sûrement virus

[moisetita]

bonjour à tous

depuis hier mêmes symptômes que l'autre fois :ça commence par une alerte du centre de sécurité windows qui me previent que mon anti virus ,parefeu est désactivé.Lorsque je réussis enfin à ouvrir mon pack sécurité sfr tout est normal.Par contre impossible d'ouvrir quoi que ce soit ,ça tourne ,ça tourne,quelquefois l'écran blanchit et tout est bloqué.Il y a sûrment qque chose :à l'ouverture les icônes ne viennent plus se ranger en bas à côté de l'horloge,par contre une fois sur 10 elles vont s'y mettre normalement et cette fois là je peux utiliser l'ordinateur normalement même s'il y a quelque ralentissement. En mode sans échec pas de problème....

Je joins les logs ,si vous pouvez m'aider ....MERCI======= RAPPORT D'AD-REMOVER 2.0.0.1,C | UNIQUEMENT XP/VISTA/7 =======ainsi que hidjackthis,malwarebytes ne trouve rien

 

Mis à jour par C_XX le 15/06/10 à 20:40

Contact: AdRemover.contact@gmail.com

Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

 

C:\Program Files\Ad-Remover\main.exe (SCAN [3]) -> Lancé à 08:20:39 le 17/06/2010, Mode sans echec

 

Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2 (X86)

Moumoune, PC-DE-MOUMOUNE (Packard Bell BV EASYNOTE SL65)

 

============== RECHERCHE ==============

 

 

 

 

============== SCAN ADDITIONNEL ==============

 

** Mozilla Firefox Version [3.6.3 (fr)] **

 

-- C:\Users\Moumoune\AppData\Roaming\Mozilla\FireFox\Profiles\lhxxbloi.default\User.js --

keyword.URL, hxxp://redirecterror.sfr.fr/?q=

 

-- C:\Users\Moumoune\AppData\Roaming\Mozilla\FireFox\Profiles\lhxxbloi.default\Prefs.js --

browser.download.dir, C:\\Users\\Moumoune\\Downloads

browser.download.lastDir, C:\\Users\\Moumoune\\Downloads

browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

browser.search.selectedEngine, Google

browser.startup.homepage, hxxp://www.sfr.fr/

browser.startup.homepage_override.mstone, rv:1.9.2.3

keyword.URL, hxxp://redirecterror.sfr.fr/?q=

 

========================================

 

** Internet Explorer Version [8.0.6001.18928] **

 

[HKCU\Software\Microsoft\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Do404Search: 0x01000000

Enable Browser Extensions: yes

Local Page: C:\Windows\system32\blank.htm

Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896

Show_ToolBar: yes

Start Page: hxxp://fr.msn.com/

Use Search Asst: no

 

[HKLM\Software\Microsoft\Internet Explorer\Main]

AutoHide: yes

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Delete_Temp_Files_On_Exit: yes

Local Page: C:\Windows\System32\blank.htm

Search bar: hxxp://search.msn.com/spbasic.htm

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Start Page: hxxp://fr.msn.com/

 

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

Blank: res://mshtml.dll/blank.htm

 

========================================

 

C:\Program Files\Ad-Remover\Quarantine: 2 Fichier(s)

C:\Program Files\Ad-Remover\Backup: 20 Fichier(s)

 

C:\Ad-Report-CLEAN[1].txt - 04/06/2010 (3543 Octet(s))

C:\Ad-Report-CLEAN[2].txt - 16/06/2010 (499 Octet(s))

C:\Ad-Report-SCAN[1].txt - 04/06/2010 (3355 Octet(s))

C:\Ad-Report-SCAN[2].txt - 16/06/2010 (2745 Octet(s))

C:\Ad-Report-SCAN[3].txt - 17/06/2010 (0 Octet(s))

 

Fin à: 08:22:58, 17/06/2010

 

============== E.O.F ==============

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:36:33, on 17/06/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18928)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Windows\WindowsMobile\wmdSync.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\CyberLink\Shared files\brs.exe

C:\Program Files\Pack Securite\Common\FSM32.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\conime.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\System32\mobsync.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\trend micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=C:\Windows\system32\ezShellStart.exe

O1 - Hosts: ::1 localhost

O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\Neuf\Kit\SFRNavErrorHelper.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Pack Securite\NRS\iescript\baselitmus.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Pack Securite\NRS\iescript\baselitmus.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe

O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"

O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"

O4 - HKLM\..\Run: [bDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [smpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

O13 - Gopher Prefix:

O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe

O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE

O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Pack Securite\ORSP Client\fsorsp.exe

O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Service Google Update (gupdate1c9b6c4a3f02135) (gupdate1c9b6c4a3f02135) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: O2FLASH (o2flash) - O2Micro International - C:\Windows\system32\DRIVERS\o2flash.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

 

--

End of file - 8816 bytes

[moisetita]

je Logfile of random's system information tool 1.07 (written by random/random)

Run by Moumoune at 2010-06-17 14:16:48

Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2

System drive C: has 147 GB (65%) free of 226 GB

Total RAM: 3066 MB (51% free)

 

HijackThis download failed

 

======Scheduled tasks folder======

 

C:\Windows\tasks\Ad-Aware Update (Weekly).job

C:\Windows\tasks\Extension de garantie-Moumoune.job

C:\Windows\tasks\Google Software Updater.job

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

C:\Windows\tasks\Scheduled scanning task.job

 

======Registry dump======

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]

Objet d'aide à la navigation SFR - C:\Program Files\Neuf\Kit\SFRNavErrorHelper.dll [2009-10-15 165184]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]

Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-05-14 191792]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-13 279664]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-02-13 812528]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6867EB7-8350-4856-877F-93CF8AE3DC9C}]

Browsing Protection Class - C:\Program Files\Pack Securite\NRS\iescript\baselitmus.dll [2010-05-26 539384]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]

CBrowserHelperObject Object - C:\Program Files\Google\Google_BAE\BAE.dll [2006-11-09 98304]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-12 41760]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-13 279664]

{265EEE8E-3228-44D3-AEA5-F7FDF5860049} - Browsing Protection Toolbar - C:\Program Files\Pack Securite\NRS\iescript\baselitmus.dll [2010-05-26 539384]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]

"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-09-18 6294048]

"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]

"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-06-08 894512]

"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-19 30192]

"toolbar_eula_launcher"=C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe [2007-02-20 28672]

"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2008-01-21 215552]

"RemoteControl8"=C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-03-20 83240]

"PDVD8LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]

"BDRegion"=C:\Program Files\Cyberlink\Shared Files\brs.exe [2008-10-07 75048]

"F-Secure Manager"=C:\Program Files\Pack Securite\Common\FSM32.EXE [2009-11-18 201128]

"F-Secure TNB"=C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe [2009-11-18 1655208]

"Ad-Watch"=C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2010-03-15 524632]

"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"SmpcSys"=C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [2008-02-04 1038136]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-01-14 1688872]

"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-05-22 68856]

"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{E54729E8-BB3D-4270-9D49-7389EA579090}"=C:\Windows\system32\EZUPBH~1.DLL [2009-03-09 49152]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"EnableLUA"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"BindDirectlyToPropertySetStorage"=

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f297b9e9-1e9a-11de-9e4d-00238b32fda5}]

shell\AutoRun\command - F:\LaunchU3.exe -a

 

 

======File associations======

 

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

 

======List of files/folders created in the last 1 months======

 

2010-06-17 14:16:48 ----D---- C:\rsit

2010-06-17 08:20:45 ----A---- C:\Ad-Report-SCAN[3].txt

2010-06-17 08:08:06 ----A---- C:\Windows\ntbtlog.txt

2010-06-16 17:31:25 ----A---- C:\Ad-Report-CLEAN[2].txt

2010-06-16 17:14:13 ----A---- C:\Ad-Report-SCAN[2].txt

2010-06-16 17:12:56 ----D---- C:\Program Files\Ad-Remover

2010-06-09 04:02:12 ----A---- C:\Windows\system32\asycfilt.dll

2010-06-09 04:02:07 ----A---- C:\Windows\system32\atmfd.dll

2010-06-09 04:02:06 ----A---- C:\Windows\system32\atmlib.dll

2010-06-09 04:01:32 ----A---- C:\Windows\system32\mshtml.dll

2010-06-09 04:01:31 ----A---- C:\Windows\system32\ieframe.dll

2010-06-09 04:01:30 ----A---- C:\Windows\system32\urlmon.dll

2010-06-09 04:01:30 ----A---- C:\Windows\system32\iertutil.dll

2010-06-09 04:01:29 ----A---- C:\Windows\system32\wininet.dll

2010-06-09 04:01:29 ----A---- C:\Windows\system32\occache.dll

2010-06-09 04:01:29 ----A---- C:\Windows\system32\msfeeds.dll

2010-06-09 04:01:29 ----A---- C:\Windows\system32\iedkcs32.dll

2010-06-09 04:01:28 ----A---- C:\Windows\system32\mstime.dll

2010-06-09 04:01:28 ----A---- C:\Windows\system32\ieui.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\msfeedssync.exe

2010-06-09 04:01:27 ----A---- C:\Windows\system32\msfeedsbs.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\jsproxy.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\ieUnatt.exe

2010-06-09 04:01:27 ----A---- C:\Windows\system32\iesysprep.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\iesetup.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\iernonce.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\iepeers.dll

2010-06-09 04:01:27 ----A---- C:\Windows\system32\ie4uinit.exe

2010-06-04 08:36:55 ----A---- C:\Ad-Report-CLEAN[1].txt

2010-06-04 08:29:22 ----A---- C:\Ad-Report-SCAN[1].txt

2010-06-03 18:32:27 ----D---- C:\Program Files\Lavalys

2010-06-03 09:25:26 ----D---- C:\Program Files\trend micro

2010-06-02 21:09:50 ----D---- C:\Windows\Sun

2010-06-02 17:28:00 ----SHD---- C:\found.000

2010-05-27 08:06:02 ----D---- C:\Users\Moumoune\AppData\Roaming\Radio France

2010-05-26 05:33:07 ----A---- C:\Windows\system32\tzres.dll

2010-05-23 08:05:28 ----D---- C:\Users\Moumoune\AppData\Roaming\Malwarebytes

2010-05-23 08:05:19 ----D---- C:\ProgramData\Malwarebytes

2010-05-23 08:05:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

 

======List of files/folders modified in the last 1 months======

 

2010-06-17 14:16:50 ----D---- C:\Windows\prefetch

2010-06-17 14:16:45 ----D---- C:\Windows\Temp

2010-06-17 12:55:36 ----D---- C:\Windows\Tasks

2010-06-17 12:55:26 ----D---- C:\ProgramData\Google Updater

2010-06-17 12:52:54 ----SHD---- C:\System Volume Information

2010-06-17 12:01:24 ----SHD---- C:\Windows\Installer

2010-06-17 11:30:31 ----D---- C:\Windows\system32\LogFiles

2010-06-17 08:09:44 ----D---- C:\Windows\system32\catroot2

2010-06-17 08:08:06 ----D---- C:\Windows

2010-06-16 17:36:57 ----HD---- C:\ProgramData

2010-06-16 17:12:56 ----RD---- C:\Program Files

2010-06-16 16:25:48 ----D---- C:\Windows\Debug

2010-06-16 16:21:28 ----D---- C:\Program Files\CCleaner

2010-06-16 15:54:01 ----D---- C:\Windows\system32\Tasks

2010-06-14 12:04:30 ----D---- C:\Windows\System32

2010-06-14 12:04:30 ----A---- C:\Windows\system32\PerfStringBackup.INI

2010-06-14 12:04:29 ----D---- C:\Windows\inf

2010-06-09 12:54:25 ----D---- C:\Windows\Microsoft.NET

2010-06-09 12:47:58 ----RSD---- C:\Windows\assembly

2010-06-09 12:39:40 ----D---- C:\Windows\winsxs

2010-06-09 12:29:31 ----D---- C:\Windows\system32\catroot

2010-06-09 12:25:30 ----D---- C:\Program Files\Windows Mail

2010-06-09 12:25:30 ----D---- C:\Program Files\Internet Explorer

2010-06-09 12:25:28 ----D---- C:\Windows\system32\migration

2010-06-09 12:02:04 ----D---- C:\Windows\system32\wbem

2010-06-08 05:55:53 ----D---- C:\ProgramData\Adobe

2010-06-08 05:55:20 ----D---- C:\Program Files\Common Files\Adobe

2010-06-08 05:55:17 ----D---- C:\Program Files\Adobe

2010-06-05 05:58:47 ----D---- C:\Program Files\Microsoft Silverlight

2010-06-04 16:27:21 ----D---- C:\Windows\system32\drivers

2010-06-04 12:02:02 ----SD---- C:\ProgramData\Microsoft

2010-06-04 08:45:41 ----HD---- C:\Windows\system32\GroupPolicy

2010-06-03 11:54:43 ----D---- C:\Windows\system32\Samsung_USB_Drivers

2010-06-03 11:49:39 ----HD---- C:\Program Files\InstallShield Installation Information

2010-06-03 11:45:55 ----D---- C:\Program Files\Samsung

2010-06-03 11:33:35 ----D---- C:\Windows\system32\config

2010-06-03 11:33:26 ----DC---- C:\Windows\system32\DRVSTORE

2010-06-03 11:33:26 ----D---- C:\Windows\system32\spool

2010-06-03 11:33:26 ----D---- C:\Windows\system32\Msdtc

2010-06-03 11:33:26 ----D---- C:\ProgramData\Lavasoft

2010-06-03 11:33:25 ----D---- C:\Windows\registration

2010-06-02 17:58:26 ----HDC---- C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}

2010-05-28 21:37:34 ----A---- C:\Windows\system32\mrt.exe

2010-05-26 18:58:56 ----D---- C:\Windows\rescache

2010-05-26 11:43:11 ----D---- C:\Windows\system32\fr-FR

2010-05-25 22:28:08 ----SD---- C:\Users\Moumoune\AppData\Roaming\Microsoft

 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R1 F-Secure HIPS;F-Secure HIPS Driver; \??\C:\Program Files\Pack Securite\HIPS\drivers\fshs.sys [2009-11-18 69928]

R1 FSES;F-Secure Email Scanning Driver; C:\Windows\System32\drivers\fses.sys [2010-03-16 35792]

R1 FSFW;F-Secure Firewall Driver; C:\Windows\System32\drivers\fsdfw.sys [2009-11-18 72904]

R1 fsvista;F-Secure Vista Support Driver; \??\C:\Program Files\Pack Securite\Anti-Virus\minifilter\fsvista.sys [2009-11-18 14248]

R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2006-07-24 5632]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl [2008-10-07 61424]

R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-07-04 3847168]

R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]

R3 F-Secure Gatekeeper;F-Secure Gatekeeper; \??\C:\Program Files\Pack Securite\Anti-Virus\minifilter\fsgk.sys [2010-06-16 113864]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-09-18 2169944]

R3 O2MDRDR;O2MDRDR; C:\Windows\system32\DRIVERS\o2media.sys [2008-08-22 51288]

R3 O2SDRDR;O2SDRDR; C:\Windows\system32\DRIVERS\o2sd.sys [2008-06-12 43608]

R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIV.sys [2008-06-18 147168]

R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-05-02 122368]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter; C:\Windows\system32\DRIVERS\RTL8187B.sys [2007-11-08 288768]

R3 StillCam;Pilote d'appareil photo numérique série; C:\Windows\system32\DRIVERS\serscan.sys [2008-01-21 9216]

R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-06-08 187448]

R3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]

R3 X10Hid;X10 Hid Device; C:\Windows\System32\Drivers\x10hid.sys [2006-11-17 13976]

S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [2009-12-18 14336]

S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-12-14 36608]

S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]

S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2009-09-21 90112]

S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-21 14976]

S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2009-09-21 121856]

S3 usb_rndisx;Carte RNDIS USB; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-04-11 15872]

S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]

S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 F-Secure Filter;F-Secure File System Filter; \??\C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSfilter.sys [2009-11-18 41640]

S4 F-Secure Recognizer;F-Secure File System Recognizer; \??\C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSrec.sys [2009-11-18 27048]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

 

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 124832]

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-07-04 692224]

R2 ezSharedSvc;Easybits Shared Services for Windows; C:\Windows\system32\svchost.exe [2008-01-21 21504]

R2 F-Secure Gatekeeper Handler Starter;FSGKHS; C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe [2009-11-18 221608]

R2 FSMA;FSMA; C:\Program Files\Pack Securite\Common\FSMA32.EXE [2009-11-18 188840]

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]

R2 o2flash;O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [2008-08-22 71512]

R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920]

R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-21 21504]

R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2007-05-14 272024]

R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2010-05-14 249136]

R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-21 21504]

R2 x10nets;X10 Device Network Service; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [2001-11-12 20480]

R3 FSDFWD;F-Secure Anti-Virus Firewall Daemon; C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe [2009-11-18 524712]

R3 FSORSPClient;F-Secure ORSP Client; C:\Program Files\Pack Securite\ORSP Client\fsorsp.exe [2010-05-17 55992]

R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-01-14 447784]

S2 gupdate1c9b6c4a3f02135;Service Google Update (gupdate1c9b6c4a3f02135); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-06 133104]

S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-06 183280]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-05-22 647680]

S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-19 30192]

S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-12-17 243056]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]

S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-15 1029456]

 

-----------------EOF-----------------

rajoute le rapport RSITque j'avais oublié