antivirus software alert [Résolu]

kirill · le 06 Mai 2010 13:24

j ai un virus qui me demande d utiliser un faux antivirus , je me suis mis en mode sans echec , car en mode normal , toutes mes actions sont bloquees , quelqu un pourrait il me guider dans mes demarches de desinfection ,
merci d avance pour votre aide

EinsteinZero · le 06 Mai 2010 16:41

Salut,
en attendant que les spécialiste des virus interviennent plusieurs petites choses

1> Système utilisé sur le PC (version de windows)

2> Deux petites choses:

---> Scan ton PC avec Malwarebyte's Antimalware >>ici<< (en mode sans échec si tu peux) supprime les malwares trouvés et poste son rapport (copier coller)

il y a de forte chance que MBAM ait la peau des parasites qui t'ennuient

Important: met à jours la base de virus avant de passer en mode sans échec

---> Poste un rapport hijackThis >>ici avec mode d'emploi<< !!!! ne fait pas l'analyse en mode sans échec!!!

kirill · le 06 Mai 2010 18:11

salut einstein , j ai lance un malware rapide en mode sans echec et un complet en mode normal , ça va mieux mais il faut l hijack pour en etre sur c est ça ?
_____________________________________________________________________________________________________
Internet Explorer 8.0.6001.18702

06/05/2010 15:09:12
mbam-log-2010-05-06 (15-09-12).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 121127
Temps écoulé: 6 minute(s), 39 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xhghrvgl (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xhghrvgl (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\c\Local Settings\Application Data\gmfmccraq\xmcouxatssd.exe (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.
C:\Documents and Settings\c\Local Settings\temp\iVao.exe (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.
C:\Documents and Settings\c\Local Settings\Temporary Internet Files\Content.IE5\RJQBTX3T\n002102304801r000cJ11000601Rc7d63596Wfcf04c2aX9fa98d66Yd44b94a5Z03009f350[1] (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.
_______________________________________________________________________________________________________

2eme mamb

Version de la base de données: 4071

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

06/05/2010 17:02:41
mbam-log-2010-05-06 (17-02-41).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|)
Elément(s) analysé(s): 228197
Temps écoulé: 1 heure(s), 17 minute(s), 39 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{0FA806AB-1FAE-4E2E-9CDC-59606ADBCEB2}\RP508\A0061006.exe (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.

jeanmimigab · le 06 Mai 2010 18:18

hello vous deux :wink:

oui, poste un rapport Hijackthis :wink:

kirill · le 06 Mai 2010 18:26

salut jeanmimigab et merci de votre aide

Code: Tout sélectionner: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:22:45, on 06/05/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Fichiers communs\Portrait Displays\Shared\DTSRVC.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\DeltaIITray.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Philips Display\SmartControl II\DTHtml.exe C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\RocketDock\RocketDock.exe C:\Program Files\SuperCopier2\SuperCopier2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\Fichiers communs\Portrait Displays\Shared\HookManager.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\Documents and Settings\christophe amouroux\Bureau\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Ziepod One-Click IE Helper - {57A30D1E-08B9-4EF4-B273-AAEA1C234A5B} - C:\WINDOWS\system32\ZiepodOneClicker.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\DeltaIITray.exe O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\WINDOWS\system32\DeltaIITray.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [DT PHL] C:\Program Files\Philips Display\SmartControl II\DTHtml.exe -startup_folder O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: adsl TV.LNK = C:\Program Files\adslTV\adsltv.exe O4 - Startup: HDDlife.lnk = C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1233327597531 O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Fichiers communs\Portrait Displays\Shared\DTSRVC.exe O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 8536 bytes

jeanmimigab · le 06 Mai 2010 20:52

hello,

Heureusement que tu as posté le rapport, il y a un proxy infectieux d'installé :-?

relance hijacthis en choisissant "do a system scan only" ,sélectionne les lignes indiquées dans la citation ci-dessous en cliquant sur la case à gauche de chaque lignes et clic sur "fix checked"

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555

ensuite...

o Dans Firefox Menu "outils" > "options".
o Cliques sur en haut à droite sur "Avancé" > "onglet "réseau" > à la rubrique "connexions",cliques sur paramètres.
o Vérifie que "pas de proxy" soit bien cochée.
o Fermes les fenêtre en cliquant sur "OK".

ensuite...

o Ouvres Internet Explorer,cliques sur le menu "Outils" > "Options Internet".
o A l'onglet "Connexions" > cliques en bas à droite sur "paramètres réseaux".
o Si la case "utiliser un serveur proxi pour votre réseau local" est cochée,décoches la...
o Quittes les fenêtre par "OK" et "Appliquer".

ensuite dit moi si tu arrives a te connecter à Windows Update car cette infection est connue pour empècher les mises à jours de windows

:wink:

kirill · le 06 Mai 2010 21:25

c est fait , tout etait coche , parcontre pour ie , j ai decoche le serveur proxy , et je n ais plus rien de coche (sur ton screen il y avait :utiliser un script de configuration .... de coche ) c est normal

jeanmimigab · le 06 Mai 2010 21:53

re,

ne fait pas attention à mon screen pour le script :wink:

Hijackthis ne montre pas la totalité de ce genre d'infection en général, un dernier petit contrôle stp...

* Télécharge >> OTL <<sur ton bureau.

* Fait un double-clic sur l'icône d'OTL pour le lancer

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "rapport minimal " soit cochée.

* Coches les case situées devant "Tous les utilisateurs", " Recherche LOP" et "Recherche Purity".

* Copier et colle le contenue de cette citation dans la partie inférieure d'OTL "personnalisation"

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
RASACD.SYS
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

* Cliques sur l'icône "Analyse" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).
* Copie et colle le ou les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

:wink:

kirill · le 07 Mai 2010 17:15

desole pour le retard voici mon rapport

Code: Tout sélectionner: OTL logfile created on: 06/05/2010 23:13:06 - Run 3 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\christophe amouroux\Mes documents\Téléchargements Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 1 007,00 Mb Total Physical Memory | 628,00 Mb Available Physical Memory | 62,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 82,00% Paging File free Paging file location(s): C:\pagefile.sys 1512 3024 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 76,32 Gb Total Space | 12,61 Gb Free Space | 16,52% Space Free | Partition Type: NTFS Drive D: | 465,76 Gb Total Space | 218,96 Gb Free Space | 47,01% Space Free | Partition Type: NTFS Drive E: | 1,17 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Drive F: | 465,75 Gb Total Space | 307,53 Gb Free Space | 66,03% Space Free | Partition Type: NTFS G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MOA-03F9YO4OWGJ Current User Name: christophe amouroux Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - C:\Documents and Settings\christophe amouroux\Mes documents\Téléchargements\OTL.exe (OldTimer Tools) PRC - C:\Program Files\a-squared Free\a2service.exe (Emsi Software GmbH) PRC - C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe () PRC - C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\DeltaIITray.exe () PRC - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA) PRC - C:\Program Files\RocketDock\RocketDock.exe () PRC - C:\Program Files\Philips Display\SmartControl II\dthtml.exe (Portrait Displays, Inc) PRC - C:\Program Files\Fichiers communs\Portrait Displays\Shared\DTSRVC.exe () PRC - C:\Program Files\Fichiers communs\Portrait Displays\Shared\HookManager.exe (Portrait Displays Inc.) PRC - C:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM) PRC - C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd) PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP) [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - C:\Documents and Settings\christophe amouroux\Mes documents\Téléchargements\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\nview.dll () MOD - C:\WINDOWS\system32\nvwrsfr.dll (NVIDIA Corporation) MOD - C:\WINDOWS\system32\nvwddi.dll (NVIDIA Corporation) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) MOD - C:\Program Files\RocketDock\RocketDock.dll () MOD - C:\Program Files\SuperCopier2\SC2Hook.dll (SFX TEAM) [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - (gusvc) -- File not found SRV - (a2free) -- C:\Program Files\a-squared Free\a2service.exe (Emsi Software GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (maconfservice) -- C:\Program Files\ma-config.com\maconfservice.exe (CybelSoft) SRV - (NMSAccessU) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe () SRV - (nTuneService) -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe (NVIDIA) SRV - (DTSRVC) -- C:\Program Files\Fichiers communs\Portrait Displays\Shared\DTSRVC.exe () [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (driverhardwarev2) -- C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys (CybelSoft) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (timounter) -- C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis) DRV - (tifsfilter) -- C:\WINDOWS\system32\drivers\tifsfilt.sys (Acronis) DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation) DRV - (nvgts) -- C:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation) DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation) DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation) DRV - (usbaudio) Pilote USB audio (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (DELTAII) Service for M-Audio Delta Driver (WDM) -- C:\WINDOWS\system32\drivers\deltaII.sys (Avid Technology, Inc.) DRV - (TPkd) -- C:\WINDOWS\system32\drivers\TPkd.sys (PACE Anti-Piracy, Inc.) DRV - (NVR0Dev) -- C:\WINDOWS\nvoclock.sys (NVidia Corp.) DRV - (UsbDiag) -- C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.) DRV - (USBModem) -- C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.) DRV - (usbbus) -- C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.) DRV - (pdiddcci) -- C:\WINDOWS\system32\drivers\pdiddcci.sys (Portrait Displays, Inc.) DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices) DRV - (PdiPorts) -- C:\WINDOWS\system32\drivers\PdiPorts.sys (Portrait Displays, Inc.) DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices) DRV - (ADIHdAudAddService) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.) DRV - (SenFiltService) -- C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura) DRV - (P17) -- C:\WINDOWS\system32\drivers\P17.sys (Creative Technology Ltd.) DRV - (ossrv) -- C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.) DRV - (ctsfm2k) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd) DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider) DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys () DRV - (rtl8139) Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://fr.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr IE - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B6 A2 FE 67 59 ED CA 01 [binary data] IE - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Bing" FF - prefs.js..browser.search.defaultthis.engineName: "Web Search" FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.google.fr/webhp?hl=fr&safe=off&client=firefox-a&rls=org.mozilla:fr:official&hs=ekH&btnG=Rechercher" FF - prefs.js..extensions.enabledItems: {47624dda-b77e-4feb-820a-e4f077d5d4ca}:9.9.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3 FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {bb628310-0ab7-11db-9cd8-0800200c9a66}:3.5.0.0 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3 FF - prefs.js..extensions.enabledItems: travian-bot@uw.hu:2.1.0.215 FF - prefs.js..extensions.enabledItems: {a02c0c70-605c-11da-8cd6-0800200c9a66}:4.22 FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/02 08:38:33 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/02 08:38:32 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/03/22 02:08:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2008/12/21 16:10:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Extensions [2010/05/06 18:09:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions [2010/03/26 15:53:12 | 000,000,000 | ---D | M] (Screengrab) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2010/04/29 08:18:00 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010/03/12 09:17:51 | 000,000,000 | ---D | M] (Boost for Facebook) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{47624dda-b77e-4feb-820a-e4f077d5d4ca} [2010/01/29 09:20:27 | 000,000,000 | ---D | M] (PimpZilla) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{a02c0c70-605c-11da-8cd6-0800200c9a66} [2010/04/20 00:49:14 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2009/04/05 23:59:29 | 000,000,000 | ---D | M] (Bookmark Duplicate Detector) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{ba243cb0-b824-4a26-9418-73ee795d9b9d} [2009/03/20 22:39:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66} [2010/04/09 19:05:47 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2010/02/01 03:44:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\extensions\travian-bot@uw.hu [2009/11/12 22:23:59 | 000,002,171 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Application Data\Mozilla\Firefox\Profiles\avnzrt03.default\searchplugins\bing.xml [2010/05/06 18:09:16 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009/06/24 14:31:33 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml [2009/06/24 14:31:33 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml [2009/06/24 14:31:33 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml [2009/06/24 14:31:33 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml [2009/06/24 14:31:33 | 000,000,652 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml O1 HOSTS File: ([2009/12/30 00:21:59 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Ziepod One-Click Helper) - {57A30D1E-08B9-4EF4-B273-AAEA1C234A5B} - C:\WINDOWS\system32\ZiepodOneClicker.dll (Ziepod) O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd) O4 - HKLM..\Run: [DeltaIITaskbarApp] C:\WINDOWS\system32\DeltaIITray.exe () O4 - HKLM..\Run: [DT PHL] C:\Program Files\Philips Display\SmartControl II\DTHtml.exe (Portrait Displays, Inc) O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP) O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) O4 - HKLM..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\system32\DeltaIITray.exe () O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.DLL () O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004..\Run: [NVIDIA nTune] C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe (NVIDIA) O4 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe () O4 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM) O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\christophe amouroux\Menu Démarrer\Programmes\Démarrage\adsl TV.LNK = C:\Program Files\adslTV\adsltv.exe File not found O4 - Startup: C:\Documents and Settings\christophe amouroux\Menu Démarrer\Programmes\Démarrage\HDDlife.lnk = C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 43 01 00 00 [binary data] O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 43 01 00 00 [binary data] O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = O7 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-1801674531-1078081533-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.) O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.) O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1233327597531 (MUCatalogWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab (Creative Software AutoUpdate Support Package) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Ma page d'accueil) - About:Home O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/12/21 01:47:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{87e0558a-5765-11df-bdcc-0015f25ce474}\Shell - "" = AutoRun O33 - MountPoints2\{87e0558a-5765-11df-bdcc-0015f25ce474}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/12/21 01:46:51 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010/05/06 22:17:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\christophe amouroux\Bureau\backups [2010/05/06 19:21:41 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\christophe amouroux\Bureau\HijackThis.exe [2010/05/06 14:58:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/05/06 14:58:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/05/06 03:23:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\christophe amouroux\Local Settings\Application Data\gmfmccraq [2010/05/05 19:19:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\christophe amouroux\Bureau\MOBICLIC [2002/04/11 09:41:06 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010/05/06 23:09:54 | 000,001,029 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\Raccourci vers OTL.lnk [2010/05/06 22:59:00 | 000,001,080 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010/05/06 17:16:56 | 000,192,857 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010/05/06 17:16:43 | 000,001,076 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010/05/06 17:05:03 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/05/06 17:04:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/05/06 17:03:18 | 014,680,064 | -H-- | M] () -- C:\Documents and Settings\christophe amouroux\NTUSER.DAT [2010/05/06 17:03:18 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\christophe amouroux\ntuser.ini [2010/05/06 14:58:42 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk [2010/05/06 09:28:31 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/05/06 03:36:17 | 002,640,622 | -H-- | M] () -- C:\Documents and Settings\christophe amouroux\Local Settings\Application Data\IconCache.db [2010/05/06 03:34:03 | 000,033,792 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/05/05 22:38:59 | 000,026,221 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\mont.jpg [2010/05/05 20:22:36 | 000,030,423 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\tableaux.jpg [2010/05/05 20:12:22 | 000,075,230 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\tytus.jpg [2010/05/05 12:09:24 | 000,012,640 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/05/04 16:22:35 | 000,025,628 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\01_Boeuf_et_Tête_de_Veau.jpg [2010/05/04 15:46:15 | 000,046,103 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\jacques_chirac_reference.jpg [2010/05/04 15:46:15 | 000,003,654 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\.recently-used.xbel [2010/05/04 13:50:15 | 000,035,281 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\picoli.jpg [2010/05/04 12:12:25 | 000,037,839 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\tete de veau.jpg [2010/05/02 21:31:17 | 000,053,912 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\bien essaye.jpg [2010/05/02 12:58:38 | 000,221,168 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\Birkenstock all over the world by Baumhouse GmbH_1272797916559.png [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/04/28 10:52:23 | 000,532,794 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat [2010/04/28 10:52:23 | 000,440,820 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/04/28 10:52:23 | 000,094,078 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat [2010/04/28 10:52:23 | 000,071,138 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/04/28 10:52:22 | 001,153,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/04/28 02:42:47 | 000,003,674 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\lettrage.rtf [2010/04/27 16:50:30 | 000,047,318 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\jdf.jpg [2010/04/26 18:14:17 | 000,123,074 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\9999_render_Render_Chaos_elu.jpg [2010/04/26 18:13:47 | 000,993,278 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\9999_render_Render_Chaos_elu.png [2010/04/24 16:53:05 | 000,054,537 | ---- | M] () -- C:\Documents and Settings\christophe amouroux\Bureau\la_cite_de_la_peur_une_comedie_familiale_1993_reference.jpg [2010/04/21 02:03:20 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Google Earth.lnk [2010/04/20 03:04:04 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010/05/06 23:09:54 | 000,001,029 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\Raccourci vers OTL.lnk [2010/05/06 14:58:42 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk [2010/05/05 22:38:58 | 000,026,221 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\mont.jpg [2010/05/05 20:22:33 | 000,030,423 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\tableaux.jpg [2010/05/05 20:12:20 | 000,075,230 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\tytus.jpg [2010/05/04 16:22:32 | 000,025,628 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\01_Boeuf_et_Tête_de_Veau.jpg [2010/05/04 15:46:15 | 000,003,654 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\.recently-used.xbel [2010/05/04 15:42:09 | 000,046,103 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\jacques_chirac_reference.jpg [2010/05/04 13:50:14 | 000,035,281 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\picoli.jpg [2010/05/02 21:31:16 | 000,053,912 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\bien essaye.jpg [2010/05/02 12:58:38 | 000,221,168 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\Birkenstock all over the world by Baumhouse GmbH_1272797916559.png [2010/04/27 16:50:29 | 000,047,318 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\jdf.jpg [2010/04/26 18:14:17 | 000,123,074 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\9999_render_Render_Chaos_elu.jpg [2010/04/24 16:53:04 | 000,054,537 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\la_cite_de_la_peur_une_comedie_familiale_1993_reference.jpg [2010/04/21 02:03:20 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Google Earth.lnk [2010/04/08 14:09:37 | 000,037,839 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\tete de veau.jpg [2010/04/07 15:34:41 | 000,003,674 | ---- | C] () -- C:\Documents and Settings\christophe amouroux\Bureau\lettrage.rtf [2009/11/13 10:20:43 | 001,970,176 | ---- | C] () -- C:\WINDOWS\System32\d3dx9.dll [2009/08/31 22:23:30 | 000,000,116 | ---- | C] () -- C:\WINDOWS\ConverterCore.INI [2009/08/18 13:35:28 | 000,004,458 | ---- | C] () -- C:\WINDOWS\System32\EXTIGY.INI [2009/05/19 23:02:57 | 000,001,305 | ---- | C] () -- C:\WINDOWS\CDPlayer.ini [2009/05/10 00:54:02 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\qtmlClient.dll [2009/04/08 13:27:28 | 000,000,253 | ---- | C] () -- C:\WINDOWS\sbwin.ini [2009/04/08 13:07:31 | 000,064,512 | ---- | C] () -- C:\WINDOWS\System32\P17.DLL [2009/03/20 21:06:24 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI [2009/03/08 16:37:54 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2009/01/28 20:50:44 | 000,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009/01/28 20:50:44 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009/01/28 20:50:44 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009/01/14 17:02:58 | 000,004,082 | ---- | C] () -- C:\WINDOWS\Q-Dir.ini [2008/12/21 23:26:50 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008/12/21 23:26:50 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2008/12/21 19:45:54 | 000,020,905 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008/12/21 19:45:48 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008/12/21 17:25:07 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2008/05/26 23:23:32 | 000,016,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2008/05/26 23:23:30 | 000,021,596 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2008/05/26 23:23:28 | 000,016,036 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007/03/12 13:01:30 | 000,217,088 | ---- | C] () -- C:\WINDOWS\NVGfxOgl.dll [2005/10/10 15:49:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005/10/10 15:49:00 | 001,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005/10/10 15:49:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005/10/10 15:49:00 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2005/10/10 15:49:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005/10/10 15:49:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2005/07/07 11:26:56 | 000,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini [2005/03/08 08:17:08 | 000,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2003/10/02 18:48:18 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll [1996/04/03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys [color=#E56717]========== LOP Check ==========[/color] [2009/05/09 13:08:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ableton [2009/03/17 18:01:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems [2009/03/21 22:22:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis [2008/12/21 21:37:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations [2009/03/20 22:43:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ma-config.com [2009/02/05 00:39:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Maxtor [2009/07/18 11:56:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MediaMonkey [2009/05/10 01:35:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy [2010/01/03 02:29:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Screentime [2009/02/05 10:48:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2009/05/09 13:10:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Ableton [2009/03/17 18:01:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\ACD Systems [2009/05/13 03:19:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\AIMP [2009/03/10 00:43:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Axialis [2009/02/05 10:24:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\BinarySense [2008/12/21 22:42:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Canneverbe_Limited [2009/05/10 01:36:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Digidesign [2009/10/28 12:12:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\DisplayTune [2009/03/23 09:48:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Filmotech_prefs [2010/04/23 00:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\foobar2000 [2009/03/23 02:20:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\GlarySoft [2010/01/03 23:34:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\GNU Solfege [2010/05/04 15:46:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\gtk-2.0 [2009/08/18 13:51:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\InterTrust [2009/03/14 12:37:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\KeePass [2009/05/13 21:30:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\LG Electronics [2009/02/25 00:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Mp3tag [2008/12/23 16:47:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\OpenOffice.org [2009/05/10 01:35:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\PACE Anti-Piracy [2009/01/17 14:07:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Q-Dir [2009/04/21 22:28:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Smart Recorder [2009/09/02 16:00:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\SolidDocuments [2008/12/23 12:23:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Thunderbird [2010/05/06 23:10:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\uTorrent [2009/01/10 15:59:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Windows Desktop Search [2009/01/10 16:14:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\christophe amouroux\Application Data\Windows Search [2009/03/21 22:24:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Acronis [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< >[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [2001/05/24 13:59:30 | 000,162,304 | ---- | M] () -- C:\UNWISE.EXE [color=#A23BEC]< MD5 for: AGP440.SYS >[/color] [2008/04/13 20:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\Documents and Settings\christophe amouroux\Mes documents\xp sp3\CD_WINXP\I386\sp3.cab:AGP440.sys [2004/08/19 17:20:54 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008/12/23 13:06:43 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2004/08/19 17:20:54 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys [2008/12/23 13:06:43 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/04/13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys [2008/04/13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color] [2008/04/13 20:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\Documents and Settings\christophe amouroux\Mes documents\xp sp3\CD_WINXP\I386\sp3.cab:atapi.sys [2004/08/19 17:20:54 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008/12/23 13:06:43 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2004/08/19 17:20:54 | 018,782,711 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys [2008/12/23 13:06:43 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys [2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys [2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys [2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys [2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [color=#A23BEC]< MD5 for: EVENTLOG.DLL >[/color] [2004/08/19 17:09:26 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=49B1376885340BF9EA0D99F71557B59A -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll [2008/04/14 04:33:24 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\ERDNT\cache\eventlog.dll [2008/04/14 04:33:24 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/14 04:33:24 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color] [2008/04/14 04:33:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\ERDNT\cache\netlogon.dll [2008/04/14 04:33:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/14 04:33:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll [2004/08/19 17:09:38 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D4CFAC76926C24E32B7F25A35C31BC6E -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll [color=#A23BEC]< MD5 for: NVGTS.SYS >[/color] [2008/08/18 19:54:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=37954CD1D0AFC11BECD149F7C3EC88C2 -- C:\NVIDIA\nForceWin2k\15.24\IS\IDE\WinXP\sataraid\nvgts.sys [2008/08/18 19:54:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=EA98BFE4931BD13D747D647C1859796E -- C:\NVIDIA\nForceWin2k\15.24\IS\IDE\WinXP\sata_ide\nvgts.sys [2008/08/18 19:54:00 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=EA98BFE4931BD13D747D647C1859796E -- C:\WINDOWS\system32\drivers\nvgts.sys [color=#A23BEC]< MD5 for: NVRD32.SYS >[/color] [2008/08/18 19:54:00 | 000,133,152 | ---- | M] (NVIDIA Corporation) MD5=BEF704AA9E17D176A46DDF77C6A52194 -- C:\NVIDIA\nForceWin2k\15.24\IS\IDE\WinXP\sataraid\nvrd32.sys [color=#A23BEC]< MD5 for: RASACD.SYS >[/color] [2001/08/28 14:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\dllcache\rasacd.sys [2001/08/28 14:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\drivers\rasacd.sys [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color] [2004/08/19 17:09:40 | 000,186,368 | ---- | M] (Microsoft Corporation) MD5=58D439F6EF73A2D9288B204E819F4BBD -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [2008/04/14 04:33:40 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\ERDNT\cache\scecli.dll [2008/04/14 04:33:40 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/14 04:33:40 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color] [3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color] < End of report >

jeanmimigab · le 08 Mai 2010 00:55

hello,

rien de méchant...

supprime juste ce dossier --
C:\Documents and Settings\christophe amouroux\Local Settings\Application Data\gmfmccraq << celui là en rouge

ensuite supprime HijackThis et OTL.exe :wink:

bon weekend

kirill · le 08 Mai 2010 01:33

ok merci encore jeanmimigab pour tout ce que tu donnes

jeanmimigab · le 08 Mai 2010 08:55

Pas de soucis, mais n'oublions pas EinsteinZero qui a bien avancé le boulot :wink:

Bon weekend
Si un GM passe par là [résolu]

kirill · le 08 Mai 2010 13:51

oui bien sur grand merci aussi a EinsteinZero
bon we
ps: j arrive pas a trouver comment on indique que c est resolu ?? :cry:

jeanmimigab · le 08 Mai 2010 18:26

t'inquiète pas pour ça, un modérateur va s'en occuper :wink:

Skynet · le 08 Mai 2010 18:34

C'est fait

.

antivirus software alert [Résolu]

antivirus software alert [Résolu]

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Re: antivirus software alert

Sujets similaires

Qui est en ligne