[Résolu] COMBOFIX

ouestfreeman · le 8 novembre 2009

bonjour

Suite a une erreur (de ma part) j'ai autorisé la mise en place sur mon PC de "SECURITY TOOLS" erreur que l'on ne fait qu'une seul fois!!!

Après avoir lu le tuto http://www.malekal.com/SecurityTool.php, j'ai passé "Malwarebyte's Anti-Malware" pour faire le ménage (14 trojean). Ensuite j'ai fait une analyse avec COMBOFIX, je me permets de vous solliciter et de vous faire suivre une copie du rapport afin que quelqu'un puisse me donner un coup de main pour finaliser le nettoyage de mon PC.

merci d'avance

OUESTFREEMAN

jsifamilly@free.fr

ComboFix 09-11-05.05 - jean.marie 06/11/2009 21:56.1.2 - NTFSx86

Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1036.18.1012.495 [GMT 1:00]

Lancé depuis: c:\users\jean.marie\Downloads\ComboFix.exe

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

c:\recycler\S-1-5-21-2161079974-4111578351-926022040-1006

c:\recycler\S-1-5-21-2161079974-4111578351-926022040-1007

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-10-06 au 2009-11-06 ))))))))))))))))))))))))))))))))))))

.

2009-11-06 21:19 . 2009-11-06 21:19 -------- d-----w- c:\users\jean.marie\AppData\Local\temp

2009-11-06 21:19 . 2009-11-06 21:19 -------- d-----w- c:\users\Isa\AppData\Local\temp

2009-11-06 21:19 . 2009-11-06 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-11-06 17:05 . 2009-11-06 17:05 -------- d-----w- c:\users\jean.marie\AppData\Roaming\Malwarebytes

2009-11-06 17:04 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-06 17:04 . 2009-11-06 17:04 -------- d-----w- c:\programdata\Malwarebytes

2009-11-06 17:04 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-06 17:04 . 2009-11-06 17:04 4096 d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-30 08:21 . 2009-10-30 08:25 -------- d-----w- c:\programdata\MyHeritage

2009-10-30 08:21 . 2009-10-30 08:21 -------- d-----w- c:\users\jean.marie\AppData\Roaming\MyHeritage

2009-10-30 08:20 . 2009-10-30 08:37 -------- d-----w- c:\program files\MyHeritage

2009-10-30 08:04 . 2009-10-30 08:37 -------- d-----w- c:\program files\Family Toolbar

2009-10-29 15:49 . 2009-10-29 15:49 3560 ------w- C:\bootsqm.dat

2009-10-28 20:09 . 2009-10-28 20:11 -------- d-----w- c:\users\jean.marie\AppData\Local\Algebrator

2009-10-28 20:09 . 2009-10-28 20:09 4096 d-----w- c:\program files\Algebrator

2009-10-27 21:57 . 2009-10-27 21:57 556848 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2009-10-23 20:41 . 2009-10-23 20:41 -------- d-----w- c:\users\jean.marie\AppData\Local\Apple Computer

2009-10-23 20:36 . 2009-10-23 20:37 4096 d-----w- c:\program files\QuickTime

2009-10-23 20:36 . 2009-10-23 20:36 -------- d-----w- c:\programdata\Apple Computer

2009-10-23 20:35 . 2009-10-23 20:35 -------- d-----w- c:\program files\Common Files\Apple

2009-10-23 20:35 . 2009-10-23 20:35 -------- d-----w- c:\users\jean.marie\AppData\Local\Apple

2009-10-23 20:35 . 2009-10-23 20:35 4096 d-----w- c:\program files\Apple Software Update

2009-10-23 20:35 . 2009-10-23 20:35 -------- d-----w- c:\programdata\Apple

2009-10-22 22:11 . 2009-10-30 22:50 -------- dc----w- c:\users\jean.marie\AppData\Local\MigWiz

2009-10-22 19:19 . 2009-10-22 19:19 -------- d-----w- c:\users\jean.marie\AppData\Roaming\Talkback

2009-10-21 22:40 . 2009-10-21 22:40 -------- d-----w- c:\users\jean.marie\AppData\Local\Microsoft Games

2009-10-21 21:07 . 2008-09-17 18:39 139264 ----a-w- c:\users\jean.marie\AppData\Roaming\Thunderbird\Profiles\mw8zj149.default\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}\components\calbscmp.dll

2009-10-21 19:57 . 2009-10-21 19:57 0 ----a-w- c:\windows\nsreg.dat

2009-10-21 19:57 . 2009-10-21 19:57 -------- d-----w- c:\users\jean.marie\AppData\Local\Thunderbird

2009-10-21 19:57 . 2009-10-21 19:57 -------- d-----w- c:\users\jean.marie\AppData\Roaming\Thunderbird

2009-10-21 19:57 . 2009-10-22 19:38 12288 d-----w- c:\program files\Mozilla Thunderbird

2009-10-17 12:38 . 2009-10-02 04:06 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2009-10-17 12:38 . 2009-09-03 07:04 1320960 ----a-w- c:\windows\system32\CertEnroll.dll

2009-10-17 12:38 . 2009-08-03 05:35 2613248 ----a-w- c:\windows\explorer.exe

2009-10-17 12:38 . 2009-08-19 07:20 507568 ----a-w- c:\windows\system32\winload.exe

2009-10-17 12:38 . 2009-08-19 07:20 442920 ----a-w- c:\windows\system32\winresume.exe

2009-10-17 12:38 . 2009-07-30 16:29 108544 ----a-w- c:\windows\system32\t2embed.dll

2009-10-17 12:38 . 2009-07-30 16:27 71168 ----a-w- c:\windows\system32\fontsub.dll

2009-10-17 12:38 . 2009-07-30 04:44 293888 ----a-w- c:\windows\system32\atmfd.dll

2009-10-17 12:38 . 2009-08-29 06:54 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2009-10-15 20:56 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll

2009-10-15 19:23 . 2009-08-29 06:57 34816 ----a-w- c:\windows\system32\msasn1.dll

2009-10-10 23:26 . 2009-10-10 23:26 -------- d-----w- c:\program files\JRE

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-06 19:48 . 2009-07-14 08:39 695004 ----a-w- c:\windows\system32\perfh00C.dat

2009-11-06 19:48 . 2009-07-14 08:39 127684 ----a-w- c:\windows\system32\perfc00C.dat

2009-11-05 17:17 . 2009-09-22 17:18 4096 d-----w- c:\users\jean.marie\AppData\Roaming\vlc

2009-11-01 13:41 . 2009-09-22 17:01 1 ----a-w- c:\users\jean.marie\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2009-10-29 21:17 . 2009-09-22 17:27 -------- d-----w- c:\program files\Common Files\Adobe

2009-10-29 17:36 . 2009-09-24 21:38 4096 d-----w- c:\users\jean.marie\AppData\Roaming\FileZilla

2009-10-24 21:10 . 2009-09-24 21:38 4096 d-----w- c:\program files\FileZilla FTP Client

2009-10-11 15:16 . 2009-09-22 16:43 61736 ----a-w- c:\users\jean.marie\AppData\Local\GDIPFONTCACHEV1.DAT

2009-10-10 23:28 . 2009-09-22 16:57 4096 d-----w- c:\program files\OpenOffice.org 3

2009-10-10 23:19 . 2009-09-22 19:42 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-10-10 23:19 . 2009-09-22 16:55 4096 d-----w- c:\program files\Java

2009-10-01 08:29 . 2009-10-03 10:47 195440 ------w- c:\windows\system32\MpSigStub.exe

2009-09-28 19:25 . 2009-09-28 19:25 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2009-09-24 22:05 . 2009-09-24 22:00 8192 d-----w- c:\program files\adslTV

2009-09-24 21:35 . 2009-09-24 21:35 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2009-09-24 21:35 . 2009-09-24 21:35 684872 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-09-24 21:00 . 2009-09-24 21:00 -------- d-----w- c:\program files\Memory-Map

2009-09-24 20:59 . 2009-09-24 20:59 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-09-24 20:32 . 2009-09-24 20:32 -------- d-----w- c:\program files\Microsoft

2009-09-24 20:31 . 2009-09-24 20:31 -------- d-----w- c:\program files\Windows Live SkyDrive

2009-09-24 20:31 . 2009-09-22 20:15 -------- d-----w- c:\program files\Windows Live

2009-09-24 20:27 . 2009-09-24 20:27 -------- d-----w- c:\program files\Common Files\Windows Live

2009-09-24 20:25 . 2009-09-22 20:14 -------- d-----w- c:\programdata\WLInstaller

2009-09-22 20:44 . 2009-09-22 20:44 -------- d-----w- c:\users\jean.marie\AppData\Roaming\Thinstall

2009-09-22 20:15 . 2009-09-22 20:15 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller

2009-09-22 17:17 . 2009-09-22 17:17 -------- d-----w- c:\program files\VideoLAN

2009-09-22 17:14 . 2009-09-22 17:14 -------- d-----w- c:\users\jean.marie\AppData\Roaming\VitySoft

2009-09-22 17:00 . 2009-09-22 17:00 -------- d-----w- c:\users\jean.marie\AppData\Roaming\OpenOffice.org

2009-09-22 16:55 . 2009-09-22 16:55 -------- d-----w- c:\program files\Common Files\Java

2009-09-22 14:09 . 2009-09-22 14:09 -------- d-----w- c:\program files\Alwil Software

2009-09-22 12:22 . 2009-09-22 12:22 -------- d-sh--we c:\programdata\Modèles

2009-09-22 12:22 . 2009-09-22 12:22 -------- d-sh--we c:\program files\Fichiers communs

2009-09-22 12:22 . 2009-09-22 12:22 -------- d-sh--we c:\programdata\Menu Démarrer

2009-09-22 12:22 . 2009-09-22 12:22 -------- d-sh--we c:\programdata\Favoris

2009-09-22 12:22 . 2009-09-22 12:22 -------- d-sh--we c:\programdata\Bureau

2009-09-03 09:53 . 2009-09-22 17:24 22848 ----a-w- c:\users\jean.marie\AppData\Roaming\Mozilla\Firefox\Profiles\gv4rjyrw.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe

2009-09-03 09:53 . 2009-09-22 17:24 19792 ----a-w- c:\users\jean.marie\AppData\Roaming\Mozilla\Firefox\Profiles\gv4rjyrw.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe

2009-08-17 16:10 . 2009-09-22 14:09 1279456 ----a-w- c:\windows\system32\aswBoot.exe

2009-08-17 16:05 . 2009-09-22 14:10 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys

2009-08-17 16:05 . 2009-09-22 14:10 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2009-08-17 16:05 . 2009-09-22 14:09 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2009-08-17 16:04 . 2009-09-22 14:10 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2009-08-17 16:04 . 2009-09-22 14:10 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2009-08-17 16:02 . 2009-09-22 14:10 97480 ----a-w- c:\windows\system32\AvastSS.scr

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2009-08-17 81000]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-16 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-16 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-16 150552]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-10 149280]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

SetupExecute REG_MULTI_SZ \0

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [22/09/2009 15:10 114768]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\System32\drivers\vwififlt.sys [14/07/2009 00:52 48128]

R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [22/09/2009 15:10 20560]

R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [22/09/2009 15:09 53328]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\System32\drivers\Rt86win7.sys [01/03/2009 22:05 139776]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - PROCEXP113

*Deregistered* - PROCEXP113

.

Contenu du dossier 'Tâches planifiées'

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.fr/

FF - ProfilePath - c:\users\jean.marie\AppData\Roaming\Mozilla\Firefox\Profiles\gv4rjyrw.default\

FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul

FF - prefs.js: keyword.URL - hxxp://search.myheritage.com/?orig=ds&q=

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

.

------- Associations de fichier -------

.

regedit=regedit.exe "%1"

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Heure de fin: 2009-11-06 22:28

ComboFix-quarantined-files.txt 2009-11-06 21:28

Avant-CF: 69 250 408 448 octets libres

Après-CF: 68 861 329 408 octets libres

- - End Of File - - 828D1AC774C17FD754444D9AFBEEF907

Modifié le 29 novembre 2009 par ouestfreeman

ouestfreeman · le 16 novembre 2009

bonjour

quelqu'un peut il me donner un coup de main? Je suis a la bonne adresse?

merci

Falkra · le 17 novembre 2009

Bonsoir,

n'utilise jamais ComboFix sans y être invité par un helper formé à l'outil, car cet outil est dangereux et tu ne trouveras aucun tuto, car son utilisation et sa documentation sont réservées aux helpers certifiés, dangereux !

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau. Cet outil va faire un état des lieux, lire la configuration, comme HijackThis, mais en plus détaillé.

Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
Ca fait deux rapports donc. Comme ils sont longs, tu peux faire 2 réponses, une par rapport.

ouestfreeman · le 24 novembre 2009

bonsoir

Merci de me répondre, message reçu pour ComboFix.

j'ai realisé la manip comme indiqué ci-dessus, mais j'ai un message d'erreur lors de l'analyse.

fenetre:AutoIt Error

Line-1:

Error:Variable used without being declared

j'ai validé OK et rien.

je suis allé jeter un coup d'oeil dans C:\rsit il y a un fichier log.txt

le contenu est:

Logfile of random's system information tool 1.06 (written by random/random)

Run by jean.marie at 2009-11-24 22:05:59

Microsoft Windows 7 Édition Intégrale

System drive C: has 64 GB (59%) free of 108 GB

Total RAM: 1012 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:06:03, on 24/11/2009

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\jean.marie\Desktop\RSIT.exe

C:\Program Files\trend micro\jean.marie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--

End of file - 3733 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - C:\Program Files\Java\jre6\bin\ssv.dll [2009-10-11 321312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"avast!"=C:\Program Files\Alwil Software\Avast4\ashDisp.exe [2009-08-17 81000]

"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-06-16 141848]

"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-06-16 173592]

"Persistence"=C:\Windows\system32\igfxpers.exe [2009-06-16 150552]

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\89147736]

C:\ProgramData\89147736\89147736.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\Windows\system32\igfxdev.dll [2009-06-16 216576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 months======

2009-11-24 22:01:33 ----D---- C:\Program Files\trend micro

2009-11-24 22:01:32 ----D---- C:\rsit

2009-11-14 00:09:01 ----A---- C:\Windows\system32\uxtuneup.dll

2009-11-14 00:09:01 ----A---- C:\Windows\system32\authuitu.dll

2009-11-14 00:06:26 ----A---- C:\Windows\system32\TURegOpt.exe

2009-11-14 00:05:41 ----D---- C:\Users\jean.marie\AppData\Roaming\TuneUp Software

2009-11-14 00:05:25 ----D---- C:\Program Files\TuneUp Utilities 2010

2009-11-14 00:04:37 ----D---- C:\ProgramData\TuneUp Software

2009-11-14 00:04:24 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

2009-11-12 22:43:18 ----D---- C:\1b4135e0baa8ca197ad0f16b

2009-11-10 21:45:32 ----D---- C:\Users\jean.marie\AppData\Roaming\ArchiFacile

2009-11-08 23:36:26 ----D---- C:\Users\jean.marie\AppData\Roaming\Google

2009-11-08 23:33:09 ----D---- C:\ProgramData\Google

2009-11-07 22:00:54 ----SD---- C:\ComboFix

2009-11-06 22:28:45 ----A---- C:\ComboFix.txt

2009-11-06 21:53:44 ----D---- C:\Windows\ERDNT

2009-11-06 18:05:01 ----D---- C:\Users\jean.marie\AppData\Roaming\Malwarebytes

2009-11-06 18:04:50 ----D---- C:\ProgramData\Malwarebytes

2009-11-06 17:54:32 ----A---- C:\Windows\ntbtlog.txt

2009-11-04 21:00:10 ----A---- C:\Windows\system32\mshtml.dll

2009-10-30 09:56:52 ----D---- C:\Windows\system32\appmgmt

2009-10-30 09:21:30 ----D---- C:\Users\jean.marie\AppData\Roaming\MyHeritage

2009-10-30 09:21:30 ----D---- C:\ProgramData\MyHeritage

2009-10-30 09:20:04 ----D---- C:\Program Files\MyHeritage

2009-10-30 09:04:07 ----D---- C:\Program Files\Family Toolbar

2009-10-29 22:17:26 ----D---- C:\Program Files\Adobe

2009-10-29 15:37:35 ----D---- C:\Windows\Minidump

2009-10-28 21:09:09 ----D---- C:\Program Files\Algebrator

======List of files/folders modified in the last 1 months======

2009-11-24 22:06:02 ----D---- C:\Windows\Temp

2009-11-24 22:01:33 ----RD---- C:\Program Files

2009-11-24 21:48:01 ----D---- C:\Windows\system32\config

2009-11-24 21:39:53 ----D---- C:\Windows\System32

2009-11-24 21:39:52 ----D---- C:\Windows\inf

2009-11-24 21:39:52 ----A---- C:\Windows\system32\PerfStringBackup.INI

2009-11-23 21:42:08 ----SHD---- C:\System Volume Information

2009-11-20 23:55:22 ----SHD---- C:\Windows\Installer

2009-11-20 23:55:18 ----D---- C:\Program Files\Java

2009-11-20 23:55:16 ----D---- C:\Program Files\Common Files

2009-11-20 21:29:20 ----RSD---- C:\Windows\Fonts

2009-11-20 21:29:14 ----D---- C:\Program Files\Common Files\microsoft shared

2009-11-20 21:28:58 ----D---- C:\Windows

2009-11-17 23:18:43 ----D---- C:\Windows\system32\NDF

2009-11-15 22:03:27 ----D---- C:\Windows\system32\drivers

2009-11-14 00:20:47 ----D---- C:\Windows\system32\Tasks

2009-11-14 00:11:47 ----D---- C:\Windows\system32\catroot2

2009-11-14 00:04:37 ----D---- C:\ProgramData

2009-11-13 17:55:02 ----D---- C:\Users\jean.marie\AppData\Roaming\FileZilla

2009-11-13 17:53:58 ----D---- C:\Program Files\FileZilla FTP Client

2009-11-12 21:20:32 ----D---- C:\Windows\winsxs

2009-11-06 23:18:58 ----D---- C:\Program Files\Mozilla Firefox

2009-11-06 22:25:50 ----D---- C:\Windows\Tasks

2009-11-06 22:20:57 ----A---- C:\Windows\system.ini

2009-11-06 22:17:35 ----D---- C:\RECYCLER

2009-11-06 22:11:34 ----D---- C:\Windows\AppPatch

2009-11-06 13:20:13 ----D---- C:\Windows\Logs

2009-11-05 18:36:21 ----A---- C:\Windows\system32\MRT.exe

2009-11-05 18:17:01 ----D---- C:\Users\jean.marie\AppData\Roaming\vlc

2009-11-04 20:59:26 ----D---- C:\Windows\system32\catroot

2009-11-02 20:42:06 ----N---- C:\Windows\system32\MpSigStub.exe

2009-11-01 19:56:31 ----SD---- C:\ProgramData\Microsoft

2009-10-30 09:56:52 ----SD---- C:\Users\jean.marie\AppData\Roaming\Microsoft

2009-10-29 22:18:47 ----D---- C:\ProgramData\Adobe

2009-10-29 22:17:41 ----D---- C:\Program Files\Common Files\Adobe

2009-10-29 17:10:58 ----D---- C:\$Recycle.Bin

2009-10-29 17:10:44 ----RD---- C:\Users

2009-10-29 15:00:28 ----D---- C:\Windows\LiveKernelReports

2009-10-27 20:49:58 ----D---- C:\Program Files\Internet Explorer

Falkra · le 25 novembre 2009

Il n'y a pas tout, en effet.

Télécharge DDS de sUBs, sur le bureau.

L'outil ne nécessite pas d'installation, lance-le en cliquant sur l'icône dds.scr

Une fenêtre DOS va apparaitre. Un premier rapport va s'ouvrir que tu enregistreras sous DDS.txt par défaut sur le bureau.

Il te sera demandé si tu veux faire le scan optionnel. Accepte.

Un nouveau rapport s'ouvre que tu enregistres sous Attach.txt sur le bureau.

Poste le rapport DDS.txt seulement, si ça marche, pour le moment.

ouestfreeman · le 25 novembre 2009

Je n'ai pas rencontré de problème.

DDS (Ver_09-11-24.02) - NTFSx86

Run by jean.marie at 22:25:44,44 on 25/11/2009

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_16

Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1036.18.1012.319 [GMT 1:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\jean.marie\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.fr/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Programme d'aide de l'Assistant de connexion Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

mRun: [avast!] "c:\program files\alwil software\avast4\ashDisp.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\jean~1.mar\appdata\roaming\mozilla\firefox\profiles\gv4rjyrw.default\

FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul

FF - prefs.js: keyword.URL - hxxp://search.myheritage.com/?orig=ds&q=

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-9-22 114768]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-9-22 20560]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-9-22 53328]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-3-1 139776]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

=============== Created Last 30 ================

2009-11-25 08:34:31 2048 ----a-w- c:\windows\system32\tzres.dll

2009-11-24 21:01:33 0 d-----w- c:\program files\trend micro

2009-11-13 23:09:01 30024 ----a-w- c:\windows\system32\uxtuneup.dll

2009-11-13 23:09:01 21320 ----a-w- c:\windows\system32\authuitu.dll

2009-11-13 23:06:26 29512 ----a-w- c:\windows\system32\TURegOpt.exe

2009-11-13 23:05:41 0 d-----w- c:\users\jean~1.mar\appdata\roaming\TuneUp Software

2009-11-13 23:05:25 0 d-----w- c:\program files\TuneUp Utilities 2010

2009-11-13 23:04:37 0 d-----w- c:\programdata\TuneUp Software

2009-11-13 23:04:24 0 d-sh--w- c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

2009-11-12 21:43:18 0 d-----w- C:\1b4135e0baa8ca197ad0f16b

2009-11-10 20:45:32 0 d-----w- c:\users\jean~1.mar\appdata\roaming\ArchiFacile

2009-11-08 22:33:09 0 d-----w- c:\programdata\Google

2009-11-07 21:00:54 0 d-s---w- C:\ComboFix

2009-11-06 17:05:01 0 d-----w- c:\users\jean~1.mar\appdata\roaming\Malwarebytes

2009-11-06 17:04:50 0 d-----w- c:\programdata\Malwarebytes

2009-10-30 08:56:52 0 d-----w- c:\windows\system32\appmgmt

2009-10-30 08:21:30 0 d-----w- c:\users\jean~1.mar\appdata\roaming\MyHeritage

2009-10-30 08:21:30 0 d-----w- c:\programdata\MyHeritage

2009-10-30 08:20:54 608448 ----a-w- c:\windows\system32\comctl32.ocx

2009-10-30 08:20:54 137000 ----a-w- c:\windows\system32\msmapi32.ocx

2009-10-30 08:20:04 0 d-----w- c:\program files\MyHeritage

2009-10-30 08:04:07 0 d-----w- c:\program files\Family Toolbar

2009-10-29 15:49:59 3560 ------w- C:\bootsqm.dat

2009-10-29 14:37:33 111136119 ----a-w- c:\windows\MEMORY.DMP

2009-10-28 20:09:09 0 d-----w- c:\program files\Algebrator

==================== Find3M ====================

2009-11-25 20:06:39 695004 ----a-w- c:\windows\system32\perfh00C.dat

2009-11-25 20:06:39 127684 ----a-w- c:\windows\system32\perfc00C.dat

2009-11-02 19:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe

2009-10-10 23:19:42 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-10-02 04:06:59 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2009-09-28 19:25:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2009-09-10 05:52:05 257024 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-03 07:04:15 1320960 ----a-w- c:\windows\system32\CertEnroll.dll

2009-08-29 06:57:31 34816 ----a-w- c:\windows\system32\msasn1.dll

2009-08-29 06:54:52 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2009-07-14 08:39:32 38160 ----a-w- c:\windows\inf\perflib\040c\perfd.dat

2009-07-14 08:39:32 38160 ----a-w- c:\windows\inf\perflib\040c\perfc.dat

2009-07-14 08:39:32 344522 ----a-w- c:\windows\inf\perflib\040c\perfi.dat

2009-07-14 08:39:32 344522 ----a-w- c:\windows\inf\perflib\040c\perfh.dat

2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini

2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat

2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 22:27:12,94 ===============

Falkra · le 25 novembre 2009

Les derniers rapports ne montrent pas d'infection active.

Est-ce que des symptômes persistent actuellement ?

(ne supprime pas combofix à la main, on va faire autrement)

ouestfreeman · le 26 novembre 2009

Bonjour

merci pour ta réactivité, mon PC se comporte bien pas de symptômes tout va bien et plus de nouvelles de SECURITY TOOLS.

Quant a combofix je ne le trouve plus! je ne sais plus se que j'en ai fait. La semaine dernière tu m'as foutu la trouille je l'aurais bien désinstallé ou mis a la poubelle, honnêtement je ne me souviens pas. J'ai fait une recherche sur C: il me reste juste un fichier texte "combofix"

Sur mon bureau j'ai toujours RSIT et dds.

J'attends les nouvelles consignes, pour l'instant je ne touche a rien

Encore merci pour pour l'analyse.

Falkra · le 27 novembre 2009

OK, poste un nouveau rapport RSIT stp (il n'en fera qu'un, c'est normal).

ouestfreeman · le 27 novembre 2009

voila

Logfile of random's system information tool 1.06 (written by random/random)

Run by jean.marie at 2009-11-27 21:15:27

Microsoft Windows 7 Édition Intégrale

System drive C: has 65 GB (60%) free of 108 GB

Total RAM: 1012 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:15:42, on 27/11/2009

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Internet Explorer\IELowutil.exe