Il y a actuellement 642 visiteurs
Dimanche 22 Décembre 2024
accueilactualitésdossierscomparer les prixtélécharger gratuitement vos logicielsoffres d'emploiforum informatique
Connexion
Créer un compte

Security tool : Help svp !

Un ordinateur qui ralentit, des écrans publicitaires qui apparaissent, des applications qui refusent de démarrer ou encore votre navigateur qui s'obstine à ouvrir une page douteuse sont autant d'éléments qui indiquent que l'intégrité de votre ordinateur est menacée par un virus. Vous trouverez dans ce forum quelques conseils et logiciels pour surfer tranquillement.
Règles du forum
Pour afficher un rapport d'analyse ou un rapport d'infection (HijackThis, OTL, AdwCleaner etc...)‎, veuillez utiliser le système de fichiers joints interne au forum. Seuls les formats les .txt et .log de moins de 1Mo sont acceptés. Pour obtenir de l'aide pour insérer vos fichiers joints, veuillez consulter ce tutoriel

Security tool : Help svp !

Message le 18 Oct 2010 19:26

Bonjour,

J'ai "contracté" le virus Security Tool et mon pc est donc infecté ! Je suis très embêtée, je ne suis pas une experte en informatique et cela me fait peur ! Je peux me connecter à internet (heureusement) mais ce virus bloque certaines fonctionnalités de mon pc :-(
J'ai fait quelques recherches et j'ai essayé : malwarebytes, mais pas de résultats ou alors j'ai mal fait ! Et aussi combofix, mais celui-ci me demande de désactiver mon antivirus et je ne peux pas y accéder à cause de Security Tool.

J'ai vu qu'un utilisateur avait réussi à s'en débarasser ! Je l'envie !!!
Pouvez-vous m'aider svp ? Merci !

EDIT :

Rebonsoir,

Je poste un second message car j'avais pensé à la restauration de système pour revenir à une date antérieure et ainsi supprimer Security Tool mais celui-ci bloquait la restauration.
J'ai lu qu'on pouvait le faire en mode sans échec et c'est donc ce que j'ai fait ! La restauration s'est bien déroulée, et je n'ose crier victoire trop vite !!
Si cela est effectif, j'en serais très contente et on pourrait mettre "résolu" à ce post !
Vous avez peut-être une solution pour vérifier ?
Merci à vous

EDIT Skynet : Messages fusionnés.
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 


Re: Security tool : Help svp !

Message le 18 Oct 2010 20:07

hello,

Tu as de la chance que la restauration soit passée, ça aurait pu planter le pc...

pour contrôler si tout va bien fais cela...
* Télécharge >> OTL <<sur ton bureau.

* Fait un double-clic sur l'icône d'OTL pour le lancer

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "rapport minimal " soit cochée.

* Coches les case situées devant "Tous les utilisateurs", " Recherche LOP" et "Recherche Purity".

* Copier et colle le contenue de cette citation dans la partie inférieure d'OTL "personnalisation"

NetSvcs
%systemroot%\system32\drivers\*.sys /lockedfiles
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
userinit.exe
winlogon.exe
tcpip.sys
Sfloppy.sys
Changer.sys
cdrom.sys
disk.sys
ndis.sys
usbscan.sys
usbprint.sys
tdtcp.sys
tdpipe.sys
swmidi.sys
splitter.sys
rdpwd.sys
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
RASACD.SYS
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles


* Cliques sur l'icône "Analyse" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( réduit dans la barre des taches).
* Copie et colle les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Message le 18 Oct 2010 20:28

Bonsoir,

Merci pour votre réponse rapide, je suis en effet contente que la restauration n'ait pas planté mon pc et j'espère que ça va durer !

Voici les rapports suite à l'analyse :

- rapport OLT.txt :

Code: Tout sélectionner
OTL logfile created on: 18/10/2010 21:18:45 - Run 1
OTL by OldTimer - Version 3.2.15.2     Folder = C:\Documents and Settings\Anne\Bureau
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 53,20 Gb Total Space | 10,29 Gb Free Space | 19,33% Space Free | Partition Type: FAT32
Drive D: | 53,69 Gb Total Space | 8,61 Gb Free Space | 16,03% Space Free | Partition Type: FAT32
 
Computer Name: ACER-1F614B65C2 | User Name: Anne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - C:\Documents and Settings\Anne\Bureau\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Documents and Settings\Anne\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\PrintDisp.exe (ActMask Co.,Ltd - http://www.all2pdf.com)
PRC - C:\WINDOWS\system32\PrintCtrl.exe (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM)
PRC - C:\Program Files\TomTom HOME 2\HOMERunner.exe (TomTom)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Logitech\QuickCam10\QuickCam10.exe ()
PRC - C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.)
PRC - C:\Program Files\Fichiers communs\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - c:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe (Logitech Inc.)
PRC - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Incorporated)
 
 
[color=#E56717]========== Modules (SafeList) ==========[/color]
 
MOD - C:\Documents and Settings\Anne\Bureau\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\mfc42.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcInj.dll (Logitech Inc.)
MOD - C:\Acer\Empowering Technology\ePower\SysHook.dll ()
MOD - C:\WINDOWS\system32\mfc42loc.dll (Microsoft Corporation)
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (Apple Mobile Device) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Printer Control) -- C:\WINDOWS\system32\PrintCtrl.exe (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM)
SRV - (maconfservice) -- C:\Program Files\ma-config.com\maconfservice.exe (CybelSoft)
SRV - (odserv) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (LightScribeService) -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (BackWeb Plug-in - 6588780) -- C:\Program Files\AntivirusFirewall\backweb\6588780\Program\ServiceWrapper-6588780.exe (Securitoo Portal)
SRV - (fsbwsys) -- C:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe (F-Secure Corp.)
SRV - (LVSrvLauncher) -- C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (LVPrcSrv) -- c:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (EvtEng) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel(R) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (FSDFWD) -- C:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe (F-Secure Corporation)
SRV - (FSMA) -- C:\Program Files\AntivirusFirewall\Common\FSMA32.EXE (F-Secure Corporation)
SRV - (AWService) -- C:\Acer\Empowering Technology\admServ.exe (Avocent Inc.)
SRV - (F-Secure Gatekeeper Handler Starter) -- C:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
SRV - (FTRTSVC) -- C:\WINDOWS\system32\FTRTSVC.exe (France Telecom)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - (ZDCndis5) -- C:\WINDOWS\System32\ZDCndis5.SYS File not found
DRV - (PCAMPR5) -- C:\WINDOWS\System32\PCAMPR5.SYS File not found
DRV - (akkqvxw) -- C:\WINDOWS\System32\drivers\akkqvxw.sys ()
DRV - (driverhardwarev2) -- C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys (CybelSoft)
DRV - (USB_RNDIS) -- C:\WINDOWS\system32\drivers\usb8023.sys (Microsoft Corporation)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (F-Secure Gatekeeper) -- C:\Program Files\AntivirusFirewall\Anti-Virus\win2k\fsgk.sys ()
DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (lvmvdrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Logitech Inc.)
DRV - (LVcKap) -- C:\WINDOWS\system32\drivers\Lvckap.sys ()
DRV - (lv321av) Logitech USB PC Camera (VC0321) -- C:\WINDOWS\system32\drivers\lv321av.sys (Logitech Inc.)
DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (LVPrcMon) -- C:\WINDOWS\system32\drivers\LVPrcMon.sys ()
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech)
DRV - (ESMCR) -- C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (ESDCR) -- C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) -- C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (w39n51) Intel(R) -- C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (EpmShd) -- C:\WINDOWS\system32\drivers\epm-shd.sys (Acer Value Labs, USA)
DRV - (EpmPsd) -- C:\WINDOWS\system32\drivers\epm-psd.sys (Acer Value Labs, USA)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (FSFW) -- C:\WINDOWS\System32\drivers\fsdfw.sys (F-Secure Corporation)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)
DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (OsaFsLoc) -- C:\WINDOWS\system32\drivers\OsaFsLoc.sys (OSA Technologies)
DRV - (NdisFilt) -- C:\WINDOWS\system32\drivers\NdisFilt.sys (OSA Technologies)
DRV - (ZDPNDIS5) -- C:\WINDOWS\system32\ZDPNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (SG760_XP) -- C:\WINDOWS\system32\drivers\WlanUZXP.sys (ZyDAS Technology Corporation)
DRV - (osaio) -- C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (NETMNT) -- C:\WINDOWS\system32\drivers\NETMNT.sys ()
DRV - (osanbm) -- C:\WINDOWS\system32\drivers\osanbm.sys (Windows (R) 2000 DDK provider)
DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (F-Secure Filter) -- C:\Program Files\AntivirusFirewall\Anti-Virus\win2k\FSfilter.sys ()
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (F-Secure Recognizer) -- C:\Program Files\AntivirusFirewall\Anti-Virus\win2k\FSrec.sys ()
DRV - (PCANDIS5) -- C:\WINDOWS\system32\PCANDIS5.SYS (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (P1110VID) -- C:\WINDOWS\system32\drivers\P1110Vid.sys (Creative Technology Ltd.)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.01net.com/http://www.01men.com/ [binary data]
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://m.fr.yahoo.com/
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://m.fr.yahoo.com/
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Wanadoo\SearchPageURL.dll ()
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.startup.homepage: "http://www.mystart101.com/"
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q="
FF - prefs.js..browser.search.selectedEngine: "MyStart"
 
 
[2008/12/30 15:39:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Mozilla\Extensions
[2008/12/30 15:39:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Mozilla\Extensions\home2@tomtom.com
[2007/12/12 17:07:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\extensions
[2007/12/12 17:07:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2007/12/12 17:07:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\extensions\staged-xpis
[2008/12/18 21:45:26 | 000,001,775 | ---- | M] () -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\live-search.xml
[2009/11/06 20:24:18 | 000,001,649 | ---- | M] () -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\Ask.xml
[2009/12/13 12:43:48 | 000,001,611 | ---- | M] () -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\MyStart.xml
[2007/12/12 17:06:54 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007/12/12 17:07:02 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2007/11/20 16:52:00 | 002,884,992 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll
 
O1 HOSTS File: ([2004/08/10 20:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Programme d'aide de l'Assistant de connexion Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (ST) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (Microsoft Corporation)
O2 - BHO: (MSNToolBandBHO) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\..\Toolbar\WebBrowser: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Incorporated)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam10\QuickCam10.exe ()
O4 - HKLM..\Run: [LVCOMSX] C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe (Logitech Inc.)
O4 - HKLM..\Run: [PrintDisp] C:\WINDOWS\system32\PrintDisp.exe (ActMask Co.,Ltd - http://www.all2pdf.com)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\HOMERunner.exe (TomTom)
O4 - Startup: C:\Documents and Settings\Anne\Menu Démarrer\Programmes\Démarrage\Notification de cadeaux MSN.lnk = C:\Documents and Settings\Anne\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: hx-1 = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 189
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm ()
O9 - Extra 'Tools' menuitem : Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll (F-Secure Corporation)
O9 - Extra 'Tools' menuitem : Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll (F-Secure Corporation)
O9 - Extra Button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Documents and Settings\Anne\Mes documents\Titan Poker\casino.exe File not found
O9 - Extra 'Tools' menuitem : Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Documents and Settings\Anne\Mes documents\Titan Poker\casino.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} http://www.nanoscan.com/as/v1/cabs/ascstubie.cab (TotalScan Installer Class)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} http://fichiers.touslesdrivers.com/maconfig/MaConfig_3_1_2_1.cab (HardwareDetection Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab (Zylom Loader Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (sockspy.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Anne\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Anne\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {1AB09B3F-A6D0-4B55-B87D-264934EBEAED} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {A93A4625-6216-499C-B360-BBD0A7C0D479} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {C5E87A05-F463-4841-B19E-DD3EC3862368} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {EE12D60D-AD9A-4095-B839-3BE6862679FD} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/09/30 12:54:12 | 000,000,075 | -HS- | M] () - D:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{b10012e6-d67c-11dd-94d3-0018de6d718b}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found
O33 - MountPoints2\{d8ee3f82-63e7-11de-9502-0018de6d718b}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe -- File not found
O33 - MountPoints2\{e23ab5bd-ea14-11de-9547-0018de6d718b}\Shell\AutoRun\command - "" = WDSetup.exe
O33 - MountPoints2\{eb57ca37-13f5-11de-94e5-0018de6d718b}\Shell - "" = AutoRun
O33 - MountPoints2\{eb57ca37-13f5-11de-94e5-0018de6d718b}\Shell\AutoRun\command - "" = F:\Une-cle-pour-demarrer.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "S24EventMonitor"
MsConfig - Services: "RegSrvc"
MsConfig - Services: "ose"
MsConfig - Services: "NVSvc"
MsConfig - Services: "LVPrcSrv"
MsConfig - Services: "LightScribeService"
MsConfig - Services: "FTRTSVC"
MsConfig - Services: "FSMA"
MsConfig - Services: "FSDFWD"
MsConfig - Services: "fsbwsys"
MsConfig - Services: "F-Secure Gatekeeper Handler Starter"
MsConfig - Services: "EvtEng"
MsConfig - Services: "BackWeb Plug-in - 6588780"
MsConfig - Services: "AWService"
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Antivirus Firewall.lnk - C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe - (Securitoo Portal)
MsConfig - StartUpFolder: C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe - ( )
MsConfig - StartUpReg: [b]Acer ePower Management[/b] - hkey= - key= - C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe (Acer Value Labs, Taiwan)
MsConfig - StartUpReg: [b]ADMTray.exe[/b] - hkey= - key= - C:\Acer\Empowering Technology\admtray.exe (Avocent Inc.)
MsConfig - StartUpReg: [b]AdVantage[/b] - hkey= - key= - C:\Program Files\AdVantage\AdVantage.exe File not found
MsConfig - StartUpReg: [b]Alcmtr[/b] - hkey= - key= - C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: [b]AzMixerSel[/b] - hkey= - key= - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: [b]BluetoothAuthenticationAgent[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]CanonMyPrinter[/b] - hkey= - key= - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
MsConfig - StartUpReg: [b]CanonSolutionMenu[/b] - hkey= - key= - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
MsConfig - StartUpReg: [b]CTFMON.EXE[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]eDataSecurity Loader[/b] - hkey= - key= - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
MsConfig - StartUpReg: [b]ehTray[/b] - hkey= - key= - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]ePower_DMC[/b] - hkey= - key= - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Incorporated)
MsConfig - StartUpReg: [b]eRecoveryService[/b] - hkey= - key= - C:\Acer\Empowering Technology\eRecovery\Monitor.exe (acer Inc.)
MsConfig - StartUpReg: [b]F-Secure Manager[/b] - hkey= - key= - C:\Program Files\AntivirusFirewall\Common\FSM32.EXE (F-Secure Corporation)
MsConfig - StartUpReg: [b]F-Secure Startup Wizard[/b] - hkey= - key= - C:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE (F-Secure Corporation)
MsConfig - StartUpReg: [b]F-Secure TNB[/b] - hkey= - key= - C:\Program Files\AntivirusFirewall\TNB\TNBUtil.exe (F-Secure Corporation)
MsConfig - StartUpReg: [b]igfxhkcmd[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]igfxpers[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]igfxtray[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]IMJPMIG8.1[/b] - hkey= - key= - C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
MsConfig - StartUpReg: [b]iTunesHelper[/b] - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: [b]KernelFaultCheck[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]LaunchApp[/b] - hkey= - key= - C:\WINDOWS\Alaunch.exe (Acer Inc.)
MsConfig - StartUpReg: [b]LManager[/b] - hkey= - key= - C:\PROGRA~1\LAUNCH~1\LManager.exe File not found
MsConfig - StartUpReg: [b]LogitechCameraAssistant[/b] - hkey= - key= - C:\Program Files\Acer\OrbiCam\CameraAssistant.exe File not found
MsConfig - StartUpReg: [b]LogitechCameraService(E)[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]LogitechVideo[inspector][/b] - hkey= - key= - C:\Program Files\Acer\OrbiCam\InstallHelper.exe File not found
MsConfig - StartUpReg: [b]LVCOMSX[/b] - hkey= - key= - C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe (Logitech Inc.)
MsConfig - StartUpReg: [b]MSMSGS[/b] - hkey= - key= - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]msnmsgr[/b] - hkey= - key= - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe File not found
MsConfig - StartUpReg: [b]MSPY2002[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]News Service[/b] - hkey= - key= - C:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe (F-Secure Corporation)
MsConfig - StartUpReg: [b]ntiMUI[/b] - hkey= - key= - C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe ()
MsConfig - StartUpReg: [b]NvCplDaemon[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]NvMediaCenter[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]nwiz[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]OpwareSE4[/b] - hkey= - key= - C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
MsConfig - StartUpReg: [b]PHIME2002A[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]PHIME2002ASync[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]QuickTime Task[/b] - hkey= - key= - C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
MsConfig - StartUpReg: [b]RTHDCPL[/b] - hkey= - key= - C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: [b]SkyTel[/b] - hkey= - key= - C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: [b]SoundMam[/b] - hkey= - key= -  File not found
MsConfig - StartUpReg: [b]SSBkgdUpdate[/b] - hkey= - key= - C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
MsConfig - StartUpReg: [b]SunJavaUpdateSched[/b] - hkey= - key= - C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: [b]SynTPEnh[/b] - hkey= - key= - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
MsConfig - StartUpReg: [b]TkBellExe[/b] - hkey= - key= - C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: [b]WinampAgent[/b] - hkey= - key= - C:\Program Files\Winamp\Winampa.exe ()
MsConfig - StartUpReg: [b]WOOKIT[/b] - hkey= - key= - C:\Program Files\Wanadoo\Shell.exe ()
MsConfig - StartUpReg: [b]WOOTASKBARICON[/b] - hkey= - key= - C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe File not found
MsConfig - StartUpReg: [b]WOOWATCH[/b] - hkey= - key= - C:\Program Files\Wanadoo\Watch.exe (France Télécom R&D)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 1
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Rendu VML (Vector Graphics Rendering)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe"
ActiveX: {1BC46932-21B2-4130-86E0-B4EB4F7A7A7B} - Microsoft .NET Framework 1.0 Hotfix (KB887998)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Lecteur Windows Media Microsoft 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {29E7D24F-BF30-45E7-8A40-AD27AFD8F5C6} - Microsoft .NET Framework 1.0 Hotfix (KB979904)
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Liaison de données Dynamic HTML pour Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {407408d4-94ed-4d86-ab69-a7f649d112ee} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Création avancée
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {9A394342-4A68-4EBA-85A6-55B559F4E700} - .NET Framework
ActiveX: {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - Microsoft .NET Framework 1.0 Hotfix (KB930494)
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Planificateur de tâches
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E8EA5BD6-D931-4001-ABF6-81BAA500360A} - Microsoft .NET Framework 1.0 Hotfix (KB953295)
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3
ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: >{CB58DED6-4AF3-4080-9DF1-DEE72075169F} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()
 
NetSvcs: 6to4 -  File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2010/10/18 21:17:14 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Anne\Bureau\OTL.exe
[2010/10/18 20:51:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Anne\Recent
[2010/10/18 20:00:24 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW(2)
[2010/10/18 19:20:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Anne\Application Data\SUPERAntiSpyware.com
[2010/10/18 19:20:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/10/18 19:20:31 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/10/18 17:57:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Anne\Application Data\Malwarebytes
[2010/10/18 17:57:28 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/10/18 17:57:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/10/18 12:43:35 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Anne\Recent(2)
[2010/10/17 20:34:12 | 000,000,000 | -HSD | C] -- C:\FOUND.001
[2010/10/15 07:41:49 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/10/15 07:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/10/15 07:39:23 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/10/15 07:38:02 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/10/14 19:04:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/10/14 18:01:54 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/14 18:01:54 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/14 18:01:47 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/10/02 20:07:56 | 000,000,000 | -HSD | C] -- C:\FOUND.000
[2010/10/01 13:01:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Anne\Mes documents\CD Dérives - René Aubry
[2010/10/01 13:00:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Anne\Mes documents\CD Signes - René Aubry
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[7 C:\Documents and Settings\Anne\Mes documents\*.tmp files -> C:\Documents and Settings\Anne\Mes documents\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2010/10/18 21:17:16 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Anne\Bureau\OTL.exe
[2010/10/18 20:54:06 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/10/18 20:53:56 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/10/18 20:53:52 | 2145,505,280 | -HS- | M] () -- C:\hiberfil.sys
[2010/10/18 20:45:54 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2010/10/18 19:14:12 | 000,752,525 | ---- | M] () -- C:\Documents and Settings\Anne\Bureau\Supprimer Security Tool.mht
[2010/10/16 11:37:22 | 000,002,573 | ---- | M] () -- C:\Documents and Settings\Anne\Bureau\Microsoft Office Word 2003.lnk
[2010/10/15 07:42:36 | 000,001,804 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\iTunes.lnk
[2010/10/15 07:39:44 | 000,001,512 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\QuickTime Player.lnk
[2010/10/15 00:00:58 | 000,000,552 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled scanning task.job
[2010/10/14 23:39:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/14 21:49:38 | 000,376,856 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/13 12:49:08 | 000,152,064 | ---- | M] () -- C:\Documents and Settings\Anne\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/27 22:00:58 | 000,080,456 | ---- | M] () -- C:\Documents and Settings\Anne\Bureau\Extrait de  Outils pour le Français CE1.mht
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[7 C:\Documents and Settings\Anne\Mes documents\*.tmp files -> C:\Documents and Settings\Anne\Mes documents\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2010/10/18 20:53:51 | 2145,505,280 | -HS- | C] () -- C:\hiberfil.sys
[2010/10/18 19:14:09 | 000,752,525 | ---- | C] () -- C:\Documents and Settings\Anne\Bureau\Supprimer Security Tool.mht
[2010/10/15 07:42:35 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\iTunes.lnk
[2010/10/15 07:39:42 | 000,001,512 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\QuickTime Player.lnk
[2010/09/27 22:00:56 | 000,080,456 | ---- | C] () -- C:\Documents and Settings\Anne\Bureau\Extrait de  Outils pour le Français CE1.mht
[2010/06/14 19:16:16 | 001,391,616 | ---- | C] () -- C:\WINDOWS\System32\ActPDF.dll
[2010/05/27 16:12:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\akkqvxw.sys
[2010/05/27 16:11:46 | 000,000,012 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\vqdlkr.dat
[2009/09/20 18:34:33 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2009/09/20 18:28:13 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\expat.dll
[2008/06/24 09:40:30 | 000,000,055 | ---- | C] () -- C:\WINDOWS\LOVEGUN.INI
[2008/05/20 18:59:31 | 001,012,736 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2008/05/20 18:59:31 | 000,012,800 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2008/05/17 16:00:24 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2007/12/27 22:24:40 | 000,000,412 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007/12/13 19:06:01 | 000,015,190 | ---- | C] () -- C:\WINDOWS\M2000Twn.ini
[2007/07/27 15:56:48 | 000,000,451 | ---- | C] () -- C:\WINDOWS\System32\eRLog.ini
[2007/07/22 21:19:54 | 000,000,088 | ---- | C] () -- C:\WINDOWS\Kit.ini
[2007/07/22 21:17:25 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll
[2007/07/11 14:00:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll
[2007/06/04 21:39:05 | 000,001,065 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2007/03/04 17:57:37 | 000,152,064 | ---- | C] () -- C:\Documents and Settings\Anne\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/03/03 19:26:45 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/03/03 17:50:55 | 000,000,719 | ---- | C] () -- C:\WINDOWS\System32\InstExec.ini
[2007/03/03 17:47:44 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2007/03/03 17:43:48 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Anne\Local Settings\Application Data\fusioncache.dat
[2007/02/06 17:45:04 | 000,025,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/02/06 17:42:40 | 001,691,808 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys
[2006/08/19 06:41:02 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/08/19 05:32:50 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
[2006/08/19 05:31:18 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
[2006/08/19 05:31:18 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
[2006/08/19 05:31:18 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
[2006/08/19 05:31:18 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
[2006/08/19 04:44:26 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/06/23 10:40:58 | 000,016,768 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPrcMon.sys
[2006/06/19 11:59:24 | 000,042,594 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006/06/16 19:17:32 | 000,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
[2006/06/12 16:11:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/12 16:11:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/06/12 16:11:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/06/12 16:11:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/06/12 16:11:00 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2005/12/27 15:50:26 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\APISlice.dll
[2005/12/27 15:50:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\SC_res.dll
[2005/12/27 15:50:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\EN_res.dll
[2005/12/27 15:50:26 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\TC_res.dll
[2005/12/27 15:50:26 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\MSNChatHook.dll
[2005/12/14 20:59:52 | 000,000,038 | ---- | C] () -- C:\WINDOWS\Acer.ini
[2005/10/31 18:17:38 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2005/10/26 14:59:46 | 000,037,706 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/08/05 15:38:54 | 000,239,104 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/05/02 12:13:42 | 000,009,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\NETMNT.sys
[2005/03/28 15:45:26 | 000,000,081 | ---- | C] () -- C:\WINDOWS\ALaunch.ini
[2005/03/14 14:38:28 | 000,000,469 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2004/12/17 17:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
[2004/08/10 20:00:00 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2004/08/10 20:00:00 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/10 20:00:00 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2004/08/10 20:00:00 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/10 20:00:00 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2004/08/10 20:00:00 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2003/12/29 20:45:08 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ServiceControl.dll
[2003/04/01 10:58:02 | 000,005,260 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/12/26 16:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
[2001/09/03 23:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
[2001/07/30 16:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/23 22:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1999/01/27 13:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2006/08/19 05:40:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Acer
[2006/08/19 05:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acer
[2007/06/04 18:59:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoldWaveCDDB
[2007/10/15 20:29:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\F-Secure
[2007/12/27 22:20:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2007/12/27 22:24:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/03/05 22:13:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zylom
[2008/05/20 18:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Droppix
[2008/05/20 18:59:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/12/30 15:39:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom
[2009/05/06 14:57:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ma-config.com
[2010/03/01 21:33:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/04/05 22:49:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/06/14 19:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Iceni
[2010/06/14 19:15:40 | 000,000,000 | RHSD | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2006/08/19 05:40:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur\Application Data\Acer
[2006/08/19 05:40:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Acer
[2007/03/22 15:15:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\ispnews
[2007/03/22 15:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\F-Secure
[2007/03/22 15:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\PEX
[2007/07/17 13:17:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\DeepBurner
[2007/07/29 17:57:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\BSplayer
[2007/07/29 17:57:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\BSplayer Pro
[2007/09/13 22:34:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\MSNInstaller
[2007/11/08 17:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\LimeWire
[2007/12/27 22:24:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\ScanSoft
[2007/12/27 22:26:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Canon
[2008/05/20 18:59:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Droppix
[2008/12/30 15:39:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\TomTom
[2009/05/18 19:12:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\OpenOffice.org
[2010/06/14 19:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Iceni
[2010/10/15 00:00:58 | 000,000,552 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled scanning task.job
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Custom Scans ==========[/color]
 
 
[color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
 
[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >[/color]
[2006/08/19 04:30:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2006/08/19 05:25:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2006/08/19 05:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acer
[2006/08/19 06:19:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2007/03/03 17:47:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Intel
[2007/04/03 13:20:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CyberLink
[2007/05/03 13:06:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2007/06/04 18:59:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GoldWaveCDDB
[2007/07/28 21:46:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nView_Profiles
[2007/10/15 20:29:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\F-Secure
[2007/12/18 19:32:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2007/12/27 22:20:00 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2007/12/27 22:24:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2007/12/27 22:24:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallShield
[2008/01/31 09:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/03/05 22:13:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zylom
[2008/03/06 12:01:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLInstaller
[2008/05/20 18:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Droppix
[2008/05/20 18:59:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/12/30 15:39:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom
[2009/05/06 14:57:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ma-config.com
[2009/05/06 15:04:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Logitech
[2009/05/06 15:04:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Logishrd
[2009/11/24 21:21:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Real
[2010/01/23 13:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2010/03/01 21:33:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/04/05 22:49:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/06/14 19:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Iceni
[2010/06/14 19:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aspell
[2010/06/14 19:15:40 | 000,000,000 | RHSD | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2010/10/18 17:57:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/10/18 19:20:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
 
[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color]
[2009/02/04 13:56:14 | 000,075,112 | ---- | M] (GEAR Software, Inc.) -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DifXInstall32.exe
[2010/10/15 07:36:46 | 000,073,000 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.1.22\SetupAdmin.exe
[2009/05/11 16:33:52 | 000,056,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Aspell\Dictionaries\Uninstall-AspellDict-en.exe
[2009/05/11 16:33:36 | 000,055,755 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Aspell\Dictionaries\Uninstall-AspellDict-uk.exe
 
[color=#A23BEC]< %APPDATA%\*. >[/color]
[2006/08/19 04:56:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Identities
[2006/08/19 05:40:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Acer
[2006/08/19 04:30:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Anne\Application Data\Microsoft
[2007/03/03 17:51:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Macromedia
[2007/03/04 22:35:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Adobe
[2007/03/06 01:02:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\AdobeUM
[2007/03/22 15:15:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\ispnews
[2007/03/22 15:15:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\F-Secure
[2007/03/22 15:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\PEX
[2007/03/22 19:30:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Help
[2007/04/03 13:20:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\CyberLink
[2007/07/17 13:17:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\DeepBurner
[2007/07/29 17:56:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\vlc
[2007/07/29 17:57:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\BSplayer
[2007/07/29 17:57:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\BSplayer Pro
[2007/09/13 22:34:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\MSNInstaller
[2007/10/26 01:18:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\dvdcss
[2007/11/08 17:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\LimeWire
[2007/12/12 09:45:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Sun
[2007/12/12 17:07:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Mozilla
[2007/12/27 22:24:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\ScanSoft
[2007/12/27 22:26:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Canon
[2008/01/31 09:16:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Apple Computer
[2008/05/20 18:59:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Droppix
[2008/12/30 15:39:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\TomTom
[2009/05/18 19:12:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\OpenOffice.org
[2009/09/21 23:30:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\InstallShield
[2009/11/24 21:21:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Real
[2010/06/14 19:15:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Aspell
[2010/06/14 19:15:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Iceni
[2010/10/18 17:57:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\Malwarebytes
[2010/10/18 19:20:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Anne\Application Data\SUPERAntiSpyware.com
 
[color=#A23BEC]< %APPDATA%\*.exe /s >[/color]
[2009/11/06 19:38:34 | 000,003,584 | R--- | M] () -- C:\Documents and Settings\Anne\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
[2009/05/06 15:05:10 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Anne\Application Data\Microsoft\Installer\{35725FBC-A136-4A46-9F29-091759D9BB93}\ARPPRODUCTICON.exe
[2009/05/06 15:05:26 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Anne\Application Data\Microsoft\Installer\{BEF726DD-4037-4214-8C6A-E625C02D2870}\ARPPRODUCTICON.exe
[2009/05/06 15:05:00 | 000,010,134 | R--- | M] () -- C:\Documents and Settings\Anne\Application Data\Microsoft\Installer\{EA516024-D84D-41F1-814F-83175A6188F2}\ARPPRODUCTICON.exe
[2009/05/13 17:37:58 | 000,000,000 | R--- | M] () -- C:\Documents and Settings\Anne\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
[2009/11/06 19:34:10 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Anne\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
[2009/11/06 19:34:10 | 000,132,672 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Anne\Application Data\Microsoft\Services Windows Live\Raccourci Windows Live Messenger.exe
[2009/11/06 19:34:10 | 000,086,576 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Anne\Application Data\Microsoft\Services Windows Live\Raccourci Galerie de Photos Windows Live.exe
[2010/05/30 22:37:32 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\Anne\Application Data\Real\Update\setup3.10\setup.exe
[2010/03/18 09:20:26 | 010,309,448 | ---- | M] () -- C:\Documents and Settings\Anne\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
[2010/03/18 09:20:28 | 000,149,000 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\Anne\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
[2010/03/18 09:20:50 | 008,405,312 | ---- | M] () -- C:\Documents and Settings\Anne\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
[2010/03/25 18:22:24 | 021,292,528 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\Anne\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold_fr.exe
[2010/03/18 09:19:38 | 000,079,368 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\Anne\Application Data\Real\Update\setup3.10\RUP\vista.exe
 
[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
 
 
[color=#A23BEC]< MD5 for: AGP440.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:AGP440.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
 
[color=#A23BEC]< MD5 for: ATAPI.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:atapi.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/10 20:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/10 20:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys
 
[color=#A23BEC]< MD5 for: CDROM.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:cdrom.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:cdrom.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys
[2008/04/13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys
[2008/04/13 20:40:46 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys
[2004/08/10 20:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys
 
[color=#A23BEC]< MD5 for: CHANGER.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:Changer.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:Changer.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys
[2008/04/13 20:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys
 
[color=#A23BEC]< MD5 for: DISK.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:disk.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:disk.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/10 20:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 20:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 20:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys
 
[color=#A23BEC]< MD5 for: EVENTLOG.DLL  >[/color]
[2004/08/10 20:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=21E83876A6287F15538EF187D286FE11 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2008/04/14 04:33:24 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 04:33:24 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll
 
[color=#A23BEC]< MD5 for: EXPLORER.EXE  >[/color]
[2004/08/10 20:00:00 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=4C33E5B9A6197B6ED215F6CFBA0A2DAA -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007/06/13 15:10:54 | 001,037,312 | ---- | M] (Microsoft Corporation) MD5=B795475444D6D57A572C14B9E1A29839 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 15:22:28 | 001,037,312 | ---- | M] (Microsoft Corporation) MD5=D0288319660EDCFED07C7E74C4EA38A5 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008/04/14 04:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\explorer.exe
[2008/04/14 04:34:04 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
[color=#A23BEC]< MD5 for: NDIS.SYS  >[/color]
[2008/04/13 21:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2008/04/13 21:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
[2004/08/10 20:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys
 
[color=#A23BEC]< MD5 for: NETLOGON.DLL  >[/color]
[2008/04/14 04:33:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 04:33:34 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/10 20:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=FAF07FDCDE76000621A28D19F8E2E8EB -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
[color=#A23BEC]< MD5 for: RASACD.SYS  >[/color]
[2004/08/10 20:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\dllcache\rasacd.sys
[2004/08/10 20:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\drivers\rasacd.sys
 
[color=#A23BEC]< MD5 for: RDPWD.SYS  >[/color]
[2005/06/10 05:06:02 | 000,139,528 | ---- | M] (Microsoft Corporation) MD5=047BEA21274C8A4A233674A76C958C2C -- C:\WINDOWS\$hf_mig$\KB899591\SP2QFE\rdpwd.sys
[2008/04/14 04:34:54 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=6728E45B66F93C08F11DE2E316FC70DD -- C:\WINDOWS\ServicePackFiles\i386\rdpwd.sys
[2008/04/14 04:34:54 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=6728E45B66F93C08F11DE2E316FC70DD -- C:\WINDOWS\system32\drivers\rdpwd.sys
[2005/06/10 05:11:22 | 000,139,528 | ---- | M] (Microsoft Corporation) MD5=B54CD38A9EBFBF2B3561426E3FE26F62 -- C:\WINDOWS\$NtServicePackUninstall$\rdpwd.sys
[2004/08/10 20:00:00 | 000,139,400 | ---- | M] (Microsoft Corporation) MD5=D4F5643D7714EF499AE9527FDCD50894 -- C:\WINDOWS\$NtUninstallKB899591$\rdpwd.sys
 
[color=#A23BEC]< MD5 for: SCECLI.DLL  >[/color]
[2008/04/14 04:33:40 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 04:33:40 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll
[2004/08/10 20:00:00 | 000,186,368 | ---- | M] (Microsoft Corporation) MD5=DEC0397F35D027874804EC72979D03CC -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
[color=#A23BEC]< MD5 for: SFLOPPY.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:Sfloppy.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:Sfloppy.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Sfloppy.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Sfloppy.sys
[2004/08/10 20:00:00 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=0D13B6DF6E9E101013A7AFB0CE629FE0 -- C:\WINDOWS\$NtServicePackUninstall$\sfloppy.sys
[2008/04/13 20:40:48 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\ServicePackFiles\i386\sfloppy.sys
[2008/04/13 20:40:48 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\system32\drivers\sfloppy.sys
 
[color=#A23BEC]< MD5 for: SPLITTER.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:splitter.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:splitter.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:splitter.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:splitter.sys
[2006/06/14 09:47:46 | 000,006,400 | ---- | M] (Microsoft Corporation) MD5=0CE218578FFF5F4F7E4201539C45C78F -- C:\WINDOWS\$NtServicePackUninstall$\splitter.sys
[2004/08/03 23:07:48 | 000,006,400 | ---- | M] (Microsoft Corporation) MD5=8E186B8F23295D1E42C573B82B80D548 -- C:\WINDOWS\$NtUninstallKB920872$\splitter.sys
[2006/06/14 09:50:20 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=9BB1DD670CB7505A90FC4E61D4AA8227 -- C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\splitter.sys
[2008/04/13 20:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\ServicePackFiles\i386\splitter.sys
[2008/04/13 20:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\system32\drivers\splitter.sys
 
[color=#A23BEC]< MD5 for: SWMIDI.SYS  >[/color]
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:swmidi.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:swmidi.sys
[2008/04/13 20:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\ServicePackFiles\i386\swmidi.sys
[2008/04/13 20:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\system32\drivers\swmidi.sys
[2001/08/17 22:00:52 | 000,054,272 | ---- | M] (Microsoft Corporation) MD5=94ABC808FC4B6D7D2BBF42B85E25BB4D -- C:\WINDOWS\$NtServicePackUninstall$\swmidi.sys
 
[color=#A23BEC]< MD5 for: TCPIP.SYS  >[/color]
[2006/04/20 12:51:50 | 000,359,808 | ---- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 -- C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
[2008/06/20 12:45:14 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2007/10/30 17:53:32 | 000,360,832 | ---- | M] (Microsoft Corporation) MD5=64798ECFA43D78C7178375FCDD16D8C8 -- C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[2008/06/20 12:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2007/10/30 18:20:56 | 000,360,064 | ---- | M] (Microsoft Corporation) MD5=90CAFF4B094573449A0872A0F919B178 -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
[2008/04/13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008/04/13 21:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008/06/20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2008/06/20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008/06/20 13:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
[2004/08/10 20:00:00 | 000,359,040 | ---- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C -- C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
[2008/06/20 13:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2006/04/20 13:18:36 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
 
[color=#A23BEC]< MD5 for: TDPIPE.SYS  >[/color]
[2004/08/10 20:00:00 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=38D437CF2D98965F239B0ABCD66DCB0F -- C:\WINDOWS\$NtServicePackUninstall$\tdpipe.sys
[2008/04/14 04:34:52 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\ServicePackFiles\i386\tdpipe.sys
[2008/04/14 04:34:52 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\system32\drivers\tdpipe.sys
 
[color=#A23BEC]< MD5 for: TDTCP.SYS  >[/color]
[2008/04/14 04:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\ServicePackFiles\i386\tdtcp.sys
[2008/04/14 04:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\system32\drivers\tdtcp.sys
[2004/08/10 20:00:00 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=ED0580AF02502D00AD8C4C066B156BE9 -- C:\WINDOWS\$NtServicePackUninstall$\tdtcp.sys
 
[color=#A23BEC]< MD5 for: USBPRINT.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:usbprint.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:usbprint.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbprint.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbprint.sys
[2004/08/03 23:01:26 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A42369B7CD8886CD7C70F33DA6FCBCF5 -- C:\WINDOWS\$NtServicePackUninstall$\usbprint.sys
[2008/04/13 20:47:38 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A717C8721046828520C9EDF31288FC00 -- C:\WINDOWS\ServicePackFiles\i386\usbprint.sys
[2008/04/13 20:47:38 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A717C8721046828520C9EDF31288FC00 -- C:\WINDOWS\system32\drivers\usbprint.sys
 
[color=#A23BEC]< MD5 for: USBSCAN.SYS  >[/color]
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\i386\sp2.cab:usbscan.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\i386\sp3.cab:usbscan.sys
[2004/08/10 20:00:00 | 017,013,719 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbscan.sys
[2008/10/11 12:35:28 | 023,892,017 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbscan.sys
[2008/04/13 20:45:34 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\ServicePackFiles\i386\usbscan.sys
[2008/04/13 20:45:34 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\system32\drivers\usbscan.sys
[2004/08/03 22:58:46 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A6BC71402F4F7DD5B77FD7F4A8DDBA85 -- C:\WINDOWS\$NtServicePackUninstall$\usbscan.sys
 
[color=#A23BEC]< MD5 for: USERINIT.EXE  >[/color]
[2004/08/10 20:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D6D65EA32B190401B57EDB6706F29669 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/14 04:34:26 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/14 04:34:26 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\system32\userinit.exe
 
[color=#A23BEC]< MD5 for: WINLOGON.EXE  >[/color]
[2004/08/10 20:00:00 | 000,506,368 | ---- | M] (Microsoft Corporation) MD5=D2DE785AEAB0BB8CA4C14A8A199DBE4E -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/14 04:34:28 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 04:34:28 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\system32\winlogon.exe
 
[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]
 
[color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
[2008/04/14 04:33:22 | 001,267,200 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\WINDOWS\system32\comsvcs.dll
[2009/03/08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\WINDOWS\system32\dxtrans.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
[color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles  >[/color]
 
[color=#A23BEC]<  >[/color]
 
[color=#A23BEC]<  >[/color]

< End of report >



Et voici le rapport extras.txt :

Code: Tout sélectionner
OTL Extras logfile created on: 18/10/2010 21:18:45 - Run 1
OTL by OldTimer - Version 3.2.15.2     Folder = C:\Documents and Settings\Anne\Bureau
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 75,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 53,20 Gb Total Space | 10,29 Gb Free Space | 19,33% Space Free | Partition Type: FAT32
Drive D: | 53,69 Gb Total Space | 8,61 Gb Free Space | 16,03% Space Free | Partition Type: FAT32
 
Computer Name: ACER-1F614B65C2 | User Name: Anne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== File Associations ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[color=#E56717]========== Shell Spawning ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[color=#E56717]========== Security Center Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[color=#E56717]========== System Restore Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
[color=#E56717]========== Firewall Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"14549:TCP" = 14549:TCP:*:Enabled:NortonAV
"12146:TCP" = 12146:TCP:*:Enabled:NortonAV
"15240:TCP" = 15240:TCP:*:Enabled:NortonAV
"15328:TCP" = 15328:TCP:*:Enabled:NortonAV
"13034:TCP" = 13034:TCP:*:Enabled:NortonAV
"48113:TCP" = 48113:TCP:LocalSubNet:Enabled:maconfig_tcp
"48113:UDP" = 48113:UDP:LocalSubNet:Enabled:maconfig_udp
"7402:TCP" = 7402:TCP:*:Enabled:BitComet 7402 TCP
"7402:UDP" = 7402:UDP:*:Enabled:BitComet 7402 UDP
 
[color=#E56717]========== Authorized Applications List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe" = C:\Program Files\AntivirusFirewall\backweb\6588780\program\fspex.exe:*:enabled:Antivirus Firewall -- (Securitoo Portal)
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- File not found
"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- File not found
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule -- (http://www.emule-project.net)
"C:\WINDOWS\System32\dpvsetup.exe" = C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe" = C:\Program Files\AntivirusFirewall\backweb\6588780\program\fspex.exe:*:enabled:Antivirus Firewall -- (Securitoo Portal)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- File not found
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" = C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Disabled:Veoh Client -- File not found
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- File not found
"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- File not found
"C:\Program Files\ma-config.com\maconfservice.exe" = C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice -- (CybelSoft)
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe -- File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
 
 
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}" = OpenOffice.org 3.1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP210_series" = Canon MP210 series
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15B70821-7893-4607-805A-BB80F3EA8279}" = Acer Empowering Technology framework
"{17342E3B-0818-4A6F-BFF8-99476605ADD6}" = livebox
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = Acer OrbiCam
"{4DA416AE-6D1C-40D6-BCA3-A65A59DD60FC}" = Acer eDataSecurity Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{6266AB37-350F-483C-88D2-C530ACA42645}" = SAGEM Wi-Fi 11g USB adapter (Tool)
"{6CA897D0-67F5-4F75-8261-DC8BFCA6DA42}" = Acer eLock Management
"{7D2370AC-D8E6-4996-986A-19824F8A167C}" = Logitech QuickCam
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{900A92BA-19EF-4A34-86CF-7B6C85BDD971}" = VC_MergeModuleToMSI
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (English) 12
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PUBLISHERR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PUBLISHERR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PUBLISHERR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PUBLISHERR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-040C-0000-0000000FF1CE}" = Module de compatibilité pour Microsoft Office System 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PUBLISHERR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B0-040C-0000-0000000FF1CE}" = Complément Microsoft Enregistrer en tant que PDF pour programmes Microsoft Office 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PUBLISHERR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9012040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91120000-0019-0000-0000-0000000FF1CE}" = Microsoft Office Publisher 2007
"{91120000-0019-0000-0000-0000000FF1CE}_PUBLISHERR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0019-0000-0000-0000000FF1CE}_PUBLISHERR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{AB3F9176-E74A-4F28-9A09-4F22349B145E}" = livebox
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600820}" = MSN Messenger 7.0
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B06B842F-2450-494F-BBDE-217CDC151A37}" = NTI Backup NOW! 4.5
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BEF726DD-4037-4214-8C6A-E625C02D2870}" = Logitech Audio Echo Cancellation Component
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CF8C077A-B467-4C43-8DB5-3A9B94FF9681}" = LightScribe System Software  1.12.29.2
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}" = Assistant de connexion Windows Live
"{D458BBDC-0363-42E0-8FF9-4736E3CB3CA2}" = Acer Screensaver
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DEE08946-40F0-4890-853E-60A6C3306041}" = Acer ePerformance Management
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{E2AA331E-E10E-438C-B1C0-24B2FFD3D9C4}" = SAGEM Wi-Fi 11g USB adapter (Driver)
"{E38BC648-883B-4EE5-966C-94C4B7AB3E0B}" = Acer eSettings Management
"{E431C518-2EE2-471E-9234-BE995C36D513}" = Acer eDataSecurity Management 1.00.26
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E780E536-16CE-4CD1-8FE0-2D5E52FAA65B}" = Ma-Config.com
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC7DDAAE-7F2B-4270-9BFD-5A130B667E9E}" = Livebox
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}" = Windows Live installer
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"0D20D36D-A11C-444c-9AF7-70CBFED42ECF" = Otto
"43442AE9-6512-4392-B5DD-9167BECD1114_is1" = Infix 4.08
"99A88D57-2C93-491B-87B8-E41A870FB6BE" = GemMaster Mystic
"AcerOrbiCamDrv" = Programme de gestion Camera de Acer
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Audacity_is1" = Audacity 1.2.6
"BackWeb-6588780 Uninstaller" = AntiVirus Firewall
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner (remove only)
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_1025007F" = HDAUDIO Soft Data Fax Modem with SmartCP
"Creative PD1110" = Creative WebCam NX Driver (1.02.01.0827)
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"eMule" = eMule
"Enregistrement utilisateur de Canon MP210 series" = Enregistrement utilisateur de Canon MP210 series
"ePresentation" = Acer ePresentation Management
"Free PDF to Word Converter_is1" = Free PDF to Word Converter 1.5
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"GestionnaireInternet.exe" = Gestionnaire Internet
"GridVista" = Acer GridVista
"hotpot6_is1" = Hot Potatoes v 6.2.0.7
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15B70821-7893-4607-805A-BB80F3EA8279}" = Acer Empowering Technology framework
"InstallShield_{6CA897D0-67F5-4F75-8261-DC8BFCA6DA42}" = Acer eLock Management
"InstallShield_{DEE08946-40F0-4890-853E-60A6C3306041}" = Acer ePerformance Management
"InstallShield_{E38BC648-883B-4EE5-966C-94C4B7AB3E0B}" = Acer eSettings Management
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"MSN Toolbar" = Barre d'outils MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Logiciel Intel(R) PROSet/Wireless
"PUBLISHERR" = Microsoft Office Publisher 2007
"QcDrv" = Programme de gestion Camera de Logitech®
"RealPlayer 12.0" = RealPlayer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VideoLAN VLC media player 0.8.6c
"WIC" = Windows Imaging Component
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service" = Windows XP Service Pack 3
"WinRAR archiver" = Archiveur WinRAR
 
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
 
[HKEY_USERS\S-1-5-21-1247518530-1040898524-1718617733-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Notification de cadeaux MSN" = Notification de cadeaux MSN
"TimeAdjuster" = Time Adjuster STANDARD 3.1
 
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
 
[ Application Events ]
Error - 16/08/2010 10:09:44 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 16/08/2010 10:09:44 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11856328
 
Error - 16/08/2010 10:09:44 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11856328
 
Error - 16/08/2010 10:09:48 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 16/08/2010 10:09:48 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11860235
 
Error - 16/08/2010 10:09:48 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11860235
 
Error - 16/08/2010 10:09:52 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 16/08/2010 10:09:52 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11864141
 
Error - 16/08/2010 10:09:52 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11864141
 
Error - 16/08/2010 10:09:56 | Computer Name = ACER-1F614B65C2 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
[ System Events ]
Error - 18/10/2010 14:47:57 | Computer Name = ACER-1F614B65C2 | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service EventSystem
 avec les arguments ""  pour démarrer le serveur :  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7001
Description = Le service Client DHCP dépend du service NetBIOS sur TCP/IP qui n'a
 pas pu démarrer en raison de l'erreur :   %%31
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7001
Description = Le service Client DNS dépend du service Pilote du protocole TCP/IP
 qui n'a pas pu démarrer en raison de l'erreur :   %%31
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7001
Description = Le service Assistance TCP/IP NetBIOS dépend du service AFD qui n'a
 pas pu démarrer en raison de l'erreur :   %%31
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7001
Description = Le service Apple Mobile Device dépend du service Pilote du protocole
 TCP/IP qui n'a pas pu démarrer en raison de l'erreur :   %%31
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7001
Description = Le service Service Bonjour dépend du service Pilote du protocole TCP/IP
 qui n'a pas pu démarrer en raison de l'erreur :   %%31
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7001
Description = Le service Services IPSEC dépend du service Pilote IPSEC qui n'a pas
 pu démarrer en raison de l'erreur :   %%31
 
Error - 18/10/2010 14:48:21 | Computer Name = ACER-1F614B65C2 | Source = Service Control Manager | ID = 7026
Description = Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se
 charger :   AFD  Fips  intelppm  IPSec  MRxSmb  NetBIOS  NetBT  RasAcd  Rdbss  SASDIFSV  SASKUTIL  Tcpip
 
Error - 18/10/2010 14:50:09 | Computer Name = ACER-1F614B65C2 | Source = DCOM | ID = 10005
Description = DCOM a reçu l'erreur "%1084" lors de la mise en route du service EventSystem
 avec les arguments ""  pour démarrer le serveur :  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 18/10/2010 14:54:04 | Computer Name = ACER-1F614B65C2 | Source = Dhcp | ID = 1002
Description = Le bail de l'adresse IP 192.168.0.4 pour la carte réseau dont l'adresse
 réseau est 0018DE6D718B  a été refusé par le serveur DHCP 192.168.1.1 (celui-ci a
 envoyé un message DHCPNACK).
 
 
< End of report >


Encore merci pour votre aide, je ne sais pas si j'ai mis les codes ?!

EDIT Skynet : balises [code] ajoutées, merci de lire les consignes en haut du sujet !
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Re: Security tool : Help svp !

Message le 18 Oct 2010 21:04

re,

on a bien fait de se méfier, il y a un rootkit, je te prépare la suite... :wink:
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Re: Security tool : Help svp !

Message le 18 Oct 2010 21:16

jeanmimigab a écrit:re,

on a bien fait de se méfier, il y a un rootkit, je te prépare la suite... :wink:



Un rootkit ? Oulala :-S
Merci de m'aider !
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Re: Security tool : Help svp !

Message le 18 Oct 2010 21:40

re,

Ne te fais pas de bile, on a déjà vu plus coriace :wink:

* Fais un double-clic sur l'icône d'OTL pour le lancer
/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "Rapport minimal" soit cochée.

* Copies et colles le contenue de cette citation dans la partie inférieure d'OTL "Personnalisation"

:Files
C:\WINDOWS\System32\drivers\akkqvxw.sys
C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\Ask.xml
C:\Program Files\AdVantage
C:\Documents and Settings\NetworkService\Application Data\vqdlkr.dat

:OTL
DRV - (akkqvxw) -- C:\WINDOWS\System32\drivers\akkqvxw.sys ()
IE - HKU\S-1-5-21-1247518530-1040898524-1718617733-1005\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
[2009/11/06 20:24:18 | 000,001,649 | ---- | M] () -- C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\Ask.xml
O28 - HKLM ShellExecuteHooks: {EE12D60D-AD9A-4095-B839-3BE6862679FD} - Reg Error: Key error. File not found
O33 - MountPoints2\{eb57ca37-13f5-11de-94e5-0018de6d718b}\Shell - "" = AutoRun
MsConfig - StartUpReg: AdVantage - hkey= - key= - C:\Program Files\AdVantage\AdVantage.exe File not found
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[7 C:\Documents and Settings\Anne\Mes documents\*.tmp files -> C:\Documents and Settings\Anne\Mes documents\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Commands
[emptytemp]
[EMPTYFLASH]
[PURITY


* Cliques sur l'icône "Correction" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un rapport va s'ouvrir "OTL.Txt"
* Copie et colle le rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Message le 18 Oct 2010 21:55

J'ai suivi les "instructions" :

Voici la copie du rapport : (j'espère ne pas m'être trompé)
J'ai dû redémarrer mon pc après la correction.

Code: Tout sélectionner
All processes killed
========== FILES ==========
C:\WINDOWS\System32\drivers\akkqvxw.sys moved successfully.
C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\Ask.xml moved successfully.
File\Folder C:\Program Files\AdVantage not found.
C:\Documents and Settings\NetworkService\Application Data\vqdlkr.dat moved successfully.
========== OTL ==========
Service akkqvxw stopped successfully!
Service akkqvxw deleted successfully!
File  C:\WINDOWS\System32\drivers\akkqvxw.sys  not found.
Registry value HKEY_USERS\S-1-5-21-1247518530-1040898524-1718617733-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
File C:\Documents and Settings\Anne\Application Data\Mozilla\Firefox\Profiles\5l7ronc3.default\searchplugins\Ask.xml not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{EE12D60D-AD9A-4095-B839-3BE6862679FD} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE12D60D-AD9A-4095-B839-3BE6862679FD}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb57ca37-13f5-11de-94e5-0018de6d718b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eb57ca37-13f5-11de-94e5-0018de6d718b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\AdVantage\ deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\DUMP2710.tmp deleted successfully.
C:\WINDOWS\DUMP4546.tmp deleted successfully.
C:\WINDOWS\DUMP3558.tmp deleted successfully.
C:\WINDOWS\DUMP3f1c.tmp deleted successfully.
C:\WINDOWS\DUMP4219.tmp deleted successfully.
C:\WINDOWS\DUMP2fba.tmp deleted successfully.
C:\WINDOWS\003306_.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\DUMP5776.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL3296.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL1972.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL0447.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL1040.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL2282.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL0001.tmp deleted successfully.
C:\Documents and Settings\Anne\Mes documents\~WRL0003.tmp deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default User
->Temp folder emptied: 507904 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: All Users
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 217793677 bytes
 
User: LocalService
->Temp folder emptied: 115616 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Administrateur
->Temp folder emptied: 507904 bytes
->Temporary Internet Files folder emptied: 32768 bytes
 
User: Anne
->Temp folder emptied: 39568086 bytes
->Temporary Internet Files folder emptied: 288862613 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3362571 bytes
->Flash cache emptied: 4258 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 507904 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1586 bytes
 
Total Files Cleaned = 526,00 mb
 
 
[EMPTYFLASH]
 
User: Default User
 
User: All Users
 
User: NetworkService
 
User: LocalService
 
User: Administrateur
 
User: Anne
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
Error: Unable to interpret <[PURITY> in the current context!
 
OTL by OldTimer - Version 3.2.15.2 log created on 10182010_224600

Files\Folders moved on Reboot...
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\favicon[2].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\favicon[3].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\favicon[5].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\favicon[4].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\favicon[1].bmp moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\favicon[6].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\4DLUG0NE\adsCAYVCGQF.htm moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\WL67717A\favicon[4].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\WL67717A\favicon[2].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\WL67717A\favicon[3].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\WL67717A\favicon[5].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\WL67717A\iframescript[2].htm moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\597H0S3O\security-tool-help-vt-53692[1].html moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\597H0S3O\adsCAHU7AI5.htm moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\KWLOXEL2\5875srnzL-I[1].ico moved successfully.
C:\Documents and Settings\Anne\Local Settings\Temporary Internet Files\Content.IE5\KWLOXEL2\favicon[3].ico moved successfully.

Registry entries deleted on Reboot...


EDIT Skynet : balises [code] ajoutées, merci de lire les consignes en haut du sujet ! Bis !!!
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Re: Security tool : Help svp !

Message le 18 Oct 2010 22:10

re,


Tu t'es bien débrouillée, le rootkit est virer :wink:

Pour virer les éventuelles traces non visible dans le rapport OTL fais cela...
  • télécharge Malwarebytes >>ici
  • Pour t'aiderun super tuto de Danakil à lire avant le scan.
  • Choisie "exécuter un examen rapide" et à la fin du scan , coche tous les éléments trouvés,et clique sur supprimer la sélection.
  • Poste moi le rapport stp.

Je te laisse pour ce soir, je file au dodo because débout très tôt demain.

Je jette un œil au rapport et te donne la suite demain en fin d'après-midi

bonne nuit &@++ :wink:
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Re: Security tool : Help svp !

Message le 19 Oct 2010 09:36

Bonjour

D'abord un grand merci pour ton aide, je ne sais pas si je vais en venir à bout car j'ai voulu faire un scan avec malwarebytes et je sais que la mise à jour est importante seulement je rencontre un souci à ce moment-là et une fenêtre s'ouvre : "Une erreur s'est produite, veuillez transmettre ce code d'erreur à notre équipe de support (MBAM_ERROR_UPDATING (12029, 0, WinhttpSendRequest)"

J'ai quand même fait le scan mais est-ce valabe tout de même ?
Voici le rapport :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

19/10/2010 10:36:13
mbam-log-2010-10-19 (10-36-13).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 126335
Temps écoulé: 4 minute(s), 36 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


Encore merci ! :wink:
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Re: Security tool : Help svp !

Message le 19 Oct 2010 19:16

hello,

Mouai, c'est louche que la MAJ de malwarebyte's ne se fasse pas, en plus la version de base de données est vraiment trop vieille. ""Version de la base de données: 4052""
J'ai fais il y a quelque mois un tool qui:
  • permettait de supprimer les proxis empêchant la mise à jour de malwarebyte
  • renomme l'exécutable de malwarebyte;
  • lance une mise à jour automatique
  • et enchaine avec un scan.

on va tenter le coup pour le fun, sinon on désinstallera/réinstallera malwarebytes :wink:

  • TéléchargeFix_MBAM_VS_AVSuite.exe (par Jeanmimigab) sur ton bureau.
  • IMPORTANT>> Si malwarebyte est ouvert >> fermes-le avant de continuer
  • Fais un double-clic dessus pour le lancer
  • Dit moi si la mise à jour et le scan ont réussi
Dans la cas contraire tu désinstalle Malwarebyte et tu le télécharge à nouveau pour retenter la MAJ et le scan afin de me poster le rapport :wink:
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Re: Security tool : Help svp !

Message le 19 Oct 2010 20:03

Bonsoir,

J'ai retenté la mise à jour de Malwarebytes et aussi avec ton lien mais rien j'ai toujours le même message d'erreur.
J'ai essayé de le désinstaller puis de le réinstaller (je suis pas sûre d'y être arrivée) mais voici tout de même le rapport après l'analyse :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

19/10/2010 21:01:12
mbam-log-2010-10-19 (21-01-12).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 133091
Temps écoulé: 5 minute(s), 14 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Re: Security tool : Help svp !

Message le 19 Oct 2010 20:46

La mise à jours ne c'est pas faite...ont va la faire manuellement

Télécharge la Mise à jour Malwarebytes' >>ICI<< sur ton bureau
Ensuite double clique sur "mbam-rules.exe" la mise à jours de Malwarebytes'que tu à enregistrer, elle resemble à une nouvelle installation, mais c'est une MAJ et elle ce fera très rapidement. :wink:

Ensuite fais un nouveau scan :wink:
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Re: Security tool : Help svp !

Message le 19 Oct 2010 21:08

Alors j'ai fait la mise à jour manuellement, en effet, c'est très rapide !
Après j'ai de nouveau fait un scan et cette fois 2 fichiers infectés :-?

Je ne sais pas si je vais réussir à en venir à bout ! En tout cas, j'ai l'impression que Security Tool a disparu, c'est déjà !

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4874

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

19/10/2010 22:05:53
mbam-log-2010-10-19 (22-05-53).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 155774
Temps écoulé: 3 minute(s), 58 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\SVOHOST.0xe (Malware.NSPack) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fjhdyfhsn.bat (Malware.Trace) -> Quarantined and deleted successfully.
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Re: Security tool : Help svp !

Message le 19 Oct 2010 21:41

hello, cette fois ci la MAJ c'est bien faite (Version de la base de données: 4874) et c'est ce qui nous a permis de trouver les deux nouveaux fichiers :wink:

Peux tu vérifier quelque chose stp...

o Dans Firefox Menu "outils" > "options".
o Cliques sur en haut à droite sur "Avancé" > "onglet "réseau" > à la rubrique "connexions",cliques sur paramètres.
o Vérifie que "pas de proxy" soit bien cochée.
o Fermes les fenêtre en cliquant sur "OK".
Image

ensuite...

o Ouvres Internet Explorer,cliques sur le menu "Outils" > "Options Internet".
o A l'onglet "Connexions" > cliques en bas à droite sur "paramètres réseaux".
o Si la case "utiliser un serveur proxi pour votre réseau local" est cochée,décoches la...
o Quittes les fenêtre par "OK" et "Appliquer".
o Vérifie que "détecter automatiquement les paramètres de connexions" soit cochée

Nous allons procéder à la désinstallation préconisée par l'équipe de Malwarebyte en cas d'erreurs de MAJ

# Cliquez sur Démarrer et sélectionnez Panneau de configuration
# Ouvrez Ajout / Suppression de programmes
# Désinstaller Malwarebytes 'Anti-Malware
# Redémarrez votre ordinateur très important
# Téléchargez et exécutez mbam-clean.exe
# Il vous sera demandé de redémarrer votre ordinateur, faite le c'est très important
# Après le redémarrage de l'ordinateur, désactiver temporairement votre anti-virus et d'installer la dernière version de Malwarebytes 'Anti-Malware

ensuite...

Désactives ton antivirus

Télécharge Gmer. (Przemyslaw Gmerek)
  • Dézippe-le dans un dossier dédié ou sur ton Bureau.
  • Déconnecte toi d'Internet puis ferme tous les programmes.
  • Double-clique sur Gmer.exe.
  • Clique sur l'onglet Rootkit.
  • A droite, coche seulement Files, Services & Registry.
  • Clique maintenant sur Scan.
  • Lorsque le scan est terminé, clique sur Copy.
  • Ouvre le Bloc-notes puis clique sur le Menu Edition / Coller.
  • Le rapport doit alors apparaître.
  • Enregistre le fichier sur ton Bureau et poste le contenu ici.

PS:Si GMER plante et fait rebooter ton pc, fais le scan en mode sans échec !
Confirme moi qu'une fois cela effectué, malwarebytes fait sa MAJ correctement :wink:
Avatar de l'utilisateur
jeanmimigab
PC-Infopraticien
PC-Infopraticien
 
Messages: 2986
Inscription: 29 Nov 2009 12:05
 

Re: Security tool : Help svp !

Message le 20 Oct 2010 10:12

Bonjour,

J'ai vérifié ce que tu m'as dit dans internet explorer > options et j'ai réussi à faire la mise à jour de Malwarebytes. Mais entre-temps j'ai changé d'antivirus car j'avais celui d'Orange qui fonctionnait très bien mais impossible de l'ouvrir et d'y accéder et donc de le désactiver ! Je l'ai désinstallé puis en ai réinstallé un autre.

Voici le rapport de Malwarebytes :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4888

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20/10/2010 11:11:01
mbam-log-2010-10-20 (11-11-01).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 155000
Temps écoulé: 8 minute(s), 43 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


Je n'ai pas fait la manip avec Gmer puisque la MAJ de Malwarebytes se fait correctement maintenant.
Est-ce que ce rootkit a disparu ou a été neutralisé ?
Encore merci de m'avoir guidé, c'est vraiment génial !
Kelis7
Visiteur
Visiteur
 
Messages: 8
Inscription: 18 Oct 2010 19:17
 

Suivante


Sujets similaires

Message Alternative à Microsoft Security Essential ou Defender
Bonjour,Est-ce que MSE ou Defender sur W10 sont des antivirus efficaces ?Sinon quelle alternative à ces produits ? Merci
Réponses: 3

Message Blue screen of death : Kernel security
Bonjour,Aujourd'hui, j'allume mon pc comme tous les jours, et celui-ci m'acceuil avec un écran bleu affichant: Kernel_Security_Check_FailureJe ne comprend pas pourquoi, je n'ai rien installé de sucpicieux, ou pas fait de mofification sur mon ordi. Lorsqu'il redémarre, tous se passe bien, et 10 minut ...
Réponses: 9

Message Kaspersky Internet Security 2016
Bonjour,OS: Windows XP pro(32 bits) Service Pack3Après installation de KIS 2016, obtention d'un écran bleu au démarrage de Windows.Windows ne démarre qu'avec "la dernière bonne configuration connue".Kaspersky me balade de manipulation en manipulation depuis 3 semaines.Mais quand on leur pa ...
Réponses: 1

Message Installer jeu sous winrar avec Daemon tool
Bonsoir!J'ai DL les 14 dossiers winrar du jeu Far cry 4 et j'ai installé Daemon tool lite. Seulement je ne sais pas quoi faire avec lol...On me parle de fichier Iso mais il n'y en a pas... sur le dossier winrar Part01 j'ai: - 16 fichiers en ".BIN" - un setup - Un icone en ".ico" ...
Réponses: 1

Message Désinstaller efficacement Mc Afee Internet Security
Bonjour,Je souhaite désinstaller proprement Mc Affee Internet Security qui était fourni avec mon PC, qui arrive à échéance et que je ne souhaite pas conserver. J'ai lu le topic concernant cette question, ai téléchargé l'utilitaire ad hoc (MCPR), mais le lien vers la procédure à suivre n'aboutit que ...
Réponses: 1

Message [Réglé] que pensez vous d'ESET Smart Security
salut à tous j'utilise avira et un technicien sous traitant de orange venu en dépannage sur ma livebox ma dit que l'antivirus que j'utilise AVIRA free antivirus est très basique sans heuristique réelle qu'il est inefficace bref pour résumer il ne protégè pas grand chose , et que lui personnell ...
Réponses: 12


Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 13 invités


.: Nous contacter :: Flux RSS :: Données personnelles :.