Suis je infectée ?

[clarine1950]

Bonjour a tous

Mon XP ne réagissant pas très bien, je me permets de vous adresser le rapport Hijackthis que je viens de faire

Pourriez vous m'indiquer si je suis infectée. En effet, une lenteur anormale se produit depuis quelques temps.

Merci

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:52:37, on 21/07/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\SAgent4.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast5\avastUI.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Orange : téléphones, forfaits, Internet, actualité, sport, video

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyB0.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} - C:\Program Files\myBabylon\tbmyB0.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: barre d'outils Orange - {D3028143-6145-4318-99D3-3EDCE54A95A9} - C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll

O3 - Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ("Ma-Config.com control) - http://www.ma-config.com/plugins/MaConfig_4_0_3_1.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B716F27D-206A-478D-862B-5A72498D2F88}: NameServer = 192.168.1.1

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe

O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

 

--

End of file - 4534 bytes

[Apollo]

Bonjour,

 

Tâche d'éviter toute toolbar: désinstalle Babylon Toolbar.

 

Ensuite,

Télécharge Ad-Remover de C-XX et Enregistre-le sur le bureau.

 

http://www.teamxscript.org/adremoverTelechargement.html

 

Ferme toutes les applications ouvertes pour l'installer.

 

Sous XP: Double-clique, (Clic droit/exécuter comme administrateur pour Vista/7) sur l'icône placée sur le bureau.

 

Si le firewall se manifeste, accorde les autorisations à l'outil pour qu'il puisse travailler.

 

Clique sur scanner

 

 

Le rapport se trouve aussi sous C:\Ad-Report Scan.

Copie/colle-le dans ta réponse stp.

 

 

----------------------------------------------------

 

Relance Ad-Remover et cette fois, clique sur Nettoyer

 

Le bureau va disparaître, c'est normal.

 

Le rapport à poster sera sur C:\Ad-Report Clean.

 

*** Poste les deux rapports stp.

 

-------------------------------------------

Seulement après avoir posté les rapports:

Relance Ad-Remover et clique sur Désinstaller.

 

@++

[clarine1950]

Bonjour Appolo, très contente de te retrouver depuis 2010 !

Je viens juste de lire ta réponse mais ne pourrai exécuter ce que tu me demande que dans la soirée.

Par contre, Babylone toolbar n'est pas dans mes programmes et revo ne le voit pas non plus ??? où peut -il être ??

Au fait suis je infectée et par quoi ??

A ce soir et merci

[Apollo]

Re

 

Il ne s'agit pas à proprement parler d'infection mais les toolbars sont connues pour ralentir les pc et si on n'y prend garde, on se retrouve vite avec plusieurs de ces TB.

 

Tu n'as sans doute que des restes mais on fera les vérifications nécessaires afin de vérifier s'il n'y a rien d'autre qui traîne.

 

@+tard

[clarine1950]

Eh bien me revoilà et voici le 1er rapport AD-R

 

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

 

Mis à jour par TeamXscript le 12/04/11

Contact: AdRemover[DOT]contact[AT]gmail[DOT]com

Site web: http://www.teamxscript.org

 

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 17:16:19 le 22/07/2011, Mode normal

 

Microsoft Windows XP Édition familiale Service Pack 3 (X86)

user@CHANTAL ( )

 

============== RECHERCHE ==============

 

 

Fichier trouvé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\searchplugins\askcom.xml

Dossier trouvé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\conduit

Dossier trouvé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\ConduitEngine

Dossier trouvé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\extensions\engine@conduit.com

Dossier trouvé: C:\Documents and Settings\user\Local Settings\Application Data\Conduit

Dossier trouvé: C:\Documents and Settings\user\Application Data\freeTVRadio

Dossier trouvé: C:\Documents and Settings\user\Application Data\PriceGong

 

-- Fichier ouvert: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\Prefs.js --

Ligne trouvée: user_pref("CT2878731.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT287...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270698/1266370/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270703/1266375/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270707/1266379/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270710/1266382/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270713/1266385/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270718/1266390/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270721/1266393/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270727/1266399/FR", "\"0\"...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/FR", "\"0\"")...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2878731", ...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2878740", ...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63428984078257...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2878731/CT2878731...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/ct2878740/CT2878731...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634...

Ligne trouvée: user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=fr", "\"634...

Ligne trouvée: user_pref("CommunityToolbar.EngineOwner", "CT2878731");

Ligne trouvée: user_pref("CommunityToolbar.EngineOwnerGuid", "{90eee664-34b1-422a-a782-779af65cdf6d}");

Ligne trouvée: user_pref("CommunityToolbar.EngineOwnerToolbarId", "incredimail_mediabar_4");

Ligne trouvée: user_pref("CommunityToolbar.IsEngineShown", false);

Ligne trouvée: user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Ligne trouvée: user_pref("CommunityToolbar.OriginalEngineOwner", "CT2878731");

Ligne trouvée: user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{90eee664-34b1-422a-a782-779af65cdf6d}");

Ligne trouvée: user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "incredimail_mediabar_4");

Ligne trouvée: user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr...

Ligne trouvée: user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2878731");

Ligne trouvée: user_pref("CommunityToolbar.ToolbarsList2", "CT2878731");

Ligne trouvée: user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Fri May 13 2011 10:27:14 GMT+02...

Ligne trouvée: user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Ligne trouvée: user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Mon May 30 2011 08:20:01 GMT+0200");

Ligne trouvée: user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Ligne trouvée: user_pref("CommunityToolbar.alert.locale", "en");

Ligne trouvée: user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Ligne trouvée: user_pref("CommunityToolbar.alert.loginLastCheckTime", "Sun May 29 2011 16:33:20 GMT+0200");

Ligne trouvée: user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Ligne trouvée: user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Ligne trouvée: user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Ligne trouvée: user_pref("CommunityToolbar.alert.showTrayIcon", false);

Ligne trouvée: user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Ligne trouvée: user_pref("CommunityToolbar.alert.userId", "36d355db-0985-42a6-b67c-3c0805091191");

Ligne trouvée: user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Dec 27 2010 19:39:10 GMT+0100");

Ligne trouvée: user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Ligne trouvée: user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Ligne trouvée: user_pref("ConduitEngine.AppTrackingLastCheckTime", "Mon May 16 2011 09:29:23 GMT+0200");

Ligne trouvée: user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Fri May 13 2011 10:27:15 GMT+0200");

Ligne trouvée: user_pref("ConduitEngine.FirstServerDate", "12/27/2010 21");

Ligne trouvée: user_pref("ConduitEngine.FirstTime", true);

Ligne trouvée: user_pref("ConduitEngine.FirstTimeFF3", true);

Ligne trouvée: user_pref("ConduitEngine.HasUserGlobalKeys", true);

Ligne trouvée: user_pref("ConduitEngine.Initialize", true);

Ligne trouvée: user_pref("ConduitEngine.InitializeCommonPrefs", true);

Ligne trouvée: user_pref("ConduitEngine.InstalledDate", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne trouvée: user_pref("ConduitEngine.IsMulticommunity", false);

Ligne trouvée: user_pref("ConduitEngine.IsOpenThankYouPage", false);

Ligne trouvée: user_pref("ConduitEngine.IsOpenUninstallPage", true);

Ligne trouvée: user_pref("ConduitEngine.LanguagePackLastCheckTime", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne trouvée: user_pref("ConduitEngine.LastLogin_3.2.5.2", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne trouvée: user_pref("ConduitEngine.PublisherContainerWidth", 0);

Ligne trouvée: user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Ligne trouvée: user_pref("ConduitEngine.SettingsLastCheckTime", "Fri May 13 2011 10:27:13 GMT+0200");

Ligne trouvée: user_pref("ConduitEngine.UserID", "UN44990037883352532");

Ligne trouvée: user_pref("ConduitEngine.engineLocale", "fr");

Ligne trouvée: user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne trouvée: user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Fri May 13 2011 10:27:16 GMT+0200");

Ligne trouvée: user_pref("ConduitEngine.initDone", true);

Ligne trouvée: user_pref("ConduitEngine.isAppTrackingManagerOn", true);

Ligne trouvée: user_pref("browser.search.defaultengine", "Ask.com");

Ligne trouvée: user_pref("browser.search.defaultenginename", "Ask.com");

Ligne trouvée: user_pref("browser.search.order.1", "Ask.com");

-- Fichier Fermé --

 

 

Clé trouvée: HKLM\Software\Classes\Interface\{6E4C89CF-3061-4EE4-B22A-B7A8AAEA5CB3}

Clé trouvée: HKLM\Software\AskBarDis

Clé trouvée: HKLM\Software\Conduit

Clé trouvée: HKCU\Software\Conduit

Clé trouvée: HKCU\Software\PriceGong

Clé trouvée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}

Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

 

Valeur trouvée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{30F9B915-B755-4826-820B-08FBA6BD249D}

Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

 

 

============== SCAN ADDITIONNEL ==============

 

**** Mozilla Firefox Version [5.0 (fr)] ****

 

HKLM_MozillaPlugins\Adobe Reader (x)

HKLM_MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 (x)

Searchplugins\bing.xml ( hxxp://www.bing.com/search)

Components\browsercomps.dll (Mozilla Foundation)

 

-- C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default --

Extensions\engine@conduit.com (Conduit Engine )

Extensions\nostmp (?)

Searchplugins\askcom.xml (?)

Prefs.js - browser.download.lastDir, F:\\Mes documents sur F\\Mes images

Prefs.js - browser.search.defaultenginename, Ask.com

Prefs.js - browser.search.selectedEngine, Google

Prefs.js - browser.startup.homepage, hxxp://hpp.orange.fr/

Prefs.js - browser.startup.homepage_override.buildID, 20110615151330

Prefs.js - browser.startup.homepage_override.mstone, rv:5.0

Prefs.js - privacy.popups.showBrowserMessage, false

 

========================================

 

**** Internet Explorer Version [8.0.6001.18702] ****

 

HKCU_Main|SearchMigratedDefaultURL - hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

HKCU_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU_Main|Start Page - hxxp://orange.fr/

HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157

HKLM_Main|Default_Search_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM_Main|Start Page - hxxp://go.microsoft.com/fwlink/?LinkId=69157

HKCU_SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} - "Ask Search" (hxxp://websearch.ask.com/redirect?client=ie&tb=GLSV5&o=10168&src=crm&q={searchTe...)

HKCU_Toolbar|{1E796980-9CC5-11D1-A83F-00C04FC99D61} (x)

HKCU_Toolbar\ShellBrowser|{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} (x)

HKCU_Toolbar\WebBrowser|{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} (x)

HKCU_Toolbar\WebBrowser|{34EA1C70-42CC-42C5-AA29-EC58B95A343E} (C:\Program Files\myBabylon\tbmyB0.dll)

HKCU_Toolbar\WebBrowser|{D3028143-6145-4318-99D3-3EDCE54A95A9} (C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll)

HKCU_Toolbar\WebBrowser|{472734EA-242A-422B-ADF8-83D1E48CC825} (x)

HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)

HKCU_Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440} (x)

HKLM_Toolbar|{34ea1c70-42cc-42c5-aa29-ec58b95a343e} (C:\Program Files\myBabylon\tbmyB0.dll)

HKLM_Toolbar|{D3028143-6145-4318-99D3-3EDCE54A95A9} (C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll)

HKLM_Toolbar|{30F9B915-B755-4826-820B-08FBA6BD249D} (x)

HKCU_ElevationPolicy\{B383BC31-AF49-4d2e-9F09-7596170BE1AB} - C:\WINDOWS\Downloaded Program Files\CONFLICT.2\gatelauncher.exe (x)

HKLM_ElevationPolicy\{003B91A6-61E3-4591-891D-01E94C8CB11E} - c:\Program Files\Microsoft Silverlight\4.0.60310.0\Silverlight.Configuration.exe (x)

HKLM_ElevationPolicy\{1ec76a37-1762-46ff-9b14-765b3e6793be} - c:\Program Files\Microsoft Silverlight\4.0.60310.0\agcp.exe (x)

HKLM_ElevationPolicy\{307C8551-FB4F-4CB1-B06E-0E76D2C05948} - C:\Program Files\Fichiers communs\fluxDVD\APIX\APIXCore.exe (ACE GmbH)

HKLM_ElevationPolicy\{44270ABA-D71B-11DA-8750-001185653D78} - c:\program files\google\googletoolbar2user.exe (x)

HKLM_ElevationPolicy\{8BC2979A-D47A-41B6-ACA8-1815D6B61F17} - C:\Program Files\Fichiers communs\fluxDVD\Download Manager\XEBDLMgr.exe (ACE GmbH)

HKLM_ElevationPolicy\{C69C0E28-C73B-40F3-8B0D-AC43598C49D1} - C:\Program Files\Fichiers communs\mpDRM\mpDRMBroker.exe (Protect Software GmbH)

HKLM_Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66} - "?" (?)

HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)

BHO\{34ea1c70-42cc-42c5-aa29-ec58b95a343e} - "myBabylon Toolbar" (C:\Program Files\myBabylon\tbmyB0.dll)

 

========================================

 

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)

C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)

 

C:\Ad-Report-SCAN[1].txt - 22/07/2011 17:16:25 (9312 Octet(s))

 

Fin à: 17:17:10, 22/07/2011

 

============== E.O.F ==============

[clarine1950]

Voici a présent le 2ème rapport

 

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

 

Mis à jour par TeamXscript le 12/04/11

Contact: AdRemover[DOT]contact[AT]gmail[DOT]com

Site web: http://www.teamxscript.org

 

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 17:23:34 le 22/07/2011, Mode normal

 

Microsoft Windows XP Édition familiale Service Pack 3 (X86)

user@CHANTAL ( )

 

============== ACTION(S) ==============

 

 

Fichier supprimé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\searchplugins\askcom.xml

Dossier supprimé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\conduit

Dossier supprimé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\ConduitEngine

Dossier supprimé: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\extensions\engine@conduit.com

Dossier supprimé: C:\Documents and Settings\user\Local Settings\Application Data\Conduit

Dossier supprimé: C:\Documents and Settings\user\Application Data\freeTVRadio

Dossier supprimé: C:\Documents and Settings\user\Application Data\PriceGong

 

(!) -- Fichiers temporaires supprimés.

 

 

-- Fichier ouvert: C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default\Prefs.js --

Ligne supprimée: user_pref("CT2878731.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT287...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270698/1266370/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270703/1266375/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270707/1266379/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270710/1266382/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270713/1266385/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270718/1266390/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270721/1266393/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1270727/1266399/FR", "\"0\"...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/FR", "\"0\"")...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2878731", ...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2878740", ...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63428984078257...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2878731/CT2878731...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/ct2878740/CT2878731...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634...

Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=fr", "\"634...

Ligne supprimée: user_pref("CommunityToolbar.EngineOwner", "CT2878731");

Ligne supprimée: user_pref("CommunityToolbar.EngineOwnerGuid", "{90eee664-34b1-422a-a782-779af65cdf6d}");

Ligne supprimée: user_pref("CommunityToolbar.EngineOwnerToolbarId", "incredimail_mediabar_4");

Ligne supprimée: user_pref("CommunityToolbar.IsEngineShown", false);

Ligne supprimée: user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Ligne supprimée: user_pref("CommunityToolbar.OriginalEngineOwner", "CT2878731");

Ligne supprimée: user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{90eee664-34b1-422a-a782-779af65cdf6d}");

Ligne supprimée: user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "incredimail_mediabar_4");

Ligne supprimée: user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr...

Ligne supprimée: user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2878731");

Ligne supprimée: user_pref("CommunityToolbar.ToolbarsList2", "CT2878731");

Ligne supprimée: user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Fri May 13 2011 10:27:14 GMT+02...

Ligne supprimée: user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Ligne supprimée: user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Mon May 30 2011 08:20:01 GMT+0200");

Ligne supprimée: user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Ligne supprimée: user_pref("CommunityToolbar.alert.locale", "en");

Ligne supprimée: user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Ligne supprimée: user_pref("CommunityToolbar.alert.loginLastCheckTime", "Sun May 29 2011 16:33:20 GMT+0200");

Ligne supprimée: user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Ligne supprimée: user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Ligne supprimée: user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Ligne supprimée: user_pref("CommunityToolbar.alert.showTrayIcon", false);

Ligne supprimée: user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Ligne supprimée: user_pref("CommunityToolbar.alert.userId", "36d355db-0985-42a6-b67c-3c0805091191");

Ligne supprimée: user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Dec 27 2010 19:39:10 GMT+0100");

Ligne supprimée: user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Ligne supprimée: user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Ligne supprimée: user_pref("ConduitEngine.AppTrackingLastCheckTime", "Mon May 16 2011 09:29:23 GMT+0200");

Ligne supprimée: user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Fri May 13 2011 10:27:15 GMT+0200");

Ligne supprimée: user_pref("ConduitEngine.FirstServerDate", "12/27/2010 21");

Ligne supprimée: user_pref("ConduitEngine.FirstTime", true);

Ligne supprimée: user_pref("ConduitEngine.FirstTimeFF3", true);

Ligne supprimée: user_pref("ConduitEngine.HasUserGlobalKeys", true);

Ligne supprimée: user_pref("ConduitEngine.Initialize", true);

Ligne supprimée: user_pref("ConduitEngine.InitializeCommonPrefs", true);

Ligne supprimée: user_pref("ConduitEngine.InstalledDate", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne supprimée: user_pref("ConduitEngine.IsMulticommunity", false);

Ligne supprimée: user_pref("ConduitEngine.IsOpenThankYouPage", false);

Ligne supprimée: user_pref("ConduitEngine.IsOpenUninstallPage", true);

Ligne supprimée: user_pref("ConduitEngine.LanguagePackLastCheckTime", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne supprimée: user_pref("ConduitEngine.LastLogin_3.2.5.2", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne supprimée: user_pref("ConduitEngine.PublisherContainerWidth", 0);

Ligne supprimée: user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Ligne supprimée: user_pref("ConduitEngine.SettingsLastCheckTime", "Fri May 13 2011 10:27:13 GMT+0200");

Ligne supprimée: user_pref("ConduitEngine.UserID", "UN44990037883352532");

Ligne supprimée: user_pref("ConduitEngine.engineLocale", "fr");

Ligne supprimée: user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Mon Dec 27 2010 19:39:07 GMT+0100");

Ligne supprimée: user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Fri May 13 2011 10:27:16 GMT+0200");

Ligne supprimée: user_pref("ConduitEngine.initDone", true);

Ligne supprimée: user_pref("ConduitEngine.isAppTrackingManagerOn", true);

Ligne supprimée: user_pref("browser.search.defaultengine", "Ask.com");

Ligne supprimée: user_pref("browser.search.defaultenginename", "Ask.com");

Ligne supprimée: user_pref("browser.search.order.1", "Ask.com");

-- Fichier Fermé --

 

 

Clé supprimée: HKLM\Software\Classes\Interface\{6E4C89CF-3061-4EE4-B22A-B7A8AAEA5CB3}

Clé supprimée: HKLM\Software\AskBarDis

Clé supprimée: HKLM\Software\Conduit

Clé supprimée: HKCU\Software\Conduit

Clé supprimée: HKCU\Software\PriceGong

Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}

Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

 

Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{30F9B915-B755-4826-820B-08FBA6BD249D}

Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

 

 

============== SCAN ADDITIONNEL ==============

 

**** Mozilla Firefox Version [5.0 (fr)] ****

 

HKLM_MozillaPlugins\Adobe Reader (x)

HKLM_MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 (x)

Searchplugins\bing.xml ( hxxp://www.bing.com/search)

Components\browsercomps.dll (Mozilla Foundation)

 

-- C:\Documents and Settings\user\Application Data\Mozilla\FireFox\Profiles\jugezqg9.default --

Extensions\nostmp (?)

Prefs.js - browser.download.lastDir, F:\\Mes documents sur F\\Mes images

Prefs.js - browser.search.selectedEngine, Google

Prefs.js - browser.startup.homepage, hxxp://hpp.orange.fr/

Prefs.js - browser.startup.homepage_override.buildID, 20110615151330

Prefs.js - browser.startup.homepage_override.mstone, rv:5.0

Prefs.js - privacy.popups.showBrowserMessage, false

 

========================================

 

**** Internet Explorer Version [8.0.6001.18702] ****

 

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896

HKCU_Main|Start Page - hxxp://fr.msn.com/

HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm

HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Start Page - hxxp://fr.msn.com/

HKCU_Toolbar|{1E796980-9CC5-11D1-A83F-00C04FC99D61} (x)

HKCU_Toolbar\ShellBrowser|{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} (x)

HKCU_Toolbar\WebBrowser|{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} (x)

HKCU_Toolbar\WebBrowser|{34EA1C70-42CC-42C5-AA29-EC58B95A343E} (C:\Program Files\myBabylon\tbmyB0.dll)

HKCU_Toolbar\WebBrowser|{D3028143-6145-4318-99D3-3EDCE54A95A9} (C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll)

HKCU_Toolbar\WebBrowser|{472734EA-242A-422B-ADF8-83D1E48CC825} (x)

HKCU_Toolbar\WebBrowser|{CCC7A320-B3CA-4199-B1A6-9F516DD69829} (x)

HKLM_Toolbar|{34ea1c70-42cc-42c5-aa29-ec58b95a343e} (C:\Program Files\myBabylon\tbmyB0.dll)

HKLM_Toolbar|{D3028143-6145-4318-99D3-3EDCE54A95A9} (C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll)

HKCU_ElevationPolicy\{B383BC31-AF49-4d2e-9F09-7596170BE1AB} - C:\WINDOWS\Downloaded Program Files\CONFLICT.2\gatelauncher.exe (x)

HKLM_ElevationPolicy\{003B91A6-61E3-4591-891D-01E94C8CB11E} - c:\Program Files\Microsoft Silverlight\4.0.60310.0\Silverlight.Configuration.exe (x)

HKLM_ElevationPolicy\{1ec76a37-1762-46ff-9b14-765b3e6793be} - c:\Program Files\Microsoft Silverlight\4.0.60310.0\agcp.exe (x)

HKLM_ElevationPolicy\{307C8551-FB4F-4CB1-B06E-0E76D2C05948} - C:\Program Files\Fichiers communs\fluxDVD\APIX\APIXCore.exe (ACE GmbH)

HKLM_ElevationPolicy\{44270ABA-D71B-11DA-8750-001185653D78} - c:\program files\google\googletoolbar2user.exe (x)

HKLM_ElevationPolicy\{8BC2979A-D47A-41B6-ACA8-1815D6B61F17} - C:\Program Files\Fichiers communs\fluxDVD\Download Manager\XEBDLMgr.exe (ACE GmbH)

HKLM_ElevationPolicy\{C69C0E28-C73B-40F3-8B0D-AC43598C49D1} - C:\Program Files\Fichiers communs\mpDRM\mpDRMBroker.exe (Protect Software GmbH)

HKLM_Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66} - "?" (?)

HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)

BHO\{34ea1c70-42cc-42c5-aa29-ec58b95a343e} - "myBabylon Toolbar" (C:\Program Files\myBabylon\tbmyB0.dll)

 

========================================

 

C:\Program Files\Ad-Remover\Quarantine: 130 Fichier(s)

C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)

 

C:\Ad-Report-CLEAN[1].txt - 22/07/2011 17:23:44 (9533 Octet(s))

C:\Ad-Report-SCAN[1].txt - 22/07/2011 17:16:25 (14244 Octet(s))

 

Fin à: 17:24:35, 22/07/2011

 

============== E.O.F ==============

[Apollo]

Re,

 

ZHPDiag :

 

• Télécharge ZHPDiag de Nicolas Coolman. et enregistre-le sur le BUREAU.
   
   
  
• Double-clique sur ZHPDiag.exe pour lancer l'installation
  
  • Important:
    Sous Vista et Windows 7 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur

N'oublie pas de cocher la case qui permet de mettre un raccourci sur le Bureau.

 

[*]L'outil a créé 2 icônes ZHPDiag et ZHPFix sur le Bureau.

 

[*]Double-clique sur ZHPDiag pour lancer l'exécution

• Important:
  Sous Vista et Windows 7 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur

 

[*]Clique sur le tournevis.

[*]Clique sur la loupe pour lancer l'analyse. Tu patientes jusqu'à ce que le scan affiche 100%

Tu refermes ZHPDiag

 

[*]Le rapport ZHPDiag.txt se trouve sur le Bureau.

Ce rapport étant trop long pour le forum, héberge le :

• soit directement sur le forum en pièce jointe dans ta réponse : Ajouter un fichier en pièce jointe sur le forum <<< Seulement pour le forum Vista-XP.fr!
  
• soit sur Cijoint.fr et copie-colle le lien fourni dans ta réponse.
  
• Free large file hosting. Send big files the easy way! copier/coller le tout premier lien fourni.

 

@++

[clarine1950]

Avez vous reçu MBRCheck ??

Je l'ai mis sur ci-joint.fr ??

[Apollo]

Bonsoir,

 

Je n'ai pas demandé de mbrcheck mais un zhpdiag; tu dois me donner le lien fourni par ci-joint pour que je puisse le consulter.

 

Si tu ne sais pas héberger le rapport, poste-le en clair ici.

 

@++

[clarine1950]

Bonjour Appolo

Effectivement je ne sais pas utiliser un hébergeur. J'ai essayé en copie mais je ne sais ou le document est parti ?

 

Voici le rapport ZHPDiag

Merci encore

 

Rapport de ZHPDiag v1.27.2424 par Nicolas Coolman, Update du 22/07/2011

Run by user at 23/07/2011 09:56:30

Web site : ZHPDiag Outil de diagnostic

 

 

---\\ Web Browser

MSIE: Internet Explorer v8.0.6001.18702

MFIE: Mozilla Firefox 5.0 v (Defaut)

 

---\\ System Information

Windows XP Home Edition Service Pack 3 (Build 2600)

~ Processor: x86 Family 6 Model 10 Stepping 0, AuthenticAMD

~ Operating System: 32 Bits

~ Boot mode: ~ Normal (Normal boot)

Total RAM: 1535 MB (60% free)

~ System Restore: Activé (Enable)

System drive C: has 89 GB (69%) free of 128 GB

 

---\\ Logged in mode

~ Computer Name: CHANTAL

~ User Name: user

~ All Users Names: user, SUPPORT_388945a0, NOUS, Michel, KERBELLEC, HelpAssistant, Administrateur,

~ Unselected Option: O45,O61,O62,O65,O66,O82

~ Logged in as Administrator

 

---\\ Environnement Variables

~ %AppData%=C:\Documents and Settings\user\Application Data\

~ %Desktop%=C:\Documents and Settings\user\Bureau\

~ %Favorites%=C:\Documents and Settings\user\Favoris\

~ %LocalAppData%=C:\Documents and Settings\user\Local Settings\Application Data\

~ %StartMenu%=C:\Documents and Settings\user\Menu Démarrer\

 

---\\ DOS/Devices

C:\ Hard drive, Flash drive, Thumb drive (Free 89 Go of 128 Go)

D:\ CD-ROM drive (Not Inserted)

E:\ CD-ROM drive (Not Inserted)

F:\ Hard drive, Flash drive, Thumb drive (Free 30 Go of 38 Go)

 

 

 

---\\ Security Center & Tools Informations

[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK

[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK

[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK

 

 

 

---\\ Recherche particulière de fichiers génériques

[MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.27/04/2011 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824]

[MD5.93AD0B78C7357A05F50E594EC7C22300] - (....) (.27/04/2011 - 03:34:20.) -- C:\WINDOWS\system32\rundll32.exe [33792]

[MD5.42F5E14E33D79C236680468B1E4999F4] - (.Microsoft Corporation - Internet Extensions for Win32.) (.17/06/2011 - 17:06:11.) -- C:\WINDOWS\system32\wininet.dll [916480]

[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.27/04/2011 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000]

[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.27/04/2011 - 19:40:30.) -- C:\WINDOWS\system32\drivers\atapi.sys [96512]

[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.27/04/2011 - 20:15:53.) -- C:\WINDOWS\system32\drivers\ntfs.sys [574976]

 

 

 

---\\ Etat des fichiers cachés (Caché/Total)

~ Mes images (My Pictures) : 3/4

~ Mes musiques (My Musics) : 14/31

~ Mes Videos (My Videos) : 2/3

~ Mes Favoris (My Favorites) : 4/280

~ Mes Documents (My Documents) : 34/2278

~ Mon Bureau (My Desktop) : 57/1659

~ Menu demarrer (Programs) : 5/51

 

 

 

---\\ Processus lancés

[MD5.D16C826F375A44802BF317982E81A7E2] - (.AVAST Software - avast! Service.) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [42184]

[MD5.E7CF222185411C6A3E68273C452B3283] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\avastUI.exe [3493720]

[MD5.4814DEDE3A8F5B36839C11B04324F240] - (.Microsoft Corporation - IType.exe.) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe [1298320]

[MD5.AA09FD16363E4232C68AF854E8A26F21] - (.SEIKO EPSON CORPORATION - SAgent4.) -- C:\WINDOWS\system32\SAgent4.exe [122880]

[MD5.6C9CD3ECBA6732661C8BBE37A877A2BD] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [924632]

[MD5.4486AD32BB05628967695FCA1BADD46E] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [16856]

[MD5.0E8A6A1BC5B08EA29E363EE5E06F7ECB] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [658944]

 

 

 

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)

C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\jugezqg9.default\prefs.js

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\amazon-france.xml

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\bing.xml

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay-france.xml

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-fr.xml

M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-france.xml

P2 - FPN:Firefox Plugin Navigator . (.Sun Microsystems, Inc. - NPRuntime Script Plug-in Library for Java Deploy.) -- C:\Program Files\Mozilla Firefox\Plugins\npdeployJava1.dll

P2 - FPN:Firefox Plugin Navigator . (.Microsoft Corporation - 1.9.0042.0.) -- C:\Program Files\Mozilla Firefox\Plugins\npLegitCheckPlugin.dll

P2 - FPN:Firefox Plugin Navigator . (.Microsoft Corporation - Office Plugin for Netscape Navigator.) -- C:\Program Files\Mozilla Firefox\Plugins\NPOFFICE.DLL

P2 - FPN:Firefox Plugin Navigator . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 10.1.0.) -- C:\Program Files\Mozilla Firefox\Plugins\nppdf32.dll

P2 - FPN:Firefox Plugin Navigator . (.NOS Microsystems Ltd. - getplusplusadobe16291.) -- C:\Program Files\Mozilla Firefox\Plugins\np_gp.dll

P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

P2 - FPN: [HKLM] [@google.com/npPicasa3,version=3.0.0] - (.Google, Inc. - Picasa plugin.) -- C:\Program Files\Google\Picasa3\npPicasa3.dll

P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_25 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

P2 - FPN: [HKLM] [@ma-config.com/HardwareDetection] - (.Cybelsoft - Plugin NPAPI Ma-Config.com.) -- C:\Program Files\ma-config.com\nphardwaredetection.dll

P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (...) -- c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll (.not file.)

P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

P2 - FPN: [HKLM] [@nosltd.com/getPlus+®,version=1.6.2.91] - (.NOS Microsystems Ltd. - getplusplusadobe16291.) -- C:\Program Files\NOS\bin\np_gp.dll

P2 - FPN: [HKLM] [@videolan.org/vlc,version=1.1.10] - (.the VideoLAN Team - Version 1.1.10, copyright 1996-2011 The VideoLAN Team<br><a href="http.) -- C:\Program Files\VideoLAN\VLC\npvlc.dll

P2 - FPN: [HKLM] [Adobe Reader] - (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape 10.1.0.) -- C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

P2 - FPN: [HKLM] [yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1] - (.Yahoo! Inc. - Yahoo! activeX Plug-in Bridge.) -- C:\Program Files\Yahoo!\Common\npyaxmpb.dll

 

 

 

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R0 - HKUS\S-1-5-21-725345543-1606980848-839522115-1004\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Microsoft Corporation

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Microsoft Corporation

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Microsoft Corporation

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Search Microsoft.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Microsoft Corporation

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (8.00.6001.19072 (longhorn_ie8_gdr.110420-1700)) -- C:\WINDOWS\system32\ieframe.dll

R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0

 

 

 

---\\ Internet Explorer, Proxy Management (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1

 

 

 

---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"

 

 

 

---\\ Browser Helper Objects de navigateur (O2)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\myBabylon\tbmyB0.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} . (.SEIKO EPSON CORPORATION - EPSON Web-To-Page.) -- C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

 

 

 

---\\ Internet Explorer Toolbars (O3)

O3 - Toolbar: myBabylon Toolbar - {34ea1c70-42cc-42c5-aa29-ec58b95a343e} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files\myBabylon\tbmyB0.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} . (.SEIKO EPSON CORPORATION - EPSON Web-To-Page.) -- C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: barre d'outils Orange - {D3028143-6145-4318-99D3-3EDCE54A95A9} . (.Orange - IE Toolbar Container.) -- C:\Program Files\Orange\ToolbarFR\ToolbarContainer101000315.dll

O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (...) -- (.not file.)

 

 

 

---\\ Applications démarrées par registre & par dossier (O4)

O4 - HKLM\..\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\avastUI.exe

O4 - HKLM\..\Run: [itype] . (.Microsoft Corporation - IType.exe.) -- c:\Program Files\Microsoft IntelliType Pro\itype.exe

 

 

 

---\\ Autres liens utilisateurs (O4)

O4 - Global Startup: C:\Documents And Settings\user\Menu Démarrer\Programmes\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\iexplore.exe

O4 - Global Startup: C:\Documents And Settings\user\Menu Démarrer\Programmes\Microsoft Money.LNK . (.Microsoft Corporation.) -- C:\Program Files\Microsoft Money\System\MSMONEY.EXE

O4 - Global Startup: C:\Documents And Settings\user\Menu Démarrer\Programmes\Outlook Express.lnk . (.Microsoft Corporation.) -- C:\Program Files\Outlook Express\msimn.exe

O4 - Global Startup: C:\Documents And Settings\user\Menu Démarrer\Programmes\Update Checker.lnk . (.FileHippo.com.) -- C:\Program Files\FileHippo.com\UpdateChecker.exe

O4 - Global Startup: C:\Documents And Settings\user\Menu Démarrer\Programmes\Windows Media Player.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Media Player\wmplayer.exe

 

 

 

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)

O9 - Extra button: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} -- C:\WINDOWS\bdoscandel.exe (.not file.)

O9 - Extra button: Uninstall BitDefender Online Scanner v8 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\PROGRA~1\MICROS~2\OFFICE11\REFBARH.ICO

O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} . (...) -- C:\PROGRA~1\MICROS~2\OFFICE11\REFBARH.ICO

 

 

 

---\\ Winsock hijacker (Layered Service Provider) (O10)

O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll

O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll

O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS\system32\mswsock.dll

 

 

 

---\\ Objets ActiveX (Downloaded Program Files)(O16)

O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} () - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ("Ma-Config.com control) - http://www.ma-config.com/plugins/MaConfig_4_0_3_1.cab

 

 

 

---\\ Modification Domaine/Adresses DNS (O17)

O17 - HKLM\System\CCS\Services\Tcpip\..\{B716F27D-206A-478D-862B-5A72498D2F88}: NameServer = 192.168.1.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{B716F27D-206A-478D-862B-5A72498D2F88}: NameServer = 192.168.1.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{B716F27D-206A-478D-862B-5A72498D2F88}: NameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{CFEE4396-AF38-4AA3-926D-4443F7939151}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{CFEE4396-AF38-4AA3-926D-4443F7939151}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{CFEE4396-AF38-4AA3-926D-4443F7939151}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

 

 

 

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)

O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\Windows\System32\crypt32.dll

O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\Windows\System32\cryptnet.dll

 

 

 

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} . (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS\system32\stobject.dll

 

 

 

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)

O22 - SharedTaskScheduler: (no name) - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll

 

 

 

---\\ Liste des services NT non Microsoft et non désactivés (O23)

O23 - Service: avast! Antivirus (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: Epson Printer Status Agent4 (StatusAgent4) . (.SEIKO EPSON CORPORATION - SAgent4.) - C:\WINDOWS\system32\SAgent4.exe

 

 

 

---\\ Enumération Active Desktop & MHTML Editor (O24)

O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Office Word.) - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe

 

 

 

---\\ Tâches planifiées en automatique (O39)

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GlaryInitialize.job

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-725345543-1606980848-839522115-1004.job

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-725345543-1606980848-839522115-1004.job

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\SpeedUpMyPC.job

O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\User_Feed_Synchronization-{FD70A7B2-6EB8-4E62-B86E-50AA37174318}.job

 

 

 

---\\ Pilotes lancés au démarrage (O41)

O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys

O41 - Driver: (AmdK7) . (.Microsoft Corporation - Pilote de périphérique processeur.) - C:\WINDOWS\System32\DRIVERS\amdk7.sys

O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS\System32\DRIVERS\cdrom.sys

O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\WINDOWS\System32\DRIVERS\i8042prt.sys

O41 - Driver: (Imapi) . (.Microsoft Corporation - IMAPI Kernel Driver.) - C:\WINDOWS\System32\drivers\Imapi.sys

O41 - Driver: (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS\System32\DRIVERS\ipsec.sys

O41 - Driver: (is-8VVOUdrv) . (.Kaspersky Lab - Klif Mini-Filter.) - C:\WINDOWS\System32\DRIVERS\43882967.sys

O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\WINDOWS\System32\DRIVERS\kbdclass.sys

O41 - Driver: (kbdhid) . (.Microsoft Corporation - Pilote de filtre souris HID.) - C:\WINDOWS\System32\DRIVERS\kbdhid.sys

O41 - Driver: (Mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\WINDOWS\System32\DRIVERS\mouclass.sys

O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys

O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\System32\DRIVERS\netbios.sys

O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\System32\DRIVERS\netbt.sys

O41 - Driver: (Processor) . (.Microsoft Corporation - Pilote de périphérique processeur.) - C:\WINDOWS\System32\DRIVERS\processr.sys

O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS\System32\DRIVERS\rasacd.sys

O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS\System32\DRIVERS\rdbss.sys

O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

O41 - Driver: (redbook) . (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) - C:\WINDOWS\System32\DRIVERS\redbook.sys

O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\WINDOWS\System32\DRIVERS\serial.sys

O41 - Driver: (ssmdrv) . (.Avira GmbH - AVIRA SnapShot Driver.) - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS\System32\DRIVERS\tcpip.sys

O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS\System32\DRIVERS\termdd.sys

O41 - Driver: Carte vidéo VGA. (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS\system32\drivers\vga.sys

O41 - Driver: Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0 (WS2IFSL) . (.Microsoft Corporation - Winsock2 IFS Layer.) - C:\WINDOWS\system32\drivers\ws2ifsl.sys

 

 

 

---\\ Logiciels installés (O42)

O42 - Logiciel: 32 Jeux de Cartes - (.Pas de propriétaire.) [HKLM] -- {515F82FC-4DCC-4D70-BAAA-9DA42369EA4F}

O42 - Logiciel: 7-Zip 9.20 - (.Pas de propriétaire.) [HKLM] -- 7-Zip

O42 - Logiciel: AIDA32 v3.93 - (.Tamas Miklos.) [HKLM] -- AIDA32_is1

O42 - Logiciel: AMD APP SDK Runtime - (.Advanced Micro Devices Inc..) [HKLM] -- {A25FF1C0-80B6-4B8B-A551-DC525697A408}

O42 - Logiciel: ATI Catalyst Control Center - (.Pas de propriétaire.) [HKLM] -- {EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}

O42 - Logiciel: ATI Catalyst Registration - (.ATI Technologies Inc..) [HKLM] -- {11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}

O42 - Logiciel: ATI Control Panel - (.Pas de propriétaire.) [HKLM] -- {0BEDBD4E-2D34-47B5-9973-57E62B29307C}

O42 - Logiciel: ATI Display Driver - (.Pas de propriétaire.) [HKLM] -- ATI Display Driver

O42 - Logiciel: Adobe Download Manager - (.NOS Microsystems Ltd..) [HKLM] -- {E2883E8F-472F-4fb0-9522-AC9BF37916A7}

O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX

O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin

O42 - Logiciel: Adobe Reader X (10.1.0) - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1033-7B44-AA1000000001}

O42 - Logiciel: Ahead Nero OEM - (.Pas de propriétaire.) [HKLM] -- Nero - Burning Rom!UninstallKey

O42 - Logiciel: Belote - (.Pas de propriétaire.) [HKLM] -- Belote

O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner

O42 - Logiciel: Defraggler - (.Piriform.) [HKLM] -- Defraggler

O42 - Logiciel: EPSON CardMonitor - (.Pas de propriétaire.) [HKLM] -- {109D28C7-FB38-483A-9C91-001CB59E2699}

O42 - Logiciel: EPSON Copy Utility 3 - (.Pas de propriétaire.) [HKLM] -- {67EDD823-135A-4D59-87BD-950616D6E857}

O42 - Logiciel: EPSON Logiciel imprimante - (.Pas de propriétaire.) [HKLM] -- EPSON Printer and Utilities

O42 - Logiciel: EPSON PRINT Image Framer Tool2.1 - (.Pas de propriétaire.) [HKLM] -- {23B59ED4-C360-11D7-875B-0090CC005647}

O42 - Logiciel: EPSON PhotoQuicker3.5 - (.Pas de propriétaire.) [HKLM] -- {65F5B7AF-3363-11D7-BB6B-00018021113F}

O42 - Logiciel: EPSON PhotoStarter3.1 - (.Pas de propriétaire.) [HKLM] -- {C48817E7-AA05-4151-A99D-1E1E550CE801}

O42 - Logiciel: EPSON Scan - (.Pas de propriétaire.) [HKLM] -- EPSON Scanner

O42 - Logiciel: EPSON Smart Panel - (.Pas de propriétaire.) [HKLM] -- {6C11D561-620B-47DA-A693-4C597F3CDF40}

O42 - Logiciel: EPSON Web-To-Page - (.Pas de propriétaire.) [HKLM] -- {7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}

O42 - Logiciel: ESPRX420 Guide de réf. - (.Pas de propriétaire.) [HKLM] -- ESPRX420 Guide de réf.

O42 - Logiciel: ESPRX420 Guide des logiciels - (.Pas de propriétaire.) [HKLM] -- ESPRX420 Guide des logiciels

O42 - Logiciel: FileHippo.com Update Checker - (.Pas de propriétaire.) [HKLM] -- FileHippo.com

O42 - Logiciel: FileMaker Pro 5.5 - (.FileMaker, Inc..) [HKLM] -- {4A425F14-0561-11D4-9027-0060089CDAE1}

O42 - Logiciel: GAZO DIGIBOOK (V9.0) - (.Pas de propriétaire.) [HKLM] -- GAZO DIGIBOOK

O42 - Logiciel: Glary Utilities 2.35.0.1216 - (.Glarysoft Ltd.) [HKLM] -- Glary Utilities_is1

O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595

O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484

O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5

O42 - Logiciel: Hotfix for Windows XP (KB976002-v5) - (.Microsoft Corporation.) [HKLM] -- KB976002-v5

O42 - Logiciel: Internet Explorer (Enable DEP) - (.Pas de propriétaire.) [HKLM] -- {a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb

O42 - Logiciel: Java 6 Update 25 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216025FF}

O42 - Logiciel: Lecteur Windows Media 11 - (.Pas de propriétaire.) [HKLM] -- Windows Media Player

O42 - Logiciel: MSXML 4.0 SP2 (KB936181) - (.Microsoft Corporation.) [HKLM] -- {C04E32E0-0416-434D-AFB9-6969D703A9EF}

O42 - Logiciel: MSXML 4.0 SP2 (KB954430) - (.Microsoft Corporation.) [HKLM] -- {86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

O42 - Logiciel: MSXML 4.0 SP2 (KB973688) - (.Microsoft Corporation.) [HKLM] -- {F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

O42 - Logiciel: Ma-Config.com - (.Cybelsoft.) [HKLM] -- {69F02EF7-5303-4ECC-B2ED-A6433DA1B305}

O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.0.1200 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1

O42 - Logiciel: Micro Application - Belote et Coinche/Contrée - (.Pas de propriétaire.) [HKLM] -- Belote et Coinche/Contrée

O42 - Logiciel: Micro Application - MediaDICO - (.Pas de propriétaire.) [HKLM] -- MediaDICO

O42 - Logiciel: Micro Application - Poker - (.Micro Application.) [HKLM] -- Poker_is1

O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

O42 - Logiciel: Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA - (.Microsoft Corporation.) [HKLM] -- {72AD53CC-CCC0-3757-8480-9EE176866A7C}

O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 - (.Microsoft Corporation.) [HKLM] -- {A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

O42 - Logiciel: Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA - (.Microsoft Corporation.) [HKLM] -- {0BD83598-C2EF-3343-847B-7D2E84599128}

O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack SP1 - fra - (.Microsoft Corporation.) [HKLM] -- {3E31821C-7917-367E-938E-E65FC413EA31}

O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 SP1

O42 - Logiciel: Microsoft .NET Framework 3.5 SP1 - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

O42 - Logiciel: Microsoft Bootvis - (.Microsoft.) [HKLM] -- {0F9196C6-58B4-445B-B56E-B1200FECC151}

O42 - Logiciel: Microsoft Fix it Center - (.Microsoft Corporation.) [HKLM] -- {B7588D45-AFDC-4C93-9E2E-A100F3554B64}

O42 - Logiciel: Microsoft IntelliType Pro 8.1 - (.Microsoft.) [HKLM] -- Microsoft IntelliType Pro 8.1

O42 - Logiciel: Microsoft IntelliType Pro 8.1 - (.Microsoft.) [HKLM] -- {96056420-DDF3-46A7-AA8D-BC2D1AE5290B}

O42 - Logiciel: Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 - (.Microsoft Corporation.) [HKLM] -- Wdf01009

O42 - Logiciel: Microsoft Money 2000 Standard - (.Pas de propriétaire.) [HKLM] -- MSMONEYV80

O42 - Logiciel: Microsoft Office Professional Edition 2003 - (.Microsoft Corporation.) [HKLM] -- {9011040C-6000-11D3-8CFE-0150048383C9}

O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 - (.Microsoft Corporation.) [HKLM] -- {770657D0-A123-3C07-8E44-1C83EC895118}

O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}

O42 - Logiciel: Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 - (.Microsoft Corporation.) [HKLM] -- {86CE85E6-DBAC-3FFD-B977-E4B79F83C909}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - (.Microsoft Corporation.) [HKLM] -- {9BE518E6-ECC6-35A9-88E4-87755C07200F}

O42 - Logiciel: Module linguistique Microsoft .NET Framework 3.5 SP1- fra - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 3.5 Language Pack SP1 - fra

O42 - Logiciel: Motorola Phone Tools - (.Avanquest Software.) [HKLM] -- {BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}

O42 - Logiciel: MouseWare 9.60 - (.Pas de propriétaire.) [HKLM] -- {5809E7CF-4DCF-11D4-9875-00105ACE7734}

O42 - Logiciel: Mozilla Firefox 5.0 (x86 fr) - (.Mozilla.) [HKLM] -- Mozilla Firefox 5.0 (x86 fr)

O42 - Logiciel: Palm Desktop - (.Palm, Inc..) [HKLM] -- {F1E906E7-1120-428D-A124-4938C306427E}

O42 - Logiciel: PhotoImpression 5 - (.Pas de propriétaire.) [HKLM] -- {66C8BE35-8BBB-472B-96C7-C7C9A499F988}

O42 - Logiciel: Picasa 3 - (.Google, Inc..) [HKLM] -- Picasa 3

O42 - Logiciel: RealUpgrade 1.1 - (.RealNetworks, Inc..) [HKLM] -- {28C2DED6-325B-4CC7-983A-1777C8F7FBAB}

O42 - Logiciel: Realtek AC'97 Audio - (.Realtek Semiconductor Corp..) [HKLM] -- {FB08F381-6533-4108-B7DD-039E11FBC27E}

O42 - Logiciel: Recuva - (.Piriform.) [HKLM] -- Recuva

O42 - Logiciel: Revo Uninstaller 1.92 - (.VS Revo Group.) [HKLM] -- Revo Uninstaller

O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- KB931906

O42 - Logiciel: Security Update for CAPICOM (KB931906) - (.Microsoft Corporation.) [HKLM] -- {0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

O42 - Logiciel: Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB2416473

O42 - Logiciel: Spybot - Search & Destroy - (.Safer Networking Limited.) [HKLM] -- {B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1

O42 - Logiciel: The Lord of the Rings FREE Trial - (.ATI Technologies Inc..) [HKLM] -- {8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}

O42 - Logiciel: TomTom HOME 2.8.2.2264 - (.TomTom.) [HKLM] -- TomTom HOME

O42 - Logiciel: TomTom HOME Visual Studio Merge Modules - (.TomTom International B.V..) [HKLM] -- {8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}

O42 - Logiciel: Uniblue SpeedUpMyPC - (.Uniblue Systems Ltd.) [HKLM] -- {E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1

O42 - Logiciel: Unlocker 1.9.1 - (.Cedrick Collomb.) [HKLM] -- Unlocker

O42 - Logiciel: Update Manager - (.Corel Corporation.) [HKLM] -- {F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}

O42 - Logiciel: Update for Microsoft .NET Framework 3.5 SP1 (KB963707) - (.Microsoft Corporation.) [HKLM] -- {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707

O42 - Logiciel: VIA Gestionnaire de périphériques de plate-forme - (.VIA Technologies, Inc..) [HKLM] -- InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}

O42 - Logiciel: VIA Rhine-Family Fast-Ethernet Adapter - (.Pas de propriétaire.) [HKLM] -- VN_VUIns_Rhine_VIA

O42 - Logiciel: VLC media player 1.1.10 - (.VideoLAN.) [HKLM] -- VLC media player

O42 - Logiciel: Visual C++ 2008 x86 Runtime - (v9.0.30729) - (.Microsoft Corporation.) [HKLM] -- {F333A33D-125C-32A2-8DCE-5C5D14231E27}

O42 - Logiciel: Visual C++ 2008 x86 Runtime - v9.0.30729.01 - (.Microsoft Corporation.) [HKLM] -- {F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01

O42 - Logiciel: Windows Genuine Advantage Notifications (KB905474) - (.Microsoft Corporation.) [HKLM] -- WgaNotify

O42 - Logiciel: Windows Internet Explorer 8 - (.Microsoft Corporation.) [HKLM] -- ie8

O42 - Logiciel: Windows Media Format 11 runtime - (.Microsoft Corporation.) [HKLM] -- wmfdist11

O42 - Logiciel: Windows Media Format 11 runtime - (.Pas de propriétaire.) [HKLM] -- Windows Media Format Runtime

O42 - Logiciel: Windows Media Player 11 - (.Microsoft Corporation.) [HKLM] -- wmp11

O42 - Logiciel: Wise Registry Cleaner 5.9.4 - (.ZhiQing Soft, Inc..) [HKLM] -- Wise Registry Cleaner_is1

O42 - Logiciel: avast! Free Antivirus - (.AVAST Software.) [HKLM] -- avast

O42 - Logiciel: barre d'outils Orange - (.France Telecom SA.) [HKLM] -- OrangeToolbarFR

O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}

 

---\\ HKCU & HKLM Software Keys

[HKCU\Software\7-Zip]

[HKCU\Software\ALWIL Software]

[HKCU\Software\ASProtect]

[HKCU\Software\ATI]

[HKCU\Software\AVAST Software]

[HKCU\Software\AVS4YOU]

[HKCU\Software\Adaptec]

[HKCU\Software\Adobe]

[HKCU\Software\Ahead]

[HKCU\Software\AppDataLow\FSOLS.Fscax.1]

[HKCU\Software\AppDataLow\FSOLS.Fscax.3]

[HKCU\Software\AppDataLow\Software\Microsoft]

[HKCU\Software\AppDataLow\Software\iGraal]

[HKCU\Software\AppDataLow\Software]

[HKCU\Software\AppDataLow]

[HKCU\Software\ArcSoft]

[HKCU\Software\Art Plus]

[HKCU\Software\Ascentive]

[HKCU\Software\AusLogics]

[HKCU\Software\Avance]

[HKCU\Software\BVRP Software]

[HKCU\Software\BitDefender]

[HKCU\Software\CDDB]

[HKCU\Software\CeWe Color]

[HKCU\Software\Classes]

[HKCU\Software\Clients]

[HKCU\Software\Digital River]

[HKCU\Software\DigitalPictureRecovery2]

[HKCU\Software\DivXNetworks]

[HKCU\Software\EPSON]

[HKCU\Software\Expertcity]

[HKCU\Software\F-Secure]

[HKCU\Software\FileHippo.com]

[HKCU\Software\FileMaker]

[HKCU\Software\Foxit Software]

[HKCU\Software\Gabest]

[HKCU\Software\GlarySoft]

[HKCU\Software\Google]

[HKCU\Software\H&&M System Software]

[HKCU\Software\HTS-BELOTE]

[HKCU\Software\HookNetwork]

[HKCU\Software\IDAVLab]

[HKCU\Software\INTEL]

[HKCU\Software\ImInstaller]

[HKCU\Software\InstallShield]

[HKCU\Software\InterTrust]

[HKCU\Software\JavaSoft]

[HKCU\Software\Lavalys]

[HKCU\Software\LeaderTech]

[HKCU\Software\Licenses]

[HKCU\Software\Ligos]

[HKCU\Software\LitePC]

[HKCU\Software\Logitech]

[HKCU\Software\Macromedia]

[HKCU\Software\Malwarebytes' Anti-Malware]

[HKCU\Software\Micro Application]

[HKCU\Software\Monitored]

[HKCU\Software\MozillaPlugins]

[HKCU\Software\Mozilla]

[HKCU\Software\Nero]

[HKCU\Software\NetIntellGames]

[HKCU\Software\Netscape]

[HKCU\Software\Novell]

[HKCU\Software\ODBC]

[HKCU\Software\Orange]

[HKCU\Software\PalmDesktopAutorun]

[HKCU\Software\Palm]

[HKCU\Software\PardaliS Software]

[HKCU\Software\Parisprog]

[HKCU\Software\PepiMK Software]

[HKCU\Software\PhotoFiltre Studio X]

[HKCU\Software\Pinnacle Systems]

[HKCU\Software\Piriform]

[HKCU\Software\Policies]

[HKCU\Software\QUAD Utilities]

[HKCU\Software\RealNetworks]

[HKCU\Software\Realtek]

[HKCU\Software\RegDokFR]

[HKCU\Software\Revenger inc.]

[HKCU\Software\RocketDock-v0.9.4]

[HKCU\Software\Safer Networking Limited]

[HKCU\Software\Simply Super Software]

[HKCU\Software\Smart Panel]

[HKCU\Software\Softonic]

[HKCU\Software\Sonic Desktop Software]

[HKCU\Software\Sysinternals]

[HKCU\Software\TeamViewer]

[HKCU\Software\The Plastic Factory]

[HKCU\Software\TomTom]

[HKCU\Software\U.S. Robotics]

[HKCU\Software\UberIcon-v1.0.0]

[HKCU\Software\Unlimited Possibilities]

[HKCU\Software\VB and VBA Program Settings]

[HKCU\Software\VSO]

[HKCU\Software\VSRevoGroup]

[HKCU\Software\WholeSecurity]

[HKCU\Software\cybelsoft]

[HKCU\Software\myBabylon]

[HKCU\Software\settings]

[HKLM\Software\ALWIL Software]

[HKLM\Software\ATI Technologies]

[HKLM\Software\ATI]

[HKLM\Software\AVAST Software]

[HKLM\Software\AVS4YOU]

[HKLM\Software\Adaptec]

[HKLM\Software\Adobe Systems]

[HKLM\Software\Adobe]

[HKLM\Software\Ahead]

[HKLM\Software\ArcSoft]

[HKLM\Software\Axialis]

[HKLM\Software\BCL Technologies]

[HKLM\Software\BVRP Software]

[HKLM\Software\BrowserChoice]

[HKLM\Software\C07ft5Y]

[HKLM\Software\Classes]

[HKLM\Software\Clients]

[HKLM\Software\Common Toolkit Suite]

[HKLM\Software\DivXNetworks]

[HKLM\Software\EPSON]

[HKLM\Software\EliaShim]

[HKLM\Software\FRANCE TELECOM]

[HKLM\Software\Gemplus]

[HKLM\Software\GlarySoft]

[HKLM\Software\Google]

[HKLM\Software\IDAVLab]

[HKLM\Software\INTEL]

[HKLM\Software\InstallShield]

[HKLM\Software\InterVideo]

[HKLM\Software\JavaSoft]

[HKLM\Software\JreMetrics]

[HKLM\Software\KasperskyLab]

[HKLM\Software\Khronos]

[HKLM\Software\Kodak]

[HKLM\Software\Licenses]

[HKLM\Software\Lola]

[HKLM\Software\Macromedia]

[HKLM\Software\Magix]

[HKLM\Software\Malwarebytes' Anti-Malware]

[HKLM\Software\MicroQuill]

[HKLM\Software\MozillaPlugins]

[HKLM\Software\Mozilla]

[HKLM\Software\NOS]

[HKLM\Software\Nero]

[HKLM\Software\ODBC]

[HKLM\Software\Orange]

[HKLM\Software\Panda Software]

[HKLM\Software\Pinnacle Systems]

[HKLM\Software\Piriform]

[HKLM\Software\PoINT]

[HKLM\Software\Policies]

[HKLM\Software\Program Groups]

[HKLM\Software\Protexis]

[HKLM\Software\RealNetworks]

[HKLM\Software\Realtek]

[HKLM\Software\RegisteredApplications]

[HKLM\Software\Roxio]

[HKLM\Software\SECURITOO]

[HKLM\Software\Safer Networking Limited]

[HKLM\Software\Schlumberger]

[HKLM\Software\Smart Panel]

[HKLM\Software\SymNRT]

[HKLM\Software\Symantec]

[HKLM\Software\SystemCheck]

[HKLM\Software\TeamViewer]

[HKLM\Software\TomTom]

[HKLM\Software\TrendMicro]

[HKLM\Software\TuneUp]

[HKLM\Software\Uniblue]

[HKLM\Software\VIA Technologies, Inc]

[HKLM\Software\VN_VUIns]

[HKLM\Software\VSO]

[HKLM\Software\VideoLAN]

[HKLM\Software\WholeSecurity]

[HKLM\Software\Windows 3.1 Migration Status]

[HKLM\Software\Windows]

[HKLM\Software\Wise Solutions]

[HKLM\Software\WiseCleaner]

[HKLM\Software\cybelsoft]

[HKLM\Software\fluxDVD]

[HKLM\Software\mozilla.org]

[HKLM\Software\mpDRM]

[HKLM\Software\myBabylon]

 

 

 

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)

O43 - CFD: 23/07/2011 - 09:57:14 - [0] ----D- C:\Program Files\Microsoft Silverlight

O43 - CFD: 23/07/2011 - 09:57:58 - [3932591] ----D- C:\Program Files\ZHPDiag

O43 - CFD: 01/12/2010 - 20:26:24 - [3543447] ----D- C:\Program Files\7-Zip

O43 - CFD: 07/07/2011 - 14:58:28 - [193007905] ----D- C:\Program Files\Adobe

O43 - CFD: 02/08/2006 - 15:41:22 - [105589071] ----D- C:\Program Files\Ahead

O43 - CFD: 09/07/2011 - 14:56:10 - [5290843] ----D- C:\Program Files\AIDA32 - Enterprise System Information

O43 - CFD: 01/02/2008 - 16:09:16 - [543622] ----D- C:\Program Files\albumfactory Designer

O43 - CFD: 05/11/2010 - 19:05:46 - [155517025] ----D- C:\Program Files\Alwil Software

O43 - CFD: 08/07/2011 - 15:36:50 - [1951772] ----D- C:\Program Files\AMD APP

O43 - CFD: 11/06/2006 - 16:28:50 - [178982202] ----D- C:\Program Files\ArcSoft

O43 - CFD: 30/09/2010 - 12:20:26 - [18482395] ----D- C:\Program Files\ATI

O43 - CFD: 26/02/2010 - 20:27:42 - [191252101] ----D- C:\Program Files\ATI Technologies

O43 - CFD: 10/05/2010 - 11:30:46 - [288925] ----D- C:\Program Files\AusLogics Disk Defrag

O43 - CFD: 11/06/2006 - 19:26:04 - [2891593] ----D- C:\Program Files\Belote

O43 - CFD: 28/06/2011 - 18:12:24 - [3926008] ----D- C:\Program Files\CCleaner

O43 - CFD: 21/04/2011 - 11:08:56 - [503] ----D- C:\Program Files\Citrix

O43 - CFD: 30/09/2010 - 12:20:26 - [91] ----D- C:\Program Files\copytoDVD

O43 - CFD: 08/07/2011 - 15:42:18 - [4382032] ----D- C:\Program Files\Defraggler

O43 - CFD: 10/07/2011 - 15:21:48 - [86388712] ----D- C:\Program Files\epson

O43 - CFD: 31/05/2011 - 11:40:00 - [424835031] ----D- C:\Program Files\Fichiers communs

O43 - CFD: 17/08/2010 - 18:54:34 - [381086] ----D- C:\Program Files\FileHippo.com

O43 - CFD: 06/03/2010 - 13:42:30 - [22069351] ----D- C:\Program Files\FileMaker Pro 5.5

O43 - CFD: 14/07/2011 - 11:09:44 - [23291097] ----D- C:\Program Files\Glary Utilities

O43 - CFD: 18/07/2011 - 13:17:56 - [75985114] ----D- C:\Program Files\Google

O43 - CFD: 10/07/2011 - 15:21:48 - [42755765] --H-D- C:\Program Files\InstallShield Installation Information

O43 - CFD: 17/06/2011 - 09:48:10 - [8738738] ----D- C:\Program Files\Internet Explorer

O43 - CFD: 07/07/2010 - 17:24:58 - [1533771] ----D- C:\Program Files\iPod

O43 - CFD: 24/04/2011 - 15:16:14 - [90638663] ----D- C:\Program Files\Java

O43 - CFD: 26/03/2010 - 11:03:10 - [3072] ----D- C:\Program Files\Lavasoft

O43 - CFD: 22/07/2011 - 18:07:16 - [6511189] ----D- C:\Program Files\ma-config.com

O43 - CFD: 17/06/2011 - 09:08:40 - [15367542] ----D- C:\Program Files\Malwarebytes' Anti-Malware

O43 - CFD: 06/07/2011 - 18:39:16 - [2128106] ----D- C:\Program Files\Messenger

O43 - CFD: 22/02/2011 - 18:36:12 - [391290237] ----D- C:\Program Files\Micro Application

O43 - CFD: 19/07/2011 - 17:40:08 - [248116032] ----D- C:\Program Files\Microsoft Bootvis

O43 - CFD: 20/01/2008 - 21:27:20 - [800662] ----D- C:\Program Files\Microsoft CAPICOM 2.1.0.2

O43 - CFD: 27/04/2011 - 15:56:34 - [35384298] ----D- C:\Program Files\Microsoft Fix it Center

O43 - CFD: 15/01/2008 - 15:54:00 - [0] ----D- C:\Program Files\microsoft frontpage

O43 - CFD: 11/03/2007 - 14:43:30 - [571931] ----D- C:\Program Files\Microsoft IntelliPoint

O43 - CFD: 08/07/2011 - 11:44:26 - [24437084] ----D- C:\Program Files\Microsoft IntelliType Pro

O43 - CFD: 03/01/2011 - 16:13:38 - [60360593] ----D- C:\Program Files\Microsoft Money

O43 - CFD: 26/04/2011 - 16:44:02 - [414272506] ----D- C:\Program Files\Microsoft Office

O43 - CFD: 15/01/2008 - 11:31:04 - [4408923] ----D- C:\Program Files\Microsoft Visual Studio

O43 - CFD: 09/11/2010 - 09:55:14 - [4368271] ----D- C:\Program Files\Microsoft Works

O43 - CFD: 22/01/2008 - 15:34:54 - [315392] ----D- C:\Program Files\Microsoft.NET

O43 - CFD: 31/05/2011 - 09:56:52 - [79877908] ----D- C:\Program Files\Motorola Phone Tools

O43 - CFD: 12/08/2010 - 07:42:30 - [11350823] ----D- C:\Program Files\Movie Maker

O43 - CFD: 18/07/2011 - 16:40:44 - [40285033] ----D- C:\Program Files\Mozilla Firefox

O43 - CFD: 18/08/2009 - 11:09:18 - [25757] ----D- C:\Program Files\MSBuild

O43 - CFD: 01/03/2010 - 20:11:34 - [39944647] ----D- C:\Program Files\MSECACHE

O43 - CFD: 08/05/2006 - 13:35:26 - [0] ----D- C:\Program Files\MSN Gaming Zone

O43 - CFD: 28/08/2010 - 10:25:44 - [1555501] ----D- C:\Program Files\myBabylon

O43 - CFD: 15/09/2009 - 16:06:32 - [3285523] ----D- C:\Program Files\NetMeeting

O43 - CFD: 30/09/2010 - 13:35:24 - [494512] ----D- C:\Program Files\NOS

O43 - CFD: 31/12/2009 - 20:38:22 - [27966910] ----D- C:\Program Files\OnePlayer

O43 - CFD: 30/09/2010 - 12:20:26 - [624] ----D- C:\Program Files\OPTENET

O43 - CFD: 21/07/2011 - 18:09:08 - [19073335] ----D- C:\Program Files\Orange

O43 - CFD: 15/12/2010 - 12:26:50 - [4379321] ----D- C:\Program Files\Outlook Express

O43 - CFD: 18/07/2011 - 13:17:56 - [40014527] ----D- C:\Program Files\palmOne

O43 - CFD: 23/02/2011 - 15:44:50 - [253488774] ----D- C:\Program Files\Pinnacle

O43 - CFD: 31/05/2011 - 11:40:10 - [24841872] ----D- C:\Program Files\Real

O43 - CFD: 23/05/2010 - 10:08:00 - [43563540] ----D- C:\Program Files\Realtek AC97

O43 - CFD: 24/04/2011 - 15:24:20 - [2090288] ----D- C:\Program Files\Recuva

O43 - CFD: 18/08/2009 - 11:09:04 - [37949185] ----D- C:\Program Files\Reference Assemblies

O43 - CFD: 04/01/2010 - 11:57:02 - [2479689] ----D- C:\Program Files\RegCleaner

O43 - CFD: 10/10/2010 - 16:08:48 - [1074670] ----D- C:\Program Files\Security Task Manager

O43 - CFD: 08/05/2006 - 13:37:12 - [1025] ----D- C:\Program Files\Services en ligne

O43 - CFD: 01/05/2011 - 18:23:58 - [134334238] ----D- C:\Program Files\Smart Panel

O43 - CFD: 11/08/2010 - 14:43:22 - [6994] ----D- C:\Program Files\Smart PC Solutions

O43 - CFD: 28/08/2009 - 14:16:34 - [11371768] ----D- C:\Program Files\SolidDocuments

O43 - CFD: 27/04/2011 - 18:04:14 - [1906858] ----D- C:\Program Files\splus

O43 - CFD: 17/06/2011 - 09:32:46 - [69902459] ----D- C:\Program Files\Spybot - Search & Destroy

O43 - CFD: 02/09/2010 - 13:04:18 - [50659132] ----D- C:\Program Files\TomTom HOME 2

O43 - CFD: 13/01/2010 - 19:19:56 - [25558] ----D- C:\Program Files\TomTom International B.V

O43 - CFD: 21/07/2011 - 18:51:12 - [1188158] ----D- C:\Program Files\Trend Micro

O43 - CFD: 20/07/2011 - 16:28:34 - [19768229] ----D- C:\Program Files\Uniblue

O43 - CFD: 08/05/2006 - 13:42:02 - [0] --H-D- C:\Program Files\Uninstall Information

O43 - CFD: 19/07/2011 - 17:35:28 - [1034125] ----D- C:\Program Files\Unlocker

O43 - CFD: 07/05/2010 - 15:12:34 - [27804] ----D- C:\Program Files\VDOWNLOADER

O43 - CFD: 03/06/2010 - 19:43:02 - [2067319] ----D- C:\Program Files\VIA

O43 - CFD: 28/10/2010 - 00:31:52 - [109208186] ----D- C:\Program Files\VideoLAN

O43 - CFD: 04/01/2010 - 12:13:28 - [6812742] ----D- C:\Program Files\VS Revo Group

O43 - CFD: 04/07/2008 - 20:58:44 - [21028] ----D- C:\Program Files\Wallpaper

O43 - CFD: 30/09/2010 - 12:20:26 - [11244982] ----D- C:\Program Files\Wanadoo

O43 - CFD: 14/11/2009 - 14:33:02 - [140886] ----D- C:\Program Files\Windows Desktop Search

O43 - CFD: 23/02/2011 - 16:22:20 - [1071490] ----D- C:\Program Files\Windows Live Safety Center

O43 - CFD: 19/07/2011 - 16:20:48 - [3596942] ----D- C:\Program Files\Windows Media Connect 2

O43 - CFD: 21/07/2011 - 18:09:08 - [6394321] ----D- C:\Program Files\Windows Media Player

O43 - CFD: 08/06/2011 - 13:25:58 - [1657344] ----D- C:\Program Files\Windows NT

O43 - CFD: 02/08/2006 - 12:22:48 - [0] --H-D- C:\Program Files\WindowsUpdate

O43 - CFD: 13/06/2011 - 14:23:12 - [13828790] ----D- C:\Program Files\Wise Registry Cleaner

O43 - CFD: 08/05/2006 - 13:38:10 - [0] ----D- C:\Program Files\xerox

O43 - CFD: 08/12/2008 - 16:21:32 - [383040] ----D- C:\Program Files\Yahoo!

O43 - CFD: 04/12/2007 - 15:44:00 - [175] --H-D- C:\Program Files\Zero G Registry

O43 - CFD: 25/08/2010 - 10:35:52 - [4629071] ----D- C:\Program Files\Fichiers Communs\Adaptec Shared

O43 - CFD: 18/07/2011 - 13:17:56 - [24105079] ----D- C:\Program Files\Fichiers Communs\Adobe

O43 - CFD: 15/08/2008 - 10:48:34 - [72704] ----D- C:\Program Files\Fichiers Communs\Adobe Systems Shared

O43 - CFD: 08/05/2006 - 13:56:00 - [10907968] ----D- C:\Program Files\Fichiers Communs\Ahead

O43 - CFD: 05/09/2008 - 16:53:08 - [731648] ----D- C:\Program Files\Fichiers Communs\DESIGNER

O43 - CFD: 28/08/2010 - 10:26:06 - [3741433] ----D- C:\Program Files\Fichiers Communs\fluxDVD

O43 - CFD: 23/04/2008 - 10:36:04 - [7770600] ----D- C:\Program Files\Fichiers Communs\France Telecom

O43 - CFD: 17/08/2008 - 17:47:30 - [19008985] ----D- C:\Program Files\Fichiers Communs\InstallShield

O43 - CFD: 24/04/2011 - 15:17:02 - [1252295] ----D- C:\Program Files\Fichiers Communs\Java

O43 - CFD: 22/02/2011 - 16:29:40 - [386169] ----D- C:\Program Files\Fichiers Communs\Logitech

O43 - CFD: 14/07/2010 - 08:54:30 - [312601198] ----D- C:\Program Files\Fichiers Communs\Microsoft Shared

O43 - CFD: 04/01/2010 - 16:58:58 - [18000] ----D- C:\Program Files\Fichiers Communs\Motorola Shared

O43 - CFD: 11/03/2008 - 10:34:50 - [1101105] ----D- C:\Program Files\Fichiers Communs\mpDRM

O43 - CFD: 08/05/2006 - 13:36:20 - [284160] ----D- C:\Program Files\Fichiers Communs\MSSoap

O43 - CFD: 21/07/2011 - 18:09:08 - [3503844] ----D- C:\Program Files\Fichiers Communs\ODBC

O43 - CFD: 17/08/2008 - 17:44:42 - [1631360] ----D- C:\Program Files\Fichiers Communs\Protexis

O43 - CFD: 18/10/2010 - 10:24:54 - [111181] ----D- C:\Program Files\Fichiers Communs\Real

O43 - CFD: 08/05/2006 - 13:36:26 - [8106] ----D- C:\Program Files\Fichiers Communs\Services

O43 - CFD: 08/05/2006 - 14:32:36 - [3787229] ----D- C:\Program Files\Fichiers Communs\SpeechEngines

O43 - CFD: 30/09/2010 - 12:20:26 - [1813406] ----D- C:\Program Files\Fichiers Communs\Symantec Shared

O43 - CFD: 04/08/2008 - 11:07:34 - [24349236] ----D- C:\Program Files\Fichiers Communs\System

O43 - CFD: 07/05/2010 - 15:12:22 - [352256] ----D- C:\Program Files\Fichiers Communs\xing shared

O43 - CFD: 16/01/2010 - 16:49:46 - [2667998] ----D- C:\Program Files\Fichiers Communs\XPressUpdate

O43 - CFD: 17/08/2009 - 15:49:44 - [0] ----D- C:\Documents and Settings\user\Application Data\2020 Fusion

O43 - CFD: 28/01/2011 - 12:16:46 - [34748903] ----D- C:\Documents and Settings\user\Application Data\Adobe

O43 - CFD: 26/10/2006 - 12:24:34 - [1322] ----D- C:\Documents and Settings\user\Application Data\AdobeAUM

O43 - CFD: 11/06/2008 - 18:27:46 - [82] ----D- C:\Documents and Settings\user\Application Data\AdobeUM

O43 - CFD: 11/06/2006 - 18:01:28 - [181704] ----D- C:\Documents and Settings\user\Application Data\Ahead

O43 - CFD: 18/10/2010 - 15:33:22 - [0] ----D- C:\Documents and Settings\user\Application Data\Apple Computer

O43 - CFD: 02/08/2006 - 15:42:12 - [21747974] ----D- C:\Documents and Settings\user\Application Data\ArcSoft

O43 - CFD: 06/03/2010 - 14:19:18 - [0] ----D- C:\Documents and Settings\user\Application Data\ATI

O43 - CFD: 29/11/2009 - 14:30:20 - [272282] ----D- C:\Documents and Settings\user\Application Data\Auslogics

O43 - CFD: 28/05/2010 - 15:14:50 - [0] ----D- C:\Documents and Settings\user\Application Data\AVS4YOU

O43 - CFD: 14/09/2009 - 16:08:28 - [4017] ----D- C:\Documents and Settings\user\Application Data\Canneverbe_Limited

O43 - CFD: 19/11/2007 - 11:38:46 - [2399] ----D- C:\Documents and Settings\user\Application Data\eBay

O43 - CFD: 15/03/2011 - 17:42:18 - [471985] ----D- C:\Documents and Settings\user\Application Data\ElevatedDiagnostics

O43 - CFD: 20/10/2006 - 20:01:14 - [0] ----D- C:\Documents and Settings\user\Application Data\EPSON

O43 - CFD: 15/04/2011 - 18:12:46 - [0] ----D- C:\Documents and Settings\user\Application Data\f-secure

O43 - CFD: 11/06/2006 - 14:46:38 - [77968] ----D- C:\Documents and Settings\user\Application Data\FileMaker

O43 - CFD: 14/12/2008 - 12:41:22 - [104127] ----D- C:\Documents and Settings\user\Application Data\Foxit

O43 - CFD: 24/01/2010 - 12:58:26 - [12] ----D- C:\Documents and Settings\user\Application Data\Foxit Software

O43 - CFD: 10/10/2010 - 16:08:48 - [814] ----D- C:\Documents and Settings\user\Application Data\FreeScreenToVideo

O43 - CFD: 20/09/2010 - 13:01:08 - [1378637] ----D- C:\Documents and Settings\user\Application Data\GlarySoft

O43 - CFD: 20/09/2006 - 16:27:46 - [0] ----D- C:\Documents and Settings\user\Application Data\Google

O43 - CFD: 14/06/2006 - 17:26:30 - [63] ----D- C:\Documents and Settings\user\Application Data\Help

O43 - CFD: 26/11/2009 - 17:06:16 - [352] ----D- C:\Documents and Settings\user\Application Data\HouseCall 6.6

O43 - CFD: 08/05/2006 - 13:42:08 - [45] ----D- C:\Documents and Settings\user\Application Data\Identities

O43 - CFD: 05/06/2010 - 13:04:40 - [1155626] ----D- C:\Documents and Settings\user\Application Data\igraal

O43 - CFD: 03/07/2008 - 09:39:04 - [0] ----D- C:\Documents and Settings\user\Application Data\InstallShield Installation Information

O43 - CFD: 12/06/2006 - 17:27:26 - [0] ----D- C:\Documents and Settings\user\Application Data\InterTrust

O43 - CFD: 08/05/2006 - 14:02:10 - [14280] ----D- C:\Documents and Settings\user\Application Data\InterVideo

O43 - CFD: 11/06/2006 - 17:42:12 - [1205] ----D- C:\Documents and Settings\user\Application Data\Leadertech

O43 - CFD: 05/07/2006 - 15:14:16 - [1585] ----D- C:\Documents and Settings\user\Application Data\Macromedia

O43 - CFD: 06/03/2009 - 15:59:10 - [0] ----D- C:\Documents and Settings\user\Application Data\Malwarebytes

O43 - CFD: 18/10/2010 - 15:45:02 - [0] ----D- C:\Documents and Settings\user\Application Data\Media Player Classic

O43 - CFD: 11/06/2006 - 17:56:30 - [43] ----D- C:\Documents and Settings\user\Application Data\Micro Application

O43 - CFD: 08/07/2011 - 14:08:12 - [11067028] -S--D- C:\Documents and Settings\user\Application Data\Microsoft

O43 - CFD: 16/09/2010 - 12:55:14 - [18362715] ----D- C:\Documents and Settings\user\Application Data\Mozilla

O43 - CFD: 09/11/2009 - 19:32:14 - [66800] ----D- C:\Documents and Settings\user\Application Data\Nero

O43 - CFD: 12/05/2011 - 16:23:52 - [0] ----D- C:\Documents and Settings\user\Application Data\Nosibay

O43 - CFD: 29/03/2009 - 13:05:22 - [1095835] ----D- C:\Documents and Settings\user\Application Data\OfficeUpdate12

O43 - CFD: 15/08/2010 - 14:28:32 - [1063] ----D- C:\Documents and Settings\user\Application Data\PhotoFiltre Studio X

O43 - CFD: 30/09/2009 - 18:35:12 - [0] ----D- C:\Documents and Settings\user\Application Data\PixelPlanet

O43 - CFD: 30/04/2011 - 14:30:30 - [65440] ----D- C:\Documents and Settings\user\Application Data\QuickScan

O43 - CFD: 31/05/2011 - 11:50:12 - [327075] ----D- C:\Documents and Settings\user\Application Data\Real

O43 - CFD: 01/05/2011 - 10:07:54 - [0] ----D- C:\Documents and Settings\user\Application Data\RegistryKeys

O43 - CFD: 03/05/2011 - 15:33:32 - [124269] ----D- C:\Documents and Settings\user\Application Data\Smart Panel

O43 - CFD: 05/01/2010 - 20:39:28 - [82129732] ----D- C:\Documents and Settings\user\Application Data\Sun

O43 - CFD: 11/06/2006 - 16:57:14 - [27765] ----D- C:\Documents and Settings\user\Application Data\Symantec

O43 - CFD: 25/03/2010 - 20:06:16 - [33759] ----D- C:\Documents and Settings\user\Application Data\TeamViewer

O43 - CFD: 13/11/2006 - 15:30:48 - [8704] ----D- C:\Documents and Settings\user\Application Data\Template

O43 - CFD: 13/01/2010 - 19:20:10 - [17161020] ----D- C:\Documents and Settings\user\Application Data\TomTom

O43 - CFD: 03/10/2009 - 15:46:04 - [23891250484] ----D- C:\Documents and Settings\user\Application Data\TRIWORKS

O43 - CFD: 03/05/2011 - 16:34:24 - [5120] ----D- C:\Documents and Settings\user\Application Data\TuneUp Software

O43 - CFD: 20/07/2011 - 16:28:42 - [250346] ----D- C:\Documents and Settings\user\Application Data\Uniblue

O43 - CFD: 02/05/2011 - 09:17:50 - [1090086] ----D- C:\Documents and Settings\user\Application Data\vlc

O43 - CFD: 16/08/2010 - 10:45:34 - [23806] ----D- C:\Documents and Settings\user\Application Data\VSO

O43 - CFD: 04/07/2008 - 18:58:46 - [679] ----D- C:\Documents and Settings\user\Application Data\Wallpaper

O43 - CFD: 17/08/2009 - 15:49:44 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\2020 Fusion

O43 - CFD: 28/01/2011 - 12:14:20 - [278415786] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Adobe

O43 - CFD: 28/11/2009 - 10:10:00 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Apple

O43 - CFD: 18/10/2010 - 15:27:58 - [7359] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Apple Computer

O43 - CFD: 27/02/2010 - 13:16:36 - [9435] ----D- C:\Documents and Settings\user\Local Settings\Application Data\ATI

O43 - CFD: 06/01/2010 - 13:56:12 - [836554] ----D- C:\Documents and Settings\user\Local Settings\Application Data\BVRP Software

O43 - CFD: 21/04/2011 - 11:07:44 - [65023] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Citrix

O43 - CFD: 28/08/2009 - 14:43:30 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Downloaded Installations

O43 - CFD: 27/04/2011 - 16:01:30 - [1003286] ----D- C:\Documents and Settings\user\Local Settings\Application Data\FixItCenter

O43 - CFD: 31/05/2011 - 10:20:20 - [132203569] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Google

O43 - CFD: 14/06/2006 - 17:26:30 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Help

O43 - CFD: 11/06/2006 - 15:54:58 - [59620135] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Identities

O43 - CFD: 27/12/2010 - 20:37:02 - [33184638] ----D- C:\Documents and Settings\user\Local Settings\Application Data\IM

O43 - CFD: 19/07/2011 - 14:33:30 - [259665171] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Microsoft

O43 - CFD: 16/09/2010 - 12:55:14 - [307321658] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Mozilla

O43 - CFD: 30/07/2009 - 09:26:48 - [665513] ----D- C:\Documents and Settings\user\Local Settings\Application Data\myBabylon

O43 - CFD: 27/10/2009 - 17:27:32 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Orange

O43 - CFD: 13/09/2010 - 12:40:14 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\PackageAware

O43 - CFD: 20/05/2010 - 11:53:52 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Pixology

O43 - CFD: 31/05/2011 - 10:19:00 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Real

O43 - CFD: 08/05/2006 - 14:03:40 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Symantec

O43 - CFD: 26/04/2011 - 14:53:04 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Temp

O43 - CFD: 02/02/2010 - 20:05:18 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Threat Expert

O43 - CFD: 13/01/2010 - 19:20:10 - [1962416] ----D- C:\Documents and Settings\user\Local Settings\Application Data\TomTom

O43 - CFD: 24/03/2008 - 16:16:58 - [56563580] ----D- C:\Documents and Settings\user\Local Settings\Application Data\Trend Micro

O43 - CFD: 10/04/2008 - 15:25:10 - [0] ----D- C:\Documents and Settings\user\Local Settings\Application Data\WMTools Downloaded Files

 

 

 

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)

O44 - LFC:[MD5.803D733F09CAE3E28711B90E7288AA4D] - 23/07/2011 - 08:52:22 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159]

O44 - LFC:[MD5.1440AC82D947326B9D10F60362DF053D] - 23/07/2011 - 08:52:21 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50]

O44 - LFC:[MD5.4FC470DAAF8C023D689CD519F3BB54BB] - 23/07/2011 - 08:52:04 -S-A- . (...) -- C:\WINDOWS\bootstat.dat [2048]

O44 - LFC:[MD5.94B114F0291EB73120EC65971F088754] - 22/07/2011 - 20:46:57 ---A- . (...) -- C:\WINDOWS\SchedLgU.Txt [32528]

O44 - LFC:[MD5.6A38866B385CA6F9DD32C5AE5F131749] - 22/07/2011 - 20:46:54 ---A- . (...) -- C:\WINDOWS\WindowsUpdate.log [4262]

O44 - LFC:[MD5.2F3E5E71B0DFF1499BBB9C5B188179C5] - 22/07/2011 - 16:29:01 ---A- . (...) -- C:\WINDOWS\hpbafd.ini [399]

O44 - LFC:[MD5.5ADBC0B15F058759A0247104E00A3A8D] - 22/07/2011 - 12:43:02 --HA- . (...) -- C:\ntuser.dat.LOG [1024]

O44 - LFC:[MD5.B81F71EE5C4A60272EF6F07CD91A9103] - 21/07/2011 - 17:59:12 ---A- . (...) -- C:\WINDOWS\System32\d3d9caps.dat [1324]

O44 - LFC:[MD5.3EEE9AB1D21A03E5B35C06752060467C] - 20/07/2011 - 15:55:19 ---A- . (...) -- C:\WINDOWS\System32\wpa.dbl [2206]

O44 - LFC:[MD5.6D6F4B1886E91EB37ABCCAD19C561EE0] - 19/07/2011 - 15:21:54 ---A- . (...) -- C:\WINDOWS\System32\amcompat.tlb [16832]

O44 - LFC:[MD5.A32B14BE5EDAE794FCE1A9E970827509] - 19/07/2011 - 15:21:54 ---A- . (...) -- C:\WINDOWS\System32\nscompat.tlb [23392]

O44 - LFC:[MD5.F778E7FB6A50F04568DFBA003EBFB17E] - 17/07/2011 - 09:48:27 ---A- . (...) -- C:\WINDOWS\System32\PerfStringBackup.INI [1426498]

O44 - LFC:[MD5.1CF9BD08C93493F7043E784A36EA7112] - 17/07/2011 - 09:48:27 ---A- . (...) -- C:\WINDOWS\System32\perfc009.dat [107000]

O44 - LFC:[MD5.118B9745DE0B25B99614549E9B5D90DA] - 17/07/2011 - 09:48:27 ---A- . (...) -- C:\WINDOWS\System32\perfc00C.dat [139036]

O44 - LFC:[MD5.3C4904146112C0C7E5A7A2B2B086AB85] - 17/07/2011 - 09:48:27 ---A- . (...) -- C:\WINDOWS\System32\perfh009.dat [528644]

O44 - LFC:[MD5.E53BE0B82AE0BB35819D884AE292CADA] - 17/07/2011 - 09:48:27 ---A- . (...) -- C:\WINDOWS\System32\perfh00C.dat [631198]

O44 - LFC:[MD5.C69F2B6C6F44CE64F41512AAA098BE1F] - 14/07/2011 - 08:46:54 ---A- . (...) -- C:\WINDOWS\System32\FNTCACHE.DAT [352976]

O44 - LFC:[MD5.CA7E135B2932666D9B1C9DBD1D433158] - 09/07/2011 - 13:28:40 ---A- . (...) -- C:\ntuser.dat [262144]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 08/07/2011 - 10:45:32 --HA- . (...) -- C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01009.Wdf [0]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 08/07/2011 - 10:45:22 --HA- . (...) -- C:\WINDOWS\System32\drivers\Msft_Kernel_dc3d_01009.Wdf [0]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 08/07/2011 - 10:45:20 --HA- . (...) -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf [0]

O44 - LFC:[MD5.42FD7AEE384C83060FC0B88A8B24D76E] - 07/07/2011 - 17:01:04 ---A- . (...) -- C:\WINDOWS\System32\EPPICResdb [215]

O44 - LFC:[MD5.07234CB78F6E524B8C520593817F16ED] - 07/07/2011 - 17:01:04 ---A- . (...) -- C:\WINDOWS\System32\EPPICResdb0001 [5592]

O44 - LFC:[MD5.9501CE82389A3B51720E7B8A4B614216] - 06/07/2011 - 17:41:19 ---A- . (...) -- C:\WINDOWS\System32\CONFIG.NT [3121]

O44 - LFC:[MD5.2658AF3FBB06D7B5C731F9CC7CBFC1B3] - 04/07/2011 - 12:43:53 ---A- . (.AVAST Software - avast! Screen Saver stub.) -- C:\WINDOWS\avastSS.scr [40112]

O44 - LFC:[MD5.C2E576B23D3969989AF90EF76B2979EA] - 04/07/2011 - 12:43:51 ---A- . (.AVAST Software - avast! start-up scanner.) -- C:\WINDOWS\System32\aswBoot.exe [199304]

O44 - LFC:[MD5.17230708A2028CD995656DF455F2E303] - 04/07/2011 - 12:36:43 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\WINDOWS\System32\drivers\aswSnx.sys [441176]

O44 - LFC:[MD5.DBEDD9D43B00630966EF05D2D8D04CEE] - 04/07/2011 - 12:36:32 ---A- . (.AVAST Software - avast! self protection module.) -- C:\WINDOWS\System32\drivers\aswSP.sys [309848]

O44 - LFC:[MD5.984CFCE2168286C2511695C2F9621475] - 04/07/2011 - 12:35:23 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\WINDOWS\System32\drivers\aswTdi.sys [43608]

O44 - LFC:[MD5.7857E0B4C817F69FF463EEA2C63E56F9] - 04/07/2011 - 12:35:12 ---A- . (.AVAST Software - avast! File System Filter Driver for Window.) -- C:\WINDOWS\System32\drivers\aswmon2.sys [102616]

O44 - LFC:[MD5.4FAE55469A56AA2B423E5E26FD1449D1] - 04/07/2011 - 12:35:09 ---A- . (.AVAST Software - avast! File System Filter Driver for Window.) -- C:\WINDOWS\System32\drivers\aswmon.sys [96344]

O44 - LFC:[MD5.8DB043BF96BB6D334E5B4888E709E1C7] - 04/07/2011 - 12:32:32 ---A- . (.AVAST Software - avast! TDI RDR Driver.) -- C:\WINDOWS\System32\drivers\aswRdr.sys [25432]

O44 - LFC:[MD5.DFCDD5936CAD0138775D5A105D4C7716] - 04/07/2011 - 12:32:13 ---A- . (.AVAST Software - avast! Base Kernel-Mode Device Driver for W.) -- C:\WINDOWS\System32\drivers\aavmker4.sys [30808]

O44 - LFC:[MD5.861CB512E4E850E87DD2316F88D69330] - 04/07/2011 - 12:32:12 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [19544]

 

 

 

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)

O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll

 

 

 

---\\ Export de clé d'application autorisée (O47)

O47 - AAKE:Key Export SP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessmgr.exe

O47 - AAKE:Key Export SP - "C:\Program Files\ma-config.com\maconfservice.exe" [Enabled] .(.CybelSoft - Service de détection matériel.) -- C:\Program Files\ma-config.com\maconfservice.exe

O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation - Gestionnaire de session de l'aide sur le Bureau à distance de Microsoft®.) -- C:\WINDOWS\system32\sessmgr.exe

 

 

 

---\\ Contrôle du Safe Boot (CSB) (O49)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS\System32\Drivers\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS\System32\Drivers\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\System32\Drivers\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (...) -- C:\WINDOWS\System32\Drivers\sermouse.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys . (.Microsoft Corporation - Pilote de filtre de système de fichiers pour la restauration du système.) -- C:\WINDOWS\System32\Drivers\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\WINDOWS\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\Wdf01000.sys . (.Microsoft Corporation - Kernel Mode Driver Framework Runtime.) -- C:\WINDOWS\System32\Drivers\Wdf01000.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS\System32\Drivers\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS\System32\Drivers\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS\System32\Drivers\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys . (.Microsoft Corporation - IPv6 Windows Firewall Driver.) -- C:\WINDOWS\System32\Drivers\ip6fw.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\WINDOWS\System32\Drivers\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys . (.Microsoft Corporation - RDP Miniport.) -- C:\WINDOWS\System32\Drivers\rdpcdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys . (...) -- C:\WINDOWS\System32\Drivers\rdpdd.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only, Not for Export).) -- C:\WINDOWS\System32\Drivers\rdpwd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (...) -- C:\WINDOWS\System32\Drivers\sermouse.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys . (.Microsoft Corporation - Pilote de filtre de système de fichiers pour la restauration du système.) -- C:\WINDOWS\System32\Drivers\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS\System32\Drivers\tdpipe.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS\System32\Drivers\tdtcp.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS\System32\Drivers\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\WINDOWS\System32\Drivers\vgasave.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\Wdf01000.sys . (.Microsoft Corporation - Kernel Mode Driver Framework Runtime.) -- C:\WINDOWS\System32\Drivers\Wdf01000.sys

 

 

 

---\\ MountPoints2 Shell Key (O51)

O51 - MPSK:{0a3154a3-f61a-11de-b1a3-000ea659c83a}\AutoRun\command - Clé orpheline

 

 

 

---\\ Trojan Driver Search Data (HKLM) (O52)

O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - Codec audio TrueSpeech DSP Group pour MSACM V3.50.) -- C:\WINDOWS\System32\tssoft32.acm

O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS\System32\iccvid.dll

O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (...) -- C:\WINDOWS\System32\ir32_32.dll

O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (...) -- C:\WINDOWS\System32\ir32_32.dll

O52 - TDSD: \Drivers32\"msacm.l3acm"="l3codecx.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\System32\l3codecx.acm

O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\System32\sl_anet.acm

O52 - TDSD: \Drivers32\"msacm.voxacm160"="vct3216.acm" . (.Voxware, Inc. - Voxware Audio Compression Manager Driver.) -- C:\WINDOWS\System32\vct3216.acm

O52 - TDSD: \Drivers32\"msacm.scg726"="scg726.acm" . (.SHARP Corporation - SHARP G.726 ACM Audio Decoder.) -- C:\WINDOWS\System32\scg726.acm

O52 - TDSD: \Drivers32\"msacm.alf2cd"="alf2cd.acm" . (.NCT Company - NCT ALF2CD Audio CODEC.) -- C:\WINDOWS\System32\alf2cd.acm

O52 - TDSD: \Drivers32\"msacm.ac3acm"="AC3ACM.acm" . (.fccHandler - AC-3 ACM Decompressor.) -- C:\WINDOWS\System32\AC3ACM.acm

O52 - TDSD: \Drivers32\"vidc.dvsd"="mcdvd_32.dll" . (.MainConcept - MainConcept DV Codec.) -- C:\WINDOWS\System32\mcdvd_32.dll

O52 - TDSD: \Drivers32\"vidc.xvid"="xvidvfw.dll" . (...) -- C:\WINDOWS\System32\xvidvfw.dll

O52 - TDSD: \Drivers32\"vidc.DIVX"="DivX.dll" . (.DivXNetworks, Inc. - DivX Video for Windows Codec.) -- C:\WINDOWS\System32\DivX.dll

O52 - TDSD: \drivers.desc\"C:\WINDOWS\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\System32\l3codeca.acm

O52 - TDSD: \drivers.desc\"l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\System32\l3codeca.acm

O52 - TDSD: \drivers.desc\"mpg4c32.dll"="MS MPEG-4 v1,2,3 driver 4.1.0.3927" . (...) -- (.not file.)

O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS\System32\sl_anet.acm

O52 - TDSD: \drivers.desc\"l3codecx.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINDOWS\System32\l3codecx.acm

O52 - TDSD: \drivers.desc\"tssoft32.acm"="tssoft32.acm" . (.DSP GROUP, INC. - Codec audio TrueSpeech DSP Group pour MSACM V3.50.) -- C:\WINDOWS\System32\tssoft32.acm

O52 - TDSD: \drivers.desc\"iccvid.dll"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS\System32\iccvid.dll

O52 - TDSD: \drivers.desc\"ir32_32.dll"="ir32_32.dll" . (...) -- C:\WINDOWS\System32\ir32_32.dll

O52 - TDSD: \drivers.desc\"vct3216.acm"="Voxware Compression Toolkit" . (.Voxware, Inc. - Voxware Audio Compression Manager Driver.) -- C:\WINDOWS\System32\vct3216.acm

O52 - TDSD: \drivers.desc\"scg726.acm"="Sharp G.726 Audio Decoder" . (...) -- (.not file.)

O52 - TDSD: \drivers.desc\"alf2cd.acm"="alf2cd.acm" . (.NCT Company - NCT ALF2CD Audio CODEC.) -- C:\WINDOWS\System32\alf2cd.acm

O52 - TDSD: \drivers.desc\"AC3ACM.acm"="AC-3 ACM Decompressor" . (.fccHandler - AC-3 ACM Decompressor.) -- C:\WINDOWS\System32\AC3ACM.acm

O52 - TDSD: \drivers.desc\"mcdvd_32.dll"="mcdvd_32.dll" . (.MainConcept - MainConcept DV Codec.) -- C:\WINDOWS\System32\mcdvd_32.dll

O52 - TDSD: \drivers.desc\"xvidvfw.dll"="XviD MPEG-4 Video Codec" . (...) -- C:\WINDOWS\System32\xvidvfw.dll

O52 - TDSD: \drivers.desc\"divx.dll"="DivX 5.0.5 Codec" . (...) -- (.not file.)

 

 

 

---\\ ShareTools MSconfig StartupReg (O53)

O53 - SMSR:HKLM\...\startupreg\Adobe ARM [Key] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

O53 - SMSR:HKLM\...\startupreg\Adobe Reader Speed Launcher [Key] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe

O53 - SMSR:HKLM\...\startupreg\ATICCC [Key] . (.ATI Technologies Inc. - CLI Application (Command Line Interface).) -- C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

O53 - SMSR:HKLM\...\startupreg\ATICustomerCare [Key] . (.Advanced Micro Devices, Inc. - ATI Customer Care.) -- C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe

O53 - SMSR:HKLM\...\startupreg\ATIPTA [Key] . (.ATI Technologies, Inc. - ATI Desktop Control Panel.) -- C:\ATI-CPanel\atiptaxx.exe

O53 - SMSR:HKLM\...\startupreg\CheckUpdate [Key] . (...) -- C:\Windows\System32\fmaj5.exe

O53 - SMSR:HKLM\...\startupreg\ctfmon.exe [Key] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe

O53 - SMSR:HKLM\...\startupreg\EPSON Stylus Photo RX420 Series [Key] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe

O53 - SMSR:HKLM\...\startupreg\FileHippo.com [Key] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files\FileHippo.com\UpdateChecker.exe

O53 - SMSR:HKLM\...\startupreg\ISUSPM Startup [Key] . (.InstallShield Software Corporation - InstallShield Update Service Update Manager.) -- C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe

O53 - SMSR:HKLM\...\startupreg\ISUSScheduler [Key] . (.InstallShield Software Corporation - InstallShield Update Service Scheduler.) -- C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

O53 - SMSR:HKLM\...\startupreg\MailNotifierSessionManager [Key] . (.France Telecom SA - SA-PROGSERV 04.01.00_08402_01_P00.) -- C:\Program Files\Orange\Notification Mail\SessionManager\SessionManager.exe

O53 - SMSR:HKLM\...\startupreg\MediaDico [Key] . (.L'Aventure Multimedia - Dictionnaire MediaDICO pour Windows.) -- C:\Program Files\Micro Application\MediaDICO\MediaDICO.exe

O53 - SMSR:HKLM\...\startupreg\Nero DriveSpeed [Key] . (.Ahead Software AG - Nero DriveSpeed.) -- C:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.exe

O53 - SMSR:HKLM\...\startupreg\SpeedUpMyPC [Key] . (.Uniblue Systems Limited - Uniblue Launcher.) -- C:\Program Files\Uniblue\SpeedUpMyPC\launcher.exe

O53 - SMSR:HKLM\...\startupreg\SunJavaUpdateSched [Key] . (.Sun Microsystems, Inc. - Java Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe

O53 - SMSR:HKLM\...\startupreg\TomTomHOME.exe [Key] . (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

O53 - SMSR:HKLM\...\startupreg\UnlockerAssistant [Key] . (...) -- C:\Program Files\Unlocker\UnlockerAssistant.exe

 

 

 

---\\ Microsoft Control Security Providers (O54)

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS\system32\msapsspc.dll

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS\system32\digest.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS\system32\msapsspc.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS\system32\schannel.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS\system32\digest.dll

 

 

 

---\\ Microsoft Windows Policies System (O55)

O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=

O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=2

O55 - MWPS:[HKCU\...\Policies\System] - "Disable TaskMgr"=1

 

 

 

---\\ Microsoft Windows Policies Explorer (O56)

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=144

O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDesktopCleanupWizard"=0

O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=1

 

 

 

---\\ Liste des Drivers Système (O58)

O58 - SDL:[MD5.0AA3AD071827118FCC8F37F7A6AB7AA1] - 27/04/2011 - 13:54:02 ---A- . (.Kaspersky Lab - Klif Mini-Filter.) -- C:\WINDOWS\system32\drivers\43882967.sys [148496]

O58 - SDL:[MD5.DFCDD5936CAD0138775D5A105D4C7716] - 27/04/2011 - 12:32:13 ---A- . (.AVAST Software - avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP.) -- C:\WINDOWS\system32\drivers\aavmker4.sys [30808]

O58 - SDL:[MD5.2521B473F18BA481C1F0815822A87F82] - 27/04/2011 - 23:15:06 R--A- . (.Sensaura Ltd - Sensaura WDM 3D Audio Driver.) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS [404608]

O58 - SDL:[MD5.DD8520280304B6145A6BE31008748C7C] - 27/04/2011 - 09:40:22 R--A- . (.Realtek Semiconductor Corp. - Realtek AC'97 Audio Driver (WDM).) -- C:\WINDOWS\system32\drivers\alcxwdm.sys [4122368]

O58 - SDL:[MD5.861CB512E4E850E87DD2316F88D69330] - 27/04/2011 - 12:32:12 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys [19544]

O58 - SDL:[MD5.4FAE55469A56AA2B423E5E26FD1449D1] - 23/04/2011 - 12:35:09 ---A- . (.AVAST Software - avast! File System Filter Driver for Windows NT/2000.) -- C:\WINDOWS\system32\drivers\aswmon.sys [96344]

O58 - SDL:[MD5.7857E0B4C817F69FF463EEA2C63E56F9] - 27/04/2011 - 12:35:12 ---A- . (.AVAST Software - avast! File System Filter Driver for Windows XP.) -- C:\WINDOWS\system32\drivers\aswmon2.sys [102616]

O58 - SDL:[MD5.8DB043BF96BB6D334E5B4888E709E1C7] - 27/04/2011 - 12:32:32 ---A- . (.AVAST Software - avast! TDI RDR Driver.) -- C:\WINDOWS\system32\drivers\aswRdr.sys [25432]

O58 - SDL:[MD5.17230708A2028CD995656DF455F2E303] - 27/04/2011 - 12:36:43 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\WINDOWS\system32\drivers\aswSnx.sys [441176]

O58 - SDL:[MD5.DBEDD9D43B00630966EF05D2D8D04CEE] - 27/04/2011 - 12:36:32 ---A- . (.AVAST Software - avast! self protection module.) -- C:\WINDOWS\system32\drivers\aswSP.sys [309848]

O58 - SDL:[MD5.984CFCE2168286C2511695C2F9621475] - 27/04/2011 - 12:35:23 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\WINDOWS\system32\drivers\aswTdi.sys [43608]

O58 - SDL:[MD5.492BD2A5F65F218D4EDE5764A3BB67E9] - 27/04/2011 - 17:50:42 ---A- . (.ATI Technologies Inc. - ATI Radeon WindowsNT Miniport Driver.) -- C:\WINDOWS\system32\drivers\ati2mtag.sys [1540608]

O58 - SDL:[MD5.34BC9A650A2402A8919814AE9F50DB91] - 27/04/2011 - 14:31:14 ---A- . (.author Ing. Igor Cesko and Atmel corporatio - Win98/XP driver for AVR309-USB device.) -- C:\WINDOWS\system32\drivers\AVR309.sys [8652]

O58 - SDL:[MD5.8C7746ACDE6225A46B58ED7AE09EC166] - 27/04/2011 - 16:24:14 ---A- . (.Roxio - CD-UDF NT Filesystem Driver.) -- C:\WINDOWS\system32\drivers\cdudf_xp.sys [241280]

O58 - SDL:[MD5.C9B25AE9B8ABD983C5AD3F8CBFAB0F9C] - 14/04/2011 - 13:00:00 ---A- . (.RAVISENT Technologies Inc. - Pilote principal CineMaster C 1.2 WDM.) -- C:\WINDOWS\system32\drivers\cinemst2.sys [262528]

O58 - SDL:[MD5.9624293E55AD405415862B504CA95B73] - 14/04/2011 - 13:00:00 ---A- . (.Compaq Computer Corporation - Compaq PA-1 Player Driver.) -- C:\WINDOWS\system32\drivers\cpqdap01.sys [11776]

O58 - SDL:[MD5.E9648254056BCE81A85380C0C3647DC4] - 27/04/2011 - 20:13:08 ---A- . (.VIA Technologies, Inc. - NDIS 5.0 miniport driver.) -- C:\WINDOWS\system32\drivers\fetnd5.sys [27165]

O58 - SDL:[MD5.A177146AA976AC4B502D20BEDD348000] - 27/04/2011 - 11:17:00 R--A- . (.VIA Technologies, Inc. - NDIS 5.0 miniport driver.) -- C:\WINDOWS\system32\drivers\fetnd5b.sys [40960]

O58 - SDL:[MD5.4580F83E94774AA1724179A6A97E25E6] - 08/07/2011 - 15:25:58 ---A- . (.VIA Technologies, Inc. - NDIS 5.0 miniport driver.) -- C:\WINDOWS\system32\drivers\fetnd5bv.sys [47104]

O58 - SDL:[MD5.3D2C13377763EEAC0CA6FB46F57217ED] - 14/04/2011 - 08:11:20 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\system32\drivers\mbam.sys [22712]

O58 - SDL:[MD5.B309912717C29FC67E1BA4730A82B6DD] - 17/06/2011 - 08:11:30 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys [39984]

O58 - SDL:[MD5.FE80C18BA448DDD76B7BEAD9EB203D37] - 14/04/2011 - 14:18:26 ---A- . (.Motorola - Motorola USB Modem and Ports Driver.) -- C:\WINDOWS\system32\drivers\motmodem.sys [23680]

O58 - SDL:[MD5.BE984D604D91C217355CDD3737AAD25D] - 14/04/2011 - 13:00:00 ---A- . (.S3/Diamond Multimedia Systems - NikeDrv Usb Driver.) -- C:\WINDOWS\system32\drivers\nikedrv.sys [12032]

O58 - SDL:[MD5.511E5CB712D30BB36F8175F10313E9DE] - 14/04/2011 - 13:52:40 ---A- . (.OrangeWare Corporation - USB 2.0 Hub Driver.) -- C:\WINDOWS\system32\drivers\ousb2hub.sys [54016]

O58 - SDL:[MD5.DA09E6945606342E712BA339733B96BB] - 14/04/2011 - 13:52:40 ---A- . (.OrangeWare Corporation - USB 2.0 Enhanced Host Controller Driver.) -- C:\WINDOWS\system32\drivers\ousbehci.sys [39040]

O58 - SDL:[MD5.803CF09C795290825607505D37819135] - 27/04/2011 - 20:39:16 ---A- . (.Palm, Inc. - USB Driver for Palm OS Handheld Devices.) -- C:\WINDOWS\system32\drivers\PalmUSBD.sys [16509]

O58 - SDL:[MD5.80D317BD1C3DBC5D4FE7B1678C60CADD] - 27/04/2011 - 13:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\drivers\ptilink.sys [17792]

O58 - SDL:[MD5.49452BFCEC22F36A7A9B9C2181BC3042] - 27/04/2011 - 20:19:06 ---A- . (.Sonic Solutions - Px Engine Device Driver for Windows 2000/XP.) -- C:\WINDOWS\system32\drivers\pxhelp20.sys [43872]

O58 - SDL:[MD5.A56FE08EC7473E8580A390BB1081CDD7] - 14/04/2011 - 13:00:00 ---A- . (.S3/Diamond Multimedia Systems - Rio8Drv.sys Usb Driver.) -- C:\WINDOWS\system32\drivers\rio8drv.sys [12032]

O58 - SDL:[MD5.0A854DF84C77A0BE205BFEAB2AE4F0EC] - 14/04/2011 - 13:00:00 ---A- . (.S3/Diamond Multimedia Systems - RioDrv Usb Driver.) -- C:\WINDOWS\system32\drivers\riodrv.sys [12032]

O58 - SDL:[MD5.4019149E4E296072831C8855605D9FDC] - 14/04/2011 - 14:40:02 ---A- . (.Sunbelt Software - Anti-Rootkit Engine.) -- C:\WINDOWS\system32\drivers\SBREDrv.sys [95024]

O58 - SDL:[MD5.90A3935D05B494A5A39D37E71F09A677] - 27/04/2011 - 11:25:54 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS\system32\drivers\secdrv.sys [20480]

O58 - SDL:[MD5.A36EE93698802CD899F98BFD553D8185] - 27/04/2011 - 15:28:02 ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\WINDOWS\system32\drivers\ssmdrv.sys [28520]

O58 - SDL:[MD5.AA2BF2AAE9ABC27C7906BBE68F11D405] - 14/04/2011 - 08:04:50 ---A- . (.Trend Micro Inc. - TrendMicro Common Module.) -- C:\WINDOWS\system32\drivers\tmcomm.sys [157712]

O58 - SDL:[MD5.D74A8EC75305F1D3CFDE7C7FC1BD62A9] - 14/04/2011 - 13:00:00 ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINDOWS\system32\drivers\tsbvcap.sys [21376]

O58 - SDL:[MD5.E1B5BFBA7F1CDE1FC28934639E83B3CF] - 27/04/2011 - 16:24:14 ---A- . (.Roxio - CD-UDF NT Filesystem Reader Driver.) -- C:\WINDOWS\system32\drivers\udfreadr_xp.sys [206464]

O58 - SDL:[MD5.55E01061C74A8CEFFF58DC36114A8D3F] - 14/04/2011 - 13:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\drivers\vdmindvd.sys [58112]

O58 - SDL:[MD5.4B039BBD037B01F5DB5A144C837F283A] - 27/04/2011 - 04:42:00 R--A- . (.VIA Technologies, Inc. - VIA NT AGP Filter.) -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS [27904]

O58 - SDL:[MD5.C147AFA614B9925479D47CD173329789] - 27/04/2011 - 10:59:18 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\WINDOWS\system32\drivers\videX32.sys [13976]

O58 - SDL:[MD5.C7F0D7AA3A3C2DF333AFDD593106F39F] - 27/04/2011 - 10:59:48 ---A- . (.VIA Technologies, Inc. - ATA/ATAPI devices Hot-Plug/DIPM monitor.) -- C:\WINDOWS\system32\drivers\xfilt.sys [23192]

O58 - SDL:[MD5.9CF9EFD8332FC0535266E281C13DEDB5] - 15/04/2011 - 11:56:20 RSH-- . (...) -- C:\WINDOWS\system32\2165DF2EF2.sys [88]

O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 15/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037]

O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 17/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097]

O58 - SDL:[MD5.C6D29F29DE7427B1B0775E53E577B623] - 17/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4912]

O58 - SDL:[MD5.582BCDD47CF4B68B5CB528F18E3CB808] - 15/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809]

O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 17/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537]

O58 - SDL:[MD5.6FF07C3F115A29A79A62C90618FDF254] - 15/04/2011 - 11:56:20 -SHA- . (...) -- C:\WINDOWS\system32\KGyGaAvL.sys [2828]

O58 - SDL:[MD5.7D30A74B5FB9FE3B245A6CE5FBCD71D5] - 17/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27916]

O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 15/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146]

O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 15/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370]

O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 15/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274]

O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 15/04/2011 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146]

O58 - SDL:[MD5.CAAA108FD7BF71989946B39704323455] - 17/04/2011 - 06:45:25 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [34000]

O58 - SDL:[MD5.6F73F50162DEF60C84B725C18CD9140F] - 15/04/2011 - 06:45:14 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560]

O58 - SDL:[MD5.0FDD5E69C1FF3B58043D44F2CC743D45] - 15/04/2011 - 06:45:10 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648]

O58 - SDL:[MD5.8842837C4D8311BF8E72BEE8CCC42217] - 15/04/2011 - 06:45:15 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424]

O58 - SDL:[MD5.6B56CEB3C6F9D5CD7293DBD9FE23B311] - 15/04/2011 - 06:45:12 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560]

O58 - SDL:[MD5.B670C5D89F0726B7A2A7DFB4E968CDF8] - 27/04/2011 - 10:38:34 ---A- . (.Printing Communications Assoc., Inc. (PCAUS - PCAUSA NDIS 5.0 MPR Protocol Driver.) -- C:\WINDOWS\system32\pcampr5.sys [34688]

O58 - SDL:[MD5.ECD2F9D67B06606064DAF6961A6D5EFE] - 27/04/2011 - 18:53:54 ---A- . (.Printing Communications Assoc., Inc. (PCAUS - PCAUSA NDIS 5.0 Protocol Driver.) -- C:\WINDOWS\system32\pcandis5.sys [32128]

 

 

 

---\\ Liste des outils de nettoyage (O63)

O63 - Logiciel: HijackThis 2.0.2 - (.TrendMicro.) [HKLM] -- HijackThis

O63 - Logiciel: ZHPDiag 1.27 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1

O63 - Logiciel: RSIT - (.random/random.)

 

 

 

---\\ Liste des services Legacy (O64)

O64 - Services: CurCS - 14/04/2008 - C:\WINDOWS\System32\dmadmin.exe - Service d'administration du Gestionnaire de disque logique(dmadmin) .(.Microsoft Corp., Veritas Software - Processus du service Gestionnaire de disque.) - LEGACY_DMADMIN

O64 - Services: CurCS - 14/04/2008 - C:\WINDOWS\System32\drivers\dmboot.sys - dmboot(dmboot) .(.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disq.) - LEGACY_DMBOOT

O64 - Services: CurCS - 30/08/2002 - C:\WINDOWS\System32\drivers\dmload.sys - dmload(dmload) .(.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD

O64 - Services: CurCS - 02/07/2011 - C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys - No object(No service) .(.CybelSoft - Driver NT Ma-Config.com.) - LEGACY_DRIVERHARDWAREV2

O64 - Services: CurCS - 22/12/2009 - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe - Google Updater Service(gusvc) .(.Google - gusvc.) - LEGACY_GUSVC

O64 - Services: CurCS - 08/07/2008 - C:\WINDOWS\System32\DRIVERS\43882967.sys - is-8VVOUdrv(is-8VVOUdrv) .(.Kaspersky Lab - Klif Mini-Filter.) - LEGACY_IS-8VVOUDRV

O64 - Services: CurCS - 23/09/2003 - C:\WINDOWS\system32\PCAMPR5.sys - PCAMPR5 NDIS Protocol Driver(PCAMPR5) .(.Printing Communications Assoc., Inc. (PCAUS - PCAUSA NDIS 5.0 MPR Protocol Driver.) - LEGACY_PCAMPR5

O64 - Services: CurCS - 01/03/2006 - C:\WINDOWS\system32\PCANDIS5.sys - PCANDIS5 NDIS Protocol Driver(PCANDIS5) .(.Printing Communications Assoc., Inc. (PCAUS - PCAUSA NDIS 5.0 Protocol Driver.) - LEGACY_PCANDIS5

O64 - Services: CurCS - 02/11/2006 - C:\Program Files\Fichiers communs\Protexis\License Service\PSIService.exe - ProtexisLicensing(ProtexisLicensing) .(.Pas de propriétaire - nTitles PSIService.) - LEGACY_PROTEXISLICENSING

O64 - Services: CurCS - 17/06/2010 - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys - ssmdrv(ssmdrv) .(.Avira GmbH - AVIRA SnapShot Driver.) - LEGACY_SSMDRV

O64 - Services: CurCS - 30/04/2004 - C:\WINDOWS\system32\SAgent4.exe - Epson Printer Status Agent4(StatusAgent4) .(.SEIKO EPSON CORPORATION - SAgent4.) - LEGACY_STATUSAGENT4

O64 - Services: CurCS - 22/04/2011 - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe - TomTomHOMEService(TomTomHOMEService) .(.TomTom - Windows Service for TomTom HOME.) - LEGACY_TOMTOMHOMESERVICE

O64 - Services: CurCS - 04/07/2010 - C:\Program Files\Unlocker\UnlockerDriver5.sys - UnlockerDriver5 (UnlockerDriver5) .(...) - LEGACY_UNLOCKERDRIVER5

 

 

 

---\\ File Associations Shell Spawning (O67)

O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (. - .) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll

O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe

O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCU\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe

O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.)

O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.)

O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll

O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- "%1" %*

O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCR\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe

O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe

 

 

 

---\\ Start Menu Internet (O68)

O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe

 

 

 

---\\ Search Browser Infection (O69)

O69 - SBI: SearchScopes [HKCU] ${searchCLSID} [DefaultScope] - (@ieframe.dll,-12512) - Bing

O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - Bing

O69 - SBI: SearchScopes [HKCU] {4BB7EA41-8E43-4B4E-B7EE-7FDC92719711} - (Google) - Google

O69 - SBI: SearchScopes [HKCU] {814C76CB-2623-43F4-AAD0-58A0E5190A20} - (Orange) - http://r.orange.fr

 

 

 

---\\ Recherche particuliere à la racine de certains dossiers (O84)

[MD5.0942B8CA7CA27523D981D2347848265E] [sPRF][21/07/2011] (...) -- C:\Documents and Settings\user\Bureau\cc_20110721_162225.reg [6918]

[MD5.986FC649C34962A0469CDF04623816E9] [sPRF][21/07/2011] (...) -- C:\Documents and Settings\user\Bureau\cc_20110721_162411.reg [1494]

[MD5.C191C746CD975CE2DD5F8B5E009F8385] [sPRF][28/06/2011] (.Microsoft Corporation - Genuine Windows Validation.) -- C:\Documents and Settings\user\Bureau\GenuineCheck.exe [1528184]

[MD5.A651B784F664D1571E609F1769CD5253] [sPRF][22/07/2011] (...) -- C:\Documents and Settings\user\Bureau\MaConfig_5_1_4_0.exe [3523216]

[MD5.1A28CB38299AA0069555B95E5C7BE372] [sPRF][22/07/2011] (.Nicolas Coolman - ZHPDiag.) -- C:\Documents and Settings\user\Bureau\ZHPDiag2.exe [2540574]

[MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [sPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576]

[MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [sPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608]

[MD5.F51D887B450E56F2879CB219E19E8045] [sPRF][28/12/2004] (.F-Secure Corporation - fscax Module.) -- C:\WINDOWS\Downloaded Program Files\fscax.dll [652736]

[MD5.DEEEBA660F061417E2AD4A8167F798DD] [sPRF][19/08/2009] (.F-Secure Corporation - fslauncher module.) -- C:\WINDOWS\Downloaded Program Files\fslauncher.dll [400896]

[MD5.3F4413DCD8D3BBABF08F68F25E6D60E1] [sPRF][16/02/2005] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [401408]

[MD5.2032BFF930F09E14105AD16C00D966D1] [sPRF][03/06/2004] (.RealNetworks, Inc. - RdxIE Module.) -- C:\WINDOWS\Downloaded Program Files\RdxIE.dll [524445]

 

 

 

---\\ Scan Additionnel (O88)

Database Version : 8545 - (22/07/2011)

Clés trouvées (Keys found) : 8

Valeurs trouvées (Values found) : 0

Dossiers trouvés (Folders found) : 1

Fichiers trouvés (Files found) : 0

 

[HKLM\Software\Classes\imside1egate.application.1] =>Adware.BHO

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201f27d4-3704-41d6-89c1-aa35e39143ed}] =>Toolbar.Ask

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{201f27d4-3704-41d6-89c1-aa35e39143ed}] =>Toolbar.Ask

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] =>Toolbar.AskTBar

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] =>Toolbar.AskTBar

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b0de3308-5d5a-470d-81b9-634fc078393b}] =>Adware.BHO

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b0de3308-5d5a-470d-81b9-634fc078393b}] =>Adware.BHO

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Toolbar] =>Toolbar.Conduit

C:\Documents and Settings\user\Application Data\Nosibay =>Adware.SPointer

 

 

 

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)

SS - | Demand 27/04/2011 72704 | (Adobe LM Service) . (.Adobe Systems.) - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

SS - | Demand 27/04/2011 413696 | (Ati HotKey Poller) . (.ATI Technologies Inc..) - C:\WINDOWS\system32\Ati2evxx.exe

SS - | Demand 27/04/2011 520192 | (ATI Smart) . (...) - C:\WINDOWS\system32\ati2sgag.exe

SR - | Auto 04/07/2011 42184 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

SS - | Demand 27/04/2011 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\System32\dmadmin.exe

SS - | Disabled 27/04/2011 136120 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

SS - | Disabled 27/04/2011 545568 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe

SS - | Demand 22/07/2011 311928 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe

SS - | Disabled 27/04/2011 174656 | (ProtexisLicensing) . (...) - C:\Program Files\Fichiers communs\Protexis\License Service\PSIService.exe

SR - | Auto 27/04/2011 122880 | (StatusAgent4) . (.SEIKO EPSON CORPORATION.) - C:\WINDOWS\system32\SAgent4.exe

SS - | Demand 27/04/2011 92592 | (TomTomHOMEService) . (.TomTom.) - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

 

 

 

---\\ Recherche Master Boot Record Infection (MBR)(O80)

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, GMER - Rootkit Detector and Remover

Run by user at 23/07/2011 10:00:22

 

device: opened successfully

user: error reading MBR

 

Disk trace:

error: Read Descripteur non valide

kernel: error reading MBR

 

 

 

End of the scan (1123 lines in 03mn 54s)(0)