Lenteurs [Résolu]

[rapasse]

Bonjour,

 

Depuis 2 semaine ma machine rame de nouveau ceci est général au PC, programme qui se bloque, firfox qui ne répond plus, il lui est arriver de s'éteindre tout seul (avant hier il a rebooter seul), je me suis aperçue qu'il chercher sans cesse même si je ne fait rien.

Je vous poste un log HijackThis:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:52:26, on 13/11/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe

C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\cacaoweb\cacaoweb.exe

C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Actualité, Sport et Vidéo

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Actualité, Sport et Vidéo

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

O4 - HKCU\..\Run: [cacaoweb] "C:\Program Files\cacaoweb\cacaoweb.exe" -noplayer

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

O23 - Service: BitDefender Serveur Arrakis (Arrakis3) - BitDefender S.R.L. Antivirus Software – BitDefender - Virus Protection Security Now! - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

 

--

End of file - 9588 bytes

 

 

En vous remerciant de votre aide.

 

Bonne journée à tous

Modifié le 27 novembre 2010 par rapasse

[lance_yien]

Bonjour rapasse,

 

---

Très Important!

 

>>> A faire immédiatement:

En haut de ce message cliquer sur le bouton "Suivre ce sujet", en choisissant "Notification immédiate" => "Soumettre" tu seras avisé en temps réel pour les réponses apportées à ton sujet et de ce fait, ta machine sera nettoyée dans les meilleurs délais.

 

>>> Que faire durant ce nettoyage, merci de NE PAS utiliser, installer et/ou désinstaller aucun programme à part ceux qui sont proposés à chaque étape ce qui a pour but d'éviter tout problème d'incompatibilité entre les outils.

 

>>> Que faire à la réception de nouvelles instructions,

• Lire la totalité du message.
  
• Télécharger et enregistrer les utilitaires DIRECTEMENT sur le Bureau ou les déplacer (tout de suite après par un clic-droit dessus => "Couper" puis clic-droit sur le Bureau => "Coller".
  Certains programmes peuvent créer des problèmes s'ils ne sont pas lancés depuis le Bureau.
  
• Prendre l'habitude de désactiver tous les programmes de protection au début de chaque nouvelle étape et de les réactiver à la fin.
  
• Procéder toujours dans l'ordre donné et demander des clarifications si nécessaire AVANT de commencer.
  
• NE PAS hésiter à commenter et signaler tout changement (en bien ou en mal) dans le comportement de la machine ou par rapport au problème initial.
  

>>> Comment répondre: Cliquer sur le bouton car je n'ai pas besoin de relire mes messages précédents.

---

 

Imprimer ces instructions ou les enregistrer dans un fichier texte sur le Bureau pour les consulter facilement à tout moment.

 

cacaoweb est un méchant programme. Et comme il est dur à supprimer par la méthode normale (parait-il), je te propose d'utiliser Revo Uninstaller pour le désinstaller proprement:

• Installer Revo Uninstaller après l'avoir téléchargé ICI.
   
  
• Lancer le programme depuis son icône sur le Bureau ou depuis "Démarrer" => "Tous les Programmes" => "Revo Uninstaller".
   
  
• Sélectionner cacaoweb dans la liste et cliquer sur le bouton Désinstaller
   
  
• Choisir le mode Avancé (tout en bas) et cliquer sur Suivant.
   
  Suivre les instructions.
   
  
• Cliquer sur Sélectionner tout (1) puis sur Supprimer (2) .
   
  Ceci a pour effet de supprimer tous les items listés dans le champ en haut de la fenêtre.
   
  
• Cliquer sur le bouton Fini pour fermer la fenêtre.
  

 

>>> Télécharger, sur le Bureau:

• OTL (par OldTimer) depuis ici ou ici.
• Security Check (par screen317) depuis ici ou ici.

 

>>> Brancher et allumer tous les médias amovibles ayant servi à un quelconque transfert de données (clés USB...).

Fermer tout et double-cliquer sur OTL.exe.

Copiez/ Collez ces lignes (commençant par netsvcs) dans l'espace sous "Personnalisation":

netsvcs

%SYSTEMDRIVE%\*.*

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

Sans rien changer, cliquer sur le bouton bleu Analyse et laisser faire.

A la fin du scan, 2 rapports seront créés: OTL.txt (qui s'ouvre dans le bloc-note) et Extras.txt (qui sera minimisé dans la Barre des tâches).

 

Poster le contenu de chaque rapport, un seul par message parce qu'ils sont souvent très longs et dépassent la limite autorisée par le forum.

 

>>> Utiliser SecurityCheck: Fermer tout et double-cliquer sur "SecurityCheck.exe" pour lancer le programme.

Appuyer sur une touche comme demandé et suivre les indications.

Note: Si un des programmes de sécurité demande la permission d'accéder à Internet depuis dig.exe, acceptez.

Le Rapport checkup.txt s'ouvre à la fin. Poster son contenu.

Ce rapport ne sera pas enregistré automatiquement. Si vous voulez en garder une copie, cliquez sur "Fichier" => "Enregistrer sous", choisissez un endroit (Bureau par exemple) et cliquez sur "Enregistrer" en bas à droite.

Poster son contenu.

 

Rapports demandés:

• OTL.txt
• Extras.txt
• checkup.txt

[rapasse]

Bonsoir,

 

Un grand merci de me venir en aide, il n'y a pas cacaoweb, dans la liste, ainsi que avancer n'est pas en bas ,j'ai pas réussi à faire cette partis demander...

Alors voici le rapport OTL:

 

OTL logfile created on: 15/11/2010 20:01:08 - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\HP_Administrateur\Bureau

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free

5,00 Gb Paging File | 4,00 Gb Available in Paging File | 86,00% Paging File free

Paging file location(s): C:\pagefile.sys 3072 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 226,07 Gb Total Space | 153,11 Gb Free Space | 67,73% Space Free | Partition Type: NTFS

Drive D: | 6,80 Gb Total Space | 0,83 Gb Free Space | 12,25% Space Free | Partition Type: FAT32

Drive I: | 124,94 Mb Total Space | 95,94 Mb Free Space | 76,79% Space Free | Partition Type: FAT

Drive K: | 3,85 Gb Total Space | 0,85 Gb Free Space | 22,15% Space Free | Partition Type: FAT32

Drive L: | 298,09 Gb Total Space | 172,42 Gb Free Space | 57,84% Space Free | Partition Type: NTFS

 

Computer Name: NOM-FB9B15D2723 | User Name: HP_Administrateur | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2010/11/15 18:43:16 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrateur\Bureau\OTL.exe

PRC - [2010/11/13 12:11:50 | 000,299,536 | ---- | M] () -- C:\Program Files\cacaoweb\cacaoweb.exe

PRC - [2010/10/29 10:39:51 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe

PRC - [2010/10/29 10:39:49 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2010/08/24 10:38:18 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

PRC - [2010/05/05 12:54:46 | 001,615,688 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe

PRC - [2010/04/01 15:40:02 | 001,123,360 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe

PRC - [2010/04/01 15:39:55 | 001,091,984 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe

PRC - [2010/01/28 14:31:49 | 000,308,552 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe

PRC - [2009/03/30 21:03:26 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

PRC - [2008/12/27 19:52:09 | 000,086,016 | ---- | M] (BitDefender) -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

PRC - [2008/04/14 03:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/09/04 18:25:44 | 000,131,072 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

PRC - [2007/08/09 08:27:52 | 000,073,728 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe

PRC - [2006/07/06 14:15:00 | 000,151,552 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2006/07/06 14:14:30 | 000,090,112 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2006/06/21 04:08:48 | 000,049,152 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

PRC - [2006/06/01 23:25:00 | 000,180,224 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe

PRC - [2004/07/27 23:50:18 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

 

 

========== Modules (SafeList) ==========

 

MOD - [2010/11/15 18:43:16 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrateur\Bureau\OTL.exe

MOD - [2010/10/14 17:32:36 | 000,286,720 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\plugin_nt.m32

MOD - [2010/10/14 17:32:36 | 000,176,128 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\plugin_extra.m32

MOD - [2010/10/14 17:32:36 | 000,098,304 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\plugin_net.m32

MOD - [2010/10/14 17:32:35 | 000,667,648 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\plugin_fragments.m32

MOD - [2010/10/14 17:32:35 | 000,237,504 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\midas32.dll

MOD - [2010/10/14 17:32:35 | 000,151,552 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\plugin_base.m32

MOD - [2010/10/14 17:32:35 | 000,126,976 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) -- C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_68\plugin_registry.m32

MOD - [2010/08/23 17:12:39 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

 

 

========== Win32 Services (SafeList) ==========

 

SRV - [2010/08/24 10:38:18 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)

SRV - [2010/05/05 12:54:46 | 001,615,688 | ---- | M] (BitDefender S.R.L.) [Auto | Running] -- C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe -- (VSSERV)

SRV - [2010/04/01 15:39:55 | 000,315,392 | ---- | M] (S.C. BitDefender S.R.L) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\scan.dll -- (scan)

SRV - [2010/01/28 14:31:49 | 000,308,552 | ---- | M] (BitDefender S.R.L.) [Auto | Running] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe -- (LIVESRV)

SRV - [2010/01/12 18:36:57 | 000,183,880 | ---- | M] (BitDefender S.R.L. http://www.bitdefender.com) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe -- (Arrakis3)

SRV - [2008/12/27 19:52:09 | 000,086,016 | ---- | M] (BitDefender) [Auto | Running] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe -- (XCOMM)

SRV - [2008/11/04 00:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2007/10/25 14:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)

SRV - [2007/09/04 18:25:44 | 000,131,072 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)

SRV - [2007/08/09 08:27:52 | 000,073,728 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

SRV - [2006/10/26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2006/07/06 14:14:30 | 000,090,112 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®

SRV - [2006/06/21 04:08:48 | 000,049,152 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe -- (LightScribeService)

SRV - [2006/06/01 23:25:00 | 000,180,224 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe -- (ELService) Intel®

SRV - [2005/04/03 23:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbVM31b.sys -- (ZSMC301b)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\mcdbus.sys -- (mcdbus)

DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys -- (ASInsHelp)

DRV - [2010/07/10 04:38:00 | 010,604,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2010/06/04 11:29:04 | 001,606,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)

DRV - [2010/05/05 12:54:52 | 000,119,504 | ---- | M] (BitDefender LLC) [Kernel | System | Running] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Firewall\bdftdif.sys -- (bdftdif)

DRV - [2010/05/05 12:54:52 | 000,058,368 | ---- | M] (BitDefender) [Kernel | On_Demand | Running] -- C:\Program Files\BitDefender\BitDefender 2010\bdselfpr.sys -- (BDSelfPr)

DRV - [2010/05/05 12:54:48 | 000,085,128 | ---- | M] (BitDefender) [Kernel | Auto | Running] -- C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys -- (BDVEDISK)

DRV - [2010/05/05 12:54:44 | 000,111,312 | ---- | M] (BitDefender LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bdfndisf.sys -- (Bdfndisf)

DRV - [2010/04/01 15:39:56 | 000,291,352 | ---- | M] (BitDefender) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\bdfsfltr.sys -- (bdfsfltr)

DRV - [2010/02/13 20:17:00 | 000,153,448 | ---- | M] (BitDefender S.R.L. Bucharest, ROMANIA) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bdfm.sys -- (bdfm)

DRV - [2010/01/12 18:37:46 | 000,014,720 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\profos.sys -- (Profos)

DRV - [2009/05/07 04:22:06 | 000,039,808 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\trufos.sys -- (Trufos)

DRV - [2008/07/08 13:54:02 | 000,148,496 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\64425156.sys -- (is-GQI3Ndrv)

DRV - [2008/04/13 19:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)

DRV - [2008/04/13 19:45:36 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irbus.sys -- (IrBus)

DRV - [2008/04/13 17:36:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2007/12/11 20:34:40 | 000,242,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel®

DRV - [2007/09/04 18:26:32 | 000,029,696 | ---- | M] (NVidia Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\nvoclock.sys -- (NVR0Dev)

DRV - [2006/09/24 14:28:46 | 000,005,248 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2006/07/25 00:15:04 | 004,353,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2006/07/06 14:59:42 | 000,246,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\iastor.sys -- (iaStor)

DRV - [2006/05/09 22:36:44 | 000,009,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ELacpi.sys -- (ELacpi)

DRV - [2006/05/09 22:36:42 | 000,007,040 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Elmon.sys -- (ELmon)

DRV - [2006/05/09 22:36:22 | 000,006,912 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Elkbd.sys -- (ELkbd)

DRV - [2006/05/09 22:36:20 | 000,006,400 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Elmou.sys -- (ELmou)

DRV - [2006/05/09 22:36:18 | 000,010,112 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Elhid.sys -- (ELhid)

DRV - [2006/04/12 04:36:56 | 002,829,696 | ---- | M] (ASUSTek) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\3xHybrid.sys -- (3xHybrid)

DRV - [2005/12/13 01:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)

DRV - [2005/10/05 03:44:06 | 000,468,768 | ---- | M] (Liteon Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wn5301.sys -- (WN5301)

DRV - [2005/06/29 16:03:18 | 000,175,104 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys -- (ftsata2)

DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C)

DRV - [2003/11/05 06:45:12 | 000,017,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\bb-run.sys -- (bb-run)

DRV - [2003/05/14 12:42:56 | 000,021,216 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmFilter.sys -- (WmFilter)

DRV - [2003/05/14 12:42:50 | 000,010,144 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmBEnum.sys -- (WmBEnum)

DRV - [2003/05/14 12:42:48 | 000,005,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmVirHid.sys -- (WmVirHid)

DRV - [2003/05/14 12:42:44 | 000,044,288 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmXlCore.sys -- (WmXlCore)

DRV - [1996/04/03 20:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Actualité, Sport et Vidéo

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Actualité, Sport et Vidéo

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.google.fr/"

FF - prefs.js..extensions.enabledItems: FFToolbar@bitdefender.com:2.0

FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.50

FF - prefs.js..extensions.enabledItems: fr-FR@dictionaries.addons.mozilla.org:3.5

FF - prefs.js..extensions.enabledItems: fr@dictionaries.addons.mozilla.org:3.5

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1

FF - prefs.js..extensions.enabledItems: illimitux@illimitux.net:4.0

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.6.2.119

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..keyword.URL: ""

 

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/03/30 21:04:17 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\extensions\\FFToolbar@bitdefender.com: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ [2010/09/20 17:01:41 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/29 10:39:52 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/29 10:39:52 | 000,000,000 | ---D | M]

 

[2008/09/20 11:59:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Extensions

[2008/09/20 11:59:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Extensions\home2@tomtom.com

[2010/11/15 18:52:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions

[2010/05/02 20:04:46 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/10/18 17:07:55 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2010/10/31 15:25:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

[2010/01/12 18:06:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}(2)

[2007/12/01 19:22:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\fr@dictionaries.addons.mozilla(2).org

[2010/02/15 20:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\fr@dictionaries.addons.mozilla.org

[2010/02/15 20:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\fr-FR@dictionaries.addons.mozilla.org

[2010/11/10 22:36:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\illimitux@illimitux.net

[2010/10/18 20:32:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\extensions\toolbar@ask.com

[2008/12/17 15:10:35 | 000,001,775 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\searchplugins\live-search.xml

[2010/11/15 18:52:56 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/10/09 13:30:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010/07/17 04:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2007/07/09 11:59:00 | 002,113,536 | ---- | M] (Rawflow Ltd) -- C:\Program Files\Mozilla Firefox\plugins\npicdclient.dll

[2010/06/25 17:24:56 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml

[2010/06/25 17:24:56 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml

[2010/06/25 17:24:56 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml

[2010/06/25 17:24:56 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml

[2010/06/25 17:24:56 | 000,000,956 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

 

O1 HOSTS File: ([2004/08/10 12:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [bDAgent] C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe (BitDefender S.R.L.)

O4 - HKLM..\Run: [bitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe (BitDefender S.R.L.)

O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4 - HKLM..\Run: [iSUSPM Startup] C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)

O4 - HKLM..\Run: [KernelFaultCheck] File not found

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\Run: [cacaoweb] C:\Program Files\cacaoweb\cacaoweb.exe ()

O4 - HKCU..\Run: [NVIDIA nTune] C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe (NVIDIA)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 255

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 0

O9 - Extra Button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()

O9 - Extra 'Tools' menuitem : Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab (Reg Error: Key error.)

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab (UnoCtrl Class)

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab (BDSCANONLINE Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Ma page d'accueil) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/01/03 02:48:17 | 000,000,100 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2010/03/24 16:00:00 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2001/07/27 08:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]

O32 - AutoRun File - [2010/03/24 16:00:02 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ FAT32 ]

O32 - AutoRun File - [2010/03/24 16:00:00 | 000,000,000 | RHSD | M] - L:\autorun.inf -- [ NTFS ]

O33 - MountPoints2\{1f9502f8-68b0-11dd-a569-00c0a8c4911d}\Shell - "" = AutoRun

O33 - MountPoints2\{8503f77c-b544-11df-9678-00c0a8c4911d}\Shell - "" = AutoRun

O33 - MountPoints2\{8503f77c-b544-11df-9678-00c0a8c4911d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found

O33 - MountPoints2\{92a3cff2-9b49-11df-962c-00c0a8c4911d}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found

O33 - MountPoints2\{d83c835a-bd91-11df-968e-00c0a8c4911d}\Shell\AutoRun\command - "" = K:\InstallTomTomHOME.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

========== Files/Folders - Created Within 30 Days ==========

 

[2010/11/15 18:43:16 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrateur\Bureau\OTL.exe

[2010/11/15 18:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group

[2010/11/14 21:19:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Application Data\U3

[2010/11/10 22:46:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Application Data\cacaoweb

[2010/11/10 22:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\cacaoweb

[2010/11/04 19:05:33 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HP_Administrateur\Recent

[2010/10/31 15:43:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google

[2010/10/31 15:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Temp

[2010/10/31 15:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google

[2010/10/31 15:06:00 | 000,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm

[2010/10/31 15:06:00 | 000,151,552 | ---- | C] (fccHandler) -- C:\WINDOWS\System32\ac3acm.acm

[2010/10/31 15:05:55 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack

[2010/10/18 19:54:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Remover

[2010/10/18 19:14:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Sony

[2010/10/18 19:13:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Mes documents\My Podcasts

[2010/10/18 19:13:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Mes documents\Media Go

[2010/10/18 19:10:17 | 000,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\Sony Shared

[2010/10/18 19:08:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Downloaded Installations

[2010/10/18 19:08:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sony Corporation

[2010/10/18 19:08:26 | 000,000,000 | ---D | C] -- C:\Program Files\Sony

[2010/10/18 19:06:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Application Data\Sony

[2010/10/18 19:05:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Sony Ericsson

[2010/10/18 19:04:36 | 000,000,000 | ---D | C] -- C:\Program Files\Sony Ericsson

[2010/10/18 19:04:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sony Ericsson

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2010/11/15 20:00:00 | 000,000,390 | ---- | M] () -- C:\WINDOWS\tasks\HPpromotions journeysoftware.job

[2010/11/15 19:43:00 | 000,000,908 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/11/15 18:43:34 | 000,869,051 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\SecurityCheck.exe

[2010/11/15 18:43:16 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrateur\Bureau\OTL.exe

[2010/11/15 18:34:42 | 000,000,928 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\Revo Uninstaller.lnk

[2010/11/15 18:29:36 | 002,409,944 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\revosetup.exe

[2010/11/15 18:19:34 | 000,000,376 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Application Dataprivacy.xml

[2010/11/15 18:18:58 | 000,000,248 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat

[2010/11/15 18:18:27 | 000,000,904 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/11/15 18:18:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/11/14 23:43:13 | 034,600,916 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx

[2010/11/14 23:43:12 | 2952,163,360 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat

[2010/11/14 23:43:07 | 000,000,052 | ---- | M] () -- C:\WINDOWS\System32\ashttpstats.csv

[2010/11/14 22:59:16 | 000,000,597 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\Mes dossiers de partage.lnk

[2010/11/14 21:30:25 | 000,146,944 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/11/13 14:49:44 | 733,401,088 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\Steppin' 2.avi

[2010/11/13 13:20:42 | 000,290,709 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\Diapo messe 14 novembre 2010 JP.pptx

[2010/11/13 12:00:15 | 000,021,005 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\Jesus-et-disciples.jpg

[2010/11/10 10:00:53 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/11/08 21:44:38 | 000,084,992 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\dm loéna.odt

[2010/11/05 00:43:44 | 000,080,460 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\couverutre Loéna.odt

[2010/11/04 22:48:54 | 000,033,694 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\2042436_7055543_la-nuit-des-temps.jpg

[2010/11/04 18:46:26 | 000,000,693 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\CCleaner.lnk

[2010/10/31 15:46:09 | 000,001,926 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Google Earth.lnk

[2010/10/31 10:12:53 | 000,515,048 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat

[2010/10/31 10:12:53 | 000,445,506 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/10/31 10:12:53 | 000,086,514 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat

[2010/10/31 10:12:53 | 000,072,712 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/10/21 09:42:58 | 019,792,940 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\.wav

[2010/10/21 09:16:08 | 000,000,335 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\Mes documents.lnk

[2010/10/18 19:54:26 | 000,001,565 | ---- | M] () -- C:\Documents and Settings\HP_Administrateur\Bureau\AD-R.lnk

[2010/10/18 19:10:23 | 000,001,633 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Media Go.lnk

[2010/10/18 19:04:49 | 000,001,916 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Sony Ericsson PC Companion 1.6.lnk

[2010/10/18 09:00:00 | 000,108,032 | ---- | M] () -- C:\WINDOWS\System32\ff_vfw.dll

[2010/10/18 09:00:00 | 000,000,038 | ---- | M] () -- C:\WINDOWS\avisplitter.ini

[2010/10/17 20:45:27 | 000,001,740 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 9.lnk

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2010/11/15 18:43:34 | 000,869,051 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\SecurityCheck.exe

[2010/11/15 18:34:42 | 000,000,928 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\Revo Uninstaller.lnk

[2010/11/15 18:29:21 | 002,409,944 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\revosetup.exe

[2010/11/13 13:23:45 | 733,401,088 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\Steppin' 2.avi

[2010/11/13 12:00:15 | 000,021,005 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\Jesus-et-disciples.jpg

[2010/11/13 11:17:35 | 000,290,709 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\Diapo messe 14 novembre 2010 JP.pptx

[2010/11/08 21:13:30 | 000,084,992 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\dm loéna.odt

[2010/11/04 22:52:26 | 000,080,460 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\couverutre Loéna.odt

[2010/11/04 21:52:03 | 000,033,694 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\2042436_7055543_la-nuit-des-temps.jpg

[2010/11/04 18:46:26 | 000,000,693 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\CCleaner.lnk

[2010/10/31 15:46:09 | 000,001,926 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Google Earth.lnk

[2010/10/31 15:38:58 | 000,000,908 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/10/31 15:38:58 | 000,000,904 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/10/31 15:06:02 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2010/10/31 15:06:01 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini

[2010/10/31 15:06:00 | 000,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml

[2010/10/31 15:05:59 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2010/10/31 15:05:59 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2010/10/31 15:05:58 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2010/10/21 09:42:58 | 019,792,940 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\.wav

[2010/10/21 09:16:08 | 000,000,335 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Mes documents\Mes documents.lnk

[2010/10/18 19:54:25 | 000,001,565 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Bureau\AD-R.lnk

[2010/10/18 19:10:23 | 000,001,633 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Media Go.lnk

[2010/10/18 19:04:49 | 000,001,916 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Sony Ericsson PC Companion 1.6.lnk

[2010/10/17 20:45:27 | 000,001,740 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Adobe Reader 9.lnk

[2010/02/21 22:36:34 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll

[2010/02/13 23:31:14 | 000,000,025 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Application Data\bdfvconp.ini

[2009/01/15 13:45:34 | 000,181,248 | ---- | C] () -- C:\WINDOWS\System32\txmlutil.dll

[2008/10/07 08:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll

[2008/10/07 08:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll

[2008/10/07 08:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll

[2008/08/27 18:13:19 | 000,041,422 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log

[2008/08/27 18:13:19 | 000,000,227 | ---- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini

[2008/08/27 18:08:59 | 000,043,593 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Application Data\Update_HP_RedboxHprblog_HPSU.log

[2008/08/27 18:08:59 | 000,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini

[2008/08/22 00:22:48 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll

[2008/08/12 15:39:40 | 000,000,140 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\fusioncache.dat

[2008/05/18 20:03:15 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2008/01/12 17:21:45 | 000,000,121 | ---- | C] () -- C:\WINDOWS\bdagent.INI

[2007/12/27 19:37:44 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt

[2007/12/04 18:41:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2007/11/14 23:02:57 | 000,003,120 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\118300.34

[2007/05/05 11:57:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSDraw.ini

[2007/03/12 11:01:30 | 000,217,088 | ---- | C] () -- C:\WINDOWS\NVGfxOgl.dll

[2007/01/31 14:50:32 | 000,913,408 | ---- | C] () -- C:\WINDOWS\System32\xreglib.dll

[2007/01/16 11:46:40 | 000,000,251 | ---- | C] () -- C:\Program Files\wt3d.ini

[2007/01/06 18:50:58 | 000,000,050 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2006/12/30 23:37:26 | 000,000,187 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Application Data\G-Force Prefs (WindowsMediaPlayer).txt

[2006/12/30 20:11:37 | 000,022,586 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat

[2006/11/25 11:34:10 | 000,146,944 | ---- | C] () -- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006/06/16 19:58:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

[2006/01/03 03:20:22 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2006/01/03 02:55:56 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys

[2006/01/03 02:51:11 | 000,014,397 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS

[2006/01/03 02:51:06 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll

[2006/01/03 02:43:39 | 000,000,157 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2006/01/03 02:39:57 | 000,000,752 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

[2006/01/03 02:39:04 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2006/01/03 02:35:00 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll

[2006/01/03 02:18:33 | 000,000,821 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2006/01/03 02:14:01 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll

[2006/01/03 02:14:01 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll

[2006/01/03 02:13:49 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll

[2005/10/10 12:33:42 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2005/08/05 22:38:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2005/03/14 13:38:28 | 000,000,469 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini

[2004/09/17 04:24:26 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll

[2003/06/24 18:20:22 | 000,000,651 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[1996/04/03 20:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 

< End of report >

 

Voilà le rapport Extra:

 

OTL Extras logfile created on: 15/11/2010 20:01:08 - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\HP_Administrateur\Bureau

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free

5,00 Gb Paging File | 4,00 Gb Available in Paging File | 86,00% Paging File free

Paging file location(s): C:\pagefile.sys 3072 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 226,07 Gb Total Space | 153,11 Gb Free Space | 67,73% Space Free | Partition Type: NTFS

Drive D: | 6,80 Gb Total Space | 0,83 Gb Free Space | 12,25% Space Free | Partition Type: FAT32

Drive I: | 124,94 Mb Total Space | 95,94 Mb Free Space | 76,79% Space Free | Partition Type: FAT

Drive K: | 3,85 Gb Total Space | 0,85 Gb Free Space | 22,15% Space Free | Partition Type: FAT32

Drive L: | 298,09 Gb Total Space | 172,42 Gb Free Space | 57,84% Space Free | Partition Type: NTFS

 

Computer Name: NOM-FB9B15D2723 | User Name: HP_Administrateur | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" File not found

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" File not found

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1700:TCP" = 1700:TCP:*:Enabled:MioNet Remote Drive Access

"1641:TCP" = 1641:TCP:*:Enabled:MioNet Remote Drive Verification

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"48113:TCP" = 48113:TCP:LocalSubNet:Enabled:maconfig_tcp

"48113:UDP" = 48113:UDP:LocalSubNet:Enabled:maconfig_udp

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL France -- File not found

"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )

"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\ma-config.com\maconfservice.exe" = C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice -- File not found

"C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\WNt500x86\RpcSandraSrv.exe" = C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service -- File not found

"C:\Program Files\cacaoweb\cacaoweb.exe" = C:\Program Files\cacaoweb\cacaoweb.exe:*:Enabled:cacaoweb -- ()

 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data

"{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow

"{0BD83598-C2EF-3343-847B-7D2E84599128}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA

"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation®Store

"{1341D838-719C-4A05-B50F-49420CA1B4BB}" = HP Boot Optimizer

"{1572F66F-F9AD-4D45-B0D2-0F45A0D5A0F6}" = OpenOffice.org 3.0

"{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus

"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress

"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java 6 Update 21

"{2DD388FF-6422-43C9-86A1-C7A99C83E946}" = ASUS nVidia Driver

"{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK

"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager

"{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1

"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder

"{3A316611-45D1-429C-AA26-B71259C44689}" = HP Photosmart, Officejet and Deskjet 7.0.A

"{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1

"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth

"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder

"{5FDD0538-C67A-4F67-B3F8-09D1AAF04D99}" = muvee autoProducer unPlugged 2.0

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler

"{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update

"{72AD53CC-CCC0-3757-8480-9EE176866A7C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA

"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune

"{82081779-4175-4666-A457-AB711CD37EF0}" = cp_LightScribeConfig

"{829DAAD6-BB11-4BB7-921B-07FFB703F944}" = CP_Package_Variety3

"{82E55892-6FFD-403F-AA97-D726846768AA}" = CP_AtenaShokunin1Config

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{866A0078-DEA7-4348-9C9A-999AF2991EAA}" = SlideShowMusic

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A534F71-3202-4464-A422-B767295E67B9}" = CP_Package_Variety2

"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime

"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload

"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules

"{90120000-0010-040C-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (French) 12

"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007

"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007

"{90120000-0015-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007

"{90120000-0016-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007

"{90120000-0018-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007

"{90120000-0019-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007

"{90120000-001A-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007

"{90120000-001B-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007

"{90120000-001F-0401-0000-0000000FF1CE}_PROPLUS_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007

"{90120000-001F-0413-0000-0000000FF1CE}_PROPLUS_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007

"{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007

"{90120000-0044-040C-0000-0000000FF1CE}_PROPLUS_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007

"{90120000-006E-040C-0000-0000000FF1CE}_PROPLUS_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{93E5A317-24EC-4744-812C-16FECFE86E6A}" = CP_Package_Variety1

"{93EC14D5-7AAA-4EAD-BB75-013817A96598}" = Logitech Gaming Software

"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack

"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1

"{A059DE09-1B49-4450-B340-7AE097EC3F04}" = Microsoft Works

"{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio

"{AC76BA86-7AD7-1036-7B44-A94000000001}" = Adobe Reader 9.4.0 - Français

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4

"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy

"{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig

"{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour

"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation®Network Downloader

"{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config

"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX

"{BADF6744-3787-48F6-B8C9-4C4995401D65}" = Windows Live Messenger

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C1BD77B7-C3BD-4932-BE85-39C249CCA225}" = BitDefender Internet Security 2010

"{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery

"{C3FAA091-B278-44A7-BF48-190811C5F9F7}" = cp_UpdateProjectsConfig

"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp

"{E7A02A01-C75A-4490-A168-5CA709A3D862}" = MainConcept for Software Encoder

"{EBD5E7A9-DBB8-4E24-AE3A-CF9390AF1CCB}" = Choice Guard

"{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1

"{EE5BC0BB-9EDA-423C-8276-48857B735D68}" = Prince of Persia l'Ame du Guerrier

"{EEFEBB48-329E-46F6-AEB8-929A5BAFDB2F}" = Le logiciel Intel® Viiv™

"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 1.60.13

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan

"{F80239D8-7811-4D5E-B033-0D0BBFE32920}" = HP DigitalMedia Archive

"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations

"{FB4740B3-2530-452D-A825-F7AB246CA7DF}" = muvee autoProducer 5.0

"{FBE5AA96-22F0-4C4A-8E92-4BE3498D4CCB}" = Media Go

"{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}" = Windows Live installer

"0D20D36D-A11C-444c-9AF7-70CBFED42ECF" = Otto

"99A88D57-2C93-491B-87B8-E41A870FB6BE" = GemMaster Mystic

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Ad-Remover" = Ad-Remover By C_XX

"CCleaner" = CCleaner

"DVD Shrink_is1" = DVD Shrink 3.2

"EL" = Intel® Quick Resume Technology Drivers

"HijackThis" = HijackThis 2.0.2

"HP Imaging Device Functions" = HP Imaging Device Functions 7.0

"HP Photo & Imaging" = HP Photosmart Premier Software 6.5

"HP Photosmart for Media Center PC" = HP Photosmart for Media Center PC

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"ie8" = Windows Internet Explorer 8

"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune

"InstallShield_{E7A02A01-C75A-4490-A168-5CA709A3D862}" = MainConcept for Software Encoder

"KLiteCodecPack_is1" = K-Lite Codec Pack 6.5.0 (Full)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Messenger Plus! Live" = Messenger Plus! Live

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 Language Pack SP1 - fra" = Module linguistique Microsoft .NET Framework 3.5 SP1- fra

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Midtown Madness 2.0" = Microsoft Midtown Madness 2

"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"MyDefrag v4.2.8_is1" = MyDefrag v4.2.8

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"NVIDIA Drivers" = NVIDIA Drivers

"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager

"PROPLUS" = Microsoft Office Professional Plus 2007

"PROSet" = Intel® Network Connections Drivers

"Python 2.2.3" = Python 2.2.3

"pywin32-py2.2" = Python 2.2 pywin32 extensions (build 203)

"RealPlayer 6.0" = RealPlayer

"Revo Uninstaller" = Revo Uninstaller 1.90

"SpeedFan" = SpeedFan (remove only)

"StepMania" = StepMania (remove only)

"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)

"SuperCopier2" = SuperCopier2

"SystemRequirementsLab" = System Requirements Lab

"TomTom HOME" = TomTom HOME 2.7.6.2056

"WChat" = Westwood Online

"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Lecteur Windows Media 11

"Windows XP Service" = Windows XP Service Pack 3

"WinRAR archiver" = Archiveur WinRAR

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Live Search" = Notification Live Search

 

========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 20/08/2010 12:33:11 | Computer Name = NOM-FB9B15D2723 | Source = ESENT | ID = 490

Description = svchost (1784) Une tentative d'ouverture du fichier "C:\WINDOWS\system32\CatRoot2\edb.chk"

pour accès en lecture/écriture a échoué en indiquant l'erreur système 32 (0x00000020)

: "Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un

autre processus. ". L'opération d'ouverture de fichier échouera en indiquant l'erreur

-1032 (0xfffffbf8).

 

Error - 20/08/2010 12:33:11 | Computer Name = NOM-FB9B15D2723 | Source = ESENT | ID = 439

Description = Catalog Database (1784) Impossible d'écrire un en-tête de sauvegarde

pour le fichier C:\WINDOWS\system32\CatRoot2\edb.chk. Erreur -1032.

 

Error - 11/09/2010 06:55:33 | Computer Name = NOM-FB9B15D2723 | Source = TomTomHOMEService | ID = 10000

Description =

 

Error - 19/09/2010 09:21:42 | Computer Name = NOM-FB9B15D2723 | Source = Application Error | ID = 1000

Description = Application défaillante divx plus player.exe, version 10.2.1.13, module

défaillant qtcore4.dll, version 4.5.0.0, adresse de défaillance 0x000e1b16.

 

Error - 18/10/2010 14:14:37 | Computer Name = NOM-FB9B15D2723 | Source = Application Error | ID = 1000

Description = Application défaillante pccompanion.exe, version 1.5.0.0, module défaillant

kernel32.dll, version 5.1.2600.5781, adresse de défaillance 0x00012afb.

 

[ OSession Events ]

Error - 22/06/2010 12:06:22 | Computer Name = NOM-FB9B15D2723 | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 0, Application Name: Microsoft Office Word, Application Version:

12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2

seconds with 0 seconds of active time. This session ended with a crash.

 

[ System Events ]

Error - 10/11/2010 20:22:19 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 11/11/2010 04:56:16 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 12/11/2010 03:55:44 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 12/11/2010 19:05:23 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 13/11/2010 05:11:57 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 13/11/2010 17:31:49 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 14/11/2010 06:46:14 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 14/11/2010 11:02:54 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 14/11/2010 11:22:42 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

Error - 15/11/2010 13:19:12 | Computer Name = NOM-FB9B15D2723 | Source = Service Control Manager | ID = 7000

Description = Le service ASInsHelp n'a pas pu démarrer en raison de l'erreur : %%2

 

 

< End of report >

 

Je ferme tout est lance SecurityCheck.exe

 

Merci

[rapasse]

Et pour finir voilà le dernier rapport:

 

Results of screen317's Security Check version 0.99.5

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

BitDefender Internet Security 2010

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

HijackThis 2.0.2

CCleaner

Java 6 Update 21

Adobe Flash Player 10.1.102.64

Adobe Reader 9.4.0 - Français

Mozilla Firefox (3.6.12) Firefox Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

BitDefender BitDefender 2010 vsserv.exe

Fichiers communs BitDefender BitDefender Communicator xcommsvr.exe

Fichiers communs BitDefender BitDefender Update Service livesrv.exe

BitDefender BitDefender 2010 bdagent.exe

BitDefender BitDefender 2010 seccenter.exe

````````````````````````````````

DNS Vulnerability Check:

Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

 

``````````End of Log````````````

 

 

En attendant votre aide je vous remercie et vous souhaite une bonne soirée

[lance_yien]

Bonjour,

 

il n'y a pas cacaoweb, dans la liste,...

Et dans Ajout/ Suppression de programme? Regarde et désinstalle-le si tu le trouves.

Tu as oublié de coller le texte que je t'ai donné avant de lancer OTL. Tant pis!

--

 

Imprimer ces instructions ou les enregistrer dans un fichier texte sur le Bureau pour les consulter facilement à tout moment et relancer OTL et copier la liste suivante (commençant par :OTL) et la coller dans l'espace sous "Personnalisation".

 

:OTL

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4 - HKLM..\Run: [KernelFaultCheck] File not found

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()

O4 - HKCU..\Run: [cacaoweb] C:\Program Files\cacaoweb\cacaoweb.exe ()

O33 - MountPoints2\{1f9502f8-68b0-11dd-a569-00c0a8c4911d}\Shell - "" = AutoRun

O33 - MountPoints2\{8503f77c-b544-11df-9678-00c0a8c4911d}\Shell - "" = AutoRun

O33 - MountPoints2\{8503f77c-b544-11df-9678-00c0a8c4911d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found

O33 - MountPoints2\{92a3cff2-9b49-11df-962c-00c0a8c4911d}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found

O33 - MountPoints2\{d83c835a-bd91-11df-968e-00c0a8c4911d}\Shell\AutoRun\command - "" = K:\InstallTomTomHOME.exe -- File not found

[2010/11/10 22:46:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrateur\Application Data\cacaoweb

[2010/11/10 22:46:24 | 000,000,000 | ---D | C] -- C:\Program Files\cacaoweb

[2010/10/18 19:54:06 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Remover

 

:Commands

[EMPTYTEMP]

Cliquer sur le bouton rouge Correction et laisser faire.

Si un ou plusieurs fichiers ne peuvent pas être supprimés normalement, le programme vous demandera de redémarrer la machine pour finir le processus, cliquer sur Oui.

 

A la fin un rapport s'ouvre dans le bloc-note. Copier tout son contenu et le coller dans une nouvelle réponse. Fermer le rapport et OTL.

 

>>> Utiliser Malwarebytes' Anti-Malware Télécharger, sur le Bureau Malware(partes Anti-Malware depuis ici ou ici[*]OTL (par OldTimer) depuis ici ou ici.[*]Security Check (par screen317) depuis ici ou ici.

Fermer tout et cliquer sur mbam-setup.exe. Suivre les indications en laissant tout par défaut. Cliquer sur Terminer sans rien changer.

- Lancer le programme depuis son icône sur le bureau ou depuis "Démarrer" => "Tous les programmes" => "Malwarebytes' Anti-Malware".

- Faire les Mises à jour depuis l'onglet du même nom). Si problème avec les mises à jour automatiques, cliquer ICI pour les télécharger et les installer manuellement.

- Dans l'onglet "Recherche" laisser la case "Exécuter un examen rapide" cochée et cliquer sur "Rechercher".

 

 

Patienter jusqu'à la fin (affichage du message ci-dessous)

 

 

Cliquer sur OK, pour fermer ce message.

 

- Cliquer sur "Afficher les résultats" puis sur "Supprimer la sélection".

 

Le programme procède alors au nettoyage. S'il vous demande de redémarrer le PC, ACCEPTER (c'est pour supprimer certains fichiers spécifiques).

A la fin un rapport s'affiche (accessible à tout moment depuis l'onglet Rapport/Logs de la fenêtre principale de MBAM. Poster son contenu dans la prochaine réponse.

 

 

>>> ESET Online Scanner: Désactiver antivirus/ parefeu et antispyware et utiliser Internet Explorer pour faire une analyse en ligne ICI.

• Cliquer sur le bouton vert ESET Online Scanner button, cocher la case YES, I accept the Terms of Use et cliquer sur Start.
  
• Accepter l'installation de l'ActiveX.
  
• Cocher Scan archives et cliquer Start.
  
• Eset téléchargera la base de données et commencera le scan. Le laisser finir son scan.
  
• Sauvegarder les résultats ("Fichier" => "Enregistrer sous...") sur le Bureau en le nommant "scan-results" pour les copier/coller ici.
  
• Cocher Uninstall application on close pour supprimer ESET Online Scanner de la machine et cliquer sur Finish.

 

 

Rapports demandés:

• OTL
• Malwarebytes Anti-Malware
• scan-results

As-tu encore des soucis avec ta machine?

[rapasse]

Bonsoir,

 

Alors cacaoweb n'est pas non plus dans Ajout/ Suppression de programme.

La dernière analyse a durée plus de 8h00 c'est normal ?

Voilà les rapports:

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Version de la base de données: 5127

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

16/11/2010 15:58:34

mbam-log-2010-11-16 (15-58-34).txt

 

Type d'examen: Examen rapide

Elément(s) analysé(s): 154720

Temps écoulé: 9 minute(s), 14 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

 

 

 

 

 

 

 

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\nwiz deleted successfully.

C:\Program Files\NVIDIA Corporation\nView\nwiz.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Recguard deleted successfully.

C:\WINDOWS\SMINST\Recguard.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cacaoweb deleted successfully.

C:\Program Files\cacaoweb\cacaoweb.exe moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1f9502f8-68b0-11dd-a569-00c0a8c4911d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f9502f8-68b0-11dd-a569-00c0a8c4911d}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8503f77c-b544-11df-9678-00c0a8c4911d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8503f77c-b544-11df-9678-00c0a8c4911d}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8503f77c-b544-11df-9678-00c0a8c4911d}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8503f77c-b544-11df-9678-00c0a8c4911d}\ not found.

File F:\LaunchU3.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{92a3cff2-9b49-11df-962c-00c0a8c4911d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92a3cff2-9b49-11df-962c-00c0a8c4911d}\ not found.

File F:\InstallTomTomHOME.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d83c835a-bd91-11df-968e-00c0a8c4911d}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d83c835a-bd91-11df-968e-00c0a8c4911d}\ not found.

File K:\InstallTomTomHOME.exe not found.

C:\Documents and Settings\HP_Administrateur\Application Data\cacaoweb folder moved successfully.

C:\Program Files\cacaoweb folder moved successfully.

C:\Program Files\Ad-Remover\res\Images folder moved successfully.

C:\Program Files\Ad-Remover\res\Icons folder moved successfully.

C:\Program Files\Ad-Remover\res folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\zvqk8qrw.default\extensions\toolbar@ask.com\logs folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\zvqk8qrw.default\extensions\toolbar@ask.com\datastore folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\zvqk8qrw.default\extensions\toolbar@ask.com folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\zvqk8qrw.default\extensions folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\zvqk8qrw.default folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur\Application Data folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings\HP_Administrateur folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C\Documents and Settings folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine\C folder moved successfully.

C:\Program Files\Ad-Remover\Quarantine folder moved successfully.

C:\Program Files\Ad-Remover\Lang folder moved successfully.

C:\Program Files\Ad-Remover\Erunt folder moved successfully.

C:\Program Files\Ad-Remover\bin folder moved successfully.

C:\Program Files\Ad-Remover\Backup\Registry-18-10-2010\Users\00000002 folder moved successfully.

C:\Program Files\Ad-Remover\Backup\Registry-18-10-2010\Users\00000001 folder moved successfully.

C:\Program Files\Ad-Remover\Backup\Registry-18-10-2010\Users folder moved successfully.

C:\Program Files\Ad-Remover\Backup\Registry-18-10-2010 folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\zvqk8qrw.default folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings\HP_Administrateur\Application Data\Mozilla folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings\HP_Administrateur\Application Data folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings\HP_Administrateur folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C\Documents and Settings folder moved successfully.

C:\Program Files\Ad-Remover\Backup\C folder moved successfully.

C:\Program Files\Ad-Remover\Backup folder moved successfully.

C:\Program Files\Ad-Remover folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrateur

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 71271 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 205815 bytes

->Flash cache emptied: 525 bytes

 

User: HP_Administrateur

->Temp folder emptied: 9055220 bytes

->Temporary Internet Files folder emptied: 269431548 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 414218532 bytes

->Google Chrome cache emptied: 5185264 bytes

->Flash cache emptied: 12214 bytes

 

User: LocalService

->Temp folder emptied: 115616 bytes

->Temporary Internet Files folder emptied: 47412 bytes

->FireFox cache emptied: 973226 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 29721083 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 23254012 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 68075 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 10442204 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 206083 bytes

RecycleBin emptied: 567603739 bytes

 

Total Files Cleaned = 1 269,00 mb

 

 

OTL by OldTimer - Version 3.2.17.3 log created on 11162010_153407

 

Files\Folders moved on Reboot...

 

Registry entries deleted on Reboot...

 

 

 

 

 

 

 

 

L:\Mes documents\Petits Fichiers\MsgPlusLive-470.exe a variant of Win32/MessengerPlus application cleaned by deleting - quarantined

L:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP519\A0098386.exe a variant of Win32/MessengerPlus application cleaned by deleting - quarantined

 

 

 

Oui, j'ai toujours ma machine qui rame, à des moment firfox ne répond plus, sinon Bitdefender ne répond plus non plus ( il ce met en gris )et là les lenteurs sont encore plus accru. J'ai remarquer que l'ordi cherche en permanence comme si je lui demander de faire plein de chose à la fois alors que je ne touche même pas la souris...

 

Cordialement,

Bonne soirée

Modifié le 17 novembre 2010 par rapasse

[lance_yien]

Bonsoir,

 

Oui sur certaine machine l'analyse peut durer très longtemps.

On voit si ComboFix peut dénicher une quelconque infection!

--

 

Imprimer ces instructions ou les enregistrer dans un fichier texte sur le Bureau pour les consulter facilement à tout moment et télécharger, sur le Bureau:

• ComboFix© (par sUBs) depuis ici ou ici
• DeFogger (par jpshoutstuff) depuis ici

 

>>> Utiliser Defogger: Fermer tout et cliquer sur Defogger.exe. Cliquer sur le bouton Disable.

Cliquer sur Yes pour continuer puis, au message "Finished!", cliquer sur OK

Si le programme demande de redémarrer la machine, cliquer sur OK

ATTENTION!

- Si vous recevez un message d'erreur, copiez/ collez sur le forum le contenu du rapport qui s'affiche et attendez la réponse.

- Ne pas réactiver ces drivers sans y être invité.

 

 

>>> Fermer tout, désactive antivirus/ pare-feu/ antispyware et cliquer ComboFix.exe. Suivre les instructions.

Accepter l'Agrément de la licence et l'installation de la Console de Récupération (proposée sous XP si pas installée).

NE PAS TOUCHER la machine avant la fin (même si les choses semblent ne pas avancer).

Quand c'est fini, un rapport (ComboFix.txt) s'affiche. Il est sauvegardé, automatiquement, à la racine de la partition système (généralement C:\)

 

Poster son contenu.

 

Bonne soirée

 

Édité pour corriger lien.

Modifié le 18 novembre 2010 par lance_yien

[rapasse]

Bonsoir,

 

Le lien DeFogger est mort, ce me met adresse introuvable.

 

Voilà le rapport de ComboFix:

 

ComboFix 10-11-17.01 - HP_Administrateur 17/11/2010 20:30:10.1.2 - x86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2046.1419 [GMT 1:00]

Lancé depuis: c:\documents and settings\HP_Administrateur\Bureau\ComboFix.exe

AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FW: BitDefender Pare-feu *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\windows\system32\404Fix.exe

c:\windows\system32\Agent.OMZ.Fix.exe

c:\windows\system32\dumphive.exe

c:\windows\system32\IEDFix.C.exe

c:\windows\system32\IEDFix.exe

c:\windows\system32\o4Patch.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\tmp.reg

c:\windows\system32\VACFix.exe

c:\windows\system32\VCCLSID.exe

c:\windows\system32\WS2Fix.exe

 

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_USNJSVC

-------\Service_usnjsvc

 

 

((((((((((((((((((((((((((((( Fichiers créés du 2010-10-17 au 2010-11-17 ))))))))))))))))))))))))))))))))))))

.

 

2010-11-16 17:47 . 2010-11-16 17:47 -------- d-----w- c:\program files\ESET

2010-11-16 14:34 . 2010-11-16 14:34 -------- d-----w- C:\_OTL

2010-11-15 17:34 . 2010-11-15 17:34 -------- d-----w- c:\program files\VS Revo Group

2010-11-14 20:19 . 2010-11-14 21:01 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\U3

2010-10-31 14:43 . 2010-10-31 14:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2010-10-31 14:39 . 2010-10-31 14:41 -------- d-----w- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Temp

2010-10-31 14:39 . 2010-10-31 14:39 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2010-10-31 14:06 . 2010-03-15 09:31 165376 ----a-w- c:\windows\system32\unrar.dll

2010-10-31 14:06 . 2010-01-17 15:18 151552 ----a-w- c:\windows\system32\ac3acm.acm

2010-10-31 14:06 . 2008-09-24 18:41 839680 ----a-w- c:\windows\system32\lameACM.acm

2010-10-31 14:05 . 2010-06-08 16:10 790528 ----a-w- c:\windows\system32\xvidcore.dll

2010-10-31 14:05 . 2010-06-08 16:10 134144 ----a-w- c:\windows\system32\xvidvfw.dll

2010-10-31 14:05 . 2010-10-18 08:00 108032 ----a-w- c:\windows\system32\ff_vfw.dll

2010-10-31 14:05 . 2010-10-31 14:07 -------- d-----w- c:\program files\K-Lite Codec Pack

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-18 10:23 . 2004-08-10 11:00 974848 ----a-w- c:\windows\system32\mfc42u.dll

2010-09-18 06:53 . 2004-08-10 11:00 974848 ----a-w- c:\windows\system32\mfc42.dll

2010-09-18 06:53 . 2004-08-10 04:00 954368 ----a-w- c:\windows\system32\mfc40.dll

2010-09-18 06:53 . 2004-08-10 04:00 953856 ----a-w- c:\windows\system32\mfc40u.dll

2010-09-10 05:50 . 2004-08-10 11:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-10 05:50 . 2004-08-10 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-10 05:50 . 2004-08-10 11:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2010-09-01 11:51 . 2004-08-10 11:00 285824 ----a-w- c:\windows\system32\atmfd.dll

2010-09-01 07:55 . 2004-08-10 11:00 1852928 ----a-w- c:\windows\system32\win32k.sys

2010-08-27 08:02 . 2004-08-10 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2010-08-27 05:58 . 2004-08-10 11:00 99840 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-27 01:43 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll

2010-08-26 13:39 . 2004-08-10 11:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-23 16:12 . 2004-08-10 11:00 617472 ----a-w- c:\windows\system32\comctl32.dll

2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2010-04-01 1123360]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2010-01-12 71152]

"ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]

"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-30 198160]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]

"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

 

c:\documents and settings\Default User\Menu D‚marrer\Programmes\D‚marrage\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-1-3 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-1-3 27136]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"HonorAutoRunSetting"= 0 (0x0)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"HonorAutoRunSetting"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1700:TCP"= 1700:TCP:MioNet Remote Drive Access

"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

 

R1 is-GQI3Ndrv;is-GQI3Ndrv;c:\windows\system32\drivers\64425156.sys [25/01/2009 00:23 148496]

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2010\bdvedisk.sys [01/04/2009 11:25 85128]

R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/08/2010 10:38 92008]

R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [03/01/2006 02:35 2829696]

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [29/06/2009 14:12 153448]

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [26/06/2009 18:01 111312]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [31/10/2010 15:38 136176]

S3 Arrakis3;BitDefender Serveur Arrakis;c:\program files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [26/06/2009 14:40 183880]

S3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [03/01/2006 02:34 468768]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx REG_MULTI_SZ scan

.

Contenu du dossier 'Tâches planifiées'

 

2010-11-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-31 14:38]

 

2010-11-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-31 14:38]

 

2010-11-17 c:\windows\Tasks\HPpromotions journeysoftware.job

- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36]

.

.

------- Examen supplémentaire -------

.

IE: &Traduire à partir de l'anglais - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Pages liées - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Pages similaires - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Recherche &Google - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: Version de la page actuelle disponible dans le cache Google - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

FF - ProfilePath - c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\zvqk8qrw.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/

FF - prefs.js: keyword.URL -

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- PARAMETRES FIREFOX ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHELINS SUPPRIMES - - - -

 

SafeBoot-AVG Anti-Spyware Driver

SafeBoot-AVG Anti-Spyware Guard

AddRemove-Ad-Remover - c:\program files\Ad-Remover\Uninstall.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-11-17 20:45

Windows 5.1.2600 Service Pack 3 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

 

- - - - - - - > 'explorer.exe'(3556)

c:\windows\system32\msi.dll

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe

c:\program files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Fichiers communs\LightScribe\LSSrvc.exe

c:\program files\NVIDIA Corporation\nTune\nTuneService.exe

c:\windows\system32\HPZipm12.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\dllhost.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\hp\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe

.

**************************************************************************

.

Heure de fin: 2010-11-17 20:51:29 - La machine a redémarré

ComboFix-quarantined-files.txt 2010-11-17 19:51

 

Avant-CF: 164 060 782 592 octets libres

Après-CF: 164 095 913 984 octets libres

 

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

 

- - End Of File - - 6CEFE5AB7AF46F088CC98C6426A032F6

[lance_yien]

Bonjour,

 

Ok pour le lien Defogger (corrigé). Il ne te concerne plus parce ComboFix a bien fonctionné.

ComboFix a bien fait du ménage et ça devrait aller mieux maintenant.

Pour améliorer le fonctionnement de ta machine:

Imprimer ces instructions ou les enregistrer dans un fichier texte sur le Bureau pour les consulter facilement à tout moment.

 

>>> Supprimer les utilitaires:

- Pour supprimer ComboFix, cliquer sur Démarrer => Exécuter et saisir (ou copier/ coller) ComboFix /Uninstall (espace entre ComboFix et /Uninstall). Cliquer sur OK.

Ce qui a pour effet de supprimer ComboFix (et les dossiers/ fichiers qu'il a commencé à installer) et ré-initialiser les points de restauration.

- Lancer OTL et cliquer sur Purge outils. Laisser faire et redémarrer le PC.

- Pour supprimer les autres utilitaires et leur rapports, cliquer-droit dessus => "Supprimer".

 

Très important: Toute ancienne version d'un programme quel qu'il soit peut comporter des vulnérabilités susceptibles d'être exploitées pour infecter un PC et notre meilleur moyen pour limiter les dégâts c'est la mise à jour régulièrement.

Ta version deJava n'est pas à jour: Utiliser, IMPÉRATIVEMENT, Internet Explorer pour téléchargez (sur le Bureau) la dernière version qui correspond à votre Système d'exploitation (32 ou 64 bits): Téléchargements Java pour tous les systèmes d'exploitation.

 

 

Avant l'installation il est important de commencer par supprimer TOUTES les anciennes versions dans votre machine parce qu'elles peuvent contenir des vulnérabilités de sécurité:

Cliquer sur "Démarrer" => "Panneau de Configuration" => "Ajout/ Suppression de Programmes".

Chercher, dans la liste les lignes concernant Java (J2SE Runtime Environment.... ) et repérables avec cette icône .

Sélectionner une ligne à la fois et cliquer sur Modifier/ Supprimer.

Quand il n'y en a plus fermez tout et installez la nouvelle version en cliquant sur le fichier que vous avez téléchargé.

 

>>> Télécharger, sur le Bureau:

• CCleaner depuis ici (si tu ne l'as pas).
  
• MBAM' StartUpLite depuis ici.
  
• Revo Uninstaller depuis ICI.

 

>>> Désinstaller les programmes inutiles.

• Installez Revo Uninstaller et lancer le programme depuis son icône sur le Bureau ou depuis "Démarrer" => "Tous les Programmes" => "Revo Uninstaller".
   
  
• Sélectionner un programme et cliquer sur le bouton Désinstaller
   
  
• Dans la nouvelle fenêtre, choisir le mode Avancé et cliquer sur Suivant.
   
  Suivre les instructions.
   
  
• Cliquer sur Sélectionner tout (1) puis sur Supprimer (2) .
   
  Ceci a pour effet de supprimer tous les items listés dans le champ en haut de la fenêtre.
   
  
• Cliquer sur le bouton Fini pour fermer la fenêtre.
  

 

>>> StartUpLite Il y a toujours des programmes qui se lancent INUTILEMENT en même temps que Windows.

Double-cliquer sur StartUpLite.exe pour lancer le programme.

Il affichera toutes les entrées inutiles en démarrage automatique

Sélectionner TOUTES les entrées affichées (à moins que vous voulez en garder intentionnellement) et cliquer sur Continue.

S'il affiche "No unnecessary startups found!", c'est qu'il n'y a rien à faire.

 

 

>>> CCleaner: Faire un nettoyage.

 

 

>>> Enfin: Dé-fragmenter toutes les partitions existantes sur le PC.

 

 

Laisse-moi savoir ce que ça donne. C'est important.

 

Bon courage!

Modifié le 18 novembre 2010 par lance_yien

[rapasse]

Bonsoir,

 

Je suis entrain de faire ce que tu ma dit mais en voulant faire MBAM' S le lien est mort pour le télécharger :/