.questionmarket.com/]

Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-3.txt[.xiti.com/]

Spyware:Cookie/Adtech No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-3.txt[.adtech.de/]

Spyware:Cookie/Traffic Marketplace No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Application Data\Mozilla\Firefox\Profiles\txsoo23h.default\cookies-3.txt[.trafficmp.com/]

Spyware:Cookie/Atwola No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Cookies\mélanie et benoît@atwola[1].txt

Spyware:Cookie/Com.com No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Cookies\mélanie et benoît@com[2].txt

Spyware:Cookie/Belnk No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Cookies\mélanie et benoî[email protected][2].txt

Spyware:Cookie/fe.lea.lycos No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Cookies\mélanie et benoî[email protected][1].txt

Spyware:Cookie/Xiti No Désinfecté C:\Documents and Settings\Mélanie et Benoît\Cookies\mélanie et benoît@xiti[1].txt

Spyware:Cookie/Reliablestats No Désinfecté C:\Documents and Settings\SARL PATIMAT\Cookies\sarl [email protected][1].txt

Spyware:Cookie/WinFixer No Désinfecté C:\Documents and Settings\SARL PATIMAT\Cookies\sarl patimat@winfixer[2].txt

Spyware:Spyware/Virtumonde No Désinfecté C:\VundoFix Backups\avdoc.dll.bad

[nybenit]

et le rapport DiagHelp option 2 :

 

FPort v2.0 - TCP/IP Process to Port Mapper

Copyright 2000 by Foundstone, Inc.

http://www.foundstone.com

 

Pid Process Port Proto Path

1000 -> 135 TCP

3620 LastFM -> 32213 TCP C:\Program Files\Last.fm\LastFM.exe

3620 LastFM -> 33367 TCP C:\Program Files\Last.fm\LastFM.exe

4 System -> 139 TCP

0 System -> 2246 TCP

0 System -> 2254 TCP

4 System -> 445 TCP

496 avgnt -> 1027 TCP C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

1584 avguard -> 18350 TCP C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

3116 firefox -> 2012 TCP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 2013 TCP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 2014 TCP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 2015 TCP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 2177 TCP C:\Program Files\Mozilla Firefox\firefox.exe

704 iexplore -> 2161 TCP C:\Program Files\Internet Explorer\iexplore.exe

704 iexplore -> 2162 TCP C:\Program Files\Internet Explorer\iexplore.exe

704 iexplore -> 2163 TCP C:\Program Files\Internet Explorer\iexplore.exe

704 iexplore -> 2164 TCP C:\Program Files\Internet Explorer\iexplore.exe

 

1000 -> 445 UDP

3620 LastFM -> 1097 UDP C:\Program Files\Last.fm\LastFM.exe

3620 LastFM -> 4500 UDP C:\Program Files\Last.fm\LastFM.exe

4 System -> 123 UDP

4 System -> 500 UDP

496 avgnt -> 1098 UDP C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

1584 avguard -> 1026 UDP C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

1584 avguard -> 1843 UDP C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

3116 firefox -> 1100 UDP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 1306 UDP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 1841 UDP C:\Program Files\Mozilla Firefox\firefox.exe

3116 firefox -> 1842 UDP C:\Program Files\Mozilla Firefox\firefox.exe

704 iexplore -> 1045 UDP C:\Program Files\Internet Explorer\iexplore.exe

704 iexplore -> 123 UDP C:\Program Files\Internet Explorer\iexplore.exe

704 iexplore -> 137 UDP C:\Program Files\Internet Explorer\iexplore.exe

704 iexplore -> 138 UDP C:\Program Files\Internet Explorer\iexplore.exe

 

 

 

PsList 1.26 - Process Information Lister

Copyright © 1999-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

 

Process information for PATIMAT:

 

Name Pid Pri Thd Hnd VM WS Priv

Idle 0 0 1 0 0 28 0

System 4 8 52 325 880 232 0

smss 656 11 3 21 3828 392 168

csrss 720 13 13 480 26092 4392 1756

winlogon 744 13 16 419 52876 4236 6580

services 788 9 16 288 37344 4352 2072

alg 632 8 5 90 32712 3584 1144

svchost 944 8 19 215 62068 5132 3208

svchost 1000 8 10 267 35136 4204 1796

svchost 1084 8 6 92 30048 3400 1356

svchost 1172 8 6 111 32980 3556 1332

svchost 1456 8 53 1026 117180 21800 11144

spoolsv 1472 8 10 127 45704 5088 3316

sched 1572 8 7 85 33136 1864 1752

avguard 1584 8 23 109 73112 316 44480

sqlservr 1644 8 20 287 607040 25012 29404

nvsvc32 1712 8 3 49 19376 1964 544

SMAgent 1784 8 2 27 22344 1724 524

svchost 1816 8 6 138 36388 4224 2456

wdfmgr 1852 8 4 64 14836 1740 1520

lsass 800 9 18 433 43872 1124 4144

taskmgr 1332 13 3 72 32264 1536 1368

ApntEx 468 8 2 30 14728 1436 352

explorer 548 8 15 568 94284 22804 17760

avgnt 496 8 2 93 46180 296 1732

PicasaMediaDetector 608 8 3 88 35216 3320 1044

IEXPLORE 704 8 19 794 229044 10552 33600

ctfmon 712 8 1 63 29516 2864 852

eabservr 988 8 4 116 35884 4060 2172

winampa 1112 8 1 21 24108 1756 528

Agent 1344 8 3 103 38356 4372 1316

AGRSMMSG 1708 8 2 35 27044 2064 692

cmd 1960 8 1 20 13892 1616 1500

pslist 2648 13 2 91 17788 1800 804

Apoint 2032 8 1 66 32336 4376 1488

firefox 3116 8 16 258 161288 60828 51624

mmc 3988 8 2 215 79648 1420 4568

LastFM 3620 8 7 236 55180 13096 6708

 

ListDLLs v2.25 - DLL lister for Win9x/NT

Copyright © 1997-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

 

------------------------------------------------------------------------------

explorer.exe pid: 548

Command line: C:\WINDOWS\Explorer.EXE

 

Base Size Version Path

0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll

0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll

0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll

0x77f40000 0x76000 6.00.2900.3059 C:\WINDOWS\system32\SHLWAPI.dll

0x7c9d0000 0x823000 6.00.2900.3051 C:\WINDOWS\system32\SHELL32.dll

0x774a0000 0x13d000 5.01.2600.2726 C:\WINDOWS\system32\ole32.dll

0x75f10000 0xfd000 6.00.2900.3059 C:\WINDOWS\system32\BROWSEUI.dll

0x7e210000 0x16f000 6.00.2900.3059 C:\WINDOWS\system32\SHDOCVW.dll

0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll

0x77aa0000 0xa7000 6.00.2900.3059 C:\WINDOWS\system32\WININET.dll

0x77390000 0x103000 6.00.2900.2982 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll

0x6bd00000 0xd000 0.01.0002.0003 C:\WINDOWS\system32\SYNCOR11.DLL

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

0x4c5a0000 0x18000 9.00.0000.3250 C:\PROGRA~1\WINDOW~1\wmpband.dll

0x76920000 0x8000 5.01.2600.2751 C:\WINDOWS\system32\LINKINFO.dll

0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL

0x7df30000 0xa0000 6.00.2900.3072 C:\WINDOWS\system32\urlmon.dll

0x0ffd0000 0x28000 5.01.2600.2161 C:\WINDOWS\system32\rsaenh.dll

0x01490000 0x2c6000 3.01.4000.2435 C:\WINDOWS\system32\msi.dll

0x76d10000 0x19000 5.01.2600.2912 C:\WINDOWS\system32\iphlpapi.dll

0x77210000 0xb1000 5.01.2600.3019 C:\WINDOWS\system32\SXS.DLL

0x10000000 0xe000 7.00.0005.0172 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

0x7c360000 0x56000 7.10.6014.0004 C:\WINDOWS\system32\MSVCR71.dll

0x012a0000 0x13000 7.00.0000.0004 C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll

0x7c250000 0x102000 7.10.3077.0000 C:\Program Files\AntiVir PersonalEdition Classic\MFC71U.DLL

0x02e40000 0x7b000 7.10.3077.0000 C:\Program Files\AntiVir PersonalEdition Classic\MSVCP71.dll

0x5d360000 0xf000 7.10.3077.0000 C:\WINDOWS\system32\MFC71FRA.DLL

0x013d0000 0x1c000 7.00.0000.0000 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\System32\MSVCP60.dll

0x76ed0000 0x27000 5.01.2600.2938 C:\WINDOWS\system32\DNSAPI.dll

0x72c60000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\msacm32.drv

0x325c0000 0x12000 11.00.5510.0000 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

0x41f00000 0x7000 1.01.0000.3917 C:\WINDOWS\system32\asfsipc.dll

0x60980000 0x7000 3.01.4000.1823 C:\WINDOWS\system32\MSISIP.DLL

0x74e10000 0x10000 5.06.0000.8820 C:\WINDOWS\system32\wshext.dll

0x73d20000 0xfe000 6.02.4131.0000 C:\WINDOWS\system32\MFC42.DLL

0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL

0x59000000 0xe000 5.06.0000.6626 C:\WINDOWS\system32\wshFR.DLL

0x36d30000 0x19000 11.00.5510.0000 C:\PROGRA~1\MICROS~3\OFFICE11\MCPS.DLL

 

ListDLLs v2.25 - DLL lister for Win9x/NT

Copyright © 1997-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

 

------------------------------------------------------------------------------

IEXPLORE.EXE pid: 704

Command line: "C:\Program Files\Internet Explorer\iexplore.exe"

 

Base Size Version Path

0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll

0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll

0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll

0x77f40000 0x76000 6.00.2900.3059 C:\WINDOWS\system32\SHLWAPI.dll

0x7e210000 0x16f000 6.00.2900.3059 C:\WINDOWS\system32\SHDOCVW.dll

0x774a0000 0x13d000 5.01.2600.2726 C:\WINDOWS\system32\ole32.dll

0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll

0x77aa0000 0xa7000 6.00.2900.3059 C:\WINDOWS\system32\WININET.dll

0x77390000 0x103000 6.00.2900.2982 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

0x7c9d0000 0x823000 6.00.2900.3051 C:\WINDOWS\system32\SHELL32.dll

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll

0x75f10000 0xfd000 6.00.2900.3059 C:\WINDOWS\system32\BROWSEUI.dll

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

0x7df30000 0xa0000 6.00.2900.3072 C:\WINDOWS\system32\urlmon.dll

0x10000000 0xe000 7.00.0005.0172 C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

0x7c360000 0x56000 7.10.6014.0004 C:\WINDOWS\system32\MSVCR71.dll

0x6d7c0000 0x79000 6.00.0010.0006 C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

0x77210000 0xb1000 5.01.2600.3019 C:\WINDOWS\system32\SXS.DLL

0x6bd00000 0xd000 0.01.0002.0003 C:\WINDOWS\system32\SYNCOR11.DLL

0x76d10000 0x19000 5.01.2600.2912 C:\WINDOWS\system32\iphlpapi.dll

0x76ed0000 0x27000 5.01.2600.2938 C:\WINDOWS\system32\DNSAPI.dll

0x76f70000 0x6000 5.01.2600.2938 C:\WINDOWS\system32\rasadhlp.dll

0x7dbf0000 0x2f5000 6.00.2900.3059 C:\WINDOWS\system32\mshtml.dll

0x74630000 0x27000 3.10.0349.0000 C:\WINDOWS\system32\msls31.dll

0x325c0000 0x12000 11.00.5510.0000 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

0x75be0000 0x6e000 5.06.0000.8831 c:\windows\system32\jscript.dll

0x672b0000 0x40000 6.00.2900.3059 C:\WINDOWS\system32\iepeers.dll

0x748f0000 0x10e000 8.70.1113.0000 C:\WINDOWS\system32\msxml3.dll

0x761c0000 0x71000 6.00.2900.3059 C:\WINDOWS\system32\mshtmled.dll

0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll

0x037d0000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll

0x30000000 0x2de000 9.00.0016.0000 C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx

0x04e80000 0xb000 11.00.5510.0000 C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

0x767c0000 0x15000 5.02.3790.2748 C:\WINDOWS\system32\HLINK.DLL

0x0ffd0000 0x28000 5.01.2600.2161 C:\WINDOWS\system32\rsaenh.dll

0x06230000 0x23000 58.06.0000.0000 C:\WINDOWS\Downloaded Program Files\asinst.dll

0x06260000 0x1f000 5.01.2600.3059 C:\WINDOWS\system32\xpsp3res.dll

0x3d0d0000 0x59000 10.04.0001.0008 C:\WINDOWS\system32\ACTIVE~1\Psscan.dll

0x24040000 0x13000 1.04.0001.0013 C:\WINDOWS\system32\ACTIVE~1\PSKUTIL.dll

0x24020000 0x7000 1.04.0001.0003 C:\WINDOWS\system32\ACTIVE~1\PSKVFILE.dll

0x24000000 0x7000 1.04.0001.0007 C:\WINDOWS\system32\ACTIVE~1\PSKALLOC.dll

0x250a0000 0x14000 1.04.0001.0012 C:\WINDOWS\system32\ACTIVE~1\pskvfs.dll

0x24200000 0x67000 1.04.0001.0040 C:\WINDOWS\system32\ACTIVE~1\PSKCMP.dll

0x24060000 0xc000 1.04.0001.0003 C:\WINDOWS\system32\ACTIVE~1\PSKPACK.DLL

0x25180000 0x2d000 1.04.0001.0008 C:\WINDOWS\system32\ACTIVE~1\pskvm.dll

0x24100000 0x34000 1.04.0001.0004 C:\WINDOWS\system32\ACTIVE~1\PSKHTML.dll

0x03a20000 0x43000 1.04.0001.0006 C:\WINDOWS\system32\ACTIVE~1\pskscs.dll

0x250e0000 0x17000 1.04.0001.0010 C:\WINDOWS\system32\ACTIVE~1\pskfss.dll

0x05920000 0xc000 2.00.0000.0028 C:\WINDOWS\system32\ACTIVE~1\Rawvfile.dll

0x06570000 0x8000 1.04.0002.0114 C:\WINDOWS\system32\ACTIVE~1\pskahk.dll

0x72fd0000 0x1c000 5.01.2600.0000 C:\WINDOWS\system32\rsvpsp.dll

0x65200000 0x29000 3.03.0004.0000 C:\WINDOWS\system32\ACTIVE~1\PAvExCom.dll

0x621f0000 0x1f000 1.00.2536.0000 C:\WINDOWS\system32\MAPI32.dll

0x35f70000 0x14d000 11.00.5601.0000 C:\Program Files\Fichiers communs\SYSTEM\MSMAPI\1036\MSMAPI32.DLL

0x30c90000 0xba7000 11.00.5606.0000 C:\Program Files\Fichiers communs\Microsoft Shared\office11\mso.dll

0x73250000 0x67000 5.06.0000.8820 c:\windows\system32\vbscript.dll

0x73d20000 0xfe000 6.02.4131.0000 c:\windows\system32\MFC42.DLL

0x61d70000 0xe000 6.00.8665.0000 C:\WINDOWS\system32\MFC42LOC.DLL

0x05850000 0x1c000 2.89.0000.0000 C:\WINDOWS\system32\ACTIVE~1\as.dll

0x05870000 0x3b000 1.25.0000.0000 C:\WINDOWS\system32\ActiveScan\ascontrol.dll

0x35e80000 0xd0000 11.00.5510.0000 C:\Program Files\Fichiers communs\SYSTEM\MSMAPI\1036\MAPIR.DLL

0x35440000 0x1e000 11.00.5510.0000 C:\Program Files\Fichiers communs\SYSTEM\MSMAPI\1036\contab32.dll

0x35cb0000 0xae000 11.00.5604.0000 C:\Program Files\Fichiers communs\SYSTEM\MSMAPI\1036\mspst32.dll

0x35510000 0x60000 11.00.5515.0000 C:\Program Files\Microsoft Office\OFFICE11\RTFHTML.DLL

0x029b0000 0x12000 3.00.0001.0000 C:\WINDOWS\system32\ACTIVE~1\TCPVfile.dll

0x72c60000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\msacm32.drv

0x76ac0000 0x11000 3.05.2284.0000 C:\WINDOWS\system32\ATL.DLL

0x76920000 0x8000 5.01.2600.2751 C:\WINDOWS\system32\LINKINFO.dll

 

ListDLLs v2.25 - DLL lister for Win9x/NT

Copyright © 1997-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

 

------------------------------------------------------------------------------

winlogon.exe pid: 744

Command line: winlogon.exe

 

Base Size Version Path

0x01000000 0x81000 \??\C:\WINDOWS\system32\winlogon.exe

0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll

0x77680000 0x11000 5.01.2600.2622 C:\WINDOWS\system32\AUTHZ.dll

0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll

0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll

0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll

0x7c9d0000 0x823000 6.00.2900.3051 C:\WINDOWS\system32\SHELL32.dll

0x77f40000 0x76000 6.00.2900.3059 C:\WINDOWS\system32\SHLWAPI.dll

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\COMCTL32.dll

0x74730000 0x3d000 3.525.1117.0000 C:\WINDOWS\system32\ODBC32.dll

0x77390000 0x103000 6.00.2900.2982 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

0x20000000 0x18000 3.525.1117.0000 C:\WINDOWS\system32\odbcint.dll

0x776a0000 0x24000 6.00.2900.3051 C:\WINDOWS\system32\SHSVCS.dll

0x774a0000 0x13d000 5.01.2600.2726 C:\WINDOWS\system32\ole32.dll

0x77210000 0xb1000 5.01.2600.3019 C:\WINDOWS\system32\sxs.dll

0x6bd00000 0xd000 0.01.0002.0003 C:\WINDOWS\system32\SYNCOR11.DLL

0x0ffd0000 0x28000 5.01.2600.2161 C:\WINDOWS\system32\rsaenh.dll

0x011d0000 0x3b000 1.07.0018.0005 C:\WINDOWS\system32\WgaLogon.dll

0x76f80000 0x7f000 2001.12.4414.0308 C:\WINDOWS\system32\CLBCATQ.DLL

0x77000000 0xd4000 2001.12.4414.0258 C:\WINDOWS\system32\COMRes.dll

0x76d10000 0x19000 5.01.2600.2912 C:\WINDOWS\system32\iphlpapi.dll

0x72c60000 0x8000 5.01.2600.0000 C:\WINDOWS\system32\msacm32.drv

0x10000000 0x8a000 1.09.0000.0305 C:\WINDOWS\system32\l3codeca.acm

 

ListDLLs v2.25 - DLL lister for Win9x/NT

Copyright © 1997-2004 Mark Russinovich

Sysinternals - www.sysinternals.com

 

------------------------------------------------------------------------------

services.exe pid: 788

Command line: C:\WINDOWS\system32\services.exe

 

Base Size Version Path

0x7c800000 0x104000 5.01.2600.2945 C:\WINDOWS\system32\kernel32.dll

0x7e390000 0x90000 5.01.2600.3099 C:\WINDOWS\system32\USER32.dll

0x77ef0000 0x47000 5.01.2600.3099 C:\WINDOWS\system32\GDI32.dll

0x77680000 0x11000 5.01.2600.2622 C:\WINDOWS\system32\AUTHZ.dll

0x7dbc0000 0x21000 5.01.2600.2744 C:\WINDOWS\system32\umpnpmgr.dll

0x6fee0000 0x54000 5.01.2600.2976 C:\WINDOWS\system32\NETAPI32.dll

0x76010000 0x65000 6.02.3104.0000 C:\WINDOWS\system32\MSVCP60.dll

0x774a0000 0x13d000 5.01.2600.2726 C:\WINDOWS\system32\ole32.dll

0x7c9d0000 0x823000 6.00.2900.3051 C:\WINDOWS\system32\SHELL32.dll

0x77f40000 0x76000 6.00.2900.3059 C:\WINDOWS\system32\SHLWAPI.dll

0x6bd00000 0xd000 0.01.0002.0003 C:\WINDOWS\system32\SYNCOR11.DLL

0x77390000 0x103000 6.00.2900.2982 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

0x58b50000 0x9a000 5.82.2900.2982 C:\WINDOWS\system32\comctl32.dll

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 0F54-00FA

 

Répertoire de C:\Program Files

 

20/04/2007 01:05 <REP> .

20/04/2007 01:05 <REP> ..

16/03/2006 22:56 <REP> Adobe

07/10/2004 04:22 <REP> AMD

07/10/2004 03:49 <REP> Analog Devices

20/04/2007 01:25 <REP> AntiVir PersonalEdition Classic

20/04/2007 01:25 <REP> Apoint2K

03/02/2007 15:09 <REP> BankPerfect

02/02/2007 13:41 <REP> Citrix

07/10/2004 11:40 <REP> ComPlus Applications

21/05/2005 20:35 <REP> ConTEXT

27/03/2005 15:25 <REP> Creative

11/06/2005 20:19 <REP> Digital Photo Navigator 1.0

12/01/2005 18:42 <REP> directx

15/06/2005 21:18 <REP> DivXCodec

13/12/2006 10:03 <REP> Easy CD-DA Extractor 10

01/02/2005 22:56 <REP> Easy Internet signup

21/05/2005 20:19 <REP> EasyPHP1-8

21/05/2005 20:49 <REP> eclipse-SDK-3.0.2-win32

21/05/2005 20:35 89 589 990 eclipse-SDK-3.0.2-win32.zip

01/03/2007 23:46 <REP> Everest Poker

03/02/2007 12:42 <REP> Eye On Network

14/04/2007 19:36 <REP> Fichiers communs

14/04/2007 19:38 <REP> FileZilla

26/07/2006 22:09 <REP> Freeplayer

27/01/2007 11:10 <REP> Google

09/04/2005 14:13 <REP> Griffin Technology

21/12/2006 02:09 <REP> Hamachi

28/07/2006 00:26 <REP> Hewlett-Packard

25/11/2006 21:29 <REP> HP

01/01/2005 04:06 <REP> HPQ

03/10/2006 23:47 <REP> Illustrate

29/11/2005 23:54 <REP> Install

22/01/2006 17:33 <REP> InterActual

20/04/2007 01:33 <REP> Internet Explorer

01/01/2005 04:17 <REP> InterVideo

07/10/2004 05:03 <REP> iPod

09/12/2006 02:15 <REP> iTunes

14/04/2007 11:36 <REP> Java

14/04/2007 19:34 <REP> Juice

20/04/2007 01:34 <REP> Last.fm

08/11/2006 00:01 <REP> Lavasoft

13/12/2006 00:38 <REP> LitexMedia

26/08/2006 12:06 <REP> MaxiCompte

23/02/2005 01:08 <REP> Messenger

14/04/2007 19:37 <REP> Microsoft ActiveSync

07/10/2004 11:40 <REP> microsoft frontpage

12/01/2005 19:00 <REP> Microsoft Office

05/10/2006 01:46 <REP> Microsoft SQL Server

05/10/2006 01:36 <REP> Microsoft Visual Studio 8

28/07/2006 00:24 <REP> Microsoft Works

05/10/2006 01:42 <REP> Microsoft.NET

07/10/2004 11:40 <REP> Movie Maker

20/04/2007 00:35 <REP> Mozilla Firefox

03/02/2007 12:43 <REP> Mozilla Thunderbird

14/04/2007 19:36 <REP> MSN

07/10/2004 11:40 <REP> MSN Gaming Zone

23/11/2006 10:47 <REP> MSXML 4.0

16/12/2006 11:12 <REP> Musicmatch

07/10/2004 11:40 <REP> NetMeeting

07/10/2004 11:40 <REP> Online Services

25/05/2006 18:39 <REP> Outlook Express

23/04/2005 16:24 <REP> Oxford Softworks

04/09/2006 22:57 <REP> Passware

20/04/2007 01:37 <REP> Picasa2

12/01/2005 18:30 <REP> PIXELA

04/10/2006 22:57 <REP> PowerQuest

16/10/2006 00:00 <REP> QuickTime

19/11/2005 15:16 <REP> Rapid CSS 2005

29/11/2005 23:55 <REP> Real

31/05/2005 21:29 <REP> RealVNC

07/10/2004 04:51 <REP> Services en ligne

21/02/2005 22:54 <REP> Softwin

29/11/2005 21:58 <REP> Sony

29/11/2005 20:52 <REP> Sony Setup

28/07/2006 00:30 <REP> Sports Interactive

14/04/2007 23:08 <REP> Spybot - Search & Destroy

21/02/2005 23:13 <REP> Symantec

05/08/2006 03:34 <REP> TightVNC

27/01/2007 00:11 <REP> TypingQueen Demo

26/11/2005 17:09 <REP> Ulead Systems

20/04/2007 01:38 <REP> Winamp

20/04/2007 01:38 <REP> Windows Media Player

07/10/2004 11:40 <REP> Windows NT

07/10/2004 11:40 <REP> xerox

1 fichier(s) 89 589 990 octets

84 Rép(s) 3 710 275 584 octets libres

Le volume dans le lecteur C n'a pas de nom.

Le numéro de série du volume est 0F54-00FA

 

Répertoire de C:\

 

11/11/2001 00:00 68 096 diff.exe

27/08/2006 14:10 103 424 grep.exe

 

Répertoire de C:\

 

11/11/2001 00:00 68 096 diff.exe

27/08/2006 14:10 103 424 grep.exe

4 fichier(s) 343 040 octets

0 Rép(s) 3 710 275 584 octets libres

C:\Documents and Settings\Mélanie et Benoît\Application Data\MSNInstaller\msnauins.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\catchme.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\diff.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\dumphive.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\FilesInfoCmd.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\Fport.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\grep.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\LFiles.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\LISTDLLS.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\pslist.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\streams.exe

C:\Documents and Settings\Mélanie et Benoît\Bureau\DiagHelp\swreg.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Application Data\Last.fm\Client\UninstITW\unins000.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Application Data\Last.fm\Client\UninstWA\unins000.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Application Data\Last.fm\Client\UninstWMP\unins000.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\bm6s24nf.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\emt35jtb.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\erauyc1q.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\hamachi-1.0.1.3.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\hamachi-update-1.0.1.5.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\hpzscr01.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\iTunesPluginWinSetup_2.0.10.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\iTunesPluginWinSetup_2.0.11.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\LastFM_Win_1.1.0.0_en.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\LastFM_Win_1.1.3.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\TFR30.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\WinampPluginSetup_2.0.30.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\WmpPluginSetup_2.0.26.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\WmpPluginSetup_2.0.27.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\WmpPluginSetup_2.0.28.0.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\hps20\HPSUSelfUpdate.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\nstmp\uninstall.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\nstmp1\uninstall.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\pftD~tmp\_ISDel.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\pftD~tmp\Setup.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\pftD~tmp\Reader\AcroRd32.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\Répertoire temporaire 1 pour process-explorer_process_explorer_10.21_anglais_14566.zip\procexp.exe

C:\Documents and Settings\Mélanie et Benoît\Local Settings\Temp\WMDM\setup.exe

C:\Documents and Settings\SARL PATIMAT\Local Settings\Temp\bye4.tmp\Disk1\setup.exe

[Thanos]

salut

 

Ok rien de notable sur ton rapport .

Pour ce qui est du résultat de scan Panda, ne t'inquiêtes pas! il ne montre que des cookies, et la quarantaine de VundoFix.

 

Une recherche supplémentaire stp >

 

-Télécharge silentrunners sur le bureau:

 

Dézippe le fichier dans un dossier .

Double clique sur le fichier "silentrunners.vbs" :une fenêtre va s'ouvrir ,clique sur "oui" . Poste le rapport qui a été généré.

 

Poste un rappport hijackthis comme ceci aussi >

 

Lance HijackThis.

Clique sur Open Misc Tools Section

Assure toi que les deux cases de droite sont bien cochées:

* List all minor sections(Full)

* List Empty Sections(Complete)

Clique sur Generate StartupList Log

Click sur "oui" lorsque l'on te le demande.

Cela va générer un rapport,copie le et poste le ici.

[nybenit]

voici les deux rapports :

 

StartupList report, 20/04/2007, 23:43:14

StartupList version: 1.52.2

Started from : E:\Mes documents\Installations\hijackthis\HijackThis.EXE

Detected: Windows XP SP2 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)

* Using default options

* Including empty and uninteresting sections

* Showing rarely important sections

==================================================

 

Running processes:

 

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Apoint2K\Apoint.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Winamp\Winampa.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

E:\Mes documents\Installations\essai benoit\benoit\WistitiSoft\Agent.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

E:\Mes documents\Installations\hijackthis\HijackThis.exe

 

--------------------------------------------------

 

Listing of startup folders:

 

Shell folders Startup:

[C:\Documents and Settings\Mélanie et Benoît\Menu Démarrer\Programmes\Démarrage]

*No files*

 

Shell folders AltStartup:

*Folder not found*

 

User shell folders Startup:

*Folder not found*

 

User shell folders AltStartup:

*Folder not found*

 

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]

Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

 

Shell folders Common AltStartup:

*Folder not found*

 

User shell folders Common Startup:

*Folder not found*

 

User shell folders Alternate Common Startup:

*Folder not found*

 

--------------------------------------------------

 

Checking Windows NT UserInit:

 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,

 

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

 

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

*Registry value not found*

 

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

 

Apoint = C:\Program Files\Apoint2K\Apoint.exe

AGRSMMSG = AGRSMMSG.exe

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

nwiz = nwiz.exe /install

UpdateManager = "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r

eabconfg.cpl = C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start

Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe

HP Component Manager = "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

WinampAgent = "C:\Program Files\Winamp\Winampa.exe"

Picasa Media Detector = C:\Program Files\Picasa2\PicasaMediaDetector.exe

ExtraFilmHemmaAgent = "E:\Mes documents\Installations\essai benoit\benoit\WistitiSoft\Agent.exe"

avgnt = "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

 

*No values found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

 

*No values found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

 

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

 

*No values found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

 

[OptionalComponents]

*No values found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No subkeys found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No subkeys found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No subkeys found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries in Registry subkeys of:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

 

--------------------------------------------------

 

File association entry for .EXE:

HKEY_CLASSES_ROOT\exefile\shell\open\command

 

(Default) = "%1" %*

 

--------------------------------------------------

 

File association entry for .COM:

HKEY_CLASSES_ROOT\comfile\shell\open\command

 

(Default) = "%1" %*

 

--------------------------------------------------

 

File association entry for .BAT:

HKEY_CLASSES_ROOT\batfile\shell\open\command

 

(Default) = "%1" %*

 

--------------------------------------------------

 

File association entry for .PIF:

HKEY_CLASSES_ROOT\piffile\shell\open\command

 

(Default) = "%1" %*

 

--------------------------------------------------

 

File association entry for .SCR:

HKEY_CLASSES_ROOT\scrfile\shell\open\command

 

(Default) = "%1" /S

 

--------------------------------------------------

 

File association entry for .HTA:

HKEY_CLASSES_ROOT\htafile\shell\open\command

 

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

 

--------------------------------------------------

 

File association entry for .TXT:

HKEY_CLASSES_ROOT\txtfile\shell\open\command

 

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

 

--------------------------------------------------

 

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)

 

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

 

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

 

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *

StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

 

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *

StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *

StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

 

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

 

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

 

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

 

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *

StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

 

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

 

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll

 

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = %SystemRoot%\system32\ie4uinit.exe

 

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *

StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

 

--------------------------------------------------

 

Enumerating ICQ Agent Autostart apps:

HKCU\Software\Mirabilis\ICQ\Agent\Apps

 

*Registry key not found*

 

--------------------------------------------------

 

Load/Run keys from C:\WINDOWS\WIN.INI:

 

load=*INI section not found*

run=*INI section not found*

 

Load/Run keys from Registry:

 

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=

HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs= sockspy.dll sockspy.dll

 

--------------------------------------------------

 

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

 

Shell & screensaver key from Registry:

 

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

 

Policies Shell key:

 

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*

 

--------------------------------------------------

 

Checking for EXPLORER.EXE instances:

 

C:\WINDOWS\Explorer.exe: PRESENT!

 

C:\Explorer.exe: not present

C:\WINDOWS\Explorer\Explorer.exe: not present

C:\WINDOWS\System\Explorer.exe: not present

C:\WINDOWS\System32\Explorer.exe: not present

C:\WINDOWS\Command\Explorer.exe: not present

C:\WINDOWS\Fonts\Explorer.exe: not present

 

--------------------------------------------------

 

Checking for superhidden extensions:

 

.lnk: HIDDEN! (arrow overlay: yes)

.pif: HIDDEN! (arrow overlay: yes)

.exe: not hidden

.com: not hidden

.bat: not hidden

.hta: not hidden

.scr: not hidden

.shs: HIDDEN!

.shb: HIDDEN!

.vbs: not hidden

.vbe: not hidden

.wsh: not hidden

.scf: HIDDEN! (arrow overlay: NO!)

.url: HIDDEN! (arrow overlay: yes)

.js: not hidden

.jse: not hidden

 

--------------------------------------------------

 

Verifying REGEDIT.EXE integrity:

 

- Regedit.exe found in C:\WINDOWS

- .reg open command is normal (regedit.exe %1)

- Regedit.exe has no CompanyName property! It is either missing or named something else.

- Regedit.exe has no OriginalFilename property! It is either missing or named something else.

- Regedit.exe has no FileDescription property! It is either missing or named something else.

 

Registry check failed!

 

--------------------------------------------------

 

Enumerating Browser Helper Objects:

 

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

 

--------------------------------------------------

 

Enumerating Task Scheduler jobs:

 

*No jobs found*

 

--------------------------------------------------

 

Enumerating Download Program Files:

 

[Citrix ICA Client]

InProcServer32 = C:\Progra~1\Citrix\icaweb32\WFICA.OCX

CODEBASE = http://a516.g.akamai.net/f/516/25175/7d/ru...cat-no-eula.cab

 

[MUWebControl Class]

InProcServer32 = C:\WINDOWS\system32\muweb.dll

CODEBASE = http://update.microsoft.com/microsoftupdat...b?1176590477703

 

[Java Plug-in 1.6.0_01]

InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

CODEBASE = http://java.sun.com/products/plugin/autodl...indows-i586.cab

 

[ActiveScan Installer Class]

InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll

CODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab

 

[Java Plug-in 1.6.0_01]

InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

CODEBASE = http://java.sun.com/products/plugin/autodl...indows-i586.cab

 

[Java Plug-in 1.6.0_01]

InProcServer32 = C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll

CODEBASE = http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

 

[shockwave Flash Object]

InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx

CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab

 

--------------------------------------------------

 

Enumerating Winsock LSP files:

 

NameSpace #1: C:\WINDOWS\System32\mswsock.dll

NameSpace #2: C:\WINDOWS\System32\winrnr.dll

NameSpace #3: C:\WINDOWS\System32\mswsock.dll

Protocol #1: C:\WINDOWS\system32\mswsock.dll

Protocol #2: C:\WINDOWS\system32\mswsock.dll

Protocol #3: C:\WINDOWS\system32\mswsock.dll

Protocol #4: C:\WINDOWS\system32\rsvpsp.dll

Protocol #5: C:\WINDOWS\system32\rsvpsp.dll

Protocol #6: C:\WINDOWS\system32\mswsock.dll

Protocol #7: C:\WINDOWS\system32\mswsock.dll

Protocol #8: C:\WINDOWS\system32\mswsock.dll

Protocol #9: C:\WINDOWS\system32\mswsock.dll

Protocol #10: C:\WINDOWS\system32\mswsock.dll

Protocol #11: C:\WINDOWS\system32\mswsock.dll

Protocol #12: C:\WINDOWS\system32\mswsock.dll

Protocol #13: C:\WINDOWS\system32\mswsock.dll

Protocol #14: C:\WINDOWS\system32\mswsock.dll

Protocol #15: C:\WINDOWS\system32\mswsock.dll

Protocol #16: C:\WINDOWS\system32\mswsock.dll

Protocol #17: C:\WINDOWS\system32\mswsock.dll

Protocol #18: C:\WINDOWS\system32\mswsock.dll

Protocol #19: C:\WINDOWS\system32\mswsock.dll

Protocol #20: C:\WINDOWS\system32\mswsock.dll

Protocol #21: C:\WINDOWS\system32\mswsock.dll

 

--------------------------------------------------

 

Enumerating Windows NT/2000/XP services

 

Pilote ACPI Microsoft: system32\DRIVERS\ACPI.sys (system)

Pilote de contrôleur intégré Microsoft: system32\DRIVERS\ACPIEC.sys (system)

aeaudio: system32\drivers\aeaudio.sys (manual start)

Suppresseur d'écho acoustique (Noyau Microsoft): system32\drivers\aec.sys (manual start)

AFD: \SystemRoot\System32\drivers\afd.sys (system)

Agere Systems Soft Modem: system32\DRIVERS\AGRSM.sys (manual start)

Avertissement: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)

Service de la passerelle de la couche Application: %SystemRoot%\System32\alg.exe (manual start)

AliIde: system32\DRIVERS\aliide.sys (system)

Pilote de processeur AMD Athlon64: system32\DRIVERS\AmdK8.sys (system)

AntiVir PersonalEdition Classic Scheduler: C:\Program Files\AntiVir PersonalEdition Classic\sched.exe (autostart)

AntiVir PersonalEdition Classic Guard: C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe (autostart)

Alps Pointing-device Filter Driver: system32\DRIVERS\Apfiltr.sys (manual start)

Gestion d'applications: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Protocole client ARP 1394: system32\DRIVERS\arp1394.sys (manual start)

Service d'état ASP.NET: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)

Pilote de média asynchrone RAS: system32\DRIVERS\asyncmac.sys (manual start)

Contrôleur de disque dur IDE/ESDI standard: system32\DRIVERS\atapi.sys (system)

Protocole client ATM ARP: system32\DRIVERS\atmarpc.sys (manual start)

Audio Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Pilote audio Stub: system32\DRIVERS\audstub.sys (manual start)

avgio: \??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys (system)

avgntflt: \??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys (manual start)

Pilote pour carte réseau BCM 802.11b: system32\DRIVERS\bcmwl5.sys (manual start)

Service de transfert intelligent en arrière-plan: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Pont MAC: system32\DRIVERS\bridge.sys (manual start)

Miniport de pont MAC: system32\DRIVERS\bridge.sys (manual start)

Explorateur d'ordinateur: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Décodeur sous-titre fermé: system32\DRIVERS\CCDECODE.sys (manual start)

Pilote de CD-ROM: system32\DRIVERS\cdrom.sys (system)

Service d'indexation: %SystemRoot%\system32\cisvc.exe (manual start)

Gestionnaire de l'Album: %SystemRoot%\system32\clipsrv.exe (disabled)

.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)

Pilote d'adaptateur secteur Microsoft: system32\DRIVERS\CmBatt.sys (manual start)

Pilote de batterie composite Microsoft: system32\DRIVERS\compbatt.sys (system)

Application système COM+: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)

Services de cryptographie: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Lanceur de processus serveur DCOM: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)

TI UltraMedia CardBus Controller Filter Driver: system32\DRIVERS\tiumflt.sys (system)

Client DHCP: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Pilote de disque: system32\DRIVERS\disk.sys (system)

Service d'administration du Gestionnaire de disque logique: %SystemRoot%\System32\dmadmin.exe /com (manual start)

dmboot: System32\drivers\dmboot.sys (disabled)

dmio: System32\drivers\dmio.sys (disabled)

dmload: System32\drivers\dmload.sys (disabled)

Gestionnaire de disque logique: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Synthétiseur DLS du noyau Microsoft: system32\drivers\DMusic.sys (manual start)

Client DNS: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)

Filtre de décodeur DRM (Noyau Microsoft): system32\drivers\drmkaud.sys (manual start)

EABFiltr: \??\C:\WINDOWS\system32\drivers\EABFiltr.sys (system)

eabusb: \??\C:\WINDOWS\system32\drivers\eabusb.sys (manual start)

Service de rapport d'erreurs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Journal des événements: %SystemRoot%\system32\services.exe (autostart)

Système d'événements de COM+: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)

Compatibilité avec le Changement rapide d'utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Carte réseau virtuelle FreeBox USB: system32\DRIVERS\fbxusb32.sys (manual start)

Pilote de contrôleur de lecteur de disquettes: system32\DRIVERS\fdc.sys (manual start)

Pilote de lecteur de disquettes: system32\DRIVERS\flpydisk.sys (manual start)

FltMgr: system32\DRIVERS\fltMgr.sys (system)

Pilote du Gestionnaire de volume: system32\DRIVERS\ftdisk.sys (system)

GEAR CDRom Filter: SYSTEM32\DRIVERS\GEARAspiWDM.sys (manual start)

Classificateur de paquets générique: system32\DRIVERS\msgpc.sys (manual start)

Google Updater Service: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" (manual start)

Hamachi Network Interface: system32\DRIVERS\hamachi.sys (manual start)

Aide et support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Accès du périphérique d'interface utilisateur: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)

Pilote de classe HID Microsoft: system32\DRIVERS\hidusb.sys (manual start)

HP WMI Interface: C:\Program Files\HPQ\SHARED\HPQWMI.exe (manual start)

IEEE-1284.4 Driver HPZid412: system32\DRIVERS\HPZid412.sys (manual start)

Print Class Driver for IEEE-1284.4 HPZipr12: system32\DRIVERS\HPZipr12.sys (manual start)

USB to IEEE-1284.4 Translation Driver HPZius12: system32\DRIVERS\HPZius12.sys (manual start)

HTTP: System32\Drivers\HTTP.sys (manual start)

HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)

Pilote pour clavier i8042 et souris sur port PS/2: system32\DRIVERS\i8042prt.sys (system)

Pilote de filtre de gravure CD: system32\DRIVERS\imapi.sys (system)

Service COM de gravage de CD IMAPI: C:\WINDOWS\system32\imapi.exe (manual start)

IntelIde: system32\DRIVERS\intelide.sys (system)

Pilote du pare-feu Windows IPv6: system32\DRIVERS\Ip6Fw.sys (manual start)

Pilote de filtre de trafic IP: system32\DRIVERS\ipfltdrv.sys (manual start)

Pilote de tunnelage IP dans IP: system32\DRIVERS\ipinip.sys (manual start)

Traducteur d'adresses réseau IP: system32\DRIVERS\ipnat.sys (manual start)

iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)

Pilote IPSEC: system32\DRIVERS\ipsec.sys (system)

Service énumérateur IR: system32\DRIVERS\irenum.sys (manual start)

Pilote de bus Plug-and-Play ISA/EISA: system32\DRIVERS\isapnp.sys (system)

Pilote de la classe Clavier: system32\DRIVERS\kbdclass.sys (system)

Pilote HID de clavier: system32\DRIVERS\kbdhid.sys (system)

Mélangeur audio Wave de noyau Microsoft: system32\drivers\kmixer.sys (manual start)

Serveur: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Station de travail: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Assistance TCP/IP NetBIOS: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Affichage des messages: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

Partage de Bureau à distance NetMeeting: C:\WINDOWS\system32\mnmsrvc.exe (manual start)

Pilote de la classe Souris: system32\DRIVERS\mouclass.sys (system)

Pilote HID de souris: system32\DRIVERS\mouhid.sys (manual start)

Redirecteur client WebDav: system32\DRIVERS\mrxdav.sys (manual start)

MRXSMB: system32\DRIVERS\mrxsmb.sys (system)

Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)

Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)

Proxy de service de répartition Microsoft: system32\drivers\MSKSSRV.sys (manual start)

Proxy d'horloge de répartition Microsoft: system32\drivers\MSPCLOCK.sys (manual start)

Proxy de gestion de qualité de répartition Microsoft: system32\drivers\MSPQM.sys (manual start)

Pilote BIOS de gestion de systèmes Microsoft: system32\DRIVERS\mssmbios.sys (manual start)

SQL Server (SQLEXPRESS): "C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (autostart)

SQL Server Active Directory Helper: "C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe" (disabled)

Convertisseur en T/site-à-site de répartition Microsoft: system32\drivers\MSTEE.sys (manual start)

Codec NABTS/FEC VBI: system32\DRIVERS\NABTSFEC.sys (manual start)

Connection TV/vidéo Microsoft: system32\DRIVERS\NdisIP.sys (manual start)

Pilote TAPI NDIS d'accès distant: system32\DRIVERS\ndistapi.sys (manual start)

NDIS mode utilisateur E/S Protocole: system32\DRIVERS\ndisuio.sys (manual start)

Pilote réseau étendu NDIS d'accès distant: system32\DRIVERS\ndiswan.sys (manual start)

Interface NetBIOS: system32\DRIVERS\netbios.sys (system)

NetBT: system32\DRIVERS\netbt.sys (system)

DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)

DSDM DDE réseau: %SystemRoot%\system32\netdde.exe (disabled)

Ouverture de session réseau: %SystemRoot%\system32\lsass.exe (manual start)

Connexions réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Pilote réseau 1394: system32\DRIVERS\nic1394.sys (manual start)

NLA (Network Location Awareness): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Fournisseur de la prise en charge de sécurité LM NT: %SystemRoot%\system32\lsass.exe (manual start)

Stockage amovible: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

nv: system32\DRIVERS\nv4_mini.sys (manual start)

NVIDIA Driver Helper Service: %SystemRoot%\system32\nvsvc32.exe (autostart)

NVIDIA nForce AGP Bus Filter: system32\DRIVERS\nv_agp.sys (system)

Pilote de filtre de trafic IPX: system32\DRIVERS\nwlnkflt.sys (manual start)

Pilote de transfert de trafic IPX: system32\DRIVERS\nwlnkfwd.sys (manual start)

Contrôleur hôte Texas Instruments IEEE 1394 compatible OHCI (Open Host Controller Interface): system32\DRIVERS\ohci1394.sys (system)

Office Source Engine: "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE" (manual start)

Pilote de port parallèle: system32\DRIVERS\parport.sys (manual start)

Pilote de bus PCI: system32\DRIVERS\pci.sys (system)

PCIIde: system32\DRIVERS\pciide.sys (system)

Pcmcia: system32\DRIVERS\pcmcia.sys (system)

JVC Communication PIX-MCV Driver: System32\Drivers\pixmcvc.sys (manual start)

JVC PIX-MCV Audio Capture: System32\Drivers\pixmcva.sys (manual start)

JVC PIX-MCV Video Capture: System32\Drivers\pixmcvv.sys (manual start)

Plug-and-Play: %SystemRoot%\system32\services.exe (autostart)

Pml Driver HPZ12: C:\WINDOWS\system32\HPZipm12.exe (manual start)

Services IPSEC: %SystemRoot%\system32\lsass.exe (autostart)

Miniport réseau étendu (PPTP): system32\DRIVERS\raspptp.sys (manual start)

Pilote processeur: system32\DRIVERS\processr.sys (system)

Emplacement protégé: %SystemRoot%\system32\lsass.exe (autostart)

Planificateur de paquets QoS: system32\DRIVERS\psched.sys (manual start)

Pilote de liaison parallèle directe: system32\DRIVERS\ptilink.sys (manual start)

PxHelp20: system32\DRIVERS\PxHelp20.sys (system)

Pilote de connexion automatique d'accès distant: system32\DRIVERS\rasacd.sys (system)

Gestionnaire de connexion automatique d'accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Miniport réseau étendu (IrDA): system32\DRIVERS\rasirda.sys (manual start)

Miniport réseau étendu (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)

Gestionnaire de connexions d'accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)

Pilote PPPOE d'accès à distance: system32\DRIVERS\raspppoe.sys (manual start)

Parallèle direct: system32\DRIVERS\raspti.sys (manual start)

Rdbss: system32\DRIVERS\rdbss.sys (system)

RDPCDD: System32\DRIVERS\RDPCDD.sys (system)

Gestionnaire de session d'aide sur le Bureau à distance: C:\WINDOWS\system32\sessmgr.exe (manual start)

Pilote de filtre de lecture digitale de CD audio: system32\DRIVERS\redbook.sys (system)

Routage et accès distant: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)

Localisateur d'appels de procédure distante (RPC): %SystemRoot%\system32\locator.exe (manual start)

Appel de procédure distante (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)

QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)

Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C): system32\DRIVERS\RTL8139.SYS (manual start)

Gestionnaire de comptes de sécurité: %SystemRoot%\system32\lsass.exe (autostart)

Carte à puce: %SystemRoot%\System32\SCardSvr.exe (manual start)

Planificateur de tâches: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Secdrv: system32\DRIVERS\secdrv.sys (manual start)

Connexion secondaire: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Notification d'événement système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Pilote de filtre Serenum: system32\DRIVERS\serenum.sys (manual start)

Pilote de port série: system32\DRIVERS\serial.sys (system)

Pare-feu Windows / Partage de connexion Internet: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Détection matériel noyau: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Détrameur décalage BDA: system32\DRIVERS\SLIP.sys (manual start)

Pilote de périphérique SMC IrCC Miniport: system32\DRIVERS\smcirda.sys (manual start)

smwdm: system32\drivers\smwdm.sys (manual start)

Pilote de filtrage Sony USB (SONYPVU1): system32\DRIVERS\SONYPVU1.SYS (manual start)

SoundMAX Agent Service: C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (autostart)

Splitter audio du noyau Microsoft: system32\drivers\splitter.sys (manual start)

Spouleur d'impression: %SystemRoot%\system32\spoolsv.exe (autostart)

SQL Server Browser: "C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe" (disabled)

Enregistreur VSS SQL Server: "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" (manual start)

Pilote de filtre de restauration système: system32\DRIVERS\sr.sys (system)

Service de restauration système: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Srv: system32\DRIVERS\srv.sys (manual start)

Service de découvertes SSDP: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Acquisition d'image Windows (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)

BDA IPSink: system32\DRIVERS\StreamIP.sys (manual start)

Pilote de bus logiciel: system32\DRIVERS\swenum.sys (manual start)

Synthétiseur de table de sons GC noyau Microsoft: system32\drivers\swmidi.sys (manual start)

MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{7B5BFFCF-0A4E-4600-AB68-EE824E8702D7} (manual start)

Périphérique audio système du noyau Microsoft: system32\drivers\sysaudio.sys (manual start)

Journaux et alertes de performance: %SystemRoot%\system32\smlogsvc.exe (manual start)

Téléphonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Pilote du protocole TCP/IP: system32\DRIVERS\tcpip.sys (system)

Pilote de périphérique terminal: system32\DRIVERS\termdd.sys (system)

Services Terminal Server: %SystemRoot%\System32\svchost -k DComLaunch (manual start)

Thèmes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

tiumfwl: system32\drivers\tiumfwl.sys (manual start)

Client de suivi de lien distribué: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Windows User Mode Driver Framework: C:\WINDOWS\system32\wdfmgr.exe (autostart)

Pilote de mise à jour microcode: system32\DRIVERS\update.sys (manual start)

Hôte de périphérique universel Plug-and-Play: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)

Onduleur: %SystemRoot%\System32\ups.exe (manual start)

Pilote parent générique USB Microsoft: system32\DRIVERS\usbccgp.sys (manual start)

Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0: system32\DRIVERS\usbehci.sys (manual start)

Concentrateur USB2: system32\DRIVERS\usbhub.sys (manual start)

Pilote miniport de contrôleur hôte ouvert USB Microsoft: system32\DRIVERS\usbohci.sys (manual start)

Classe d'imprimantes USB Microsoft: system32\DRIVERS\usbprint.sys (manual start)

Pilote de scanneur USB: system32\DRIVERS\usbscan.sys (manual start)

Pilote de stockage de masse USB: system32\DRIVERS\USBSTOR.SYS (manual start)

Pilote miniport de contrôleur hôte universel USB Microsoft: system32\DRIVERS\usbuhci.sys (manual start)

USB RNDIS Adapter: system32\DRIVERS\usb8023x.sys (manual start)

VgaSave: \SystemRoot\System32\drivers\vga.sys (system)

ViaIde: system32\DRIVERS\viaide.sys (system)

Cliché instantané de volume: %SystemRoot%\System32\vssvc.exe (manual start)

Horloge Windows: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Pilote ARP IP d'accès distant: system32\DRIVERS\wanarp.sys (manual start)

Pilote WINMM de compatibilité audio WDM Microsoft: system32\drivers\wdmaud.sys (manual start)

WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)

Infrastructure de gestion Windows: %systemroot%\system32\svchost.exe -k netsvcs (autostart)

Service de numéro de série du lecteur multimédia portable: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

Interface de gestion Microsoft Windows pour ACPI: system32\DRIVERS\wmiacpi.sys (system)

Carte de performance WMI: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)

Centre de sécurité: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Codec Teletext standard: system32\DRIVERS\WSTCODEC.SYS (manual start)

Mises à jour automatiques: %systemroot%\system32\svchost.exe -k netsvcs (disabled)

Configuration automatique sans fil: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Service d'approvisionnement réseau: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)

 

 

--------------------------------------------------

 

Enumerating Windows NT logon/logoff scripts:

*No scripts set to run*

 

Windows NT checkdisk command:

BootExecute = autocheck autochk *

 

Windows NT 'Wininit.ini':

PendingFileRenameOperations: *Registry value not found*

 

--------------------------------------------------

 

Enumerating ShellServiceObjectDelayLoad items:

 

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\system32\webcheck.dll

SysTray: C:\WINDOWS\system32\stobject.dll

 

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

 

*Registry key not found*

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

 

*Registry key not found*

 

--------------------------------------------------

 

End of report, 36 834 bytes

Report generated in 0,141 seconds

 

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

 

 

 

et

 

 

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"

 

 

Startup items buried in registry:

---------------------------------

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"Apoint" = "C:\Program Files\Apoint2K\Apoint.exe" ["Alps Electric Co., Ltd."]

"AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]

"UpdateManager" = ""C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"]

"eabconfg.cpl" = "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start" ["Hewlett-Packard "]

"Cpqset" = "C:\Program Files\HPQ\Default Settings\cpqset.exe" [null data]

"HP Component Manager" = ""C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"" ["Hewlett-Packard Company"]

"WinampAgent" = ""C:\Program Files\Winamp\Winampa.exe"" [null data]

"Picasa Media Detector" = "C:\Program Files\Picasa2\PicasaMediaDetector.exe" ["Google Inc."]

"ExtraFilmHemmaAgent" = ""E:\Mes documents\Installations\essai benoit\benoit\WistitiSoft\Agent.exe"" [null data]

"avgnt" = ""C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

-> {HKLM...CLSID} = "AcroIEHlprObj Class"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

-> {HKLM...CLSID} = "SSVHelper Class"

\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"

-> {HKLM...CLSID} = "Extension Affichage Panorama du Panneau de configuration"

\InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"

-> {HKLM...CLSID} = "HyperTerminal Icon Ext"

\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"

-> {HKLM...CLSID} = "Explorateur de Bureau"

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"

-> {HKLM...CLSID} = "Microsoft Office Outlook"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"

-> {HKLM...CLSID} = "Outlook File Icon Extension"

\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"

-> {HKLM...CLSID} = "Shell Extension for Malware scanning"

\InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]

 

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\

<<!>> "AppInit_DLLs" = " sockspy.dll sockspy.dll" [file not found]

 

HKLM\Software\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

-> {HKLM...CLSID} = (no title provided)

\InProcServer32\(Default) = "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

 

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

-> {HKLM...CLSID} = "PDF Shell Extension"

\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

 

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"

-> {HKLM...CLSID} = "Shell Extension for Malware scanning"

\InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]

 

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"

-> {HKLM...CLSID} = "Shell Extension for Malware scanning"

\InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]

 

 

Group Policies {policy setting}:

--------------------------------

 

Note: detected settings may not have any effect.

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

 

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001

{Shutdown: Allow system to be shut down without having to log on}

 

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001

{Devices: Allow undock without having to log on}

 

 

Active Desktop and Wallpaper:

-----------------------------

 

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

 

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

 

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Documents and Settings\Mélanie et Benoît\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"

 

 

Startup items in "Mélanie et Benoît" & "All Users" startup folders:

-------------------------------------------------------------------

 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

"Lancement rapide d'Adobe Reader" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]

 

 

Winsock2 Service Provider DLLs:

-------------------------------

 

Namespace Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

 

Transport Service Providers

 

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

 

 

Toolbars, Explorer Bars, Extensions:

------------------------------------

 

Explorer Bars

 

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

 

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Rechercher"

Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL" [MS]

 

Extensions (Tools menu items, main toolbar menu buttons)

 

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Console Java (Sun)"

"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"

 

 

Miscellaneous IE Hijack Points

------------------------------

 

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

 

Added lines (compared with English-language version):

(unwritable string)

 

Missing lines (compared with English-language version):

[Version]: 2 lines

[RestoreHomePage]: 1 line

[RestoreHomePage.reg]: 1 line

[RestoreBrowserSettings.reg]: 12 lines

[DeleteTemplates.reg]: 5 lines

[DeleteAutosearch.reg]: 1 line

[strings]: 1 line

[RestoreBrowserSettings]: 2 lines

[strings]: 3 lines

 

 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------

 

AntiVir PersonalEdition Classic Guard, AntiVirService, "C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe" ["AVIRA GmbH"]

AntiVir PersonalEdition Classic Scheduler, AntiVirScheduler, "C:\Program Files\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]

NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]

SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]

SQL Server (SQLEXPRESS), MSSQL$SQLEXPRESS, ""C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS" [MS]

Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

 

 

Print Monitors:

---------------

 

HKLM\System\CurrentControlSet\Control\Print\Monitors\

hpzlnt10\Driver = "hpzlnt10.dll" ["HP"]

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

 

 

----------

<<!>>: Suspicious data at a malware launch point.

 

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

DLL launch points, use the -supp parameter or answer "No" at the

first message box and "Yes" at the second message box.

---------- (total run time: 31 seconds)

[Thanos]

salut

 

Je n'ai fait que survoller tes rapports, et à priori il n'y a rien qui explique cette occupation du processeur! J'y reviendrait ce soir. (boulot!) Dis moi est ce que tu reçois des alertes de Windows ?

 

Va voir dans l'observateur d'événements => passe par "Démarrer/Exécuter" et tu tapes eventvwr

dans la fenêtre qui vient de s'ouvrir , panneau de droite, deux éléments à vérifier => Applications et Système

Fais un double clic dessus. Jette un oeil sur les rapports en te concentrant sur ceux générés lors du crash(il y a la date et l'heure pour t'y retrouver).Fais un double clic sur l'événement (surement avec une croix rouge devant

et une notation "erreur") et dis moi si tu vois quelque chose.

 

@+