[Résolu] Malwares dans la base de registre

[marsouin10_0]

bonjour

je suis sous xp sp3

en analysant mon pc avec zhp j ai trouvé ces choses:

 

 

---\\ ZHPSearch, Outil de recherche d'infection de Base de Registres (O71)

O71 - BDRI:[hklm\software\microsoft\windows\currentversion\explorer\networkcrawler\objects\workgroupcrawler]

O71 - BDRI:[hkcr\wlcui.dialerwindow]

O71 - BDRI:[hkcr\wlcui.dialerwindow.1]

O71 - BDRI:[hkcr\wlcui.phonenumber]

O71 - BDRI:[hkcr\wlcui.phonenumber.1]

 

mon pc ne semble pourtant pas affecté par ces malwares

un moyen de s'en débarasser?

merci d'avance

Modifié le 25 juin 2011 par marsouin10_0

[marsouin10_0]

un conseil concernant mon post de ce matin?

merci d avance

[pear]

Bonjour,

 

Ce sont des éléments de recherche mais Zhp n'y voit pas d'infection sinon vous auriez en réponse un "bilan"->Trouvé ...

[marsouin10_0]

bonjour et merci de votre réponse

 

voici ce que je trouve:

 

Zeb Help Process v2.49 by Nicolas Coolman - Rapport Général du 25/06/2011 09:10:01

 

Rapport de ZHPSearch v1.20.1 par Nicolas Coolman

Enregistré le 25/06/2011 09:09:56

Platform : Microsoft Windows XP (5.1.2600) Service Pack 3

 

---\\ ZHPSearch, Recherche particulière de Clé, valeur ou donnée de BDR (RPR) (O70)

*** None ***

 

 

---\\ ZHPSearch, Outil de recherche d'infection de Base de Registres (O71)

O71 - BDRI:[hklm\software\microsoft\windows\currentversion\explorer\networkcrawler\objects\workgroupcrawler]

O71 - BDRI:[hkcr\wlcui.dialerwindow]

O71 - BDRI:[hkcr\wlcui.dialerwindow.1]

O71 - BDRI:[hkcr\wlcui.phonenumber]

O71 - BDRI:[hkcr\wlcui.phonenumber.1]

 

 

Lignes traitées 11/11 en 00mn 00s)

 

ils sont traités comme malwares sur zhp

 

 

dois je ne pas m'en inquiéter et laisser en l'état?

merci encore

Modifié le 25 juin 2011 par marsouin10_0

[pear]

Si vous avez quelque inquiétude, postez un rapport Zhpdiag.

[marsouin10_0]

re

voici le raport zhpdiag:

 

Rapport de ZHPDiag v1.27.2347 par Nicolas Coolman, Update du 25/06/2011

Run by Robert at 25/06/2011 17:08:06

Web site : ZHPDiag Outil de diagnostic

 

 

---\\ Web Browser

MSIE: Internet Explorer v8.0.6001.18702 (Defaut)

 

---\\ System Information

Windows XP Home Edition Service Pack 3 (Build 2600)

Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel

Operating System: 32 Bits

Boot mode: Normal (Normal boot)

Total RAM: 2038 MB (71% free)

System Restore: Activé (Enable)

System drive C: has 35 GB (63%) free of 56 GB

 

---\\ Logged in mode

Computer Name: MERIGLIE-8B4AA0

User Name: Robert

All Users Names: SUPPORT_388945a0, Robert, HelpAssistant, ASPNET, Administrateur,

Unselected Option: O45,O61,O62,O65,O66,O82

Logged in as Administrator

 

---\\ Environnement Variables

%AppData%=C:\Documents and Settings\Robert\Application Data

%LocalAppData%=C:\Documents and Settings\Robert\Local Settings\Application Data

%StartMenu%=C:\Documents and Settings\Robert\Menu Démarrer

 

---\\ DOS/Devices

C:\ Hard drive, Flash drive, Thumb drive (Free 35 Go of 56 Go)

D:\ CD-ROM drive (Not Inserted)

 

 

 

---\\ Security Center & Tools Informations

[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK

[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK

[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableRegistryTools: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] WarnOnHTTPSToHTTPRedirect: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK

 

 

 

---\\ Recherche particulière de fichiers génériques

[MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824]

[MD5.42F5E14E33D79C236680468B1E4999F4] - (.Microsoft Corporation - Internet Extensions for Win32.) (.25/04/2011 17:06:11.) -- C:\WINDOWS\system32\wininet.dll [916480]

[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000]

[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 19:40:30.) -- C:\WINDOWS\system32\drivers\atapi.sys [96512]

[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 20:15:53.) -- C:\WINDOWS\system32\drivers\ntfs.sys [574976]

 

 

 

---\\ Etat des fichiers cachés (Caché/Total)

~ Mes images (My Pictures) : 1924/67559

~ Mes musiques (My Musics) : 1/2

~ Mes Videos (My Videos) : 1924/67008

~ Mes Favoris (My Favorites) : 8/35

~ Mes Documents (My Documents) : 68/1547

~ Mon Bureau (My Desktop) : 1/27

~ Menu demarrer (Programs) : 6/50

~ Dossier utilisateur (AppData) : 215/3904

 

 

 

---\\ Processus lancés

[MD5.29DEB59DE57EA97553B1566F04B39D11] - (.American Power Conversion Corporation - Battery backup management service.) -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe [176241]

[MD5.A2B790F9A751F24F17967F9A5574186D] - (.Kaspersky Lab - Kaspersky Anti-Virus.) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe [348760]

[MD5.6E5B42219F1FE4A3D087D9D501E343D5] - (.Infowatch - InfoWatch CryptoStorage Protected objects c.) -- C:\Program Files\Fichiers communs\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [743992]

[MD5.9DBA73C2F1E76EC4CB837E67C5743596] - (.Sun Microsystems, Inc. - Java Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe [153376]

[MD5.CC632EB3A7D106464E933E7D53883550] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe [131072]

[MD5.F8D427DAE2984A4968E2D1CB53634784] - (.Nuance Communications, Inc. - OCR Aware.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [79400]

[MD5.A2A570828AFDB7F96B11C9E0B6EDBAB4] - (.Logitech Inc. - ImageStudio Tray Application.) -- C:\Program Files\Logitech\Video\LogiTray.exe [77824]

[MD5.6E0B205042FC3AF5DE84F90F875AFFDA] - (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe [249856]

[MD5.554D891F18BEE41940A280195B27BCB4] - (.Logitech Inc. - LVCom Server.) -- C:\WINDOWS\system32\LVComS.exe [135214]

[MD5.4F0BED169FAB31EA094A649B0473B5C6] - (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe [135168]

[MD5.8B0DE4B972DB725FB9D591E69CD236FB] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe [159744]

[MD5.255E405D801CF01247390F38F92D8042] - (...) -- C:\Program Files\Unlocker\UnlockerAssistant.exe [17408]

[MD5.E75D8F09B954FB8EF4B83E4EE9E985F4] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [660992]

 

 

 

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)

C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\92g146wq.default\prefs.js

P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_26 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

P2 - FPN: [HKLM] [@ma-config.com/HardwareDetection] - (.Cybelsoft - Plugin NPAPI Ma-Config.com.) -- C:\Program Files\ma-config.com\nphardwaredetection.dll

P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.60531.0.) -- c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll

P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

P2 - FPN: [HKLM] [Adobe Reader] - (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 10.1.0.) -- C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

M0 - MFSP: prefs.js [Robert - 92g146wq.default] Go recherche

 

 

 

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)

C:\Documents and Settings\Robert\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

G0 - GCSP: Preference [user Data\Default][HomePage] Google

 

 

 

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Abonnement Adsl Haut débit avec Alice France. Page d'accueil du portail.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R0 - HKUS\S-1-5-21-602162358-1844823847-839522115-1004\Software\Microsoft\Internet Explorer\Main,Start Page = Abonnement Adsl Haut débit avec Alice France. Page d'accueil du portail.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Microsoft Corporation

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Microsoft Corporation

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Microsoft Corporation

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Search Microsoft.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Microsoft Corporation

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (8.00.6001.19072 (longhorn_ie8_gdr.110420-1700)) -- C:\WINDOWS\system32\ieframe.dll

R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0

R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2

 

 

 

---\\ Internet Explorer, Proxy Management (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1

 

 

 

---\\ ---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"

 

 

 

---\\ Browser Helper Objects de navigateur (O2)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} . (.Orbiscom Ltd. All rights reserved. - e-Carte Bleue.) -- C:\WINDOWS\system32\BhoECart.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} . (.Kaspersky Lab - IE Virtual Keyboard.) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\ievkbd.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} . (.Kaspersky Lab - WebToolBar component.) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} . (.Sun Microsystems, Inc. - Java Quick Starter binary.) -- C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

 

 

 

---\\ ---\\ Applications démarrées par registre & par dossier (O4)

O4 - HKLM\..\Run: [AVP] . (.Kaspersky Lab - Kaspersky Anti-Virus.) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe

O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [OpwareSE4] . (.Nuance Communications, Inc. - OCR Aware.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe

O4 - HKLM\..\Run: [LogitechVideoTray] . (.Logitech Inc. - ImageStudio Tray Application.) -- C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [LogitechVideoRepair] . (.Logitech Inc. - Logitech QuickCam Startup Application.) -- C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [igfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

O4 - HKLM\..\Run: [unlockerAssistant] . (...) -- C:\Program Files\Unlocker\UnlockerAssistant.exe

O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe

O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-21-602162358-1844823847-839522115-1004\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe

O4 - HKUS\S-1-5-21-602162358-1844823847-839522115-1004\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe

 

 

 

---\\ ---\\ Autres liens utilisateurs (O4)

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Adobe Reader X.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AA1000000001}\SC_Reader.ico

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Microsoft Access.lnk . (...) -- C:\WINDOWS\Installer\{9028040C-6000-11D3-8CFE-0050048383C9}\accicons.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Microsoft Excel.lnk . (...) -- C:\WINDOWS\Installer\{9028040C-6000-11D3-8CFE-0050048383C9}\xlicons.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Microsoft FrontPage.lnk . (...) -- C:\WINDOWS\Installer\{9028040C-6000-11D3-8CFE-0050048383C9}\misc.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Microsoft Outlook.lnk . (...) -- C:\WINDOWS\Installer\{9028040C-6000-11D3-8CFE-0050048383C9}\outicon.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\MSN.lnk . (.Microsoft Corporation.) -- C:\Program Files\MSN\MSNCoreFiles\Install\msnsusii.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Paint.NET.lnk . (.dotPDN LLC.) -- C:\Program Files\Paint.NET\PaintDotNet.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\PowerpointImageExtractor V1.2.lnk . (.---.) -- C:\Program Files\PowerpointImageExtractor_V1_2\PowerpointImageExtractor.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Visionneuse Microsoft Office PowerPoint 2007.lnk . (...) -- C:\WINDOWS\Installer\{95120000-00AF-040C-0000-0000000FF1CE}\ppvwicon.exe

O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Windows Movie Maker.lnk . (.Microsoft Corporation.) -- C:\Program Files\Movie Maker\moviemk.exe

O4 - Global Startup: C:\Documents And Settings\Robert\Menu Démarrer\Programmes\Assistance à distance.lnk . (.Microsoft Corporation.) -- C:\WINDOWS\system32\rcimlby.exe

O4 - Global Startup: C:\Documents And Settings\Robert\Menu Démarrer\Programmes\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe

O4 - Global Startup: C:\Documents And Settings\Robert\Menu Démarrer\Programmes\Microsoft PowerPoint Viewer 97.lnk . (.Microsoft Corporation.) -- C:\Program Files\PowerPoint Viewer\setup\INSTALL.EXE

O4 - Global Startup: C:\Documents And Settings\Robert\Menu Démarrer\Programmes\Outlook Express.lnk . (.Microsoft Corporation.) -- C:\Program Files\Outlook Express\msimn.exe

O4 - Global Startup: C:\Documents And Settings\Robert\Menu Démarrer\Programmes\Windows Media Player.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Media Player\wmplayer.exe

 

 

 

---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)

O8 - Extra context menu item: Ajouter à l'Anti-bannière . (...) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm

 

 

 

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)

O9 - Extra button: Mon Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} . (...) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\kbrd.ico

O9 - Extra button: Mon Clavier &virtuel - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (...) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\logo.ico

O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} . (...) -- C:\Program Files\Kaspersky Lab\Kaspersky PURE\logo.ico

 

 

 

---\\ Winsock hijacker (Layered Service Provider) (O10)

O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll

O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll

O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll

 

 

 

---\\ Objets ActiveX (Downloaded Program Files)(O16)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2665693B-C4F3-434B-83DB-7574CF50C8B7} (Kaspersky License Finder) - http://www.kaspersky.com/downloads/misc/kasperskylicensefinder.cab

O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab

O16 - DPF: {50DC58D0-C870-4BE6-BC41-971ED2D5F022} (HookWlmEx Control) - http://www.super-messenger.fr/tab/HookWlmEx.exe

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} () - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1282320427890

O16 - DPF: {6F74F92E-8DD8-4DDE-8FB8-CBB882A68048} - (Microsoft Office XP Professional Step by Step Interactive) - (...) -- C:\Program Files\Formation interactive Microsoft\o10c\mitm0026.cab

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} () - http://download.eset.com/special/eos-beta/OnlineScanner.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ("Ma-Config.com control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_5_1_1_0.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} () - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

 

 

 

---\\ Modification Domaine/Adresses DNS (O17)

O17 - HKLM\System\CCS\Services\Tcpip\..\{C3F4AD8B-01A7-4D52-8981-EC04DD41F6D9}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{C3F4AD8B-01A7-4D52-8981-EC04DD41F6D9}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CS3\Services\Tcpip\..\{C3F4AD8B-01A7-4D52-8981-EC04DD41F6D9}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

 

 

 

---\\ Protocole additionnel et piratage de protocole (O18)

O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

 

 

 

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)

O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\Windows\System32\crypt32.dll

O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\Windows\System32\cryptnet.dll

O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\Windows\System32\cscdll.dll

O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\System32\dimsntfy.dll

O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll

O20 - Winlogon Notify: klogon . (.Kaspersky Lab - Logon Visualizer.) -- C:\WINDOWS\system32\klogon.dll

O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll

O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll

O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\Windows\System32\sclgntfy.dll

O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\WlNotify.dll

O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll

O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\Windows\System32\wlnotify.dll

 

 

 

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\shell32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS\system32\stobject.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll

 

 

 

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)

O22 - SharedTaskScheduler: (no name) - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll

 

 

 

---\\ Liste des services NT non Microsoft et non désactivés (O23)

O23 - Service: APC UPS Service (APC UPS Service) . (.American Power Conversion Corporation - Battery backup management service.) - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe

O23 - Service: Kaspersky PURE (AVP) . (.Kaspersky Lab - Kaspersky Anti-Virus.) - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe

O23 - Service: Service de gestion du système CryproStorage (CSObjectsSrv) . (.Infowatch - InfoWatch CryptoStorage Protected objects c.) - C:\Program Files\Fichiers communs\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) . (.Sun Microsystems, Inc. - Java Quick Starter Service.) - C:\Program Files\Java\jre6\bin\jqs.exe

 

 

 

---\\ Enumération Active Desktop & MHTML Editor (O24)

O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Word.) - C:\Program Files\Microsoft Office\Office10\WINWORD.exe

 

 

 

---\\ Tâches planifiées en automatique (O39)

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GlaryInitialize.job

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{D8D3402F-1544-4D48-AF51-E93075AB3755}.job

 

 

 

---\\ Pilotes lancés au démarrage (O41)

O41 - Driver: (80759601) . (.Kaspersky Lab - Kaspersky Unified Driver.) - C:\WINDOWS\System32\DRIVERS\80759601.sys

O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys

O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS\System32\DRIVERS\cdrom.sys

O41 - Driver: (CSVirtualDiskDrv) . (.Infowatch - Virtual Volume Container Driver (wxp).) - C:\WINDOWS\System32\DRIVERS\CSVirtualDiskDrv.sys

O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\WINDOWS\System32\DRIVERS\i8042prt.sys

O41 - Driver: (Imapi) . (.Microsoft Corporation - IMAPI Kernel Driver.) - C:\WINDOWS\System32\DRIVERS\imapi.sys

O41 - Driver: (intelppm) . (.Microsoft Corporation - Pilote de périphérique processeur.) - C:\WINDOWS\System32\DRIVERS\intelppm.sys

O41 - Driver: (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS\System32\DRIVERS\ipsec.sys

O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\WINDOWS\System32\DRIVERS\kbdclass.sys

O41 - Driver: (kl1) . (.Kaspersky Lab - Kaspersky Unified Driver.) - C:\WINDOWS\system32\drivers\kl1.sys

O41 - Driver: (KLIF) . (.Kaspersky Lab - Klif Mini-Filter [fre_wnet_x86].) - C:\WINDOWS\System32\DRIVERS\klif.sys

O41 - Driver: (Mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\WINDOWS\System32\DRIVERS\mouclass.sys

O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\System32\DRIVERS\netbios.sys

O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\System32\DRIVERS\netbt.sys

O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS\System32\DRIVERS\rasacd.sys

O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS\System32\DRIVERS\rdbss.sys

O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

O41 - Driver: (redbook) . (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) - C:\WINDOWS\System32\DRIVERS\redbook.sys

O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\WINDOWS\System32\DRIVERS\serial.sys

O41 - Driver: setup_9.0.0.722_27.04.2011_18-09drv (setup_9.0.0.722_27.04.2011_18-09drv) . (.Kaspersky Lab - Klif Mini-Filter [fre_wnet_x86].) - C:\WINDOWS\System32\DRIVERS\8075960.sys

O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS\System32\DRIVERS\tcpip.sys

O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS\System32\DRIVERS\termdd.sys

O41 - Driver: Carte vidéo VGA. (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS\system32\drivers\vga.sys

 

 

 

---\\ Logiciels installés (O42)

O42 - Logiciel: APC PowerChute Personal Edition - (.American Power Conversion Corporation.) [HKLM] -- {5A0C892E-FD1C-4203-941E-0956AED20A6A}

O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX

O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin

O42 - Logiciel: Adobe Reader X (10.1.0) - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-AA1000000001}

O42 - Logiciel: Assistant de connexion Windows Live - (.Microsoft Corporation.) [HKLM] -- {DCE8CD14-FBF5-4464-B9A4-E18E473546C7}

O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner

O42 - Logiciel: CamStudio 2.0 Fr - (.Pas de propriétaire.) [HKLM] -- CamStudio 2.0 Fr_is1

O42 - Logiciel: Canon MP Navigator EX 1.0 - (.Pas de propriétaire.) [HKLM] -- MP Navigator EX 1.0

O42 - Logiciel: Canon MP210 series - (.Pas de propriétaire.) [HKLM] -- {1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP210_series

O42 - Logiciel: CoolScript2(remove) - (.Pas de propriétaire.) [HKLM] -- Coolscript2

O42 - Logiciel: Defraggler - (.Piriform.) [HKLM] -- Defraggler

O42 - Logiciel: Enregistrement utilisateur de Canon MP210 series - (.Pas de propriétaire.) [HKLM] -- Enregistrement utilisateur de Canon MP210 series

O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {1EE04769-91C4-4A06-92B7-FCAFE6BABDD9}

O42 - Logiciel: Glary Utilities 2.34.0.1190 - (.Glarysoft Ltd.) [HKLM] -- Glary Utilities_is1

O42 - Logiciel: High Definition Audio Driver Package - KB888111 - (.Microsoft Corporation.) [HKLM] -- KB888111WXPSP2

O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595

O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484

O42 - Logiciel: Hotfix for Windows Media Format 11 SDK (KB929399) - (.Microsoft Corporation.) [HKLM] -- KB929399

O42 - Logiciel: Hotfix for Windows XP (KB915800-v4) - (.Microsoft Corporation.) [HKLM] -- KB915800-v4

O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5

O42 - Logiciel: Hotfix for Windows XP (KB976002-v5) - (.Microsoft Corporation.) [HKLM] -- KB976002-v5

O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite_Wave3

O42 - Logiciel: Installation Windows Live - (.Microsoft Corporation.) [HKLM] -- {133742BA-6F46-4D3E-85AF-78631D9AD8B8}

O42 - Logiciel: Intel® Graphics Media Accelerator Driver - (.Pas de propriétaire.) [HKLM] -- HDMI

O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {8E5233E1-7495-44FB-8DEB-4BE906D59619}

O42 - Logiciel: Kaspersky PURE - (.Kaspersky Lab.) [HKLM] -- InstallWIX_{1A59064A-12A9-469F-99F6-04BF118DBCFF}

O42 - Logiciel: Kaspersky PURE - (.Kaspersky Lab.) [HKLM] -- {1A59064A-12A9-469F-99F6-04BF118DBCFF}

O42 - Logiciel: Lecteur Windows Media 11 - (.Pas de propriétaire.) [HKLM] -- Windows Media Player

O42 - Logiciel: Logitech Print Service - (.Pas de propriétaire.) [HKLM] -- Logitech Print Service

O42 - Logiciel: Logitech QuickCam - (.Logitech, Inc..) [HKLM] -- {A488D63E-B3DD-4423-892F-2F2EC8909518}

O42 - Logiciel: Ludi - (.Pas de propriétaire.) [HKLM] -- Ludi

O42 - Logiciel: Ludiclub.com - (.Pas de propriétaire.) [HKLM] -- Ludiclub.com

O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

O42 - Logiciel: Ma-Config.com - (.Cybelsoft.) [HKLM] -- {0810B8B7-7539-41D3-983E-6127FCF1CC9E}

O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.0.1200 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1

O42 - Logiciel: Microsoft .NET Framework 1.1 - (.Microsoft.) [HKLM] -- {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

O42 - Logiciel: Microsoft .NET Framework 1.1 - (.Pas de propriétaire.) [HKLM] -- Microsoft .NET Framework 1.1 (1033)

O42 - Logiciel: Microsoft .NET Framework 1.1 French Language Pack - (.Microsoft.) [HKLM] -- {9A394342-4A68-4EBA-85A6-55B559F4E700}

O42 - Logiciel: Microsoft .NET Framework 1.1 Security Update (KB2416447) - (.Pas de propriétaire.) [HKLM] -- M2416447

O42 - Logiciel: Microsoft .NET Framework 1.1 Security Update (KB979906) - (.Pas de propriétaire.) [HKLM] -- M979906

O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 SP1

O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}

O42 - Logiciel: Microsoft .NET Framework 4 Client Profile FRA Language Pack - (.Microsoft Corporation.) [HKLM] -- {0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}

O42 - Logiciel: Microsoft Choice Guard - (.Microsoft Corporation.) [HKLM] -- {F0E12BBA-AD66-4022-A453-A1C8A0C4D570}

O42 - Logiciel: Microsoft Compression Client Pack 1.0 for Windows XP - (.Microsoft Corporation.) [HKLM] -- MSCompPackV1

O42 - Logiciel: Microsoft Office PowerPoint Viewer 2007 (French) - (.Microsoft Corporation.) [HKLM] -- {95120000-00AF-040C-0000-0000000FF1CE}

O42 - Logiciel: Microsoft Office XP - Autoformation Interactive - (.Pas de propriétaire.) [HKLM] -- {A46C3CC2-B6F2-492D-83BF-52EB320307CC}

O42 - Logiciel: Microsoft Office XP Media Content - (.Microsoft Corporation.) [HKLM] -- {9030040C-6000-11D3-8CFE-0050048383C9}

O42 - Logiciel: Microsoft Office XP Professional avec FrontPage - (.Microsoft Corporation.) [HKLM] -- {9028040C-6000-11D3-8CFE-0050048383C9}

O42 - Logiciel: Microsoft PowerPoint Viewer 97 - (.Pas de propriétaire.) [HKLM] -- PPTView97

O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}

O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0 - (.Microsoft Corporation.) [HKLM] -- Wudf01000

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 - (.Microsoft Corporation.) [HKLM] -- {86CE85E6-DBAC-3FFD-B977-E4B79F83C909}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - (.Microsoft Corporation.) [HKLM] -- {9BE518E6-ECC6-35A9-88E4-87755C07200F}

O42 - Logiciel: Module linguistique Microsoft .NET Framework 4 Client Profile FRA - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile FRA Language Pack

O42 - Logiciel: Outil de téléchargement Windows Live - (.Microsoft Corporation.) [HKLM] -- {205C6BDD-7B73-42DE-8505-9A093F35A238}

O42 - Logiciel: Package de base Microsoft de service de chiffrement pour cartes à puce - (.Microsoft Corporation.) [HKLM] -- KB909520

O42 - Logiciel: Paint.NET v3.10 - (.Paint.NET Team.) [HKLM] -- {5E749AEB-5A19-43BA-BB20-3CBB37539FE4}

O42 - Logiciel: PhotoFiltre - (.Pas de propriétaire.) [HKLM] -- PhotoFiltre

O42 - Logiciel: PowerpointImageExtractor - (.Pas de propriétaire.) [HKLM] -- PowerpointImageExtractor_is1

O42 - Logiciel: Programme de gestion Camera de Logitech® - (.Pas de propriétaire.) [HKLM] -- QcDrv

O42 - Logiciel: REALTEK GbE & FE Ethernet PCI-E NIC Driver - (.Realtek.) [HKLM] -- {C9BED750-1211-4480-B1A5-718A3BE15525}

O42 - Logiciel: Radio Fr Solo 2.1 - (.Pas de propriétaire.) [HKLM] -- Radio_Fr

O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}

O42 - Logiciel: ScanSoft OmniPage SE 4 - (.Nuance Communications, Inc..) [HKLM] -- {DEE88727-779B-47A9-ACEF-F87CA5F92A65}

O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- KB931906

O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- {0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

O42 - Logiciel: Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB2416473

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2446708

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2478663

O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2518870

O42 - Logiciel: Security Update for Module linguistique Microsoft .NET Framework 4 Client Profile FRA (KB2478663) - (.Microsoft Corporation.) [HKLM] -- {0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}.KB2478663

O42 - Logiciel: Security Update for Windows Search 4 - KB963093 - (.Microsoft Corporation.) [HKLM] -- KB963093

O42 - Logiciel: Segoe UI - (.Microsoft Corp.) [HKLM] -- {A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}

O42 - Logiciel: Skype™ 5.3 - (.Skype Technologies S.A..) [HKLM] -- {5335DADB-34BA-4AE8-A519-648D78498846}

O42 - Logiciel: Unlocker 1.9.1 - (.Cedrick Collomb.) [HKLM] -- Unlocker

O42 - Logiciel: Update for Microsoft .NET Framework 3.5 SP1 (KB963707) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707

O42 - Logiciel: Windows Genuine Advantage Validation Tool (KB892130) - (.Microsoft Corporation.) [HKLM] -- KB892130

O42 - Logiciel: Windows Internet Explorer 8 - (.Microsoft Corporation.) [HKLM] -- ie8

O42 - Logiciel: Windows Live Call - (.Microsoft Corporation.) [HKLM] -- {B3B487E7-6171-4376-9074-B28082CEB504}

O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {3175E049-F9A9-4A3D-8F19-AC9FB04514D1}

O42 - Logiciel: Windows Live FolderShare - (.Microsoft Corporation.) [HKLM] -- {76810709-A7D3-468D-9167-A1780C1E766C}

O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {5DD76286-9BE7-4894-A990-E905E91AC818}

O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {445B183D-F4F1-45C8-B9DB-F11355CA657B}

O42 - Logiciel: Windows Management Framework Core - (.Microsoft Corporation.) [HKLM] -- KB968930

O42 - Logiciel: Windows Media Format 11 runtime - (.Microsoft Corporation.) [HKLM] -- WMFDist11

O42 - Logiciel: Windows Media Format 11 runtime - (.Pas de propriétaire.) [HKLM] -- Windows Media Format Runtime

O42 - Logiciel: Windows Media Player 11 - (.Microsoft Corporation.) [HKLM] -- wmp11

O42 - Logiciel: Windows XP Service Pack 3 - (.Microsoft Corporation.) [HKLM] -- Windows XP Service

O42 - Logiciel: ZebHelpProcess 2.49 - (.Nicolas Coolman.) [HKLM] -- Zeb Help Process_is1

O42 - Logiciel: e-Carte Bleue LCL - (.Pas de propriétaire.) [HKLM] -- {3D6B54EF-65E4-4624-8709-03A3BBE2C240}

O42 - Logiciel: e-Carte Bleue VISA Cléo - (.Pas de propriétaire.) [HKLM] -- e-Carte Bleue VISA Cléo

O42 - Logiciel: mIRC - (.Pas de propriétaire.) [HKLM] -- mIRC

O42 - Logiciel: network module - (.Microsoft.) [HKLM] -- {9FD78518-7CBD-4071-8BE2-DDCA898890E0}

 

---\\ HKCU & HKLM Software Keys

[HKCU\Software\AEB Soft]

[HKCU\Software\Adobe]

[HKCU\Software\Alp-Software]

[HKCU\Software\Borland]

[HKCU\Software\COOL]

[HKCU\Software\CanonBJ]

[HKCU\Software\Canon]

[HKCU\Software\Classes]

[HKCU\Software\Clients]

[HKCU\Software\ESTsoft]

[HKCU\Software\Elguevel]

[HKCU\Software\File Helper]

[HKCU\Software\FotoWire]

[HKCU\Software\Fridgesoft]

[HKCU\Software\GlarySoft]

[HKCU\Software\Google]

[HKCU\Software\HookNetwork]

[HKCU\Software\IM Providers]

[HKCU\Software\Intel]

[HKCU\Software\JavaSoft]

[HKCU\Software\KasperskyLab]

[HKCU\Software\Local AppWizard-Generated Applications]

[HKCU\Software\Logitech]

[HKCU\Software\Ludi]

[HKCU\Software\Ludiclub]

[HKCU\Software\Macromedia]

[HKCU\Software\Malwarebytes' Anti-Malware]

[HKCU\Software\Netscape]

[HKCU\Software\ODBC]

[HKCU\Software\PC SOFT]

[HKCU\Software\Paint.NET]

[HKCU\Software\Piriform]

[HKCU\Software\Policies]

[HKCU\Software\Radio Fr Solo]

[HKCU\Software\RealNetworks]

[HKCU\Software\Realtek]

[HKCU\Software\SOFTWIN]

[HKCU\Software\ScanSoft]

[HKCU\Software\SkypeApps]

[HKCU\Software\Skype]

[HKCU\Software\Sysinternals]

[HKCU\Software\Trolltech]

[HKCU\Software\VB and VBA Program Settings]

[HKCU\Software\YahooPartnerToolbar]

[HKCU\Software\cybelsoft]

[HKCU\Software\http://www.ecran-de-veille.com]

[HKLM\Software\APC]

[HKLM\Software\Adobe]

[HKLM\Software\Axialis]

[HKLM\Software\Borland]

[HKLM\Software\BrowserChoice]

[HKLM\Software\C07ft5Y]

[HKLM\Software\Canon]

[HKLM\Software\Classes]

[HKLM\Software\Clients]

[HKLM\Software\Creative Tech]

[HKLM\Software\ESTsoft]

[HKLM\Software\Eset]

[HKLM\Software\File Helper]

[HKLM\Software\FotoWire]

[HKLM\Software\Gemplus]

[HKLM\Software\GlarySoft]

[HKLM\Software\Google]

[HKLM\Software\InfoWatch]

[HKLM\Software\InstallShield]

[HKLM\Software\Intel]

[HKLM\Software\JavaRa]

[HKLM\Software\JavaSoft]

[HKLM\Software\JreMetrics]

[HKLM\Software\KasperskyLab]

[HKLM\Software\Logitech]

[HKLM\Software\MSI]

[HKLM\Software\Macromedia]

[HKLM\Software\Malwarebytes' Anti-Malware]

[HKLM\Software\MimarSinan]

[HKLM\Software\MozillaPlugins]

[HKLM\Software\Mozilla]

[HKLM\Software\ODBC]

[HKLM\Software\OldTimer Tools]

[HKLM\Software\Paint.NET]

[HKLM\Software\Panda Software]

[HKLM\Software\Piriform]

[HKLM\Software\Policies]

[HKLM\Software\Program Groups]

[HKLM\Software\RTLSetup]

[HKLM\Software\RealNetworks]

[HKLM\Software\Realtek]

[HKLM\Software\RegisteredApplications]

[HKLM\Software\RichFX]

[HKLM\Software\ScanSoft]

[HKLM\Software\Schlumberger]

[HKLM\Software\SecureDigitalServices]

[HKLM\Software\Skype]

[HKLM\Software\Swearware]

[HKLM\Software\TrendMicro]

[HKLM\Software\Uniblue]

[HKLM\Software\Windows 3.1 Migration Status]

[HKLM\Software\Windows]

[HKLM\Software\Wow6432Node]

[HKLM\Software\cybelsoft]

[HKLM\Software\e-Carte Bleue LCL]

[HKLM\Software\mozilla.org]

 

 

 

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)

O43 - CFD: 25/06/2011 - 08:37:04 - [0] ----D- C:\Program Files\Ad-Remover

O43 - CFD: 15/06/2011 - 08:36:36 - [116645820] ----D- C:\Program Files\Adobe

O43 - CFD: 20/08/2010 - 17:25:34 - [6558139] ----D- C:\Program Files\APC

O43 - CFD: 20/02/2011 - 12:55:38 - [8387326] ----D- C:\Program Files\CamStudio

O43 - CFD: 10/12/2010 - 11:37:06 - [82130573] ----D- C:\Program Files\Canon

O43 - CFD: 20/08/2010 - 17:03:42 - [25556097] --H-D- C:\Program Files\CanonBJ

O43 - CFD: 01/06/2011 - 09:39:12 - [4500659] ----D- C:\Program Files\CCleaner

O43 - CFD: 20/06/2011 - 12:04:12 - [5330672] ----D- C:\Program Files\Coolscript2

O43 - CFD: 20/04/2011 - 10:29:06 - [3986872] ----D- C:\Program Files\Defraggler

O43 - CFD: 12/06/2011 - 09:36:22 - [488564] ----D- C:\Program Files\e-Carte Bleue LCL

O43 - CFD: 20/06/2011 - 18:04:22 - [431608] ----D- C:\Program Files\ESTsoft

O43 - CFD: 15/06/2011 - 08:44:48 - [372203100] ----D- C:\Program Files\Fichiers communs

O43 - CFD: 12/10/2010 - 16:59:38 - [123821240] ----D- C:\Program Files\Formation interactive Microsoft

O43 - CFD: 01/06/2011 - 10:03:02 - [23256856] ----D- C:\Program Files\Glary Utilities

O43 - CFD: 12/10/2010 - 16:59:32 - [22488067] --H-D- C:\Program Files\InstallShield Installation Information

O43 - CFD: 20/08/2010 - 10:59:54 - [96703] ----D- C:\Program Files\Intel

O43 - CFD: 19/06/2011 - 11:08:32 - [5322561] ----D- C:\Program Files\Internet Explorer

O43 - CFD: 15/06/2011 - 08:44:10 - [81169171] ----D- C:\Program Files\Java

O43 - CFD: 29/03/2011 - 11:31:42 - [98188235] ----D- C:\Program Files\Kaspersky Lab

O43 - CFD: 26/12/2010 - 12:01:36 - [30747851] ----D- C:\Program Files\Logitech

O43 - CFD: 23/06/2011 - 10:22:28 - [31002019] ----D- C:\Program Files\Ludi

O43 - CFD: 21/08/2010 - 10:54:40 - [4967177] ----D- C:\Program Files\Ludiclub

O43 - CFD: 10/04/2011 - 06:41:50 - [5657562] ----D- C:\Program Files\ma-config.com

O43 - CFD: 23/06/2011 - 17:21:04 - [7566871] ----D- C:\Program Files\Malwarebytes' Anti-Malware

O43 - CFD: 20/08/2010 - 14:23:42 - [2152579] ----D- C:\Program Files\Messenger

O43 - CFD: 13/06/2011 - 11:51:00 - [231444] ----D- C:\Program Files\Microsoft

O43 - CFD: 21/08/2010 - 08:10:16 - [800662] ----D- C:\Program Files\Microsoft CAPICOM 2.1.0.2

O43 - CFD: 20/08/2010 - 10:41:04 - [0] ----D- C:\Program Files\microsoft frontpage

O43 - CFD: 24/10/2010 - 08:37:28 - [276524631] ----D- C:\Program Files\Microsoft Office

O43 - CFD: 16/06/2011 - 06:32:34 - [38411899] ----D- C:\Program Files\Microsoft Silverlight

O43 - CFD: 15/02/2011 - 09:27:48 - [1829877] ----D- C:\Program Files\Microsoft SQL Server Compact Edition

O43 - CFD: 20/08/2010 - 15:39:56 - [15715] ----D- C:\Program Files\Microsoft.NET

O43 - CFD: 20/08/2010 - 14:39:22 - [10374874] ----D- C:\Program Files\Movie Maker

O43 - CFD: 28/04/2011 - 11:26:36 - [200852] ----D- C:\Program Files\Mozilla Firefox

O43 - CFD: 20/08/2010 - 15:35:02 - [25757] ----D- C:\Program Files\MSBuild

O43 - CFD: 21/08/2010 - 09:13:18 - [27892223] ----D- C:\Program Files\MSECache

O43 - CFD: 20/08/2010 - 10:37:16 - [19278399] ----D- C:\Program Files\MSN

O43 - CFD: 20/08/2010 - 10:37:42 - [8745735] ----D- C:\Program Files\MSN Gaming Zone

O43 - CFD: 20/08/2010 - 14:19:20 - [3285523] ----D- C:\Program Files\NetMeeting

O43 - CFD: 20/08/2010 - 10:37:50 - [1804] ----D- C:\Program Files\Online Services

O43 - CFD: 07/10/2010 - 09:37:52 - [233223] ----D- C:\Program Files\OpenOffice.org 2.0

O43 - CFD: 29/08/2010 - 11:35:50 - [379964479] ----D- C:\Program Files\OpenOffice.org 3

O43 - CFD: 15/12/2010 - 07:20:08 - [4379321] ----D- C:\Program Files\Outlook Express

O43 - CFD: 18/03/2011 - 11:40:28 - [10004300] ----D- C:\Program Files\Paint.NET

O43 - CFD: 13/02/2011 - 11:56:18 - [3701213] ----D- C:\Program Files\PhotoFiltre

O43 - CFD: 12/10/2010 - 16:52:10 - [1068340] ----D- C:\Program Files\PowerPoint Viewer

O43 - CFD: 21/08/2010 - 08:42:24 - [1757343] ----D- C:\Program Files\PowerpointImageExtractor_V1_2

O43 - CFD: 18/06/2011 - 09:55:24 - [10844104] ----D- C:\Program Files\Radio Fr Solo

O43 - CFD: 20/08/2010 - 11:06:36 - [71827456] ----D- C:\Program Files\Realtek

O43 - CFD: 20/08/2010 - 15:34:54 - [36400897] ----D- C:\Program Files\Reference Assemblies

O43 - CFD: 20/08/2010 - 17:05:32 - [121570105] ----D- C:\Program Files\ScanSoft

O43 - CFD: 20/08/2010 - 10:39:40 - [1025] ----D- C:\Program Files\Services en ligne

O43 - CFD: 14/04/2011 - 06:30:46 - [19061615] R---D- C:\Program Files\Skype

O43 - CFD: 24/06/2011 - 15:16:52 - [785730] ----D- C:\Program Files\Trend Micro

O43 - CFD: 23/06/2011 - 17:09:00 - [233180] ----D- C:\Program Files\Unlocker

O43 - CFD: 19/06/2011 - 13:59:42 - [0] ----D- C:\Program Files\Windows Desktop Search

O43 - CFD: 15/02/2011 - 09:28:28 - [117421541] ----D- C:\Program Files\Windows Live

O43 - CFD: 20/08/2010 - 17:42:58 - [245112] ----D- C:\Program Files\Windows Live SkyDrive

O43 - CFD: 19/12/2010 - 10:46:06 - [3586190] ----D- C:\Program Files\Windows Media Connect 2

O43 - CFD: 10/12/2010 - 11:37:06 - [8580314] ----D- C:\Program Files\Windows Media Player

O43 - CFD: 20/08/2010 - 14:19:16 - [3942655] ----D- C:\Program Files\Windows NT

O43 - CFD: 20/08/2010 - 10:39:44 - [0] --H-D- C:\Program Files\WindowsUpdate

O43 - CFD: 20/08/2010 - 10:41:04 - [0] ----D- C:\Program Files\xerox

O43 - CFD: 24/06/2011 - 18:03:04 - [154438106] ----D- C:\Program Files\ZebHelpProcess

O43 - CFD: 25/06/2011 - 17:11:04 - [3926243] ----D- C:\Program Files\ZHPDiag

O43 - CFD: 15/06/2011 - 08:36:58 - [3603106] ----D- C:\Program Files\Fichiers Communs\Adobe

O43 - CFD: 20/08/2010 - 17:54:42 - [7675823] ----D- C:\Program Files\Fichiers Communs\Borland Shared

O43 - CFD: 22/08/2010 - 11:02:32 - [99136] ----D- C:\Program Files\Fichiers Communs\DESIGNER

O43 - CFD: 26/12/2010 - 12:01:36 - [86016] ----D- C:\Program Files\Fichiers Communs\FotoWire

O43 - CFD: 26/03/2011 - 08:33:16 - [3381150] ----D- C:\Program Files\Fichiers Communs\InfoWatch

O43 - CFD: 20/08/2010 - 17:25:20 - [8123200] ----D- C:\Program Files\Fichiers Communs\InstallShield

O43 - CFD: 15/06/2011 - 08:44:48 - [1258951] ----D- C:\Program Files\Fichiers Communs\Java

O43 - CFD: 26/12/2010 - 11:58:24 - [36923641] ----D- C:\Program Files\Fichiers Communs\Logitech

O43 - CFD: 16/06/2011 - 06:20:56 - [116386230] ----D- C:\Program Files\Fichiers Communs\Microsoft Shared

O43 - CFD: 20/08/2010 - 10:39:00 - [284160] ----D- C:\Program Files\Fichiers Communs\MSSoap

O43 - CFD: 20/08/2010 - 12:30:14 - [322] ----D- C:\Program Files\Fichiers Communs\ODBC

O43 - CFD: 20/08/2010 - 17:05:48 - [210472] ----D- C:\Program Files\Fichiers Communs\ScanSoft Shared

O43 - CFD: 20/08/2010 - 10:39:04 - [8106] ----D- C:\Program Files\Fichiers Communs\Services

O43 - CFD: 14/04/2011 - 06:30:46 - [2254216] ----D- C:\Program Files\Fichiers Communs\Skype

O43 - CFD: 06/05/2011 - 17:15:36 - [0] ----D- C:\Program Files\Fichiers Communs\Softwin

O43 - CFD: 20/08/2010 - 12:30:10 - [3787229] ----D- C:\Program Files\Fichiers Communs\SpeechEngines

O43 - CFD: 12/10/2010 - 16:52:42 - [18764231] ----D- C:\Program Files\Fichiers Communs\System

O43 - CFD: 20/08/2010 - 17:38:36 - [169357111] ----D- C:\Program Files\Fichiers Communs\Windows Live

O43 - CFD: 15/06/2011 - 08:38:26 - [1647799] ----D- C:\Documents and Settings\Robert\Application Data\Adobe

O43 - CFD: 20/08/2010 - 14:45:34 - [57539895] R-H-D- C:\Documents and Settings\Robert\Application Data\Application Data

O43 - CFD: 01/05/2011 - 10:54:38 - [13195] ----D- C:\Documents and Settings\Robert\Application Data\Bureau

O43 - CFD: 10/02/2011 - 07:12:24 - [0] ----D- C:\Documents and Settings\Robert\Application Data\Canon

O43 - CFD: 20/08/2010 - 14:45:52 - [426931] ----D- C:\Documents and Settings\Robert\Application Data\Contacts

O43 - CFD: 20/08/2010 - 14:45:56 - [11291] R---D- C:\Documents and Settings\Robert\Application Data\Favoris

O43 - CFD: 20/08/2010 - 14:34:06 - [83113] ----D- C:\Documents and Settings\Robert\Application Data\FotoWire

O43 - CFD: 20/08/2010 - 14:34:06 - [52156] ----D- C:\Documents and Settings\Robert\Application Data\GlarySoft

O43 - CFD: 04/12/2010 - 09:09:34 - [168] ----D- C:\Documents and Settings\Robert\Application Data\gtk-2.0

O43 - CFD: 27/12/2010 - 08:26:06 - [0] ----D- C:\Documents and Settings\Robert\Application Data\Help

O43 - CFD: 20/08/2010 - 14:48:42 - [397138803] --H-D- C:\Documents and Settings\Robert\Application Data\Local Settings

O43 - CFD: 20/08/2010 - 14:34:06 - [2480] ----D- C:\Documents and Settings\Robert\Application Data\Macromedia

O43 - CFD: 23/06/2011 - 17:21:10 - [2129] ----D- C:\Documents and Settings\Robert\Application Data\Malwarebytes

O43 - CFD: 20/08/2010 - 14:48:56 - [39037] R---D- C:\Documents and Settings\Robert\Application Data\Menu Démarrer

O43 - CFD: 20/08/2010 - 14:48:58 - [1560610057] R---D- C:\Documents and Settings\Robert\Application Data\Mes documents

O43 - CFD: 15/06/2011 - 08:38:26 - [24309088] -S--D- C:\Documents and Settings\Robert\Application Data\Microsoft

O43 - CFD: 20/08/2010 - 14:59:30 - [37456] --H-D- C:\Documents and Settings\Robert\Application Data\Modèles

O43 - CFD: 08/01/2011 - 09:09:48 - [584588] ----D- C:\Documents and Settings\Robert\Application Data\moovida-1

O43 - CFD: 27/04/2011 - 11:32:50 - [13336293] ----D- C:\Documents and Settings\Robert\Application Data\Mozilla

O43 - CFD: 22/08/2010 - 08:21:40 - [8416123] ----D- C:\Documents and Settings\Robert\Application Data\OpenOffice.org

O43 - CFD: 20/08/2010 - 14:34:10 - [3603798] ----D- C:\Documents and Settings\Robert\Application Data\OpenOffice.org2

O43 - CFD: 08/01/2011 - 10:54:02 - [1793202] ----D- C:\Documents and Settings\Robert\Application Data\Real

O43 - CFD: 20/08/2010 - 14:59:28 - [6547] R-H-D- C:\Documents and Settings\Robert\Application Data\Recent

O43 - CFD: 20/08/2010 - 14:34:12 - [16063] ----D- C:\Documents and Settings\Robert\Application Data\ScanSoft

O43 - CFD: 20/08/2010 - 14:59:30 - [1864] R-H-D- C:\Documents and Settings\Robert\Application Data\SendTo

O43 - CFD: 23/06/2011 - 09:06:26 - [3371295] ----D- C:\Documents and Settings\Robert\Application Data\Skype

O43 - CFD: 23/06/2011 - 09:04:58 - [11328] ----D- C:\Documents and Settings\Robert\Application Data\skypePM

O43 - CFD: 24/10/2010 - 08:36:48 - [937497] ----D- C:\Documents and Settings\Robert\Application Data\SoftGrid Client

O43 - CFD: 20/08/2010 - 14:34:14 - [8752745] ----D- C:\Documents and Settings\Robert\Application Data\Sun

O43 - CFD: 20/08/2010 - 14:34:20 - [2289598] ----D- C:\Documents and Settings\Robert\Application Data\Todae

O43 - CFD: 10/12/2010 - 11:37:06 - [0] ----D- C:\Documents and Settings\Robert\Application Data\Tracing

O43 - CFD: 20/08/2010 - 14:59:30 - [0] --H-D- C:\Documents and Settings\Robert\Application Data\Voisinage d'impression

O43 - CFD: 20/08/2010 - 14:59:30 - [0] --H-D- C:\Documents and Settings\Robert\Application Data\Voisinage réseau

O43 - CFD: 19/06/2011 - 13:47:58 - [0] ----D- C:\Documents and Settings\Robert\Application Data\Windows Search

O43 - CFD: 15/06/2011 - 08:35:20 - [15499154] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Adobe

O43 - CFD: 07/10/2010 - 06:40:20 - [3165] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\ApplicationHistory

O43 - CFD: 07/06/2011 - 07:59:30 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Axialis

O43 - CFD: 20/08/2010 - 15:19:02 - [262292] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Google

O43 - CFD: 27/12/2010 - 08:26:06 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Help

O43 - CFD: 20/08/2010 - 15:20:02 - [33785256] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Identities

O43 - CFD: 23/08/2010 - 08:57:58 - [833] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\IP_service

O43 - CFD: 15/06/2011 - 08:38:26 - [658807906] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Microsoft

O43 - CFD: 06/09/2010 - 12:04:56 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Microsoft Help

O43 - CFD: 08/01/2011 - 09:09:10 - [178863] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\moovida Air

O43 - CFD: 27/04/2011 - 11:32:26 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Mozilla

O43 - CFD: 20/06/2011 - 11:33:34 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\PackageAware

O43 - CFD: 23/06/2011 - 07:42:04 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Paint.NET

O43 - CFD: 28/01/2011 - 09:40:48 - [333] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Quick_Zip_Dev

O43 - CFD: 21/08/2010 - 07:14:04 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Scansoft

O43 - CFD: 22/08/2010 - 11:04:40 - [4562944] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\SoftGrid Client

O43 - CFD: 15/06/2011 - 08:38:26 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\Temp

O43 - CFD: 17/12/2010 - 10:07:16 - [0] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\WMTools Downloaded Files

 

 

 

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)

O44 - LFC:[MD5.30EE1200FEFFFFFF57494E444F577E31] - 25/06/2011 - 13:23:52 ---A- . (...) -- C:\WINDOWS\WindowsUpdate.log [2056501]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/06/2011 - 13:23:34 ---A- . (...) -- C:\WINDOWS\0.log [0]

O44 - LFC:[MD5.30EE1200FEFFFFFF000000006CF11200] - 25/06/2011 - 13:22:57 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159]

O44 - LFC:[MD5.30EE1200FEFFFFFF000000006CF11200] - 25/06/2011 - 13:22:55 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50]

O44 - LFC:[MD5.6A2CB42966136854F4464516FBB4AE72] - 25/06/2011 - 13:22:52 -S-A- . (...) -- C:\WINDOWS\bootstat.dat [2048]

O44 - LFC:[MD5.30EE1200FEFFFFFF000000006CF11200] - 25/06/2011 - 10:46:00 ---A- . (...) -- C:\WINDOWS\SchedLgU.Txt [32438]

O44 - LFC:[MD5.533FAFB7876A9DD6AA0947DFA3DCC5A2] - 25/06/2011 - 10:09:12 ---A- . (...) -- C:\WINDOWS\BELOTEXP.INI [39]

O44 - LFC:[MD5.2BDE2871DAB85806C6B49118C8D6E958] - 25/06/2011 - 08:13:46 ---A- . (...) -- C:\PDOXUSRS.NET [13030]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 24/06/2011 - 10:26:34 ---A- . (...) -- C:\Documents [0]

O44 - LFC:[MD5.19BC3077C98654C4F685624D8383BC2E] - 22/06/2011 - 10:39:57 ---A- . (...) -- C:\WINDOWS\Radio_Fr.ini [1208]

O44 - LFC:[MD5.83EEB82E9ED7098EBC0C083C6BFD3116] - 21/06/2011 - 05:16:55 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [404640]

O44 - LFC:[MD5.199B74544A8C1618125CF9440428721D] - 20/06/2011 - 09:22:43 ---A- . (...) -- C:\WINDOWS\System32\wpa.dbl [13646]

O44 - LFC:[MD5.CF6A8F42A50F30056591F0836829F16A] - 19/06/2011 - 12:57:42 ---A- . (...) -- C:\WINDOWS\System32\perfc009.dat [79210]

O44 - LFC:[MD5.574484F5495F2F962A5B12ACC96A9ACC] - 19/06/2011 - 12:57:42 ---A- . (...) -- C:\WINDOWS\System32\perfc00C.dat [94042]

O44 - LFC:[MD5.2FC38A1CE10EBAE382982D7C8087DBBD] - 19/06/2011 - 12:57:42 ---A- . (...) -- C:\WINDOWS\System32\perfh009.dat [481136]

O44 - LFC:[MD5.47F7808025EACEDD5DC88A66D4F1D511] - 19/06/2011 - 12:57:42 ---A- . (...) -- C:\WINDOWS\System32\perfh00C.dat [552342]

O44 - LFC:[MD5.54D921B5951E4502B8EE969852747F66] - 19/06/2011 - 10:05:47 ---A- . (...) -- C:\WINDOWS\System32\PerfStringBackup.INI [1247706]

O44 - LFC:[MD5.D9966C0B7FA9775E5C6BB2BC1F70136B] - 15/06/2011 - 07:49:15 ---A- . (...) -- C:\JavaRa.log [24326]

O44 - LFC:[MD5.2340832B8B1EFB379280A30140D1B7ED] - 15/06/2011 - 07:44:12 ---A- . (.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\WINDOWS\System32\java.exe [145184]

O44 - LFC:[MD5.FD8AB373BD7834A65114DD899199D00B] - 15/06/2011 - 07:44:12 ---A- . (.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\WINDOWS\System32\javaw.exe [145184]

O44 - LFC:[MD5.4EDDB64328BE19A164657230C647913E] - 15/06/2011 - 07:44:12 ---A- . (.Sun Microsystems, Inc. - Java Web Start Launcher.) -- C:\WINDOWS\System32\javaws.exe [157472]

O44 - LFC:[MD5.4538CBF0AF0D6D9AC250E2EC23BAF44F] - 13/06/2011 - 09:21:44 ---A- . (...) -- C:\PhysicalDisk0_MBR.bin [512]

O44 - LFC:[MD5.B309912717C29FC67E1BA4730A82B6DD] - 29/05/2011 - 08:11:30 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [39984]

O44 - LFC:[MD5.3D2C13377763EEAC0CA6FB46F57217ED] - 29/05/2011 - 08:11:20 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\System32\drivers\mbam.sys [22712]

 

 

 

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)

O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll

 

 

 

---\\ Export de clé d'application autorisée (O47)

O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessmgr.exe

O47 - AAKE:Key Export SP - "C:\Program Files\ma-config.com\maconfservice.exe" [Enabled] .(.CybelSoft - Service de détection matériel.) -- C:\Program Files\ma-config.com\maconfservice.exe

O47 - AAKE:Key Export SP - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [Enabled] .(.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe

O47 - AAKE:Key Export SP - "C:\Program Files\Coolscript2\cool script.exe" [Enabled] .(.Cool Co. Ltd. - Cool.) -- C:\Program Files\Coolscript2\cool script.exe

O47 - AAKE:Key Export SP - "C:\Program Files\Ludi\Ludi.exe" [Enabled] .(.Ludi.com SA - Ludi.) -- C:\Program Files\Ludi\Ludi.exe

O47 - AAKE:Key Export SP - "C:\Program Files\Ludi\LCBelote\LCBelote.exe" [Enabled] .(.Ludi - Ludi Belote.) -- C:\Program Files\Ludi\LCBelote\LCBelote.exe

O47 - AAKE:Key Export SP - "C:\Program Files\Ludi\LCDiag.exe" [Enabled] .(.LP - Pas de description.) -- C:\Program Files\Ludi\LCDiag.exe

O47 - AAKE:Key Export SP - "C:\Program Files\Skype\Phone\Skype.exe" [Enabled] .(.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe

O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessmgr.exe

 

 

 

---\\ Contrôle du Safe Boot (CSB) (O49)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS\System32\Drivers\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS\System32\Drivers\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\System32\Drivers\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (...) -- C:\WINDOWS\System32\Drivers\sermouse.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys . (.Microsoft Corporation - Pilote de filtre de système de fichiers pour la restauration du système.) -- C:\WINDOWS\System32\Drivers\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\WINDOWS\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS\System32\Drivers\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS\System32\Drivers\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\System32\Drivers\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys . (.Microsoft Corporation - IPv6 Windows Firewall Driver.) -- C:\WINDOWS\System32\Drivers\ip6fw.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\WINDOWS\System32\Drivers\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys . (.Microsoft Corporation - RDP Miniport.) -- C:\WINDOWS\System32\Drivers\rdpcdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys . (...) -- C:\WINDOWS\System32\Drivers\rdpdd.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only, Not for Export).) -- C:\WINDOWS\System32\Drivers\rdpwd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (...) -- C:\WINDOWS\System32\Drivers\sermouse.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys . (.Microsoft Corporation - Pilote de filtre de système de fichiers pour la restauration du système.) -- C:\WINDOWS\System32\Drivers\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS\System32\Drivers\tdpipe.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS\System32\Drivers\tdtcp.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\WINDOWS\System32\Drivers\vgasave.sys (.not file.)

 

 

 

---\\ Image File Execution Options (IFEO) (O50)

O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d

 

 

 

---\\ Trojan Driver Search Data (HKLM) (O52)

O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - Codec audio TrueSpeech DSP Group pour MSACM V3.50.) -- C:\WINDOWS\System32\tssoft32.acm

O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS\System32\iccvid.dll

O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (...) -- C:\WINDOWS\System32\ir32_32.dll

O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (...) -- C:\WINDOWS\System32\ir32_32.dll

O52 - TDSD: \Drivers32\"vidc.iv41"="ir41_32.ax" . (.Intel Corporation - Intel Indeo® Video 4.5.) -- C:\WINDOWS\System32\ir41_32.ax

O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\System32\sl_anet.acm

O52 - TDSD: \Drivers32\"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax

O52 - TDSD: \Drivers32\"vidc.iv50"="ir50_32.dll" . (.Intel Corporation - Intel Indeo® video 5.10.) -- C:\WINDOWS\System32\ir50_32.dll

O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\system32\l3codeca.acm

O52 - TDSD: \Drivers32\"msacm.enc"="ITIG726.acm" . (.Ingenient Technologies, Inc. - Ingenient Technologies, Inc. G.726 CODEC.) -- C:\WINDOWS\System32\ITIG726.acm

O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\System32\sl_anet.acm

O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\iac25_32.ax"="Indeo® audio software" . (.Intel Corporation - Indeo® audio software.) -- C:\WINDOWS\system32\iac25_32.ax

O52 - TDSD: \drivers.desc\"ir50_32.dll"="Indeo® video 5.10" . (...) -- (.not file.)

O52 - TDSD: \drivers.desc\"C:\WINDOWS\system32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\system32\l3codeca.acm

O52 - TDSD: \drivers.desc\"ITIG726.acm"="ITI G.726 Audio Codec" . (...) -- (.not file.)

O52 - TDSD: \drivers.desc\"ir32_32.dll"="Indeo® video R3.2 by Intel" . (...) -- (.not file.)

O52 - TDSD: \drivers.desc\"ir41_32.ax"="Indeo® video interactive R4.3 by Intel" . (...) -- (.not file.)

O52 - TDSD: \drivers.desc\"iyvu9_32.dll"="Indeo® video Raw YVU9 by Intel" . (...) -- C:\WINDOWS\System32\iyvu9_32.dll

 

 

 

---\\ Microsoft Control Security Providers (O54)

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS\system32\msapsspc.dll

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS\system32\digest.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS\system32\msapsspc.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS\system32\digest.dll

 

 

 

---\\ Microsoft Windows Policies System (O55)

O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=

O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "DisableRegistryTools"=0

O55 - MWPS:[HKCU\...\Policies\System] - "disableregistrytools"=0

 

 

 

---\\ Microsoft Windows Policies Explorer (O56)

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=323

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveAutoRun"=67108863

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDrives"=0

O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=1

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveTypeAutoRun"=351

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveAutoRun"=67108863

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDrives"=0

 

 

 

---\\ Liste des Drivers Système (O58)

O58 - SDL:[MD5.66EF49622BAA18E4D4F1FE4BAE1D51B8] - 09/10/2009 - 22:31:10 ---A- . (.Kaspersky Lab - Klif Mini-Filter [fre_wnet_x86].) -- C:\WINDOWS\system32\drivers\8075960.sys [315408]

O58 - SDL:[MD5.7DD41B7AC1FBB1DBF20BB1F4E4FBE58C] - 25/09/2009 - 16:59:42 ---A- . (.Kaspersky Lab - Kaspersky Unified Driver.) -- C:\WINDOWS\system32\drivers\80759601.sys [128016]

O58 - SDL:[MD5.A305FAD3719C5DB0C13D1C2BFD08A04D] - 22/10/2009 - 12:54:18 ---A- . (.Kaspersky Lab - Kaspersky Lab Boot Guard Driver.) -- C:\WINDOWS\system32\drivers\80759602.sys [37392]

O58 - SDL:[MD5.267FC636801EDC5AB28E14036349E3BE] - 18/11/2009 - 00:16:00 ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\drivers\Ambfilt.sys [1691480]

O58 - SDL:[MD5.98EE301B9D1511B795C3DA89048A642E] - 29/08/2003 - 07:43:48 R--A- . (.Logitech Inc. - Universal Serial Bus Camera Driver.) -- C:\WINDOWS\system32\drivers\CamDrL21.sys [334096]

O58 - SDL:[MD5.C9B25AE9B8ABD983C5AD3F8CBFAB0F9C] - 05/08/2004 - 13:00:00 ---A- . (.RAVISENT Technologies Inc. - Pilote principal CineMaster C 1.2 WDM.) -- C:\WINDOWS\system32\drivers\cinemst2.sys [262528]

O58 - SDL:[MD5.9624293E55AD405415862B504CA95B73] - 05/08/2004 - 13:00:00 ---A- . (.Compaq Computer Corporation - Compaq PA-1 Player Driver.) -- C:\WINDOWS\system32\drivers\cpqdap01.sys [11776]

O58 - SDL:[MD5.5CBF20674BE8364FEBB6A13451A42F0A] - 14/12/2009 - 11:44:24 ---A- . (.Infowatch - Cryptographic Algorithm Lib Driver..) -- C:\WINDOWS\system32\drivers\CSCrySec.sys [88632]

O58 - SDL:[MD5.2C3F213EDDD231099FB779A45D7680E0] - 14/12/2009 - 11:44:24 ---A- . (.Infowatch - Virtual Volume Container Driver (wxp).) -- C:\WINDOWS\system32\drivers\CSVirtualDiskDrv.sys [39352]

O58 - SDL:[MD5.0F68E2EC713F132FFB19E45415B09679] - 19/12/2007 - 04:32:12 R--A- . (.Intel Corporation - Intel Graphics Miniport Driver.) -- C:\WINDOWS\system32\drivers\igxpmp32.sys [5854688]

O58 - SDL:[MD5.CE3958F58547454884E97BDA78CD7040] - 01/09/2009 - 14:29:50 ---A- . (.Kaspersky Lab - Kaspersky Unified Driver.) -- C:\WINDOWS\system32\drivers\kl1.sys [128016]

O58 - SDL:[MD5.53EEDAB3F0511321AC3AE8BC968B158C] - 14/10/2009 - 20:18:34 ---A- . (.Kaspersky Lab - Kaspersky Lab Boot Guard Driver.) -- C:\WINDOWS\system32\drivers\klbg.sys [36880]

O58 - SDL:[MD5.CF9F89B7B5E08BEB60E52DD7FF3A69E5] - 29/03/2011 - 10:31:00 ---A- . (.Kaspersky Lab - Klif Mini-Filter [fre_wnet_x86].) -- C:\WINDOWS\system32\drivers\klif.sys [315408]

O58 - SDL:[MD5.FBDC2034B58D2135D25FE99EB8B747C3] - 14/09/2009 - 13:42:46 ---A- . (.Kaspersky Lab - Kaspersky Lab Intermediate Network Driver.) -- C:\WINDOWS\system32\drivers\klim5.sys [32272]

O58 - SDL:[MD5.1F351C4BA53BFE58A1CA5FCDD11E1F81] - 02/10/2009 - 18:39:44 ---A- . (.Kaspersky Lab - KLMOUFLT Mouse Device Filter [fre_wnet_x86].) -- C:\WINDOWS\system32\drivers\klmouflt.sys [19472]

O58 - SDL:[MD5.58DB33AB25D6A72CA75CB1D79D5F92C1] - 29/08/2003 - 07:40:12 R--A- . (.Logitech Inc. - SmoothVision filter.) -- C:\WINDOWS\system32\drivers\LVSVF2.sys [560640]

O58 - SDL:[MD5.F8179F468ADAC55E88E8ACC7FE3741CD] - 29/08/2003 - 07:40:02 R--A- . (.Logitech Inc. - USB Statistic Driver.) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys [12112]

O58 - SDL:[MD5.3D2C13377763EEAC0CA6FB46F57217ED] - 29/05/2011 - 08:11:20 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\system32\drivers\mbam.sys [22712]

O58 - SDL:[MD5.B309912717C29FC67E1BA4730A82B6DD] - 29/05/2011 - 08:11:30 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys [39984]

O58 - SDL:[MD5.C7D9F9717916B34C1B00DD4834AF485C] - 18/11/2009 - 00:17:00 ---A- . (.Creative Technology Ltd. - Creative WDM Audio Driver (32-bit).) -- C:\WINDOWS\system32\drivers\Monfilt.sys [1395800]

O58 - SDL:[MD5.BE984D604D91C217355CDD3737AAD25D] - 05/08/2004 - 13:00:00 ---A- . (.S3/Diamond Multimedia Systems - NikeDrv Usb Driver.) -- C:\WINDOWS\system32\drivers\nikedrv.sys [12032]

O58 - SDL:[MD5.80D317BD1C3DBC5D4FE7B1678C60CADD] - 05/08/2004 - 13:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\drivers\ptilink.sys [17792]

O58 - SDL:[MD5.A56FE08EC7473E8580A390BB1081CDD7] - 05/08/2004 - 13:00:00 ---A- . (.S3/Diamond Multimedia Systems - Rio8Drv.sys Usb Driver.) -- C:\WINDOWS\system32\drivers\rio8drv.sys [12032]

O58 - SDL:[MD5.0A854DF84C77A0BE205BFEAB2AE4F0EC] - 05/08/2004 - 13:00:00 ---A- . (.S3/Diamond Multimedia Systems - RioDrv Usb Driver.) -- C:\WINDOWS\system32\drivers\riodrv.sys [12032]

O58 - SDL:[MD5.6FC7DDF3B8D94FBA7AC664452D6478D4] - 27/11/2009 - 08:20:06 R--A- . (.Realtek Semiconductor Corporation - Realtek 10/100/1000 NDIS 5.1 Driver.) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys [177152]

O58 - SDL:[MD5.364D3642AE236C3F2F5F55F43B09FFDA] - 25/12/2009 - 11:26:30 ---A- . (.Realtek Semiconductor Corp. - Realtek® High Definition Audio Function Driver.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys [6039584]

O58 - SDL:[MD5.90A3935D05B494A5A39D37E71F09A677] - 13/04/2008 - 17:39:15 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS\system32\drivers\secdrv.sys [20480]

O58 - SDL:[MD5.D74A8EC75305F1D3CFDE7C7FC1BD62A9] - 05/08/2004 - 13:00:00 ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINDOWS\system32\drivers\tsbvcap.sys [21376]

O58 - SDL:[MD5.55E01061C74A8CEFFF58DC36114A8D3F] - 05/08/2004 - 13:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\drivers\vdmindvd.sys [58112]

O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037]

O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097]

O58 - SDL:[MD5.C6D29F29DE7427B1B0775E53E577B623] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4912]

O58 - SDL:[MD5.582BCDD47CF4B68B5CB528F18E3CB808] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809]

O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537]

O58 - SDL:[MD5.7D30A74B5FB9FE3B245A6CE5FBCD71D5] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27916]

O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146]

O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370]

O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274]

O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146]

O58 - SDL:[MD5.CAAA108FD7BF71989946B39704323455] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [34000]

O58 - SDL:[MD5.6F73F50162DEF60C84B725C18CD9140F] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560]

O58 - SDL:[MD5.0FDD5E69C1FF3B58043D44F2CC743D45] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648]

O58 - SDL:[MD5.8842837C4D8311BF8E72BEE8CCC42217] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424]

O58 - SDL:[MD5.6B56CEB3C6F9D5CD7293DBD9FE23B311] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560]

 

 

 

---\\ Liste des outils de nettoyage (O63)

O63 - Logiciel: ZHPDiag 1.27 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1

O63 - Logiciel: RSIT - (.random/random.)

 

 

 

---\\ Liste des services Legacy (O64)

O64 - Services: CurCS - 25/09/2009 - C:\WINDOWS\System32\DRIVERS\80759601.sys - 80759601(80759601) .(.Kaspersky Lab - Kaspersky Unified Driver.) - LEGACY_80759601

O64 - Services: CurCS - 22/10/2009 - C:\WINDOWS\System32\DRIVERS\80759602.sys - 80759602 Boot Guard Driver(80759602) .(.Kaspersky Lab - Kaspersky Lab Boot Guard Driver.) - LEGACY_80759602

O64 - Services: CurCS - 01/10/2010 - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe - Kaspersky PURE(AVP) .(.Kaspersky Lab - Kaspersky Anti-Virus.) - LEGACY_AVP

O64 - Services: CurCS - 14/12/2009 - C:\WINDOWS\System32\DRIVERS\CSCrySec.sys - InfoWatch Encrypt Sector Library driver(CSCrySec) .(.Infowatch - Cryptographic Algorithm Lib Driver..) - LEGACY_CSCRYSEC

O64 - Services: CurCS - 21/12/2009 - C:\Program Files\Fichiers communs\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe - Service de gestion du système CryproStorage(CSObjectsSrv) .(.Infowatch - InfoWatch CryptoStorage Protected objects c.) - LEGACY_CSOB

O64 - Services: CurCS - 14/12/2009 - C:\WINDOWS\System32\DRIVERS\CSVirtualDiskDrv.sys - InfoWatch Virtual Disk driver(CSVirtualDiskDrv) .(.Infowatch - Virtual Volume Container Driver (wxp).) - LEGACY_CSVIRTUALDISKDRV

O64 - Services: CurCS - 14/04/2008 - C:\WINDOWS\System32\drivers\dmboot.sys - dmboot(dmboot) .(.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disq.) - LEGACY_DMBOOT

O64 - Services: CurCS - 05/08/2004 - C:\WINDOWS\System32\drivers\dmload.sys - dmload(dmload) .(.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD

O64 - Services: CurCS - 30/08/2010 - C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys - No object(No service) .(.CybelSoft - Driver NT Ma-Config.com.) - LEGACY_DRIVERHARDWAREV2

O64 - Services: CurCS - 04/05/2011 - C:\Program Files\Java\jre6\bin\jqs.exe - Java Quick Starter(JavaQuickStarterService) .(.Sun Microsystems, Inc. - Java Quick Starter Service.) - LEGACY_JAVAQUICKSTARTERSERVICE

O64 - Services: CurCS - 01/09/2009 - C:\WINDOWS\system32\drivers\kl1.sys - Kl1(kl1) .(.Kaspersky Lab - Kaspersky Unified Driver.) - LEGACY_KL1

O64 - Services: CurCS - 14/10/2009 - C:\WINDOWS\System32\DRIVERS\klbg.sys - Kaspersky Lab Boot Guard Driver(klbg) .(.Kaspersky Lab - Kaspersky Lab Boot Guard Driver.) - LEGACY_KLBG

O64 - Services: CurCS - 29/03/2011 - C:\WINDOWS\System32\DRIVERS\klif.sys - Kaspersky Lab Driver(KLIF) .(.Kaspersky Lab - Klif Mini-Filter [fre_wnet_x86].) - LEGACY_KLIF

O64 - Services: CurCS - 10/03/2011 - C:\Program Files\ma-config.com\maconfservice.exe - Ma-Config Service(maconfservice) .(.CybelSoft - Service de détection matériel.) - LEGACY_MACONFSERVICE

O64 - Services: CurCS - 29/05/2011 - C:\WINDOWS\system32\drivers\mbam.sys - MBAMProtector(MBAMProtector) .(.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - LEGACY_MBAMPROTECTOR

O64 - Services: CurCS - 29/05/2011 - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe - MBAMService(MBAMService) .(.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - LEGACY_MBAMSERVICE

O64 - Services: CurCS - 09/10/2009 - C:\WINDOWS\System32\DRIVERS\8075960.sys - setup_9.0.0.722_27.04.2011_18-09drv(setup_9.0.0.722_27.04.2011_18-09drv) .(.Kaspersky Lab - Klif Mini-Filter [fre_wnet_x86].) - LEGACY_SETUP_9.0.0.722_27.04.2011_18-09DRV

O64 - Services: CurCS - 04/07/2010 - C:\Program Files\Unlocker\UnlockerDriver5.sys - UnlockerDriver5 (UnlockerDriver5) .(...) - LEGACY_UNLOCKERDRIVER5

O64 - Services: CurCS - ??/??/???? - C:\WINDOWS\system32\Drivers\utqxnjcz.sys (.not file.) - AVZ Kernel Driver (utqxnjcz) .(...) - LEGACY_UTQXNJCZ

 

 

 

---\\ File Associations Shell Spawning (O67)

O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (. - .) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll

O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe

O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe

O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll

O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <htmlfile>[HKCR\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe

O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe

 

 

 

---\\ Start Menu Internet (O68)

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe

 

 

 

---\\ Search Browser Infection (O69)

O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - Bing

O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - Bing

O69 - SBI: SearchScopes [HKCU] {2F2339BC-A98B-4E8E-85C0-347DD83D14B6} - (Google) - Google

O69 - SBI: SearchScopes [HKCU] {9D5BD211-422C-4164-9298-BB4186A30F31} [DefaultScope] - (Bing) - Bing

 

 

 

---\\ Scan Additionnel (O88)

Database Version : 8450 - (25/06/2011)

Clés trouvées (Keys found) : 5

Valeurs trouvées (Values found) : 0

Dossiers trouvés (Folders found) : 1

Fichiers trouvés (Files found) : 1

 

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] =>Toolbar.Agent

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] =>Toolbar.Agent

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9FD78518-7CBD-4071-8BE2-DDCA898890E0}] =>Trojan.Gorech

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}] =>Adware.SPointer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}] =>Adware.SPointer

C:\Documents and Settings\Robert\Local Settings\Application Data\moovida air =>Adware.SPointer

C:\WINDOWS\microsoft.net\framework\v2.0.50727\iislog\winservice.exe =>

 

 

 

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)

SR - | Auto 21/07/2004 176241 | (APC UPS Service) . (.American Power Conversion Corporation.) - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe

SR - | Auto 01/10/2010 348760 | (AVP) . (.Kaspersky Lab.) - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe

SR - | Auto 21/12/2009 743992 | (CSObjectsSrv) . (.Infowatch.) - C:\Program Files\Fichiers communs\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\System32\dmadmin.exe

SR - | Auto 04/05/2011 153376 | (JavaQuickStarterService) . (.Sun Microsystems, Inc..) - C:\Program Files\Java\jre6\bin\jqs.exe

SS - | Demand 10/03/2011 311744 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe

SS - | Disabled 29/05/2011 366640 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

 

 

 

---\\ Recherche Master Boot Record Infection (MBR)(O80)

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover

Run by Robert at 25/06/2011 17:11:34

 

device: opened successfully

user: MBR read successfully

 

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS

1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x89BAA030]

3 CLASSPNP[0xF7647FD7] -> nt!IofCallDriver[0x804E13B9] -> \Device\00000066[0x89BFEF18]

5 ACPI[0xF750D620] -> nt!IofCallDriver[0x804E13B9] -> \Device\Ide\IdeDeviceP0T0L0-4[0x89BAA940]

kernel: MBR read successfully

user & kernel MBR OK

 

 

 

---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)

Written by ad13, http://ad13.geekstog

Run by Robert at 25/06/2011 17:11:37

 

********* Dump file Name *********

C:\PhysicalDisk0_MBR.bin

 

 

 

End of the scan (958 lines in 03mn 30s)(0)

[pear]

Java n'est pas à jour,donc moins sécurisé.

 

Rendez vous là:

Java Downloads for All Operating Systems

 

Cliquer Remove older Versions

Puis sur

Windows 7/XP Online

 

 

 

Sélectionner(Ctrl A et Ctrl C) toutes les lignes en vert ci dessous(et seulement elles)

 

O42 - Logiciel: network module - (.Microsoft.) [HKLM] -- {9FD78518-7CBD-4071-8BE2-DDCA898890E0}

O43 - CFD: 08/01/2011 - 09:09:48 - [584588] ----D- C:\Documents and Settings\Robert\Application Data\moovida-1

O43 - CFD: 08/01/2011 - 09:09:10 - [178863] ----D- C:\Documents and Settings\Robert\Local Settings\Application Data\moovida Air

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9FD78518-7CBD-4071-8BE2-DDCA898890E0}]

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}]

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}]

C:\Documents and Settings\Robert\Local Settings\Application Data\moovida air

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]

 

Cliquer sur l'icône Zhpfix qui est sur votre bureau

Sous Vista/7 clic-droit, "Exécuter En tant qu'Administrateur

 

Collez (Ctrl V) les lignes vertes dans le cadre Cliquez ensuite sur le H-

Cliquer sur "OK", ce qui fait apparaître un carré à gauche de chaque ligne.

Cliquer sur "Tous" puis sur "Nettoyer" 2.

Acceptez de Redémarrer pour achever le nettoyage.

Un rapport apparait:

Si le rapport n'apparait pas,cliquer sur

Copier-coller le rapport de suppression dans la prochaine réponse.

[marsouin10_0]

voici le rapport de suppression:

 

Rapport de ZHPFix 1.12.3326 par Nicolas Coolman, Update du 25/06/2011

Fichier d'export Registre : C:\ZHPExportRegistry-25-06-2011-17-54-20.txt

Run by Robert at 25/06/2011 17:54:20

Windows XP Home Edition Service Pack 3 (Build 2600)

Web site : ZHPFix Fix de rapport

 

========== Clé(s) du Registre ==========

SUPPRIME Partiel Software Key: {9FD78518-7CBD-4071-8BE2-DDCA898890E0}

SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9FD78518-7CBD-4071-8BE2-DDCA898890E0}

ERREUR Key**: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}

SUPPRIME Key*: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E2A7BD67-0EAF-497f-B05B-748D7BF3C421}

ERREUR Key**: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}

SUPPRIME Key*: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}

 

========== Dossier(s) ==========

SUPPRIME C:\Documents and Settings\Robert\Application Data\moovida-1

SUPPRIME C:\Documents and Settings\Robert\Local Settings\Application Data\moovida Air

 

========== Fichier(s) ==========

ABSENT Folder/File: c:\documents and settings\robert\local settings\application data\moovida air

 

 

========== Récapitulatif ==========

6 : Clé(s) du Registre

2 : Dossier(s)

1 : Fichier(s)

 

 

========== Chemin du fichier rapport ==========

C:\Program Files\ZHPDiag\ZHPFixReport.txt

 

 

End of the scan

[pear]

Encore quelque chose ?

 

Si vous estimez votre problème résolu, éditez l'en tête de votre premier message en choisissant l'option "utiliser l'éditeur complet" et y indiquez Résolu pour que ceux qui la recherchent y trouvent une solution.

[marsouin10_0]

tout m'a l air o.k

je vous en remercie beaucoup

je vous souhaite un bon dimanche