[Résolu] Virus Smart Fortress / ZeroAccess

[DadooNum]

--- 16-04-2012 à 12h53 ---

 

Bonjour à tous,

 

Je suis apparemment infecté par les virus Smart Fortress 2012 et ZeroAccess.

 

Je ne suis pas sûr d'avoir completement supprimé SF 2012 avec Avast et suis perdu avec ZeroAccess.

 

 

J'ai regardé un certain nombre de forum et suis tombé sur RogueKiller et c'est comme ça que j'ai découvert ZeroAccess.

Mon gros problème est que je n'ai plus aucun accès au reseau réseau local (Internet fonctionne).

 

Tout ça est il lié ???

 

 

Ci joint le dernier rapport Roguekiller si cela peut aider :

 

RogueKiller V7.3.2 [20/03/2012] par Tigzy

mail: tigzyRK<at>gmail<dot>com

Remontees: [RogueKiller] Remontées (1/49)

Blog: tigzy-RK

 

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version

Demarrage : Mode normal

Utilisateur: numelec [Droits d'admin]

Mode: Recherche -- Date: 16/04/2012 12:38:45

 

¤¤¤ Processus malicieux: 0 ¤¤¤

 

¤¤¤ Entrees de registre: 0 ¤¤¤

 

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

 

¤¤¤ Driver: [CHARGE] ¤¤¤

SSDT[25] : NtClose @ 0x805BC530 -> HOOKED (d347bus.sys @ 0xB7F8E818)

SSDT[41] : NtCreateKey @ 0x806240F0 -> HOOKED (d347bus.sys @ 0xB7F8E7D0)

SSDT[45] : NtCreatePagingFile @ 0x805AB9EE -> HOOKED (d347bus.sys @ 0xB7F82A20)

SSDT[71] : NtEnumerateKey @ 0x8062493C -> HOOKED (d347bus.sys @ 0xB7F832A8)

SSDT[73] : NtEnumerateValueKey @ 0x80624BA6 -> HOOKED (d347bus.sys @ 0xB7F8E910)

SSDT[119] : NtOpenKey @ 0x806254CE -> HOOKED (d347bus.sys @ 0xB7F8E794)

SSDT[160] : NtQueryKey @ 0x80625810 -> HOOKED (d347bus.sys @ 0xB7F832C8)

SSDT[177] : NtQueryValueKey @ 0x80622314 -> HOOKED (d347bus.sys @ 0xB7F8E866)

SSDT[241] : NtSetSystemPowerState @ 0x80653E18 -> HOOKED (d347bus.sys @ 0xB7F8E0B0)

_INLINE_ : NtCreatePagingFile -> HOOKED (d347bus.sys @ 0xB7F965C4)

 

¤¤¤ Infection : ZeroAccess ¤¤¤

[ZeroAccess] (LOCKED) windir\NtUpdateKBxxxx present!

 

¤¤¤ Fichier HOSTS: ¤¤¤

127.0.0.1 localhost

127.0.0.1 mpa.one.microsoft.com

 

 

¤¤¤ MBR Verif: ¤¤¤

 

+++++ PhysicalDrive0: SAMSUNG HD753LJ +++++

--- User ---

[MBR] 83d21979f1bca489a7472afac19fe694

[bSP] 9ea93bfacf471b7fbb4d9d1055d1c197 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 715394 Mo

User = LL1 ... OK!

User = LL2 ... OK!

 

Termine : << RKreport[5].txt >>

RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt

 

 

Merci d'avance pour vos réponses

Dadoo

 

--- 16-04-2012 à 18h43 ---

 

(re)bonjour,

 

Concernant les problemes de connexion reseau c'est résolu.

 

Avast ayant détecté un virus dans le fichier/composant appelé netBT (lié au TCP/IP) il l'avait placé en quarantaine.

La restauration n'a rien fait.

 

Le probleme a été résolu avec Microsoftfixit5.

 

Pour l'instant tout est stable mais jusqu'à quand ???

J'aimerai pouvoir supprimer de façon définitive SF 2012 et ZeroAccess !!

 

Merci d'avance de vos réponses.

Dadoo

 

-édit- Dans cette section, il ne faut pas multiplier les messages dans ton sujet avant d'avoir été pris en charge : au vu de la présence d'une « réponse », les helpers ne s'y intéresseront pas, croyant le problème pris en mains par l'un des leurs. Tu peux en revanche utiliser le bouton "Modifier" que tu trouves en bas à droite du premier message…

J'ai fusionné tes deux messages.

Modifié le 3 mai 2012 par DadooNum

[bernard53]

Bonjour

 

Relance RoqueKiller puis

Cliquer sur Suppression. Cliquer sur Rapport et copier-coller le contenu du notepad

 

Ensuite pour voir un peu plus.

 

Télécharges << ZHPDiag>> (de Nicolas Coolman)

 

dezzipes le fichier sur ton bureau...

Fais un clic-droit sur l'icône ZHPDiag .exe et choisis "exécuter en tant qu'administrateur".

 

 

L'installation va créer raccourcis (ZHPDiag et ZHPFix et MBRchek) sur ton bureau

 

 

 

A la fin de l'installation ZHPDiag va se lancer....

 

Cliques sur l'icône "Options" (image du tournevis) et coches toutes les options.

Cliques sur "Lancer le diagnostique" (image de la loupe) et patiente...

 

A la fin du scan cliques sur l'icône "sauvegarder le fichier sous" (image de la disquette bleu) et enregistre le rapport sur ton bureau.

 

Mets le rapport ici car il prend bien de la place.

Cliquez ici.

ou la

Accueil de Cjoint.com

[DadooNum]

Bonjour Bernard53,

 

Merci pour ta réponse.

 

Voici le rapport RogueKiller récupéré après un Scan + Supprimer.

 

----------

 

RogueKiller V7.3.2 [20/03/2012] par Tigzy

mail: tigzyRK<at>gmail<dot>com

Remontees: [RogueKiller] Remontées (1/49)

Blog: tigzy-RK

 

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version

Demarrage : Mode normal

Utilisateur: numelec [Droits d'admin]

Mode: Recherche -- Date: 23/04/2012 17:16:50

 

¤¤¤ Processus malicieux: 0 ¤¤¤

 

¤¤¤ Entrees de registre: 0 ¤¤¤

 

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

 

¤¤¤ Driver: [CHARGE] ¤¤¤

SSDT[25] : NtClose @ 0x805BC530 -> HOOKED (d347bus.sys @ 0xB7F8E818)

SSDT[41] : NtCreateKey @ 0x806240F0 -> HOOKED (d347bus.sys @ 0xB7F8E7D0)

SSDT[45] : NtCreatePagingFile @ 0x805AB9EE -> HOOKED (d347bus.sys @ 0xB7F82A20)

SSDT[71] : NtEnumerateKey @ 0x8062493C -> HOOKED (d347bus.sys @ 0xB7F832A8)

SSDT[73] : NtEnumerateValueKey @ 0x80624BA6 -> HOOKED (d347bus.sys @ 0xB7F8E910)

SSDT[119] : NtOpenKey @ 0x806254CE -> HOOKED (d347bus.sys @ 0xB7F8E794)

SSDT[160] : NtQueryKey @ 0x80625810 -> HOOKED (d347bus.sys @ 0xB7F832C8)

SSDT[177] : NtQueryValueKey @ 0x80622314 -> HOOKED (d347bus.sys @ 0xB7F8E866)

SSDT[241] : NtSetSystemPowerState @ 0x80653E18 -> HOOKED (d347bus.sys @ 0xB7F8E0B0)

_INLINE_ : NtCreatePagingFile -> HOOKED (d347bus.sys @ 0xB7F965C4)

 

¤¤¤ Infection : ZeroAccess ¤¤¤

[ZeroAccess] (LOCKED) windir\NtUpdateKBxxxx present!

 

¤¤¤ Fichier HOSTS: ¤¤¤

127.0.0.1 localhost

127.0.0.1 mpa.one.microsoft.com

 

 

¤¤¤ MBR Verif: ¤¤¤

 

+++++ PhysicalDrive0: SAMSUNG HD753LJ +++++

--- User ---

[MBR] 83d21979f1bca489a7472afac19fe694

[bSP] 9ea93bfacf471b7fbb4d9d1055d1c197 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 715394 Mo

User = LL1 ... OK!

User = LL2 ... OK!

 

Termine : << RKreport[8].txt >>

 

--------------

 

Pour ZHPDiag, le scan ne va pas jusqu'au bout et il plante.

Malgré un arret + redémarrage de l'ordi : même probleme.

 

Le Message d'erreur est Lien CJoint.com 0DxrSWWYD14

 

 

Merci

Dadou

[bernard53]

attention RoqueKiller, du moins ton rapport est en mode recherche

Utilisateur: numelec [Droits d'admin]

Mode: Recherche -- Date: 23/04/2012 17:16:50

 

Valide le mode suppression puis si ZHP bloque ceci a la place.

 

* Télécharge >> OTL <<sur ton bureau.

 

* Fait un double-clic sur l'icône d'OTL pour le lancer

/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

 

* Assure-toi d'avoir fermé toutes les applications en court de fonctionnement.

 

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "Rapport minimal " soit cochée.

 

* Copies et colles le contenue de cette citation dans la partie inférieure d'OTL " Personnalisation"

HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl|FEATURE_BROWSER_EMULATION /rs

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl|feature_enable_ie_compression /rs

HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\FeatureControl|feature_enable_ie_compression /rs

hklm\software\clients\startmenuinternet|command /rs

hklm\software\clients\startmenuinternet|command /64 /rs

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers /s

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 /s

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc /s

%temp%\smtmp\1\*.* /s

%temp%\smtmp\2\*.* /s

%temp%\smtmp\4\*.* /s

nslookup Google /c

SAVEMBR:0

NetSvcs

%systemroot%\system32\drivers\*.sys /lockedfiles

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

netsvcs

/md5start

dwm.exe

taskhost.exe

taskeng.exe

wscntfy.exe

ctfmon.exe

rdpclip.exe

volsnap.sys

sptd.sys

explorer.exe

userinit.exe

winlogon.exe

wininit.exe

tcpip.sys

Sfloppy.sys

Changer.sys

cdrom.sys

disk.sys

ndis.sys

usbscan.sys

usbprint.sys

tdtcp.sys

tdpipe.sys

swmidi.sys

splitter.sys

rdpwd.sys

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

RASACD.SYS

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

nvrd32.sys

/md5stop

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

 

* Cliques sur l'icône "Analyse" (en haut à gauche) .

* Laisse le scan aller à son terme sans te servir du PC

* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).

* Copie et colle le ou les rapports dans ta réponse stp...

* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

Mets le rapport ici car il prend bien de la place.

Cliquez ici.

ou la

Accueil de Cjoint.com

[DadooNum]

Bonjour Bernard,

 

Ci-après le rapport RogueKiller en mode SUPRRESSION

 

-------------------------------

RogueKiller V7.3.2 [20/03/2012] par Tigzy

mail: tigzyRK<at>gmail<dot>com

Remontees: [RogueKiller] Remontées (1/49)

Blog: tigzy-RK

 

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version

Demarrage : Mode normal

Utilisateur: numelec [Droits d'admin]

Mode: Suppression -- Date: 24/04/2012 11:06:16

 

¤¤¤ Processus malicieux: 0 ¤¤¤

 

¤¤¤ Entrees de registre: 0 ¤¤¤

 

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

 

¤¤¤ Driver: [CHARGE] ¤¤¤

SSDT[25] : NtClose @ 0x805BC530 -> HOOKED (d347bus.sys @ 0xB7F8E818)

SSDT[41] : NtCreateKey @ 0x806240F0 -> HOOKED (d347bus.sys @ 0xB7F8E7D0)

SSDT[45] : NtCreatePagingFile @ 0x805AB9EE -> HOOKED (d347bus.sys @ 0xB7F82A20)

SSDT[71] : NtEnumerateKey @ 0x8062493C -> HOOKED (d347bus.sys @ 0xB7F832A8)

SSDT[73] : NtEnumerateValueKey @ 0x80624BA6 -> HOOKED (d347bus.sys @ 0xB7F8E910)

SSDT[119] : NtOpenKey @ 0x806254CE -> HOOKED (d347bus.sys @ 0xB7F8E794)

SSDT[160] : NtQueryKey @ 0x80625810 -> HOOKED (d347bus.sys @ 0xB7F832C8)

SSDT[177] : NtQueryValueKey @ 0x80622314 -> HOOKED (d347bus.sys @ 0xB7F8E866)

SSDT[241] : NtSetSystemPowerState @ 0x80653E18 -> HOOKED (d347bus.sys @ 0xB7F8E0B0)

_INLINE_ : NtCreatePagingFile -> HOOKED (d347bus.sys @ 0xB7F965C4)

 

¤¤¤ Infection : ZeroAccess ¤¤¤

[ZeroAccess] (LOCKED) windir\NtUpdateKBxxxx present!

 

¤¤¤ Fichier HOSTS: ¤¤¤

127.0.0.1 localhost

127.0.0.1 mpa.one.microsoft.com

 

 

¤¤¤ MBR Verif: ¤¤¤

 

+++++ PhysicalDrive0: SAMSUNG HD753LJ +++++

--- User ---

[MBR] 83d21979f1bca489a7472afac19fe694

[bSP] 9ea93bfacf471b7fbb4d9d1055d1c197 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 715394 Mo

User = LL1 ... OK!

User = LL2 ... OK!

 

Termine : << RKreport[10].txt >>

-------------------------------

 

 

Et enfin les 2 rapports OTL

 

OTL.txt

-------------------------------

OTL logfile created on: 24/04/2012 11:51:17 - Run 1

OTL by OldTimer - Version 3.2.41.0 Folder = C:\Documents and Settings\numelec\Bureau

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

 

2,99 Gb Total Physical Memory | 2,19 Gb Available Physical Memory | 73,12% Memory free

4,83 Gb Paging File | 4,07 Gb Available in Paging File | 84,23% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 698,63 Gb Total Space | 644,69 Gb Free Space | 92,28% Space Free | Partition Type: NTFS

Unable to calculate disk information.

Drive W: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive X: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive Y: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive Z: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

 

Computer Name: SONATA | User Name: numelec | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - C:\Documents and Settings\numelec\Bureau\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\ZHPDiag\ZHPDiag.exe ()

PRC - C:\Program Files\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH)

PRC - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)

PRC - C:\Program Files\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH)

PRC - C:\Program Files\Copernic Desktop Search - Pro\DesktopSearchService.exe (Copernic Inc.)

PRC - C:\Program Files\ClearImage\COM\InliteLMService.exe ( Inlite Research, Inc.)

PRC - C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe (Nitro PDF Software)

PRC - C:\WINDOWS\system32\NLSSRV32.EXE (Nalpeiron Ltd.)

PRC - C:\Program Files\Fichiers communs\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe (ABBYY)

PRC - C:\Program Files\Fichiers communs\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)

PRC - C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAC8SWK.EXE (CANON INC.)

PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAP2RPK.EXE (CANON INC.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.)

PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)

PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)

PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)

PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)

PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)

PRC - C:\Program Files\D-Tools\daemon.exe (DAEMON'S HOME)

PRC - C:\WINDOWS\system32\rmctrl.exe ()

 

 

========== Modules (No Company Name) ==========

 

MOD - C:\Program Files\ZHPDiag\ZHPDiag.exe ()

MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()

MOD - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\pdfshell.FRA ()

MOD - C:\WINDOWS\system32\msdmo.dll ()

MOD - C:\Program Files\Alwil Software\Avast4\unacev2.dll ()

MOD - C:\WINDOWS\daemon.dll ()

MOD - C:\Program Files\D-Tools\Plugins\Images\bw5mount.dll ()

MOD - C:\WINDOWS\system32\rmctrl.exe ()

MOD - C:\WINDOWS\system32\ctrldll.dll ()

 

 

========== Win32 Services (SafeList) ==========

 

SRV - (TeamViewer7) -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (InliteLM) -- C:\Program Files\ClearImage\COM\InliteLMService.exe ( Inlite Research, Inc.)

SRV - (NitroDriverReadSpool) -- C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe (Nitro PDF Software)

SRV - (nlsX86cc) -- C:\WINDOWS\system32\NLSSRV32.EXE (Nalpeiron Ltd.)

SRV - (FLEXnet Licensing Service) -- C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)

SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)

SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)

SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)

SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)

SRV - (aswUpdSv) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)

SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

 

 

========== Driver Services (SafeList) ==========

 

DRV - (WDICA) -- File not found

DRV - (PDRFRAME) -- File not found

DRV - (PDRELI) -- File not found

DRV - (PDFRAME) -- File not found

DRV - (PDCOMP) -- File not found

DRV - (PCIDump) -- File not found

DRV - (lbrtfdc) -- File not found

DRV - (i2omgmt) -- File not found

DRV - (Changer) -- File not found

DRV - (.netbt) -- File not found

DRV - (SenFiltService) -- C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)

DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)

DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)

DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)

DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)

DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)

DRV - (d347prt) -- C:\WINDOWS\system32\drivers\d347prt.sys ( )

DRV - (d347bus) -- C:\WINDOWS\system32\drivers\d347bus.sys ( )

DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys ()

DRV - (CLPCIID) -- C:\Program Files\CyberLink\PowerDVD\clpciid.sys (CyberLink Corp.)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?barid={6D7BBA8B-87A8-11E1-ACCE-1CAFF770EFAC}

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing

IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = Server Error

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = {searchTerms} - Recherche Google

IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = Server Error

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: [email protected]:1.0

FF - prefs.js..extensions.enabledItems: {5A288A4E-7C09-40B9-AF27-A297A10B881D}:3.0.4.19

FF - prefs.js..network.proxy.type: 0

FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""

FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\numelec\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/10 09:45:28 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/03 12:13:25 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ff7ea51e-0dcd-4e5d-a0a0-332a854012ba}: C:\Program Files\Copernic Desktop Search - Pro\Firefox70Connector [2011/12/22 12:42:11 | 000,000,000 | ---D | M]

 

[2010/07/01 16:04:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\numelec\Application Data\Mozilla\Extensions

[2012/04/18 15:48:00 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\numelec\Application Data\Mozilla\Firefox\Profiles\wf2jc75x.default\extensions

[2011/07/03 18:51:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\numelec\Application Data\Mozilla\Firefox\Profiles\wf2jc75x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012/02/03 12:13:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010/09/08 16:28:07 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2012/04/10 09:45:27 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2010/09/08 16:28:06 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012/02/15 14:33:00 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml

[2012/02/15 14:33:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012/02/15 14:33:00 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml

[2012/02/15 14:33:00 | 000,001,154 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml

[2012/02/15 14:33:00 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml

[2012/02/15 14:33:00 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

 

O1 HOSTS File: ([2010/06/22 16:56:15 | 000,000,837 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)

O4 - HKLM..\Run: [CNAP2 Launcher] C:\WINDOWS\system32\spool\drivers\w32x86\3\CNAP2LAK.EXE (CANON INC.)

O4 - HKLM..\Run: [DAEMON Tools-1033] C:\Program Files\D-Tools\daemon.exe (DAEMON'S HOME)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] nwiz.exe /installquiet File not found

O4 - HKLM..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe ()

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKCU..\Run: [Copernic Desktop Search - Professional] C:\Program Files\Copernic Desktop Search - Pro\DesktopSearchService.exe (Copernic Inc.)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil11f_Plugin.exe (Adobe Systems, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Ajouter à un fichier PDF existant - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convertir au format Adobe PDF - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Rechercher sur le Web - C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1277218640093 (WUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB945B33-E3E1-4C74-805A-CF54DD12839D}: DhcpNameServer = 192.168.0.254

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Ma page d'accueil) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\numelec\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\numelec\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/06/22 13:34:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{4786c33e-da92-11df-ac3e-1caff770efac}\Shell - "" = AutoRun

O33 - MountPoints2\{4786c33e-da92-11df-ac3e-1caff770efac}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NumEdex.eXe

O33 - MountPoints2\{78bdbc58-8519-11df-ac31-1caff770efac}\Shell - "" = AutoRun

O33 - MountPoints2\{78bdbc58-8519-11df-ac31-1caff770efac}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Nc.exe

O33 - MountPoints2\{86417aa2-98be-11e0-ac70-1caff770efac}\Shell - "" = AutoRun

O33 - MountPoints2\{86417aa2-98be-11e0-ac70-1caff770efac}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe - (McAfee, Inc.)

MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe - (Microsoft Corporation)

MsConfig - StartUpReg: 99058D590010B14700015A98D151FC4E - hkey= - key= - File not found

MsConfig - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

MsConfig - StartUpReg: Adobe Acrobat Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: CANON DR6080_7580_9080C SVC - hkey= - key= - File not found

MsConfig - StartUpReg: Facebook Update - hkey= - key= - C:\Documents and Settings\numelec\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)

MsConfig - StartUpReg: NvCplDaemon - hkey= - key= - File not found

MsConfig - StartUpReg: SoundMAX - hkey= - key= - C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)

MsConfig - StartUpReg: SoundMAXPnP - hkey= - key= - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

MsConfig - StartUpReg: SweetIM - hkey= - key= - C:\Program Files\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)

MsConfig - StartUpReg: Sweetpacks Communicator - hkey= - key= - C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)

 

SafeBootMin: PEVSystemStart - Service

SafeBootMin: procexp90.Sys - Driver

 

SafeBootNet: PEVSystemStart - Service

SafeBootNet: procexp90.Sys - Driver

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {0fde1f56-0d59-4fd7-9624-e3df6b419d0f} - IEEX

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Rendu VML (Vector Graphics Rendering)

ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Liaison de données Dynamic HTML pour Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Création avancée

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes Java DirectAnimation

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Mise à jour de sécurité pour Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {72AD53CC-CCC0-3757-8480-9EE176866A7C} - .NET Framework

ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

ActiveX: {8B51B502-2A1B-B9AB-90D8-315590B18170} - Outlook Express

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {9A394342-4A68-4EBA-85A6-55B559F4E700} - .NET Framework

ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Planificateur de tâches

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash

ActiveX: {D67A7A22-D86D-52F8-0FB3-9A864A3733D3} - Mise à jour de la version d’Internet Explorer

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ActiveX: Microsoft Base Smart Card Crypto Provider Package -

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

 

========== Files/Folders - Created Within 30 Days ==========

 

[2012/04/24 11:49:05 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\numelec\Recent

[2012/04/24 11:19:59 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\numelec\Bureau\OTL.exe

[2012/04/23 12:13:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google

[2012/04/23 12:11:09 | 001,706,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\GDIPLUS.DLL

[2012/04/23 12:11:09 | 001,033,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSPCORE.DLL

[2012/04/23 12:11:09 | 000,443,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MDIVWCTL.DLL

[2012/04/23 12:11:09 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSPGIMME.DLL

[2012/04/19 15:02:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\numelec\modelio

[2012/04/16 17:46:29 | 000,000,000 | ---D | C] -- C:\spoolerlogs

[2012/04/16 17:41:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\numelec\Local Settings\Application Data\canon.jp

[2012/04/16 15:06:51 | 000,000,000 | ---D | C] -- C:\ZHP

[2012/04/16 15:06:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ZHP

[2012/04/16 15:06:37 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPDiag

[2012/04/16 12:32:20 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2012/04/16 12:32:20 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2012/04/16 12:32:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2012/04/16 12:32:20 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2012/04/16 12:32:15 | 000,000,000 | --SD | C] -- C:\ComboFix

[2012/04/16 12:32:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2012/04/16 12:30:56 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012/04/16 12:30:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\numelec\Menu Démarrer\Programmes\Outils d'administration

[2012/04/16 12:28:33 | 004,464,884 | R--- | C] (Swearware) -- C:\Documents and Settings\numelec\Bureau\ComboFix.exe

[2012/04/16 12:19:55 | 002,071,600 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\numelec\Bureau\tdsskiller.exe

[2012/04/16 11:52:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\numelec\Bureau\RK_Quarantine

[2012/04/16 11:42:05 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM

[2012/04/16 11:42:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SweetIM

[2012/04/13 19:32:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\numelec\Menu Démarrer\Programmes\Smart Fortress 2012

[2012/04/13 19:23:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\99058D590010B14700015A98D151FC4E

[2012/04/13 14:48:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\numelec\Mes documents\Maxprog

[2012/04/13 14:48:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\numelec\Application Data\Maxprog

[2012/04/13 14:48:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\MaxBulk Mailer

[2012/04/13 14:47:59 | 000,000,000 | ---D | C] -- C:\Program Files\MaxBulk Mailer

[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2012/04/24 11:55:00 | 000,000,436 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{40D3A964-4E61-4ABF-86DA-8531D879AE23}.job

[2012/04/24 11:52:16 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin

[2012/04/24 11:19:59 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\numelec\Bureau\OTL.exe

[2012/04/24 11:11:01 | 000,001,006 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-725345543-1993962763-1801674531-1003UA.job

[2012/04/24 11:11:00 | 000,000,984 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-725345543-1993962763-1801674531-1003Core.job

[2012/04/24 10:56:24 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/04/24 10:55:58 | 000,276,202 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml

[2012/04/24 10:54:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/04/24 08:30:03 | 000,000,466 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack AGORA STOCKAGE - ETAPE 2-2.job

[2012/04/24 07:00:02 | 000,000,458 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack AGORA POOL - ETAPE 1-2.job

[2012/04/24 05:00:00 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack JOAN.job

[2012/04/24 00:07:26 | 000,000,448 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack SVG_PC5_DECOUPAGE.job

[2012/04/24 00:00:00 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack Migration Modeles sur Sonata.job

[2012/04/23 23:28:55 | 000,000,454 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack SVG_SONATA_DECOUPAGE.job

[2012/04/23 23:25:01 | 000,000,454 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack SONATA LOCAL DEC svg.job

[2012/04/23 23:20:01 | 000,000,456 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack COPERNIC INDEX SONATA.job

[2012/04/23 23:10:02 | 000,000,464 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack MODELES SAUVEGARDE SONATA.job

[2012/04/23 23:00:12 | 000,000,460 | ---- | M] () -- C:\WINDOWS\tasks\SyncBack MODELES SAUVEGARDE PCAN.job

[2012/04/23 19:05:43 | 000,000,009 | ---- | M] () -- C:\Contrib.PWD

[2012/04/23 17:54:51 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\numelec\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012/04/23 12:08:24 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\nolette.mdi

[2012/04/19 17:07:58 | 000,021,058 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\PAPREC RECU.pdf

[2012/04/19 16:40:57 | 000,011,885 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\Infogreffe recu.pdf

[2012/04/16 16:26:35 | 000,650,240 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\MicrosoftFixit50199.msi

[2012/04/16 15:44:32 | 000,000,375 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.ics

[2012/04/16 15:12:10 | 000,000,512 | ---- | M] () -- C:\PhysicalDisk0_MBR.bin

[2012/04/16 15:06:39 | 000,000,673 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk

[2012/04/16 15:06:39 | 000,000,666 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk

[2012/04/16 15:06:39 | 000,000,661 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk

[2012/04/16 12:28:08 | 004,464,884 | R--- | M] (Swearware) -- C:\Documents and Settings\numelec\Bureau\ComboFix.exe

[2012/04/16 12:19:14 | 002,071,600 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\numelec\Bureau\tdsskiller.exe

[2012/04/16 11:52:21 | 001,262,080 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\RogueKiller.exe

[2012/04/13 19:32:06 | 000,001,324 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\Smart Fortress 2012.lnk

[2012/04/11 03:07:28 | 000,575,542 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat

[2012/04/11 03:07:28 | 000,481,832 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012/04/11 03:07:28 | 000,103,620 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat

[2012/04/11 03:07:28 | 000,079,906 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012/04/10 10:41:32 | 000,000,298 | ---- | M] () -- C:\Documents and Settings\numelec\Application Data\Microsoft\Internet Explorer\Quick Launch\Raccourci vers Production sur 'Disk Station ' (W).lnk

[2012/04/10 10:41:07 | 000,000,298 | ---- | M] () -- C:\Documents and Settings\numelec\Bureau\Production sur Disk Station.lnk

[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2012/04/24 11:52:16 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin

[2012/04/23 12:08:24 | 000,233,472 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\nolette.mdi

[2012/04/19 17:07:58 | 000,021,058 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\PAPREC RECU.pdf

[2012/04/19 16:40:57 | 000,011,885 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\Infogreffe recu.pdf

[2012/04/16 16:26:34 | 000,650,240 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\MicrosoftFixit50199.msi

[2012/04/16 15:12:10 | 000,000,512 | ---- | C] () -- C:\PhysicalDisk0_MBR.bin

[2012/04/16 15:06:39 | 000,000,673 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk

[2012/04/16 15:06:39 | 000,000,666 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk

[2012/04/16 15:06:39 | 000,000,661 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk

[2012/04/16 12:32:20 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2012/04/16 12:32:20 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2012/04/16 12:32:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2012/04/16 12:32:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2012/04/16 12:32:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2012/04/16 11:52:57 | 001,262,080 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\RogueKiller.exe

[2012/04/13 19:32:06 | 000,001,324 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\Smart Fortress 2012.lnk

[2012/04/12 12:23:02 | 000,000,466 | ---- | C] () -- C:\WINDOWS\tasks\SyncBack AGORA STOCKAGE - ETAPE 2-2.job

[2012/04/12 12:22:20 | 000,000,458 | ---- | C] () -- C:\WINDOWS\tasks\SyncBack AGORA POOL - ETAPE 1-2.job

[2012/04/10 10:41:32 | 000,000,298 | ---- | C] () -- C:\Documents and Settings\numelec\Application Data\Microsoft\Internet Explorer\Quick Launch\Raccourci vers Production sur 'Disk Station ' (W).lnk

[2012/04/10 10:41:07 | 000,000,298 | ---- | C] () -- C:\Documents and Settings\numelec\Bureau\Production sur Disk Station.lnk

[2012/03/03 17:22:21 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2012/02/29 19:39:21 | 000,000,026 | ---- | C] () -- C:\WINDOWS\COOWIZCK.INI

[2012/02/29 19:38:54 | 000,000,050 | ---- | C] () -- C:\WINDOWS\coowiz20.ini

[2012/02/14 20:10:03 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011/02/22 19:11:59 | 000,326,040 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-725345543-1993962763-1801674531-1003-0.dat

[2011/02/22 19:11:58 | 000,275,822 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat

[2010/09/17 16:33:22 | 000,000,050 | ---- | C] () -- C:\WINDOWS\MegaManager.INI

[2010/09/08 11:27:04 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\numelec\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/07/02 17:03:43 | 000,005,226 | ---- | C] () -- C:\WINDOWS\pixcache.ini

[2010/07/02 16:41:39 | 000,024,610 | ---- | C] () -- C:\WINDOWS\SetScan.ini

[2010/07/01 16:03:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/06/23 15:59:09 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2010/06/22 20:43:52 | 000,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys

[2010/06/22 20:43:52 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys

[2010/06/22 20:35:58 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\ctrldll.dll

[2010/06/22 20:35:58 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\rmctrl.exe

[2010/06/22 19:57:21 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\numelec\Local Settings\Application Data\fusioncache.dat

[2010/06/22 16:26:10 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini

[2010/06/22 16:24:48 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys

[2010/06/22 16:24:38 | 000,030,320 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2010/06/22 16:24:38 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2010/06/22 13:57:32 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010/06/22 13:56:18 | 000,270,984 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/06/22 13:45:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010/06/22 13:32:23 | 000,021,892 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

 

========== Custom Scans ==========

 

< HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl|FEATURE_BROWSER_EMULATION /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\\sllauncher.exe: 8000

 

< HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl|feature_enable_ie_compression /rs >

 

< HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\FeatureControl|feature_enable_ie_compression /rs >

 

< hklm\software\clients\startmenuinternet|command /rs >

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012/04/10 09:45:24 | 000,836,840 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012/04/10 09:45:24 | 000,836,840 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012/04/10 09:45:24 | 000,836,840 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012/04/10 09:45:26 | 000,924,600 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012/04/10 09:45:26 | 000,924,600 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012/04/10 09:45:26 | 000,924,600 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2012/02/29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2012/02/29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2012/02/29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

 

< hklm\software\clients\startmenuinternet|command /64 /rs >

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012/04/10 09:45:24 | 000,836,840 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012/04/10 09:45:24 | 000,836,840 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012/04/10 09:45:24 | 000,836,840 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012/04/10 09:45:26 | 000,924,600 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012/04/10 09:45:26 | 000,924,600 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012/04/10 09:45:26 | 000,924,600 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2012/02/29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2012/02/29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2012/02/29 14:17:40 | 000,174,080 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

 

< HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers /s >

"timer" = timer.drv -- [2001/08/28 16:00:00 | 000,004,096 | ---- | M] (Microsoft Corporation)

 

< HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc /s >

"msaud32.acm" = Windows Media Audio Codec

"sl_anet.acm" = Sipro Lab Telecom Audio Codec

"C:\WINDOWS\system32\iac25_32.ax" = Indeo® audio software

"ir50_32.dll" = Indeo® video 5.10

"C:\WINDOWS\system32\l3codeca.acm" = Fraunhofer IIS MPEG Layer-3 Codec

"wdmaud.drv" = ADI UAA Function Driver for High Definition Audio

 

< %temp%\smtmp\1\*.* /s >

 

< %temp%\smtmp\2\*.* /s >

 

< %temp%\smtmp\4\*.* /s >

 

< nslookup Google /c >

Serveur : UnKnown

Address: 192.168.0.254

 

< %systemroot%\system32\drivers\*.sys /lockedfiles >

 

< %APPDATA%\*.exe /s >

[2006/08/15 10:15:04 | 000,110,592 | ---- | M] () -- C:\Documents and Settings\numelec\Application Data\U3\temp\cleanup.exe

 

< %SYSTEMDRIVE%\*.exe >

[1999/01/12 12:42:20 | 000,073,728 | ---- | M] (InstallShield Software Corporation) -- C:\Setup.exe

[1998/10/27 13:06:48 | 000,027,648 | ---- | M] (InstallShield Software Corporation) -- C:\_ISDel.exe

 

< MD5 for: AGP440.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

 

< MD5 for: AHCIX86.SYS >

[2008/08/20 10:05:39 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\NLDRV\003\ahcix86.sys

[2008/08/20 10:05:41 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\NLDRV\004\ahcix86.sys

[2008/08/20 10:16:37 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\NLDRV\013\ahcix86.sys

[2008/08/20 10:16:38 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\NLDRV\014\ahcix86.sys

[2008/08/20 10:19:04 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\NLDRV\023\ahcix86.sys

[2008/08/20 10:19:05 | 000,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\NLDRV\024\ahcix86.sys

 

< MD5 for: ATAPI.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys

[2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0023\DriverFiles\i386\atapi.sys

 

< MD5 for: CDROM.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys

[2008/04/13 11:40:48 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys

[2011/02/08 03:16:22 | 000,062,592 | ---- | M] (Microsoft Corporation) MD5=7B53584D94E9D8716B2DE91D5F1CB42D -- C:\WINDOWS\system32\dllcache\cdrom.sys

 

< MD5 for: CHANGER.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys

 

< MD5 for: CTFMON.EXE >

[2008/04/13 19:34:00 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=59DC5BB82E4C8E0B3EADCFDBC44BA6E4 -- C:\WINDOWS\system32\ctfmon.exe

[2008/04/13 19:34:00 | 000,015,360 | ---- | M] (Microsoft Corporation) MD5=59DC5BB82E4C8E0B3EADCFDBC44BA6E4 -- C:\WINDOWS\system32\dllcache\ctfmon.exe

 

< MD5 for: DISK.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys

[2008/04/13 11:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

 

< MD5 for: EVENTLOG.DLL >

[2008/04/13 19:33:26 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\dllcache\eventlog.dll

[2008/04/13 19:33:26 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll

 

< MD5 for: EXPLORER.EXE >

[2008/04/13 19:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\explorer.exe

[2008/04/13 19:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\system32\dllcache\explorer.exe

 

< MD5 for: IASTOR.SYS >

[2008/08/20 10:05:47 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\WINDOWS\NLDRV\009\iastor.sys

[2008/08/20 10:16:44 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\WINDOWS\NLDRV\019\iastor.sys

[2008/08/20 10:19:10 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\WINDOWS\NLDRV\029\iastor.sys

 

< MD5 for: NDIS.SYS >

[2008/04/13 12:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\dllcache\ndis.sys

[2008/04/13 12:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys

 

< MD5 for: NETLOGON.DLL >

[2008/04/13 19:33:36 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\dllcache\netlogon.dll

[2008/04/13 19:33:36 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll

 

< MD5 for: NVATABUS.SYS >

[2008/08/20 10:05:57 | 000,098,432 | ---- | M] (NVIDIA Corporation) MD5=11D1AD7E946538E02F9EF6A6E1792061 -- C:\WINDOWS\NLDRV\010\nvatabus.sys

[2008/08/20 10:16:54 | 000,098,432 | ---- | M] (NVIDIA Corporation) MD5=11D1AD7E946538E02F9EF6A6E1792061 -- C:\WINDOWS\NLDRV\020\nvatabus.sys

[2008/08/20 10:19:20 | 000,098,432 | ---- | M] (NVIDIA Corporation) MD5=11D1AD7E946538E02F9EF6A6E1792061 -- C:\WINDOWS\NLDRV\030\nvatabus.sys

 

< MD5 for: RASACD.SYS >

[2001/08/28 16:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\dllcache\rasacd.sys

[2001/08/28 16:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\drivers\rasacd.sys

 

< MD5 for: RDPCLIP.EXE >

[2008/04/13 19:34:20 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=B46EF6930DDE7393FB4BD0150BCC786C -- C:\WINDOWS\system32\dllcache\rdpclip.exe

[2008/04/13 19:34:20 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=B46EF6930DDE7393FB4BD0150BCC786C -- C:\WINDOWS\system32\rdpclip.exe

 

< MD5 for: RDPWD.SYS >

[2012/01/09 18:19:13 | 000,139,784 | ---- | M] (Microsoft Corporation) MD5=2D293B720C206473A05950CE007DB12A -- C:\WINDOWS\$hf_mig$\KB2621440\SP3QFE\rdpwd.sys

[2011/06/24 16:09:15 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=3348E61A78BA4F79C795AAD6565D3B6F -- C:\WINDOWS\$hf_mig$\KB2570222\SP3QFE\rdpwd.sys

[2012/01/09 18:20:23 | 000,139,784 | ---- | M] (Microsoft Corporation) MD5=5B3055DAA788BD688594D2F5981F2A83 -- C:\WINDOWS\system32\dllcache\rdpwd.sys

[2012/01/09 18:20:23 | 000,139,784 | ---- | M] (Microsoft Corporation) MD5=5B3055DAA788BD688594D2F5981F2A83 -- C:\WINDOWS\system32\drivers\rdpwd.sys

 

< MD5 for: SCECLI.DLL >

[2008/04/13 19:33:42 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\dllcache\scecli.dll

[2008/04/13 19:33:42 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll

 

< MD5 for: SFLOPPY.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Sfloppy.sys

[2008/04/13 11:40:50 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\system32\drivers\sfloppy.sys

 

< MD5 for: SPLITTER.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:splitter.sys

[2008/04/13 11:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\system32\dllcache\splitter.sys

[2008/04/13 11:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\system32\drivers\splitter.sys

 

< MD5 for: SWMIDI.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:swmidi.sys

[2008/04/13 11:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\system32\dllcache\swmidi.sys

[2008/04/13 11:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\system32\drivers\swmidi.sys

 

< MD5 for: TCPIP.SYS >

[2008/06/20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys

[2008/06/20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys

[2008/06/20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys

[2008/06/20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

 

< MD5 for: TDPIPE.SYS >

[2008/04/13 19:34:54 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\system32\dllcache\tdpipe.sys

[2008/04/13 19:34:54 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\system32\drivers\tdpipe.sys

 

< MD5 for: TDTCP.SYS >

[2008/04/13 19:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\system32\dllcache\tdtcp.sys

[2008/04/13 19:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\system32\drivers\tdtcp.sys

 

< MD5 for: USBPRINT.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbprint.sys

[2008/04/13 11:47:38 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A717C8721046828520C9EDF31288FC00 -- C:\WINDOWS\system32\dllcache\usbprint.sys

[2008/04/13 11:47:38 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A717C8721046828520C9EDF31288FC00 -- C:\WINDOWS\system32\drivers\usbprint.sys

 

< MD5 for: USBSCAN.SYS >

[2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbscan.sys

[2008/04/13 11:45:36 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\system32\dllcache\usbscan.sys

[2008/04/13 11:45:36 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\system32\drivers\usbscan.sys

 

< MD5 for: USERINIT.EXE >

[2008/04/13 19:34:28 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\system32\dllcache\userinit.exe

[2008/04/13 19:34:28 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\system32\userinit.exe

 

< MD5 for: VOLSNAP.SYS >

[2008/04/13 18:56:06 | 000,053,376 | ---- | M] (Microsoft Corporation) MD5=46DE1126684369BACE4849E4FC8C43CA -- C:\WINDOWS\system32\dllcache\volsnap.sys

[2008/04/13 18:56:06 | 000,053,376 | ---- | M] (Microsoft Corporation) MD5=46DE1126684369BACE4849E4FC8C43CA -- C:\WINDOWS\system32\drivers\volsnap.sys

 

< MD5 for: WINLOGON.EXE >

[2008/04/13 19:34:30 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2008/04/13 19:34:30 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\system32\winlogon.exe

 

< MD5 for: WSCNTFY.EXE >

[2008/04/13 19:34:30 | 000,013,824 | ---- | M] (Microsoft Corporation) MD5=02DA31AB433A6C1110A736C85701DECA -- C:\WINDOWS\system32\dllcache\wscntfy.exe

[2008/04/13 19:34:30 | 000,013,824 | ---- | M] (Microsoft Corporation) MD5=02DA31AB433A6C1110A736C85701DECA -- C:\WINDOWS\system32\wscntfy.exe

 

< %systemroot%\*. /mp /s >

 

< %systemroot%\system32\*.dll /lockedfiles >

[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 

< %systemroot%\Tasks\*.job /lockedfiles >

 

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========

[C:\WINDOWS\$NtUninstallKB12939$] -> Error: Cannot create file handle -> Unknown point type

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:24051EFF

 

< End of report >

-------------------------------------

 

 

ET EXTRAS.TXT

 

 

-------------------------------------

OTL Extras logfile created on: 24/04/2012 11:51:17 - Run 1

OTL by OldTimer - Version 3.2.41.0 Folder = C:\Documents and Settings\numelec\Bureau

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

 

2,99 Gb Total Physical Memory | 2,19 Gb Available Physical Memory | 73,12% Memory free

4,83 Gb Paging File | 4,07 Gb Available in Paging File | 84,23% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 698,63 Gb Total Space | 644,69 Gb Free Space | 92,28% Space Free | Partition Type: NTFS

Unable to calculate disk information.

Drive W: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive X: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive Y: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive Z: | 1372,38 Gb Total Space | 420,41 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

 

Computer Name: SONATA | User Name: numelec | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"5985:TCP" = 5985:TCP:*:Disabled:Gestion à distance de Windows

"80:TCP" = 80:TCP:*:Disabled:Gestion à distance de Windows - Mode de compatibilité (HTTP-Entrée)

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Synology\Assistant\DSAssistant.exe" = C:\Program Files\Synology\Assistant\DSAssistant.exe:*:Enabled:DSAssistant -- ()

"C:\Program Files\TeamViewer\Version7\TeamViewer.exe" = C:\Program Files\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)

"C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe" = C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)

"C:\Documents and Settings\numelec\Application Data\Spotify\spotify.exe" = C:\Documents and Settings\numelec\Application Data\Spotify\spotify.exe:*:Enabled:Spotify

"C:\Documents and Settings\numelec\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\numelec\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin -- (Skype Limited)

"C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe" = C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe:*:Enabled:SweetPacksUpdateManager -- (SweetIM Technologies Ltd.)

 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0965F857-DAAD-4F93-8054-0E2EC3C8C5B0}" = SweetIM for Messenger 3.6

"{0BD83598-C2EF-3343-847B-7D2E84599128}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA

"{0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E}" = Microsoft .NET Framework 4 Client Profile FRA Language Pack

"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java 6 Update 21

"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}" = DAEMON Tools

"{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5B58EF61-85F2-4977-97A5-84C19F926579}" = SweetPacks Toolbar for Internet Explorer 4.5

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{72AD53CC-CCC0-3757-8480-9EE176866A7C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA

"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{9011040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{AAF80000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 8.0 Professional Edition

"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch

"{AC76BA86-1033-F400-7760-000000000004}_920" = Adobe Acrobat 9.2.0 - CPSID_50026

"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch

"{AC76BA86-7AD7-1036-7B44-A94000000001}" = Adobe Reader 9.4.1 - Français

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D2F3B366-830E-4371-9130-A8D6BE751363}" = CapturePerfect 3.0

"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX

"{F0CD13AB-2094-45D3-938D-9DA3DC9FE69C}" = Nitro PDF Professional

"{F1000000-0001-0000-0000-074957833700}" = ABBYY FineReader 10 Professional Edition

"{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Arachnophilia 5.4_is1" = Arachnophilia 5.4

"avast!" = avast! Antivirus

"Bulk Rename Utility_is1" = Bulk Rename Utility 2.7.1.2

"Canon LBP5050" = Canon LBP5050

"CCleaner" = CCleaner (remove only)

"ClearImage 7 PDK" = ClearImage 7 PDK

"CopernicDesktopSearch2" = Copernic Desktop Search - Professional

"DR-6080/7580/9080C Driver" = Canon DR-6080/7580/9080C Driver

"File Recover_is1" = File Recover 8.0

"FileZilla Client" = FileZilla Client 3.5.2

"ie8" = Windows Internet Explorer 8

"Marvell Miniport Driver" = Marvell Miniport Driver

"MaxBulk Mailer_is1" = MaxBulk Mailer 8.3.7

"McAfee Security Scan" = McAfee Security Scan Plus

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 Language Pack SP1 - fra" = Module linguistique Microsoft .NET Framework 3.5 SP1- fra

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile FRA Language Pack" = Module linguistique Microsoft .NET Framework 4 Client Profile FRA

"Mozilla Firefox 11.0 (x86 fr)" = Mozilla Firefox 11.0 (x86 fr)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NoIPDUC" = No-IP DUC

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"NVIDIA Drivers" = NVIDIA Drivers

"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager

"Oloneo PhotoEngine" = Oloneo PhotoEngine

"Picasa 3" = Picasa 3

"Recovery Toolbox for PDF_is1" = Recovery Toolbox for PDF 1.1

"SilverStream JRunner" = SilverStream JRunner

"SyncBack_is1" = SyncBack

"Synology Assistant" = Synology Assistant (remove only)

"TeamViewer 7" = TeamViewer 7

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Lecteur Windows Media 11

"WinRAR archiver" = Logiciel d'archivage WinRAR

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

"ZHPDiag_is1" = ZHPDiag 1.30

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"5db7d2994f64dec1" = Numelex PdfCuttingTable

"8c916c411752ae2e" = Numelex search and replace

"8cfef47c5fe7719b" = Numelex ScanCleaner

"Smart Fortress 2012" = Smart Fortress 2012

 

========== Last 10 Event Log Errors ==========

 

[ Antivirus Events ]

Error - 06/07/2010 08:17:38 | Computer Name = SONATA | Source = avast! | ID = 33554522

Description = Scan of "H:\" area failed with 00000003 error (function avfilesScanReal

failed).

 

Error - 09/02/2011 15:25:37 | Computer Name = SONATA | Source = avast! | ID = 33554522

Description = AAVM - scanning error: Aavm: FetchGlobalCounters cannot open mapping

- server DOWN???, 00000002.

 

[ Application Events ]

Error - 24/11/2011 04:44:59 | Computer Name = SONATA | Source = PerfNet | ID = 2004

Description = Impossible d'ouvrir le Service serveur. Les données de performance

du serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD

0.

 

Error - 24/11/2011 07:38:36 | Computer Name = SONATA | Source = PerfNet | ID = 2004

Description = Impossible d'ouvrir le Service serveur. Les données de performance

du serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD

0.

 

Error - 24/11/2011 09:19:21 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée EXCEL.EXE, version 11.0.8341.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 24/11/2011 09:21:07 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée EXCEL.EXE, version 11.0.8341.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 27/11/2011 06:45:10 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée iexplore.exe, version 8.0.6001.18702, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 07:10:34 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée Acrobat.exe, version 9.0.0.332, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 12:08:05 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:14:44 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:24:36 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:29:56 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

[ Application Events ]

Error - 24/11/2011 04:44:59 | Computer Name = SONATA | Source = PerfNet | ID = 2004

Description = Impossible d'ouvrir le Service serveur. Les données de performance

du serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD

0.

 

Error - 24/11/2011 07:38:36 | Computer Name = SONATA | Source = PerfNet | ID = 2004

Description = Impossible d'ouvrir le Service serveur. Les données de performance

du serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD

0.

 

Error - 24/11/2011 09:19:21 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée EXCEL.EXE, version 11.0.8341.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 24/11/2011 09:21:07 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée EXCEL.EXE, version 11.0.8341.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 27/11/2011 06:45:10 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée iexplore.exe, version 8.0.6001.18702, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 07:10:34 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée Acrobat.exe, version 9.0.0.332, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 12:08:05 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:14:44 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:24:36 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:29:56 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

[ Application Events ]

Error - 24/11/2011 04:44:59 | Computer Name = SONATA | Source = PerfNet | ID = 2004

Description = Impossible d'ouvrir le Service serveur. Les données de performance

du serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD

0.

 

Error - 24/11/2011 07:38:36 | Computer Name = SONATA | Source = PerfNet | ID = 2004

Description = Impossible d'ouvrir le Service serveur. Les données de performance

du serveur ne seront pas renvoyées. Le code d'erreur renvoyé est la donnée DWORD

0.

 

Error - 24/11/2011 09:19:21 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée EXCEL.EXE, version 11.0.8341.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 24/11/2011 09:21:07 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée EXCEL.EXE, version 11.0.8341.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 27/11/2011 06:45:10 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée iexplore.exe, version 8.0.6001.18702, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 07:10:34 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée Acrobat.exe, version 9.0.0.332, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 12:08:05 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:14:44 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:24:36 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

Error - 29/11/2011 13:29:56 | Computer Name = SONATA | Source = Application Hang | ID = 1002

Description = Application bloquée WINWORD.EXE, version 11.0.8328.0, module bloqué

hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

 

[ System Events ]

Error - 13/04/2012 13:27:33 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service TeamViewer 6 s'est terminé de manière inattendue. Ceci

s'est produit 2 fois. L'action corrective suivante va être effectuée dans 60000

millisecondes : Redémarrer le service.

 

Error - 13/04/2012 13:28:53 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service Windows Search s'est terminé de manière inattendue. Ceci

s'est produit 1 fois. L'action corrective suivante va être effectuée dans 30000

millisecondes : Redémarrer le service.

 

Error - 13/04/2012 13:32:06 | Computer Name = SONATA | Source = Service Control Manager | ID = 7024

Description = Le service Windows Search s'est arrêté avec l'erreur service particulière

2147749155 (0x80040D23).

 

Error - 16/04/2012 09:43:07 | Computer Name = SONATA | Source = ipnathlp | ID = 31008

Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de

résolution de noms à partir du registre. La donnée est le code de l'erreur.

 

Error - 16/04/2012 09:44:24 | Computer Name = SONATA | Source = ipnathlp | ID = 31008

Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de

résolution de noms à partir du registre. La donnée est le code de l'erreur.

 

Error - 16/04/2012 09:44:27 | Computer Name = SONATA | Source = ipnathlp | ID = 31008

Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de

résolution de noms à partir du registre. La donnée est le code de l'erreur.

 

Error - 16/04/2012 11:46:35 | Computer Name = SONATA | Source = Service Control Manager | ID = 7034

Description = Le service Spouleur d'impression s'est terminé de façon inattendue

pour la 1ème fois.

 

Error - 24/04/2012 04:49:26 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service Windows Search s'est terminé de manière inattendue. Ceci

s'est produit 1 fois. L'action corrective suivante va être effectuée dans 30000

millisecondes : Redémarrer le service.

 

Error - 24/04/2012 04:50:10 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service Windows Search s'est terminé de manière inattendue. Ceci

s'est produit 2 fois. L'action corrective suivante va être effectuée dans 30000

millisecondes : Redémarrer le service.

 

Error - 24/04/2012 04:50:55 | Computer Name = SONATA | Source = Service Control Manager | ID = 7034

Description = Le service Windows Search s'est terminé de façon inattendue pour la

3ème fois.

 

[ System Events ]

Error - 13/04/2012 13:27:33 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service TeamViewer 6 s'est terminé de manière inattendue. Ceci

s'est produit 2 fois. L'action corrective suivante va être effectuée dans 60000

millisecondes : Redémarrer le service.

 

Error - 13/04/2012 13:28:53 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service Windows Search s'est terminé de manière inattendue. Ceci

s'est produit 1 fois. L'action corrective suivante va être effectuée dans 30000

millisecondes : Redémarrer le service.

 

Error - 13/04/2012 13:32:06 | Computer Name = SONATA | Source = Service Control Manager | ID = 7024

Description = Le service Windows Search s'est arrêté avec l'erreur service particulière

2147749155 (0x80040D23).

 

Error - 16/04/2012 09:43:07 | Computer Name = SONATA | Source = ipnathlp | ID = 31008

Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de

résolution de noms à partir du registre. La donnée est le code de l'erreur.

 

Error - 16/04/2012 09:44:24 | Computer Name = SONATA | Source = ipnathlp | ID = 31008

Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de

résolution de noms à partir du registre. La donnée est le code de l'erreur.

 

Error - 16/04/2012 09:44:27 | Computer Name = SONATA | Source = ipnathlp | ID = 31008

Description = L'agent proxy DNS n'a pas pu lire la liste locale des serveurs de

résolution de noms à partir du registre. La donnée est le code de l'erreur.

 

Error - 16/04/2012 11:46:35 | Computer Name = SONATA | Source = Service Control Manager | ID = 7034

Description = Le service Spouleur d'impression s'est terminé de façon inattendue

pour la 1ème fois.

 

Error - 24/04/2012 04:49:26 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service Windows Search s'est terminé de manière inattendue. Ceci

s'est produit 1 fois. L'action corrective suivante va être effectuée dans 30000

millisecondes : Redémarrer le service.

 

Error - 24/04/2012 04:50:10 | Computer Name = SONATA | Source = Service Control Manager | ID = 7031

Description = Le service Windows Search s'est terminé de manière inattendue. Ceci

s'est produit 2 fois. L'action corrective suivante va être effectuée dans 30000

millisecondes : Redémarrer le service.

 

Error - 24/04/2012 04:50:55 | Computer Name = SONATA | Source = Service Control Manager | ID = 7034

Description = Le service Windows Search s'est terminé de façon inattendue pour la

3ème fois.

 

 

< End of report >

---------------------------------------

 

 

Dans l'attente de te lire

Merci

Dadoo

[bernard53]

ok fait ceci.

 

* Fait un double-clic sur l'icône d'OTL pour le lancer

/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

 

* Assure-toi d'avoir fermé toutes les applications en court de fonctionnement.

 

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case " Rapport minimal" soit cochée.

 

* Copies et colles le contenue de cette citation dans la partie inférieure d'OTL "Personnalisation"

:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim....E-1CAFF770EFAC}

IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}

IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = Server Error

IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)

IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = Server Error

FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"

O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O4 - HKLM..\Run: [] File not found

O8 - Extra context menu item: Rechercher sur le Web - C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()

[2012/04/16 11:42:05 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM

[2012/04/16 11:42:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SweetIM

[2012/04/24 11:11:01 | 000,001,006 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-725345543-1993962763-1801674531-1003UA.job

[2012/04/24 11:11:00 | 000,000,984 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-725345543-1993962763-1801674531-1003Core.job

:Commands

* Cliques sur l'icône Correction (en haut à gauche) .

* Laisse le scan aller à son terme sans te servir du PC

* A la fin du scan un rapport s'ouvrir "OTL.log"

* Copie et colle le ou les rapports dans ta réponse stp...

* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

Mets le rapport ici car il prend bien de la place.

Cliquez ici.

ou la

Accueil de Cjoint.com

 

Puis:

 

 

Télécharge ComboFix <ICI>>

 

Pour les Utilisateurs de VISTA et SEVEN: Clic-droit et choisis "Exécuter en tant qu'administrateur".

Pour VISTA et SEVEN: pas d'installation de la console de récupération.

 

>> Lors de son exécution, ComboFix va vérifier si la Console de récupération Microsoft Windows est installée.

 

Avec des infections comme celles d'aujourd'hui, il est fortement conseillé de l'avoir préinstallée sur votre PC avant toute suppression de nuisibles.

Elle permettra de démarrer dans un mode spécial, de récupération (réparation), qui nous permet de vous aider plus facilement si jamais votre ordinateur rencontre un problème après une tentative de nettoyage.

 

Suis les invites pour permettre à ComboFix de télécharger et installer la Console de récupération Microsoft Windows, et lorsque cela est demandé, accepte le Contrat de Licence Utilisateur Final pour l'installer.

>> Une fois sur ton bureau double clique dessus pour le lancer.

Note importante : Si la Console de récupération Microsoft Windows est déjà installée, ComboFix continuera ses procédures de suppression de nuisibles.

 

Lorsque le scan sera complet, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

 

>>Ne pas cliquer dans la fenêtre de Combofix durant l’analyse, ceci provoquerait le gel du programme

[DadooNum]

Bernard,

 

Ci joint les rapport OTL (Correction) et ComboFix.

 

A noter que j'ai dû redémarrer le PC suite au scan Combofix. Au préalable, j'avais sauvargardé le rapport Combofix en plus de celui contenu sur C:\

Au démarrage, j'ai à chaque fois le message "C:\WINDOWS\deamon.dll error".

 

Merci

Dadoo

 

 

========== OTL ==========

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ deleted successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.

Prefs.js: "SweetIM Search" removed from browser.search.defaultenginename

Prefs.js: "" removed from browser.search.defaulturl

Prefs.js: "SweetIM Search" removed from browser.search.selectedEngine

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ deleted successfully.

File C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.

File C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Rechercher sur le Web\ deleted successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\orange folder moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\green folder moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\blue folder moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\resources folder moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\Microsoft.VC90.CRT folder moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf folder moved successfully.

C:\Program Files\SweetIM\Toolbars\Internet Explorer folder moved successfully.

C:\Program Files\SweetIM\Toolbars folder moved successfully.

C:\Program Files\SweetIM\Messenger\resources\sqlite folder moved successfully.

C:\Program Files\SweetIM\Messenger\resources\images folder moved successfully.

C:\Program Files\SweetIM\Messenger\resources folder moved successfully.

C:\Program Files\SweetIM\Messenger folder moved successfully.

C:\Program Files\SweetIM\Communicator\resources\sqlite folder moved successfully.

C:\Program Files\SweetIM\Communicator\resources folder moved successfully.

C:\Program Files\SweetIM\Communicator\Microsoft.VC90.CRT folder moved successfully.

C:\Program Files\SweetIM\Communicator folder moved successfully.

C:\Program Files\SweetIM folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer\cache folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\update folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\logs folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\packages\FailDialog folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\packages folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\Bars\Default\400 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\Bars\Default\200 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\Bars\Default\100 folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\Bars\Default folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\Bars folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Communicator\Logs folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Communicator\conf folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM\Communicator folder moved successfully.

C:\Documents and Settings\All Users\Application Data\SweetIM folder moved successfully.

C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-725345543-1993962763-1801674531-1003UA.job moved successfully.

C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-725345543-1993962763-1801674531-1003Core.job moved successfully.

========== COMMANDS ==========

 

OTL by OldTimer - Version 3.2.41.0 log created on 04242012_144713

 

 

 

ComboFix 12-04-24.01 - numelec 24/04/2012 15:06:18.1.8 - x86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3063.2487 [GMT 2:00]

Lancé depuis: c:\documents and settings\numelec\Bureau\ComboFix.exe

AV: avast! antivirus 4.7.1001 [VPS 120424-0] *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\numelec\Application Data\Mozilla\Firefox\Profiles\wf2jc75x.default\weave\toFetch

C:\setup.exe

c:\windows\$NtUninstallKB12939$

c:\windows\$NtUninstallKB12939$\776074327

c:\windows\daemon.dll

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\SET14C.tmp

c:\windows\system32\SET16A.tmp

c:\windows\system32\SET16B.tmp

c:\windows\system32\SET174.tmp

c:\windows\system32\SET178.tmp

c:\windows\system32\urttemp

c:\windows\system32\urttemp\fusion.dll

c:\windows\system32\urttemp\mscoree.dll

c:\windows\system32\urttemp\mscoree.dll.local

c:\windows\system32\urttemp\mscorsn.dll

c:\windows\system32\urttemp\mscorwks.dll

c:\windows\system32\urttemp\msvcr71.dll

c:\windows\system32\urttemp\regtlib.exe

.

.

((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_.netbt

.

.

((((((((((((((((((((((((((((( Fichiers créés du 2012-03-24 au 2012-04-24 ))))))))))))))))))))))))))))))))))))

.

.

2012-04-24 12:47 . 2012-04-24 12:47 -------- d-----w- C:\_OTL

2012-04-24 09:52 . 2012-04-24 09:52 512 ----a-w- C:\PhysicalMBR.bin

2012-04-23 10:13 . 2012-04-23 10:13 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2012-04-23 10:11 . 2003-06-18 15:31 16384 ----a-w- c:\windows\system32\MSPGIMME.DLL

2012-04-23 10:11 . 2003-06-18 15:31 443904 ----a-w- c:\windows\system32\MDIVWCTL.DLL

2012-04-23 10:11 . 2003-06-18 15:31 1033216 ----a-w- c:\windows\system32\MSPCORE.DLL

2012-04-23 10:11 . 2002-08-12 12:56 1706800 ----a-w- c:\windows\system32\GDIPLUS.DLL

2012-04-19 13:02 . 2012-04-19 13:02 -------- d-----w- c:\documents and settings\numelec\modelio

2012-04-16 15:46 . 2012-04-16 15:46 -------- d-----w- C:\spoolerlogs

2012-04-16 15:41 . 2012-04-16 15:41 -------- d-----w- c:\documents and settings\numelec\Local Settings\Application Data\canon.jp

2012-04-16 13:12 . 2012-04-16 13:12 512 ----a-w- C:\PhysicalDisk0_MBR.bin

2012-04-16 13:06 . 2012-04-24 09:07 -------- d-----w- C:\ZHP

2012-04-16 13:06 . 2012-04-24 09:07 -------- d-----w- c:\program files\ZHPDiag

2012-04-13 17:23 . 2012-04-16 11:55 -------- d-----w- c:\documents and settings\All Users\Application Data\99058D590010B14700015A98D151FC4E

2012-04-13 12:48 . 2012-04-13 12:48 -------- d-----w- c:\documents and settings\numelec\Application Data\Maxprog

2012-04-13 12:47 . 2012-04-13 12:48 -------- d-----w- c:\program files\MaxBulk Mailer

2012-04-10 07:45 . 2012-04-10 07:45 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll

2012-04-10 07:45 . 2012-04-10 07:45 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll

.

.

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-22 19:12 . 2012-03-22 19:12 4435968 ----a-w- c:\windows\system32\GPhotos.scr

2012-03-01 11:00 . 2008-04-13 17:33 916992 ----a-w- c:\windows\system32\wininet.dll

2012-03-01 11:00 . 2008-04-13 17:34 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-03-01 11:00 . 2008-04-13 17:33 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-02-29 14:10 . 2008-04-13 17:33 177664 ----a-w- c:\windows\system32\wintrust.dll

2012-02-29 14:10 . 2008-04-13 17:33 148480 ----a-w- c:\windows\system32\imagehlp.dll

2012-02-29 12:17 . 2008-04-13 17:00 385024 ----a-w- c:\windows\system32\html.iec

2012-02-16 19:16 . 2011-07-14 10:08 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-03 09:58 . 2008-04-13 16:58 1860224 ----a-w- c:\windows\system32\win32k.sys

2012-04-10 07:45 . 2012-02-03 10:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-08-20 . 33578A738C564B4F84D906EFD91025E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Copernic Desktop Search - Professional"="c:\program files\Copernic Desktop Search - Pro\DesktopSearchService.exe" [2011-11-22 1798104]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-05-14 248552]

"CNAP2 Launcher"="c:\windows\System32\spool\DRIVERS\W32X86\3\CNAP2LAK.EXE" [2007-09-05 406944]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]

"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]

"RemoteControl"="c:\windows\system32\rmctrl.exe" [2001-11-09 32768]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^McAfee Security Scan Plus.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\McAfee Security Scan Plus.lnk

backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Search.lnk]

path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2009-10-02 22:32 640376 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]

2009-10-03 03:08 38768 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-03 07:37 843712 ----a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CANON DR6080_7580_9080C SVC]

2005-02-15 11:48 61440 ----a-w- c:\windows\system32\DR9KSVC.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]

2011-11-24 10:06 137536 ----atw- c:\documents and settings\numelec\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2010-04-03 17:23 13670504 ----a-w- c:\windows\system32\nvcpl.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]

2008-07-17 11:10 888832 ----a-w- c:\program files\Analog Devices\SoundMAX\SMax4.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

2008-04-14 20:41 1040384 ----a-r- c:\program files\Analog Devices\Core\smax4pnp.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Synology\\Assistant\\DSAssistant.exe"=

"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=

"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=

"c:\\Documents and Settings\\numelec\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=

"c:\\WINDOWS\\system32\\msiexec.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Gestion à distance de Windows

.

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [22/06/2010 20:43 155136]

R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [22/06/2010 20:43 5248]

R2 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files\Fichiers communs\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [22/07/2010 18:07 814344]

R2 InliteLM;InliteLM Service;c:\progra~1\CLEARI~1\COM\INLITE~1.EXE [08/12/2011 20:14 709672]

R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [21/03/2011 12:55 196928]

R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [20/10/2010 18:41 67904]

R2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [02/12/2011 11:37 2923392]

R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]

S3 CLPCIID;CLPCIID;c:\program files\CyberLink\PowerDVD\clpciid.sys [22/06/2010 20:35 24772]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14:49 227232]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [13/04/2008 19:34 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

Contenu du dossier 'Tâches planifiées'

.

2012-04-24 c:\windows\Tasks\SyncBack AGORA POOL - ETAPE 1-2.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-24 c:\windows\Tasks\SyncBack AGORA STOCKAGE - ETAPE 2-2.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack COPERNIC INDEX SONATA.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-24 c:\windows\Tasks\SyncBack JOAN.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2011-02-10 c:\windows\Tasks\SyncBack Luxia - PRODUCTION sur MD.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2011-02-10 c:\windows\Tasks\SyncBack Luxia - PRODUCTION sur PC1.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2011-02-10 c:\windows\Tasks\SyncBack Luxia - PRODUCTION sur PC2.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2011-02-10 c:\windows\Tasks\SyncBack Luxia - PRODUCTION sur SONATA.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack Migration DD sur Production-Lexbase.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack Migration Modeles sur Sonata.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack MODELES SAUVEGARDE PCAN.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack MODELES SAUVEGARDE SONATA.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack SONATA LOCAL DEC svg.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack SVG_PC5_DECOUPAGE.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-23 c:\windows\Tasks\SyncBack SVG_SONATA_DECOUPAGE.job

- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2010-10-27 10:00]

.

2012-04-24 c:\windows\Tasks\User_Feed_Synchronization-{40D3A964-4E61-4ABF-86DA-8531D879AE23}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.fr/

mStart Page =

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Ajouter à un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir au format Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.254

FF - ProfilePath - c:\documents and settings\numelec\Application Data\Mozilla\Firefox\Profiles\wf2jc75x.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.search.selectedEngine -

FF - prefs.js: browser.startup.homepage - www.google.com

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHELINS SUPPRIMES - - - -

.

HKLM-Run-nwiz - nwiz.exe

MSConfigStartUp-99058D590010B14700015A98D151FC4E - c:\documents and settings\All Users\Application Data\99058D590010B14700015A98D151FC4E\99058D590010B14700015A98D151FC4E.exe

MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe

MSConfigStartUp-Sweetpacks Communicator - c:\program files\SweetIM\Communicator\SweetPacksUpdateManager.exe

AddRemove-Smart Fortress 2012 - c:\documents and settings\All Users\Application Data\99058D590010B14700015A98D151FC4E\99058D590010B14700015A98D151FC4E.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-04-24 15:18

Windows 5.1.2600 Service Pack 3 NTFS

.

Recherche de processus cachés ...

.

Recherche d'éléments en démarrage automatique cachés ...

.

Recherche de fichiers cachés ...

.

Scan terminé avec succès

Fichiers cachés: 0

.

**************************************************************************

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]

"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs chargées dans les processus actifs ---------------------

.

- - - - - - - > 'explorer.exe'(3188)

c:\program files\Copernic Desktop Search - Pro\DeskbandContainer_Win32.dll

c:\program files\Copernic Desktop Search - Pro\SearchPlatform-s.dll

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Autres processus actifs ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\WgaTray.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\SearchIndexer.exe

c:\program files\TeamViewer\Version7\TeamViewer.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\program files\TeamViewer\Version7\tv_w32.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\System32\spool\DRIVERS\W32X86\3\CNAP2RPK.EXE

c:\windows\System32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE

c:\windows\System32\spool\DRIVERS\W32X86\3\CNAC8SWK.EXE

.

**************************************************************************

.

Heure de fin: 2012-04-24 15:21:42 - La machine a redémarré

ComboFix-quarantined-files.txt 2012-04-24 13:21

.

Avant-CF: 692 220 493 824 octets libres

Après-CF: 694 860 095 488 octets libres

.

- - End Of File - - BE79DB8374511DBE09549495FAAC0007

[bernard53]

ok pour les rapports

 

Au démarrage, j'ai à chaque fois le message "C:\WINDOWS\deamon.dll error"

démarrer << exécuter << tapes msconfig puis onglet démarrage. Décoches tout ce qui concerne "deamon" puis redémarre le pc.

 

 

Après dis moi comment va ton pc s.t.p

[DadooNum]

Super !!! Merci Beaucoup Bernard !

 

Concernant le PC j'ai quelques questions/remarques :

1 - Au démarrage,je n'ai plus le message d'erreur. Il m'indique que je dois Sélectionner "Demarrage Normal" dans MSCONFIG (suis actuellement en "Demarrage Sélectif") : j'imagine que je dois bien le faire ??

 

2 - Un petit souci de connexion aux favoris reseaux et le reseau en général : je n'ai plus accès aux autres domaines réseaux (type MSGROUP, WORKGROUP) autre que celui du PC en question.

 

3 - Que s'est il finalement passé au niveau du/des virus ? J'avais zeroaccess et Smart fortress ? J'ai également vu des commandes (dans tes citations) concernant sweetIM : c'était un virus ??

 

4 - De manière générale que préconise tu comme anti-virus (fiable, stable et pas trop gourmant en ressources ...???)

 

5 - Je souhaite démarrer un autre sujet concernant d'autres problemes de virus sur mon portable. Afin de faciliter la recherche des helpers, préconise tu de mettre les rapports suivant au lancement du sujet :

a- RogueKiller - rapport de scan

b- RogueKiller - rapport de suppression

c- ZHPDiag ou OTL : Les 2 premiers rapports générés avec tes 1eres commandes citées dans "Personnalisation"

 

Encore Merci

Dadou

[bernard53]

1-Non reste comme tu es mais valide la case pour ne plus avoir cette demande. tu as cela suite au passage de msconfig.

 

 

2 -redémarre le pc et revérifies si le Pare feu n'est pas en cause

 

3-"sweetIM " est surtout du genre casse pied quand au autres ils sont plus tenaces et Combofix as tout remis d'aplomb.

 

4-Garde AVAST qui est bien et garde ceci en plus.

Installe Malewarebytes' Antimalware,

 

Malwarebytes : Malwarebytes Anti-Malware PRO removes malware including viruses, spyware, worms and trojans, plus it protects your computer

 

Prends bien la version FREE

*** Met-le à jour puis choisi, Fait juste un scan rapide

 

*** Si une infection est trouvée, coche la case a coté et valides avec l’Onglet Supprimer la sélection

 

Poste le rapport final.

 

5-ok pour ouvrir un autre rapport pour ton portable.

En premier MalwaresBytes et si toujours soucis.

 

 

Télécharges << ZHPDiag>> (de Nicolas Coolman)

 

dezzipes le fichier sur ton bureau...

Fais un clic-droit sur l'icône ZHPDiag .exe et choisis "exécuter en tant qu'administrateur".

 

 

L'installation va créer raccourcis (ZHPDiag et ZHPFix et MBRchek) sur ton bureau

 

 

 

A la fin de l'installation ZHPDiag va se lancer....

 

Cliques sur l'icône "Options" (image du tournevis) et coches toutes les options.

Cliques sur "Lancer le diagnostique" (image de la loupe) et patiente...

 

A la fin du scan cliques sur l'icône "sauvegarder le fichier sous" (image de la disquette bleu) et enregistre le rapport sur ton bureau.

 

Mets le rapport ici car il prend bien de la place.

Cliquez ici.

ou la

Accueil de Cjoint.com

 

Pour ce post que tu considères comme résolu fait ceci.

Fait ceci pour supprimer les logiciels qui ont servis à cette désinfection.

 

Télécharge << DELFIX >> de Xplode pour supprimer les logiciels qui ont servis a cette désinfection.

 

 

Lance-le.

 

* A l'invite, [suppression] ()

 

* Un rapport va s'ouvrir à la fin, colle le dans la réponse

 

Ensuite pour le désinstaller ; tu relances et tu passes à l'option [Désinstallation]

 

Puis:Maintenant on va mettre la restauration du système propre.

 

Cliquez avec le bouton droit sur l'icône Poste de travail, puis cliquez sur Propriétés

ou touche "Windows+Pause"

Cliquez sur l'onglet Restauration du système

 

Sélectionnez Désactiver la Restauration du système sur tous les lecteurs.

 

Cliquez sur Appliquer puis OUI dans la fenêtre suivante.

 

Attendre quelques instants puis :

 

activer la restauration du système de nouveau. en décochant la case que vous venez de cocher puis valider par Appliquer et OK

 

Maintenant on crée un nouveau point de restauration.

 

Démarrer—Exécuter—ou touche "Windows+R" et tapes:

%SystemRoot%\System32\restore\rstrui.exe

 

Puis coche " Créer un point de restauration" que tu nommes PC- Clean. Valide.

 

Vous pouvez maintenant fermer toutes les fenêtres.

 

ET pour valider ton post en résolu.

http://forum.zebulon.fr/comment-afficher-son-sujet-comme-resolu-t180253.html

 

Bonne soirée