       |
le 01 Oct 2011 16:32
Je voulais le mettre en réseau mais j'ai peur qu'il soit infecter et donc je ne voudrais pas infecter mes autres pc.
le 01 Oct 2011 23:15
le 02 Oct 2011 10:19
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Version de la base de données: 7842
Windows 5.0.2195 Service Pack 4
Internet Explorer 6.0.2800.1106
29/10/2002 01:29:39
mbam-log-2002-10-29 (01-29-38).txt
Type d'examen: Examen complet (C:\|D:\|G:\|)
Elément(s) analysé(s): 197293
Temps écoulé: 15 minute(s), 35 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\AxInst.IgbInstall (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AxInst.IgbInstall.1 (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\IGB (Malware.Trace) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
le 02 Oct 2011 21:09
Fait un double-clic sur l'icône d'OTL pour le lancer:OTL
DRV - (NetDetect) -- C:\WINNT\system32\drivers\netdtect.sys (Microsoft Corporation)
[2003/01/05 20:44:55 | 000,010,000 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\mstinit.exe
[2006/11/11 12:41:25 | 000,003,192 | ---- | M] () -- C:\WINNT\System32\lzjhpqtws_navps.dat.ren
[2006/11/09 12:01:42 | 000,239,502 | ---- | M] () -- C:\WINNT\System32\lzjhpqtws_nav.dat.ren
[2006/11/01 20:51:37 | 000,003,192 | ---- | C] () -- C:\WINNT\System32\lzjhpqtws_navps.dat.ren
[2006/11/01 20:51:36 | 000,239,502 | ---- | C] () -- C:\WINNT\System32\lzjhpqtws_nav.dat.ren
[2008/09/23 14:07:12 | 000,000,047 | ---- | M] () -- C:\WINNT\popcinfot.dat
[2008/09/01 13:57:50 | 000,000,047 | ---- | C] () -- C:\WINNT\popcinfot.dat
IE - HKU\S-1-5-21-436374069-152049171-1343024091-500\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\blank.htm
FF - prefs.js..browser.startup.homepage: "http://www.persolinks.fr/demarrage/chez_moi.php?id=44jalewzd95ura39f5mf&jok=1"
FF - prefs.js..browser.startup.homepage: "http://search.notepad.com"
[2007/09/16 09:40:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\012b7o29.default\extensions
:Files
C:\WINNT\eReg.dat
C:\WINNT\System32\dmremote.exe
C:\WINNT\System32\telnet.exe
C:\WINNT\System32\dmremote.exe
C:\WINNT\System32\Install7x.dll
C:\WINNT\System32\Install7x.dll
:Commands
[emptytemp]
[emptyflash]
[createrestorepoint]
le 02 Oct 2011 21:53
All processes killed
========== OTL ==========
Service NetDetect stopped successfully!
Service NetDetect deleted successfully!
C:\WINNT\system32\drivers\netdtect.sys moved successfully.
C:\WINNT\system32\dllcache\mstinit.exe moved successfully.
C:\WINNT\system32\lzjhpqtws_navps.dat.ren moved successfully.
C:\WINNT\system32\lzjhpqtws_nav.dat.ren moved successfully.
File C:\WINNT\System32\lzjhpqtws_navps.dat.ren not found.
File C:\WINNT\System32\lzjhpqtws_nav.dat.ren not found.
C:\WINNT\popcinfot.dat moved successfully.
File C:\WINNT\popcinfot.dat not found.
HKU\S-1-5-21-436374069-152049171-1343024091-500\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
Prefs.js: "http://www.persolinks.fr/demarrage/chez_moi.php?id=44jalewzd95ura39f5mf&jok=1" removed from browser.startup.homepage
Prefs.js: "http://search.notepad.com" removed from browser.startup.homepage
C:\Documents and Settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\012b7o29.default\extensions folder moved successfully.
========== FILES ==========
C:\WINNT\eReg.dat moved successfully.
C:\WINNT\System32\dmremote.exe moved successfully.
C:\WINNT\System32\telnet.exe moved successfully.
File\Folder C:\WINNT\System32\dmremote.exe not found.
C:\WINNT\System32\Install7x.dll moved successfully.
File\Folder C:\WINNT\System32\Install7x.dll not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrateur
->Temp folder emptied: 22033792 bytes
->Temporary Internet Files folder emptied: 458819 bytes
->Java cache emptied: 2038120 bytes
->FireFox cache emptied: 2467735 bytes
->Flash cache emptied: 2160 bytes
User: All Users
User: Arnaud
->Temp folder emptied: 54832 bytes
->Temporary Internet Files folder emptied: 197010 bytes
->Flash cache emptied: 583 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: rousseau
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Rémi
->Temp folder emptied: 91297694 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 678 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2669 bytes
RecycleBin emptied: shell32.dll unable to determine bytes removed.
Total Files Cleaned = 113,00 mb
[EMPTYFLASH]
User: Administrateur
->Flash cache emptied: 0 bytes
User: All Users
User: Arnaud
->Flash cache emptied: 0 bytes
User: Default User
User: rousseau
User: Rémi
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0,00 mb
OTL by OldTimer - Version 3.2.29.1 log created on 10292002_120656
Files\Folders moved on Reboot...
File\Folder C:\WINNT\temp\JETAA09.tmp not found!
File\Folder C:\WINNT\temp\JETC5CF.tmp not found!
Registry entries deleted on Reboot...
Fix Navipromo version 4.1.0 commencé le mar. 29/10/2002 12:12:34,51
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
Outil exécuté depuis C:\navilog1
Mise à jour le 20.04.2011 à 09h00 par IL-MAFIOSO
Microsoft Windows 2000 Professionnel ( v5.0.2195 ) Service Pack 4
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) Processor )
BIOS : Default System BIOS
USER : Administrateur ( Administrator )
BOOT : Normal
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:19 Go (Free:10 Go)
D:\ (Local Disk) - NTFS - Total:9 Go (Free:7 Go)
E:\ (USB)
F:\ (CD or DVD)
G:\ (USB) - FAT32 - Total:1000 Mo (Free:0 Go)
Recherche executée en mode normal
[b]Nettoyage exécuté en mode normal et non au reboot
!! Les résultats ne seront pas optimisés !! [/b]
C:\WINNT\system32\lzjhpqtws.dat.ren supprimé !
C:\WINNT\system32\stgneizx.dat supprimé !
C:\WINNT\system32\wlddoax.dat supprimé !
Nettoyage contenu C:\WINNT\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Administrateur\locals~1\Temp effectué !
*** Sauvegarde du Registre vers dossier Safebackup ***
sauvegarde du Registre réalisée avec succès !
*** Nettoyage Registre ***
Nettoyage Registre Ok
*** Scan terminé mar. 29/10/2002 12:13:51,21 ***
le 02 Oct 2011 21:56
Télécharge ZHPDiag par Nicolas Coolman et sauvegarde-le sur le Bureau. le 03 Oct 2011 16:29
Rapport de ZHPDiag v1.28.1361 par Nicolas Coolman, Update du 01/10/2011
Run by Administrateur at 29/10/2002 00:31:58
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
---\\ Web Browser
MSIE: Internet Explorer v6.0.2800.1106 (Defaut)
---\\ Windows Product Information
Windows 2000 Professional Service Pack 4 (Build 2195)
Windows Server License Manager Script : Absent (Not found)
Windows ID Activation : Inconnue (Unknown)
Windows Licence : Inconnue (Unknown)
Windows Automatic Updates : OK
---\\ System Information
~ Processor: x86 Family 6 Model 6 Stepping 2, AuthenticAMD
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 767 MB (65% free)
System Restore: Inconnu (Unknown)
System drive C: has 10 GB (53%) free of 20 GB
---\\ Logged in mode
~ Computer Name: LAROSEGRENIER
~ User Name: Administrateur
~ All Users Names: Rémi, rousseau, Administrateur,
~ Unselected Option: None
~ Logged in as Unknown
---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Documents and Settings\Administrateur\Application Data\
~ %Desktop% : C:\Documents and Settings\Administrateur\Bureau\
~ %Favorites% : C:\Documents and Settings\Administrateur\Favoris\
~ %LocalAppData% : C:\Documents and Settings\Administrateur\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\Administrateur\Menu Démarrer\
~ %Windir% : C:\WINNT\s\
~ %System% : C:\WINNT\system32\
---\\ DOS/Devices
A:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
C:\ Hard drive, Flash drive, Thumb drive (Free 10 Go of 20 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 7 Go of 9 Go)
E:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
F:\ CD-ROM drive (Not Inserted)
---\\ Security Center & Tools Informations
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoDesktop: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoStartMenuSubFolder: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoResolveSearch: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoClose: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] WarnOnHTTPSToHTTPRedirect: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
~ Scan Security Center in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.61CF5B74A4B5FE430F87E9259B7E4F60] - (....) (.29/10/2002 - 00:00:00.) -- C:\WINNT\system32\rundll32.exe [10000]
[MD5.CDA73F069C9976EBBA4438170A618F95] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.29/10/2002 - 17:24:06.) -- C:\WINNT\system32\wininet.dll [590336]
[MD5.E211511865C8532E1BF44D5C5E8B947B] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\Winlogon.exe [185616]
[MD5.320CAC00366BB4D5684B46928CEE5ADF] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\AFD.sys [120240] 1788
[MD5.8C718AA8C77041B3285D55A0CE980867] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\atapi.sys [86672] 1740
[MD5.378BBF444D7232E74C74DFAE04D4DED0] - (.Microsoft Corporation - CD-ROM File System Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\Cdfs.sys [61680] 1756
[MD5.4B86A90A7F0095D514D22A9083826488] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\Cdrom.sys [27984] 1764
[MD5.B27A36D4725A362A13D0C52AD6C7175B] - (.Microsoft Corporation - FIPS Crypto Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\Fips.sys [33616] 1732
[MD5.6D953C5F6885A49C4DDFF7FC0D68FE22] - (.Microsoft Corporation - Pilote de port i8042.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\i8042prt.sys [48432] 1796
[MD5.3509E9C33281F4343D2DA5650039F59D] - (.Microsoft Corporation - IP Network Address Translator.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\IpNat.sys [67120] 1772
[MD5.6BF394C7987FBC91B047EB0A8EFB2AA5] - (.Microsoft Corporation - IPSEC Driver (US/Canada Only, Not for Export).) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\IPSec.sys [64304] 1836
[MD5.E0836182D738EBE0E958EE641FDFA597] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\MRxSmb.sys [418640] 1764
[MD5.E854473D50E5F7917767A7C10E08E5F8] - (.Microsoft Corporation - MBT Transport driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\netBT.sys [168624] 1740
[MD5.F6AB0E765D5B80443B93C52C42F2602A] - (.Microsoft Corporation - NT File System Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\ntfs.sys [534192] 1740
[MD5.EEB9D4705BEFF7CDFE7E0C6EDEA6085A] - (.Microsoft Corporation - Pilote de port parallèle.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\Parport.sys [25328] 1796
[MD5.EC6037C594F20ADEDEA65F0D809493D2] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\Rasl2tp.sys [52112] 1828
[MD5.FB832B074B7215110E81B0B96EBDB4D5] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\redbook.sys [36304] 1836
~ Scan Generic Processes in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 0/5
~ Mes musiques (My Musics) : 0/0
~ Mes Videos (My Video) : 0/0
~ Mes Favoris (My Favorites) : 1/15
~ Mes Documents (My Documents) : 4/1101
~ Mon Bureau (My Desktop) : 0/36
~ Menu demarrer (Programs) : 0/90
~ Scan Hidden Files in 00mn 00s
---\\ Processus lancés
[MD5.CB143DCD8864442CFCF37629002766E3] - (.ESET - ESET Service.) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [974944] [PID.]
[MD5.683A07B982832426128B684B7366710F] - (.Hewlett-Packard Company - LightScribe Service.) -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [79400] [PID.]
[MD5.B3A6BC70F941A92DA318F3BD44362BCC] - (.Microsoft Corporation - Remote Registry Service.) -- C:\WINNT\system32\regsvc.exe [68368] [PID.]
[MD5.409995AA9BC32033FD00A03413F8905F] - (.Microsoft Corporation - Moteur du Planificateur de tâches.) -- C:\WINNT\system32\MSTask.exe [121104] [PID.]
[MD5.974EE1A488A7AF678F84826B588D4AF1] - (.Microsoft Corporation - Infrastructure de gestion Windows.) -- C:\WINNT\System32\WBEM\WinMgmt.exe [196706] [PID.]
[MD5.02B98BB104281570C6C4F926069CBAFF] - (.ESET - ESET GUI.) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [3076144] [PID.1008]
[MD5.ECE648CDC3A09421E996DFFDA76F5C53] - (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [153136] [PID.612]
[MD5.1303337E1B3DB25584C29E30E22AC8E5] - (.Sweex Europe BV - Sweex WiFi Utility.) -- C:\Program Files\Sweex\Installer\Win2k\SWU.exe [598016] [PID.600]
[MD5.060DAF68493AD7ADF104413E5A62AFA8] - (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe [271920] [PID.]
[MD5.B920AAF7ABEA489AC415DD38AD7B76CD] - (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe [1209904] [PID.]
[MD5.6D5884C13D655DD1C9E65AFCC19A8D5C] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe [91136] [PID.1624]
[MD5.20B58B5874A519037BC3DC5764E81963] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [2128384] [PID.1436]
~ Scan Processes Running in 00mn 00s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com
R0 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.google.com
R1 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (...) (No version) -- %SystemRoot%\System32\shdocvw.dll
~ Scan IE Browser in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Scan Proxy management in 00mn 00s
---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Scan Keys in 00mn 00s
---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Scan Hosts File in 00mn 00s
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} . (.Adobe Systems Incorporated - Adobe Acrobat IE Helper Version 6.0 for Act.) -- C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
~ Scan BHO in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} . (.Microsoft Corporation - Contrôle ActiveX du Lecteur Windows Media.) -- C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (...) -- (.not file.)
~ Scan Toolbar in 00mn 00s
---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Synchronization Manager] . (.Microsoft Corporation - Gestionnaire de synchronisation Microsoft.) -- C:\WINNT\system32\mobsync.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Computer, Inc. - Pas de description.) -- C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [egui] . (.ESET - ESET GUI.) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype. Take a deep breath.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
O4 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\..\Run: [Skype] . (.Skype Technologies S.A. - Skype. Take a deep breath.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] . (.Microsoft Corporation - Assistant Connexion Internet.) -- C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe
~ Scan Application in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Adobe Reader 6.0.lnk . (...) -- C:\WINNT\Installer\{AC76BA86-7AD7-1036-7B44-A00000000001}\SC_Reader_PM.ico
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Microsoft Office Word Viewer 2003.lnk . (...) -- C:\WINNT\Installer\{9085040C-6000-11D3-8CFE-0150048383C9}\wrdvicon.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\ZHPDiag.lnk . (...) -- C:\Program Files\ZHPDiag\ZHP2.exe (.not file.)
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Fatman Adventures.lnk . (.Another Day Ltd.) -- C:\Program Files\Another Day\Fatman Adventures\Fatman.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Free Spider.lnk . (.TreeCardGames.com.) -- C:\Program Files\Free Spider\FreeSpider.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Lecteur Windows Media.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Outlook Express.lnk . (.Microsoft Corporation.) -- C:\Program Files\Outlook Express\msimn.exe
~ Scan Global Startup in 00mn 00s
---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xporter vers Microsoft Excel . (.Microsoft Corporation - Microsoft Office Excel.) -- C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.exe
~ Scan IE Menu Contextuel in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} . (...) -- C:\PROGRA~1\Skype\Toolbars\INTERN~1\favicon.ico
O9 - Extra button: Skype - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\PROGRA~1\MICROS~3\OFFICE11\REFBARH.ICO
~ Scan IE Extra Buttons in 00mn 00s
---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Windows Socket2 NameSpace DLL.) -- C:\WINNT\system32\rnr20.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINNT\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Service client pour le fournisseur NetWare et DLL d'authentification.) -- C:\WINNT\system32\nwprovau.dll
~ Scan Winsock in 00mn 00s
---\\ Internet Explorer Plugins (O12)
O12 - Plugin for .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
~ Scan IE Extra Buttons in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: DirectAnimation Java Classes - (DirectAnimation Java Classes) - (.not file.) - file:\\C:\WINNT\Java\classes\dajava.cab
O16 - DPF: Microsoft XML Parser for Java - (Microsoft XML Parser for Java) - (.not file.) - file:\\C:\WINNT\Java\classes\xmldso.cab
~ Scan Objets ActiveX in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{712A0CF2-E39F-416B-9EC8-33B9851F3C08}: NameServer = 192.168.3.1,192.168.3.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{712A0CF2-E39F-416B-9EC8-33B9851F3C08}: NameServer = 192.168.3.1,192.168.3.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{712A0CF2-E39F-416B-9EC8-33B9851F3C08}: NameServer = 192.168.3.1,192.168.3.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{C7C312EA-1A7D-41EC-BDDC-898225BEA427}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{C7C312EA-1A7D-41EC-BDDC-898225BEA427}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpDomain = lan
~ Scan Domain in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\WINNT\System32\itss.dll
O18 - Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (...) -- C:\WINNT\s\System32\inetcomm.dll
O18 - Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\WINNT\System32\itss.dll
O18 - Handler: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} . (.Microsoft Corporation - Microsoft Office XP Web Components.) -- C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Handler: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} . (.Microsoft Corporation - Microsoft Office Web Components 2003.) -- C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} . (.Microsoft Corporation - Contrôle ActiveX du Lecteur Windows Media.) -- C:\WINNT\system32\msdxm.ocx
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} . (...) -- C:\WINNT\s\system32\shell32.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
~ Scan Protocole Additionnel in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINNT\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINNT\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent Réseau hors-connexion.) -- C:\WINNT\system32\cscdll.dll
O20 - Winlogon Notify: nwprovau . (.Microsoft Corporation - Service client pour le fournisseur NetWare.) -- C:\WINNT\system32\nwprovau.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINNT\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINNT\system32\WlNotify.dll
O20 - Winlogon Notify: wzcnotif . (.Microsoft Corporation - UI du service de configuration automatique.) -- C:\WINNT\system32\wzcdlg.dll
~ Scan Winlogon in 00mn 00s
---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: Network.ConnectionTray - {7007ACCF-3202-11D1-AAD2-00805FC1270E} . (.Microsoft Corporation - Noyau des Connexions réseau.) -- C:\WINNT\system32\NETSHELL.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (....) -- C:\WINNT\s\System32\webcheck.dll (.not file.)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINNT\system32\stobject.dll
~ Scan SSODL in 00mn 00s
---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (...) -- C:\WINNT\s\System32\browseui.dll
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (...) -- C:\WINNT\s\System32\browseui.dll
~ Scan STS/SSO in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Avertissement (Alerter) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Explorateur d'ordinateur (Browser) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Client DHCP (Dhcp) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Gestionnaire de disque logique (dmserver) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Client DNS (Dnscache) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: ESET Service (ekrn) . (.ESET - ESET Service.) - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Journal des événements (Eventlog) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Serveur (lanmanserver) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Station de travail (lanmanworkstation) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) . (.Hewlett-Packard Company - LightScribe Service.) - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Service d'application d'assistance TCP/IP NetBIOS (LmHosts) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Affichage des messages (Messenger) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Service client pour NetWare (NWCWorkstation) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Plug-and-Play (PlugPlay) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Agent de stratégie IPSEC (PolicyAgent) . (...) - C:\WINNT\s\System32\lsass.exe (.not file.)
O23 - Service: Emplacement protégé (ProtectedStorage) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Service d'accès à distance au Registre (RemoteRegistry) . (...) - C:\WINNT\s\system32\regsvc.exe (.not file.)
O23 - Service: Planificateur de tâches (Schedule) . (...) - C:\WINNT\s\system32\MSTask.exe (.not file.)
O23 - Service: Service d'exécution par délégation (seclogon) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Spouleur d'impression (Spooler) . (...) - C:\WINNT\s\system32\spoolsv.exe (.not file.)
O23 - Service: Infrastructure de gestion Windows (WinMgmt) . (...) - C:\WINNT\s\System32\WBEM\WinMgmt.exe (.not file.)
~ Scan Services in 00mn 00s
---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Office Word.) - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe
~ Scan Desktop Component in 00mn 00s
---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINNT\system32\DRIVERS\cdrom.sys
O41 - Driver: (ehdrv) . (.ESET - ESET Helper driver.) - C:\WINNT\system32\DRIVERS\ehdrv.sys
O41 - Driver: (epfwtdir) . (.ESET - ESET Antivirus Network Redirector.) - C:\WINNT\system32\DRIVERS\epfwtdir.sys
O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\WINNT\system32\DRIVERS\i8042prt.sys
O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\WINNT\system32\DRIVERS\kbdclass.sys
O41 - Driver: (Mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\WINNT\system32\DRIVERS\mouclass.sys
O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINNT\system32\DRIVERS\mrxsmb.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINNT\system32\DRIVERS\netbios.sys
O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINNT\system32\DRIVERS\netbt.sys
O41 - Driver: (Parport) . (.Microsoft Corporation - Pilote de port parallèle.) - C:\WINNT\system32\DRIVERS\parport.sys
O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINNT\system32\DRIVERS\rasacd.sys
O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINNT\system32\DRIVERS\rdbss.sys
O41 - Driver: (redbook) . (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) - C:\WINNT\system32\DRIVERS\redbook.sys
O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\WINNT\system32\DRIVERS\serial.sys
O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP driver.) - C:\WINNT\system32\DRIVERS\tcpip.sys
O41 - Driver: (VgaSave) . (. - .) - C:\WINNT\s\system32\drivers\vga.sys (.not file.)
~ Scan Drivers in 00mn 00s
---\\ Logiciels installés (O42)
O42 - Logiciel: Adobe Flash Player 9 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- ShockwaveFlash
O42 - Logiciel: Adobe Flash Player ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Reader 6.0.1 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A00000000001}
O42 - Logiciel: Adobe Shockwave Player - (.Adobe Systems, Inc..) [HKLM] -- Adobe Shockwave Player
O42 - Logiciel: C-Media Audio - (.Pas de propriétaire.) [HKLM] -- C-Media Audio
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: Chicken Ball - (.Micro Application.) [HKLM] -- {6A6E5A7E-B1B8-4DAB-B07D-0FA6822A1651}
O42 - Logiciel: Compatibility Pack for the 2007 Office system - (.Microsoft Corporation.) [HKLM] -- {90120000-0020-0409-0000-0000000FF1CE}
O42 - Logiciel: Compte pour Windows - (.Pas de propriétaire.) [HKLM] -- ST6UNST #1
O42 - Logiciel: Encyclopédie Hachette Multimédia - (.Pas de propriétaire.) [HKLM] -- Encyclopédie Hachette Multimédia
O42 - Logiciel: F-16 Demo - (.Pas de propriétaire.) [HKLM] -- F-16 Demo
O42 - Logiciel: F-22 Lightning 3 - (.Pas de propriétaire.) [HKLM] -- F-22 Lightning 3
O42 - Logiciel: FA-18 Hornet 3.0 - (.Pas de propriétaire.) [HKLM] -- FA-18 Hornet 3.0
O42 - Logiciel: Fatman Adventures - (.Another Day.) [HKLM] -- Fatman Adventures_is1
O42 - Logiciel: Free Spider - (.TreeCardGames.com.) [HKLM] -- Free Spider
O42 - Logiciel: Lock On: Air Combat Simulation - (.Pas de propriétaire.) [HKLM] -- {E90DCEE9-DC27-401B-A7AC-B0AFF5B34E4D}
O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.2.1300 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Microsoft Office 2000 Premium - (.Microsoft Corporation.) [HKLM] -- {0000040C-78E1-11D2-B60F-006097C998E7}
O42 - Logiciel: Microsoft Office Professional Edition 2003 - (.Microsoft Corporation.) [HKLM] -- {9011040C-6000-11D3-8CFE-0150048383C9}
O42 - Logiciel: Microsoft Office Word Viewer 2003 - (.Microsoft Corporation.) [HKLM] -- {9085040C-6000-11D3-8CFE-0150048383C9}
O42 - Logiciel: Nero 7 Essentials - (.Nero AG.) [HKLM] -- {1DED92A7-05FA-4736-8AEA-1BE2363F1036}
O42 - Logiciel: QuickTime - (.Pas de propriétaire.) [HKLM] -- QuickTime
O42 - Logiciel: SiS 900 PCI Fast Ethernet Adapter Driver - (.Pas de propriétaire.) [HKLM] -- SiSLan
O42 - Logiciel: Sierra Utilities - (.Pas de propriétaire.) [HKLM] -- Sierra Utilities
O42 - Logiciel: Skype™ 3.6 - (.Skype Technologies S.A..) [HKLM] -- {5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
O42 - Logiciel: Sweex WiFi Utility - (.Sweex.) [HKLM] -- {356D234E-3AD4-4495-B5CD-9AC1C05A19C8}
O42 - Logiciel: Talisman 3 - (.Pas de propriétaire.) [HKLM] -- Talisman 3
O42 - Logiciel: Tout le Primaire 2005 AutoProtect_Internet - (.Novosoft International.) [HKLM] -- InstallShield_{A26DEB76-8AC3-4F6A-8AEC-F201D30BFC81}
O42 - Logiciel: Ulead Photo Explorer 8.0 SE Basic - (.Ulead Systems, Inc..) [HKLM] -- {D271DAE0-8D68-4C97-8356-A126D48A1D8C}
O42 - Logiciel: Windows Installer 3.0 (KB884016) - (.Microsoft Corporation.) [HKLM] -- MSI30-KB884016
O42 - Logiciel: adsl TV - (.adsl TV / FM.) [HKLM] -- {3AFDD2C6-8663-46B5-B195-6CEB00D44768}
O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\Adobe]
[HKCU\Software\Ahead]
[HKCU\Software\Another Day]
[HKCU\Software\Aurigma]
[HKCU\Software\Binary Noise]
[HKCU\Software\Borland]
[HKCU\Software\Classes]
[HKCU\Software\Dacris Software]
[HKCU\Software\ESET]
[HKCU\Software\Free-backup.info]
[HKCU\Software\GNU]
[HKCU\Software\GSpot Appliance Corp]
[HKCU\Software\Gabest]
[HKCU\Software\Game Maker 4]
[HKCU\Software\GameSpy]
[HKCU\Software\Google]
[HKCU\Software\Haali]
[HKCU\Software\Intel]
[HKCU\Software\InterVideo]
[HKCU\Software\JEDI-VCL]
[HKCU\Software\Jasc]
[HKCU\Software\Kodak]
[HKCU\Software\LeaderTech]
[HKCU\Software\LightScribe]
[HKCU\Software\Lighttek]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\MainConcept]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MaxiWare]
[HKCU\Software\MaximumSoft]
[HKCU\Software\Netscape]
[HKCU\Software\ODBC]
[HKCU\Software\OXXOgames]
[HKCU\Software\Opendisc]
[HKCU\Software\PIXELA]
[HKCU\Software\Panda Software]
[HKCU\Software\PepiMK Software]
[HKCU\Software\Piriform]
[HKCU\Software\Pointsoft]
[HKCU\Software\Policies]
[HKCU\Software\PopCap]
[HKCU\Software\Redemption??]
[HKCU\Software\Safer Networking Limited]
[HKCU\Software\SecuROM]
[HKCU\Software\Skype]
[HKCU\Software\Sony Corporation]
[HKCU\Software\TechSmith]
[HKCU\Software\Terravirtual]
[HKCU\Software\TurboPower]
[HKCU\Software\ULead]
[HKCU\Software\Ulead Systems]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\Valve]
[HKCU\Software\Virtools]
[HKCU\Software\WOI]
[HKCU\Software\Warthog]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\shockwave.com]
[HKLM\Software\ALWIL Software]
[HKLM\Software\ATI Technologies]
[HKLM\Software\Absolutist]
[HKLM\Software\Adaptec]
[HKLM\Software\Adobe]
[HKLM\Software\Ahead]
[HKLM\Software\Another Day]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Audible]
[HKLM\Software\BBC Multimedia]
[HKLM\Software\BackWeb]
[HKLM\Software\Big Fish Games]
[HKLM\Software\BigFish]
[HKLM\Software\Borland]
[HKLM\Software\C-Media]
[HKLM\Software\C07ft5Y]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Contrôle Parental]
[HKLM\Software\DPAv3]
[HKLM\Software\Disney Interactive]
[HKLM\Software\ESET]
[HKLM\Software\Electronic Arts]
[HKLM\Software\FX Interactive]
[HKLM\Software\Fish Technology Group]
[HKLM\Software\GNU]
[HKLM\Software\Gabest]
[HKLM\Software\GameOverGames]
[HKLM\Software\Gemplus]
[HKLM\Software\Google]
[HKLM\Software\INTEL]
[HKLM\Software\InstallShield]
[HKLM\Software\Kodak]
[HKLM\Software\L&H]
[HKLM\Software\Licenses]
[HKLM\Software\LightScribe]
[HKLM\Software\MDC]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MicroQuill]
[HKLM\Software\Mindscape]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\Name of your company]
[HKLM\Software\Nero]
[HKLM\Software\NovaLogic]
[HKLM\Software\ODBC]
[HKLM\Software\OldTimer Tools]
[HKLM\Software\PCI Audio Applications]
[HKLM\Software\PepiMK Software]
[HKLM\Software\Piriform]
[HKLM\Software\Policies]
[HKLM\Software\PopCap]
[HKLM\Software\Program Groups]
[HKLM\Software\Razorworks]
[HKLM\Software\Redemption??]
[HKLM\Software\SECURITOO]
[HKLM\Software\SPAMfighter]
[HKLM\Software\Safer Networking Limited]
[HKLM\Software\Secure]
[HKLM\Software\SiS]
[HKLM\Software\Sierra On-Line]
[HKLM\Software\Sierra OnLine]
[HKLM\Software\Skype]
[HKLM\Software\SoftAssist]
[HKLM\Software\SoftShape]
[HKLM\Software\Sonic]
[HKLM\Software\Sweex]
[HKLM\Software\TRAVELLERSTALESTOYSTORY2]
[HKLM\Software\Techcity]
[HKLM\Software\TerraVirtual]
[HKLM\Software\The Learning Company]
[HKLM\Software\The Silicon Realms Toolworks]
[HKLM\Software\Thomson]
[HKLM\Software\Titus]
[HKLM\Software\Trolltech]
[HKLM\Software\UBISOFT]
[HKLM\Software\Ulead Systems]
[HKLM\Software\Valve]
[HKLM\Software\VideoLAN]
[HKLM\Software\Virtools]
[HKLM\Software\Voice]
[HKLM\Software\WINDOWS]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\Winsock2]
[HKLM\Software\lameme]
[HKLM\Software\mozilla.org]
[HKLM\Software\muvee Technologies]
[HKLM\Software\travellerstalesbuzz2k]
~ Scan Softwares in 00mn 00s
le 03 Oct 2011 17:35
Rapport de ZHPDiag v1.28.1350 par Nicolas Coolman, Update du 20/09/2011
Run by Administrateur at 29/10/2002 01:47:39
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
---\\ Web Browser
MSIE: Internet Explorer v6.0.2800.1106 (Defaut)
---\\ Windows Product Information
Windows 2000 Professional Service Pack 4 (Build 2195)
Windows Server License Manager Script : Absent (Not found)
Windows ID Activation : Inconnue (Unknown)
Windows Licence : Inconnue (Unknown)
Windows Automatic Updates : OK
---\\ System Information
~ Processor: x86 Family 6 Model 6 Stepping 2, AuthenticAMD
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 767 MB (63% free)
System Restore: Inconnu (Unknown)
System drive C: has 10 GB (53%) free of 20 GB
---\\ Logged in mode
~ Computer Name: LAROSEGRENIER
~ User Name: Administrateur
~ All Users Names: Rémi, rousseau, Administrateur,
~ Unselected Option: O43,O61
~ Logged in as Unknown
---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Documents and Settings\Administrateur\Application Data\
~ %Desktop% : C:\Documents and Settings\Administrateur\Bureau\
~ %Favorites% : C:\Documents and Settings\Administrateur\Favoris\
~ %LocalAppData% : C:\Documents and Settings\Administrateur\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\Administrateur\Menu Démarrer\
~ %Windir% : C:\WINNT\s\
~ %System% : C:\WINNT\system32\
---\\ DOS/Devices
A:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
C:\ Hard drive, Flash drive, Thumb drive (Free 10 Go of 20 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 7 Go of 9 Go)
E:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
F:\ CD-ROM drive (Not Inserted)
---\\ Security Center & Tools Informations
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoDesktop: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoStartMenuSubFolder: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoResolveSearch: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoClose: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] WarnOnHTTPSToHTTPRedirect: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
~ Scan Security Center in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.61CF5B74A4B5FE430F87E9259B7E4F60] - (....) (.29/10/2002 - 00:00:00.) -- C:\WINNT\system32\rundll32.exe [10000]
[MD5.CDA73F069C9976EBBA4438170A618F95] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.29/10/2002 - 17:24:06.) -- C:\WINNT\system32\wininet.dll [590336]
[MD5.E211511865C8532E1BF44D5C5E8B947B] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\Winlogon.exe [185616]
[MD5.8C718AA8C77041B3285D55A0CE980867] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\atapi.sys [86672]
[MD5.F6AB0E765D5B80443B93C52C42F2602A] - (.Microsoft Corporation - NT File System Driver.) (.29/10/2002 - 11:05:04.) -- C:\WINNT\system32\drivers\ntfs.sys [534192]
~ Scan Generic Processes in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 0/5
~ Mes musiques (My Musics) : 0/0
~ Mes Videos (My Video) : 0/0
~ Mes Favoris (My Favorites) : 1/5
~ Mes Documents (My Documents) : 4/367
~ Mon Bureau (My Desktop) : 0/14
~ Menu demarrer (Programs) : 0/30
~ Scan Hidden Files in 00mn 00s
---\\ Processus lancés
[MD5.CB143DCD8864442CFCF37629002766E3] - (.ESET - ESET Service.) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [974944] [PID.]
[MD5.683A07B982832426128B684B7366710F] - (.Hewlett-Packard Company - LightScribe Service.) -- C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [79400] [PID.]
[MD5.B3A6BC70F941A92DA318F3BD44362BCC] - (.Microsoft Corporation - Remote Registry Service.) -- C:\WINNT\system32\regsvc.exe [68368] [PID.]
[MD5.409995AA9BC32033FD00A03413F8905F] - (.Microsoft Corporation - Moteur du Planificateur de tâches.) -- C:\WINNT\system32\MSTask.exe [121104] [PID.]
[MD5.974EE1A488A7AF678F84826B588D4AF1] - (.Microsoft Corporation - Infrastructure de gestion Windows.) -- C:\WINNT\System32\WBEM\WinMgmt.exe [196706] [PID.]
[MD5.02B98BB104281570C6C4F926069CBAFF] - (.ESET - ESET GUI.) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [3076144] [PID.1008]
[MD5.ECE648CDC3A09421E996DFFDA76F5C53] - (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [153136] [PID.612]
[MD5.1303337E1B3DB25584C29E30E22AC8E5] - (.Sweex Europe BV - Sweex WiFi Utility.) -- C:\Program Files\Sweex\Installer\Win2k\SWU.exe [598016] [PID.600]
[MD5.060DAF68493AD7ADF104413E5A62AFA8] - (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe [271920] [PID.]
[MD5.B920AAF7ABEA489AC415DD38AD7B76CD] - (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe [1209904] [PID.]
[MD5.6D5884C13D655DD1C9E65AFCC19A8D5C] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe [91136] [PID.1624]
[MD5.B26A2F3CD6459548DB6891D138080876] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [2121216] [PID.480]
~ Scan Processes Running in 00mn 00s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com
R0 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.google.com
R1 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (...) (No version) -- %SystemRoot%\System32\shdocvw.dll
~ Scan IE Browser in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Scan Proxy management in 00mn 00s
---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Scan Keys in 00mn 00s
---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Scan Hosts File in 00mn 00s
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} . (.Adobe Systems Incorporated - Adobe Acrobat IE Helper Version 6.0 for Act.) -- C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
~ Scan BHO in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} . (.Microsoft Corporation - Contrôle ActiveX du Lecteur Windows Media.) -- C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (...) -- (.not file.)
~ Scan Toolbar in 00mn 00s
---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Synchronization Manager] . (.Microsoft Corporation - Gestionnaire de synchronisation Microsoft.) -- C:\WINNT\system32\mobsync.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Computer, Inc. - Pas de description.) -- C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [egui] . (.ESET - ESET GUI.) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype. Take a deep breath.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
O4 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\..\Run: [Skype] . (.Skype Technologies S.A. - Skype. Take a deep breath.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-436374069-152049171-1343024091-500\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] . (.Microsoft Corporation - Assistant Connexion Internet.) -- C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe
~ Scan Application in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Adobe Reader 6.0.lnk . (...) -- C:\WINNT\Installer\{AC76BA86-7AD7-1036-7B44-A00000000001}\SC_Reader_PM.ico
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\Microsoft Office Word Viewer 2003.lnk . (...) -- C:\WINNT\Installer\{9085040C-6000-11D3-8CFE-0150048383C9}\wrdvicon.exe
O4 - Global Startup: C:\Documents And Settings\All Users\Menu Démarrer\Programmes\ZHPDiag.lnk . (...) -- C:\Program Files\ZHPDiag\ZHP2.exe (.not file.)
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Fatman Adventures.lnk . (.Another Day Ltd.) -- C:\Program Files\Another Day\Fatman Adventures\Fatman.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Free Spider.lnk . (.TreeCardGames.com.) -- C:\Program Files\Free Spider\FreeSpider.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Lecteur Windows Media.lnk . (.Microsoft Corporation.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - Global Startup: C:\Documents And Settings\Administrateur\Menu Démarrer\Programmes\Outlook Express.lnk . (.Microsoft Corporation.) -- C:\Program Files\Outlook Express\msimn.exe
~ Scan Global Startup in 00mn 00s
---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xporter vers Microsoft Excel . (.Microsoft Corporation - Microsoft Office Excel.) -- C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.exe
~ Scan IE Menu Contextuel in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} . (...) -- C:\PROGRA~1\Skype\Toolbars\INTERN~1\favicon.ico
O9 - Extra button: Skype - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\PROGRA~1\MICROS~3\OFFICE11\REFBARH.ICO
~ Scan IE Extra Buttons in 00mn 00s
---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Windows Socket2 NameSpace DLL.) -- C:\WINNT\system32\rnr20.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINNT\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Service client pour le fournisseur NetWare et DLL d'authentification.) -- C:\WINNT\system32\nwprovau.dll
~ Scan Winsock in 00mn 00s
---\\ Internet Explorer Plugins (O12)
O12 - Plugin for .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
~ Scan IE Extra Buttons in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: DirectAnimation Java Classes - (DirectAnimation Java Classes) - (.not file.) - file:\\C:\WINNT\Java\classes\dajava.cab
O16 - DPF: Microsoft XML Parser for Java - (Microsoft XML Parser for Java) - (.not file.) - file:\\C:\WINNT\Java\classes\xmldso.cab
~ Scan Objets ActiveX in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{712A0CF2-E39F-416B-9EC8-33B9851F3C08}: NameServer = 192.168.3.1,192.168.3.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{712A0CF2-E39F-416B-9EC8-33B9851F3C08}: NameServer = 192.168.3.1,192.168.3.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{712A0CF2-E39F-416B-9EC8-33B9851F3C08}: NameServer = 192.168.3.1,192.168.3.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{C7C312EA-1A7D-41EC-BDDC-898225BEA427}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{C3E7E817-57D3-4343-A381-4F3D845EF07F}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{C7C312EA-1A7D-41EC-BDDC-898225BEA427}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{EA6859E8-F8BB-4906-8D8F-338CFFAE1386}: DhcpDomain = lan
~ Scan Domain in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\WINNT\System32\itss.dll
O18 - Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} . (...) -- C:\WINNT\s\System32\inetcomm.dll
O18 - Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} . (.Microsoft Corporation - Microsoft® InfoTech Storage System Library.) -- C:\WINNT\System32\itss.dll
O18 - Handler: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} . (.Microsoft Corporation - Microsoft Office XP Web Components.) -- C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Handler: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} . (.Microsoft Corporation - Microsoft Office Web Components 2003.) -- C:\PROGRA~1\FICHIE~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- C:\WINNT\s\system32\mshtml.dll
O18 - Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} . (.Microsoft Corporation - Contrôle ActiveX du Lecteur Windows Media.) -- C:\WINNT\system32\msdxm.ocx
O18 - Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\WINNT\system32\urlmon.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} . (...) -- C:\WINNT\s\system32\shell32.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
~ Scan Protocole Additionnel in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINNT\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINNT\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent Réseau hors-connexion.) -- C:\WINNT\system32\cscdll.dll
O20 - Winlogon Notify: nwprovau . (.Microsoft Corporation - Service client pour le fournisseur NetWare.) -- C:\WINNT\system32\nwprovau.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINNT\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINNT\system32\WlNotify.dll
O20 - Winlogon Notify: wzcnotif . (.Microsoft Corporation - UI du service de configuration automatique.) -- C:\WINNT\system32\wzcdlg.dll
~ Scan Winlogon in 00mn 00s
---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: Network.ConnectionTray - {7007ACCF-3202-11D1-AAD2-00805FC1270E} . (.Microsoft Corporation - Noyau des Connexions réseau.) -- C:\WINNT\system32\NETSHELL.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (....) -- C:\WINNT\s\System32\webcheck.dll (.not file.)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINNT\system32\stobject.dll
~ Scan SSODL in 00mn 00s
---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (...) -- C:\WINNT\s\System32\browseui.dll
O22 - SharedTaskScheduler: (no name) - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (...) -- C:\WINNT\s\System32\browseui.dll
~ Scan STS/SSO in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Avertissement (Alerter) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Explorateur d'ordinateur (Browser) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Client DHCP (Dhcp) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Gestionnaire de disque logique (dmserver) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Client DNS (Dnscache) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: ESET Service (ekrn) . (.ESET - ESET Service.) - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Journal des événements (Eventlog) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Serveur (lanmanserver) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Station de travail (lanmanworkstation) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) . (.Hewlett-Packard Company - LightScribe Service.) - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Service d'application d'assistance TCP/IP NetBIOS (LmHosts) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Affichage des messages (Messenger) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Service client pour NetWare (NWCWorkstation) . (...) - C:\WINNT\s\System32\services.exe (.not file.)
O23 - Service: Plug-and-Play (PlugPlay) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Agent de stratégie IPSEC (PolicyAgent) . (...) - C:\WINNT\s\System32\lsass.exe (.not file.)
O23 - Service: Emplacement protégé (ProtectedStorage) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Service d'accès à distance au Registre (RemoteRegistry) . (...) - C:\WINNT\s\system32\regsvc.exe (.not file.)
O23 - Service: Planificateur de tâches (Schedule) . (...) - C:\WINNT\s\system32\MSTask.exe (.not file.)
O23 - Service: Service d'exécution par délégation (seclogon) . (...) - C:\WINNT\s\system32\services.exe (.not file.)
O23 - Service: Spouleur d'impression (Spooler) . (...) - C:\WINNT\s\system32\spoolsv.exe (.not file.)
O23 - Service: Infrastructure de gestion Windows (WinMgmt) . (...) - C:\WINNT\s\System32\WBEM\WinMgmt.exe (.not file.)
~ Scan Services in 00mn 00s
---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Office Word.) - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe
~ Scan Desktop Component in 00mn 00s
---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINNT\system32\DRIVERS\cdrom.sys
O41 - Driver: (ehdrv) . (.ESET - ESET Helper driver.) - C:\WINNT\system32\DRIVERS\ehdrv.sys
O41 - Driver: (epfwtdir) . (.ESET - ESET Antivirus Network Redirector.) - C:\WINNT\system32\DRIVERS\epfwtdir.sys
O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\WINNT\system32\DRIVERS\i8042prt.sys
O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\WINNT\system32\DRIVERS\kbdclass.sys
O41 - Driver: (Mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\WINNT\system32\DRIVERS\mouclass.sys
O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINNT\system32\DRIVERS\mrxsmb.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINNT\system32\DRIVERS\netbios.sys
O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINNT\system32\DRIVERS\netbt.sys
O41 - Driver: (Parport) . (.Microsoft Corporation - Pilote de port parallèle.) - C:\WINNT\system32\DRIVERS\parport.sys
O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINNT\system32\DRIVERS\rasacd.sys
O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINNT\system32\DRIVERS\rdbss.sys
O41 - Driver: (redbook) . (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) - C:\WINNT\system32\DRIVERS\redbook.sys
O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\WINNT\system32\DRIVERS\serial.sys
O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP driver.) - C:\WINNT\system32\DRIVERS\tcpip.sys
O41 - Driver: (VgaSave) . (. - .) - C:\WINNT\s\system32\drivers\vga.sys (.not file.)
~ Scan Drivers in 00mn 00s
---\\ Logiciels installés (O42)
O42 - Logiciel: Adobe Flash Player 9 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- ShockwaveFlash
O42 - Logiciel: Adobe Flash Player ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Shockwave Player - (.Adobe Systems, Inc..) [HKLM] -- Adobe Shockwave Player
O42 - Logiciel: C-Media Audio - (.Pas de propriétaire.) [HKLM] -- C-Media Audio
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: Compte pour Windows - (.Pas de propriétaire.) [HKLM] -- ST6UNST #1
O42 - Logiciel: Encyclopédie Hachette Multimédia - (.Pas de propriétaire.) [HKLM] -- Encyclopédie Hachette Multimédia
O42 - Logiciel: F-16 Demo - (.Pas de propriétaire.) [HKLM] -- F-16 Demo
O42 - Logiciel: F-22 Lightning 3 - (.Pas de propriétaire.) [HKLM] -- F-22 Lightning 3
O42 - Logiciel: FA-18 Hornet 3.0 - (.Pas de propriétaire.) [HKLM] -- FA-18 Hornet 3.0
O42 - Logiciel: Fatman Adventures - (.Another Day.) [HKLM] -- Fatman Adventures_is1
O42 - Logiciel: Free Spider - (.TreeCardGames.com.) [HKLM] -- Free Spider
O42 - Logiciel: Lock On: Air Combat Simulation - (.Pas de propriétaire.) [HKLM] -- {E90DCEE9-DC27-401B-A7AC-B0AFF5B34E4D}
O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.2.1300 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: QuickTime - (.Pas de propriétaire.) [HKLM] -- QuickTime
O42 - Logiciel: SiS 900 PCI Fast Ethernet Adapter Driver - (.Pas de propriétaire.) [HKLM] -- SiSLan
O42 - Logiciel: Sierra Utilities - (.Pas de propriétaire.) [HKLM] -- Sierra Utilities
O42 - Logiciel: Sweex WiFi Utility - (.Sweex.) [HKLM] -- {356D234E-3AD4-4495-B5CD-9AC1C05A19C8}
O42 - Logiciel: Talisman 3 - (.Pas de propriétaire.) [HKLM] -- Talisman 3
O42 - Logiciel: Tout le Primaire 2005 AutoProtect_Internet - (.Novosoft International.) [HKLM] -- InstallShield_{A26DEB76-8AC3-4F6A-8AEC-F201D30BFC81}
O42 - Logiciel: Ulead Photo Explorer 8.0 SE Basic - (.Ulead Systems, Inc..) [HKLM] -- {D271DAE0-8D68-4C97-8356-A126D48A1D8C}
O42 - Logiciel: Windows Installer 3.0 (KB884016) - (.Microsoft Corporation.) [HKLM] -- MSI30-KB884016
O42 - Logiciel: adsl TV - (.adsl TV / FM.) [HKLM] -- {3AFDD2C6-8663-46B5-B195-6CEB00D44768}
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\Adobe]
[HKCU\Software\Ahead]
[HKCU\Software\Another Day]
[HKCU\Software\Aurigma]
[HKCU\Software\Binary Noise]
[HKCU\Software\Borland]
[HKCU\Software\Classes]
[HKCU\Software\Dacris Software]
[HKCU\Software\ESET]
[HKCU\Software\Free-backup.info]
[HKCU\Software\GNU]
[HKCU\Software\GSpot Appliance Corp]
[HKCU\Software\Gabest]
[HKCU\Software\Game Maker 4]
[HKCU\Software\GameSpy]
[HKCU\Software\Google]
[HKCU\Software\Haali]
[HKCU\Software\Intel]
[HKCU\Software\InterVideo]
[HKCU\Software\JEDI-VCL]
[HKCU\Software\Jasc]
[HKCU\Software\Kodak]
[HKCU\Software\LeaderTech]
[HKCU\Software\LightScribe]
[HKCU\Software\Lighttek]
[HKCU\Software\Local AppWizard-Generated Applications]
[HKCU\Software\Macromedia]
[HKCU\Software\MainConcept]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MaxiWare]
[HKCU\Software\MaximumSoft]
[HKCU\Software\Netscape]
[HKCU\Software\ODBC]
[HKCU\Software\OXXOgames]
[HKCU\Software\Opendisc]
[HKCU\Software\PIXELA]
[HKCU\Software\Panda Software]
[HKCU\Software\PepiMK Software]
[HKCU\Software\Piriform]
[HKCU\Software\Pointsoft]
[HKCU\Software\Policies]
[HKCU\Software\PopCap]
[HKCU\Software\Redemption??]
[HKCU\Software\Safer Networking Limited]
[HKCU\Software\SecuROM]
[HKCU\Software\Skype]
[HKCU\Software\Sony Corporation]
[HKCU\Software\TechSmith]
[HKCU\Software\Terravirtual]
[HKCU\Software\TurboPower]
[HKCU\Software\ULead]
[HKCU\Software\Ulead Systems]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\Valve]
[HKCU\Software\Virtools]
[HKCU\Software\WOI]
[HKCU\Software\Warthog]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\shockwave.com]
[HKLM\Software\ALWIL Software]
[HKLM\Software\ATI Technologies]
[HKLM\Software\Absolutist]
[HKLM\Software\Adaptec]
[HKLM\Software\Adobe]
[HKLM\Software\Ahead]
[HKLM\Software\Another Day]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Audible]
[HKLM\Software\BBC Multimedia]
[HKLM\Software\BackWeb]
[HKLM\Software\Big Fish Games]
[HKLM\Software\BigFish]
[HKLM\Software\Borland]
[HKLM\Software\C-Media]
[HKLM\Software\C07ft5Y]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Contrôle Parental]
[HKLM\Software\DPAv3]
[HKLM\Software\Disney Interactive]
[HKLM\Software\ESET]
[HKLM\Software\Electronic Arts]
[HKLM\Software\FX Interactive]
[HKLM\Software\Fish Technology Group]
[HKLM\Software\GNU]
[HKLM\Software\Gabest]
[HKLM\Software\GameOverGames]
[HKLM\Software\Gemplus]
[HKLM\Software\Google]
[HKLM\Software\INTEL]
[HKLM\Software\InstallShield]
[HKLM\Software\Kodak]
[HKLM\Software\L&H]
[HKLM\Software\Licenses]
[HKLM\Software\LightScribe]
[HKLM\Software\MDC]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MicroQuill]
[HKLM\Software\Mindscape]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\Name of your company]
[HKLM\Software\Nero]
[HKLM\Software\NovaLogic]
[HKLM\Software\ODBC]
[HKLM\Software\OldTimer Tools]
[HKLM\Software\PCI Audio Applications]
[HKLM\Software\PepiMK Software]
[HKLM\Software\Piriform]
[HKLM\Software\Policies]
[HKLM\Software\PopCap]
[HKLM\Software\Program Groups]
[HKLM\Software\Razorworks]
[HKLM\Software\Redemption??]
[HKLM\Software\SECURITOO]
[HKLM\Software\SPAMfighter]
[HKLM\Software\Safer Networking Limited]
[HKLM\Software\Secure]
[HKLM\Software\SiS]
[HKLM\Software\Sierra On-Line]
[HKLM\Software\Sierra OnLine]
[HKLM\Software\Skype]
[HKLM\Software\SoftAssist]
[HKLM\Software\SoftShape]
[HKLM\Software\Sonic]
[HKLM\Software\Sweex]
[HKLM\Software\TRAVELLERSTALESTOYSTORY2]
[HKLM\Software\Techcity]
[HKLM\Software\TerraVirtual]
[HKLM\Software\The Learning Company]
[HKLM\Software\The Silicon Realms Toolworks]
[HKLM\Software\Thomson]
[HKLM\Software\Titus]
[HKLM\Software\Trolltech]
[HKLM\Software\UBISOFT]
[HKLM\Software\Ulead Systems]
[HKLM\Software\Valve]
[HKLM\Software\VideoLAN]
[HKLM\Software\Virtools]
[HKLM\Software\Voice]
[HKLM\Software\WINDOWS]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\Winsock2]
[HKLM\Software\lameme]
[HKLM\Software\mozilla.org]
[HKLM\Software\muvee Technologies]
[HKLM\Software\travellerstalesbuzz2k]
~ Scan Softwares in 00mn 00s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.6EB2473615B439544104C85692AAA704] - 14/11/2002 - 18:57:09 ---A- . (...) -- C:\WINNT\system32\Perflib_Perfdata_2ec.dat [16384]
O44 - LFC:[MD5.BD8D29294CD8C44651852239BCE66CDA] - 10/11/2002 - 19:57:15 ---A- . (.TechSmith Corporation - TechSmith Screen Capture Codec.) -- C:\WINNT\system32\tsccvid.dll [110592]
O44 - LFC:[MD5.ACB3CC1E571BCC65FE7A648C9DD45139] - 29/10/2002 - 12:13:51 ---A- . (...) -- C:\cleannavi.txt [1349]
O44 - LFC:[MD5.D79D3F46B9A55A27474BBD544878B1F2] - 29/10/2002 - 01:06:56 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINNT\system32\drivers\mbam.sys [20552]
O44 - LFC:[MD5.FF4E41DD2F9F4CCD2A486D51E31E9803] - 29/10/2002 - 00:26:54 ---A- . (...) -- C:\PhysicalMBR.bin [512]
O44 - LFC:[MD5.C052C79E2D8F3622EA20A335E1807859] - 29/10/2002 - 00:17:10 ---A- . (...) -- C:\TDSSKiller.2.6.4.0_29.10.2002_00.13.35_log.txt [42552]
O44 - LFC:[MD5.17396157340A624C5A6A22A8EE95F8A8] - 29/10/2002 - 00:14:52 ---A- . (...) -- C:\WINNT\system32\Perflib_Perfdata_2d4.dat [16384]
O44 - LFC:[MD5.B46511760B9F628A71003B8F8FF4A7D9] - 29/10/2002 - 00:03:27 ---A- . (...) -- C:\WINNT\system32\Perflib_Perfdata_138.dat [16384]
~ Scan Files in 00mn 03s
---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys . (.VERITAS Software Corp. - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINNT\system32\Drivers\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys . (.VERITAS Software Corp. - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINNT\system32\Drivers\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys . (.VERITAS Software Corp. - NT Disk Manager Startup Driver.) -- C:\WINNT\system32\Drivers\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (.Microsoft Corporation - Pilote de filtre souris série.) -- C:\WINNT\system32\Drivers\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sglfb.sys . (...) -- C:\WINNT\system32\Drivers\sglfb.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\tga.sys . (...) -- C:\WINNT\system32\Drivers\tga.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINNT\system32\Drivers\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\WINNT\system32\Drivers\vgasave.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys . (.VERITAS Software Corp. - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINNT\system32\Drivers\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys . (.VERITAS Software Corp. - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINNT\system32\Drivers\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys . (.VERITAS Software Corp. - NT Disk Manager Startup Driver.) -- C:\WINNT\system32\Drivers\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\nbf.sys . (.Microsoft Corporation - NetBEUI Frames Protocol Driver.) -- C:\WINNT\system32\Drivers\nbf.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (.Microsoft Corporation - Pilote de filtre souris série.) -- C:\WINNT\system32\Drivers\sermouse.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sglfb.sys . (...) -- C:\WINNT\system32\Drivers\sglfb.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tga.sys . (...) -- C:\WINNT\system32\Drivers\tga.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINNT\system32\Drivers\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\WINNT\system32\Drivers\vgasave.sys (.not file.)
~ Scan CSB in 00mn 00s
---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ Scan IFEO in 00mn 00s
---\\ Trojan Driver Search Data (HKLM) (O52)
O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - Codec audio TrueSpeech(TM) DSP Group pour MSACM V3.50.) -- C:\WINNT\system32\tssoft32.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Codec Cinepak®.) -- C:\WINNT\system32\iccvid.dll
O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (...) -- C:\WINNT\system32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (...) -- C:\WINNT\system32\ir32_32.dll
O52 - TDSD: \Drivers32\"msacm.iac2"="C:\WINNT\System32\iac25_32.ax" . (...) -- (.not file.)
O52 - TDSD: \Drivers32\"vidc.iv50"="ir50_32.dll" . (.Intel Corporation - Intel Indeo® video 5.10.) -- C:\WINNT\system32\ir50_32.dll
O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINNT\system32\sl_anet.acm
O52 - TDSD: \Drivers32\"msacm.l3acm"="l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\WINNT\system32\l3codeca.acm
O52 - TDSD: \Drivers32\"VIDC.IYUV"="iyuv_32.dll" . (.Intel(R) Corporation - Intel Indeo(R) Video YUV R2.0.) -- C:\WINNT\system32\iyuv_32.dll
O52 - TDSD: \Drivers32\"VIDC.YVU9"="tsbyuv.dll" . (.Toshiba Corporation - Toshiba Video 1.) -- C:\WINNT\system32\tsbyuv.dll
O52 - TDSD: \Drivers32\"vidc.tscc"="tsccvid.dll" . (.TechSmith Corporation - TechSmith Screen Capture Codec.) -- C:\WINNT\system32\tsccvid.dll
O52 - TDSD: \drivers.desc\"C:\WINNT\System32\iac25_32.ax"="Indeo® audio software" . (...) -- (.not file.)
O52 - TDSD: \drivers.desc\"ir50_32.dll"="Indeo® video 5.10" . (...) -- (.not file.)
O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINNT\system32\sl_anet.acm
O52 - TDSD: \drivers.desc\"C:\WINNT\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (...) -- (.not file.)
O52 - TDSD: \drivers.desc\"tsccvid.dll"="TechSmith Screen Capture Codec" . (.TechSmith Corporation - TechSmith Screen Capture Codec.) -- C:\WINNT\system32\tsccvid.dll
O52 - TDSD: \drivers.desc\"xvidvfw.dll"=" XviD MPEG-4 Video Codec" . (...) -- (.not file.)
~ Scan Keys in 00mn 00s
---\\ Microsoft Control Security Providers (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINNT\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINNT\system32\schannel.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINNT\system32\digest.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINNT\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINNT\system32\schannel.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINNT\system32\digest.dll
~ Scan Keys in 00mn 00s
---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
~ Scan Keys in 00mn 00s
---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=149
O56 - MWPE:[HKCU\...\policies\Explorer] - "CDRAutoRun"=0
~ Scan Keys in 00mn 00s
---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.DCEE132D2F76C47B209EDD8E6B588608] - 29/10/2002 - 20:37:25 ---A- . (.Meetinghouse Data Communications - IEEE 802.1X Protocol Driver.) -- C:\WINNT\system32\drivers\AegisP.sys [19387]
O58 - SDL:[MD5.AB3ACDFED1A8F4EE6162F640D42C0234] - 29/10/2002 - 22:10:50 ---A- . (.ATI Technologies Inc. - Pilote de miniport ATIRAGE3.) -- C:\WINNT\system32\drivers\atimpab.sys [71792]
O58 - SDL:[MD5.7C962A809AB27F6F287F73BF2D811FB9] - 29/10/2002 - 13:54:04 ---A- . (.Service & Quality Technology. - Universal Serial Bus Camera Driver.) -- C:\WINNT\system32\drivers\Camd905c.sys [25216]
O58 - SDL:[MD5.6F6A0307C30B33E65AAF52C46CEA2ECD] - 29/10/2002 - 09:23:32 ---A- . (.Service & Quality Technology. - Universal Serial Bus Camera Driver.) -- C:\WINNT\system32\drivers\Capt905c.sys [35328]
O58 - SDL:[MD5.BF79E659C506674C0497CC9C61F1A165] - 29/10/2002 - 02:00:00 ---A- . (.Sonic Solutions - CDR4 CD and DVD Place Holder Driver (see PxHelp).) -- C:\WINNT\system32\drivers\cdr4_2k.sys [2432]
O58 - SDL:[MD5.2C41CD49D82D5FD85C72D57B6CA25471] - 29/10/2002 - 02:00:00 ---A- . (.Sonic Solutions - CDRAL Place Holder Driver (see PxHelp).) -- C:\WINNT\system32\drivers\cdralw2k.sys [2560]
O58 - SDL:[MD5.3918528E4992DE465483A9688D3684EC] - 29/10/2002 - 00:00:00 ---A- . (.RAVISENT Technologies Inc. - Pilote principal CineMaster C 1.2 WDM.) -- C:\WINNT\system32\drivers\cinemst2.sys [272496]
O58 - SDL:[MD5.7A75FB83733CE56E529F0E0742A6A63F] - 29/10/2002 - 07:27:02 ---A- . (.C-Media Inc - C-Media Audio WDM Driver.) -- C:\WINNT\system32\drivers\cmuda.sys [389135]
O58 - SDL:[MD5.FA45DDCD183F7CF307821854CADB61B4] - 29/10/2002 - 11:05:04 ---A- . (.VERITAS Software Corp. - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINNT\system32\drivers\dmboot.sys [369104]
O58 - SDL:[MD5.8ACEDA70A5962B5EF908203E3D91CF5F] - 29/10/2002 - 11:05:04 ---A- . (.VERITAS Software Corp. - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINNT\system32\drivers\dmio.sys [138096]
O58 - SDL:[MD5.3F1701FFA97AB012685ABC8A2D6FCE22] - 29/10/2002 - 11:05:04 ---A- . (.VERITAS Software Corp. - NT Disk Manager Startup Driver.) -- C:\WINNT\system32\drivers\dmload.sys [7312]
O58 - SDL:[MD5.9309C5C9831203436E64CF2AE605C5D7] - 29/10/2002 - 13:57:10 ---A- . (.ESET - Amon monitor.) -- C:\WINNT\system32\drivers\eamon.sys [154136]
O58 - SDL:[MD5.DEFF87F04AB5F6DD5EDF2B80853BBE10] - 29/10/2002 - 09:20:36 ---A- . (.ESET - ESET Helper driver.) -- C:\WINNT\system32\drivers\ehdrv.sys [118104]
O58 - SDL:[MD5.06C65AC0A703CF8EEA4F284D901A1550] - 29/10/2002 - 09:20:38 ---A- . (.ESET - ESET Antivirus Network Redirector.) -- C:\WINNT\system32\drivers\epfwtdir.sys [103112]
O58 - SDL:[MD5.2103BD93DCB8E267AED829CB24C6A427] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\drivers\lvcam.sys [88816]
O58 - SDL:[MD5.AEF9AA9261DC271095753CC1E1ABEF07] - 29/10/2002 - 00:00:00 ---A- . (.Logitech Inc. - Video Codec.) -- C:\WINNT\system32\drivers\lvcodek.sys [79120]
O58 - SDL:[MD5.2877BBBEE506BEC0BD5388BBA407D730] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\drivers\lvsound.sys [17424]
O58 - SDL:[MD5.D79D3F46B9A55A27474BBD544878B1F2] - 29/10/2002 - 17:00:50 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\WINNT\system32\drivers\mbam.sys [20552]
O58 - SDL:[MD5.A4A897EC59CE8C52D2537DA00128EF40] - 29/10/2002 - 13:29:28 ---A- . (.Windows (R) 2000 DDK provider - Mouse Filter Driver.) -- C:\WINNT\system32\drivers\MOUFILTR.SYS [9548]
O58 - SDL:[MD5.B78775F217255F786C2E8DBE4334E413] - 29/10/2002 - 11:05:04 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINNT\system32\drivers\ptilink.sys [17680]
O58 - SDL:[MD5.70AEEC67E87A2002E6B2CC353D56E222] - 29/10/2002 - 19:50:06 ---A- . (.Ralink Technology Inc. - Sample Driver for Ralink 802.11g Wireless USB Adapters.) -- C:\WINNT\system32\drivers\rt2500usb.SYS [245376]
O58 - SDL:[MD5.6EA04A4370609E5E1EAEEE898A2AB6AC] - 29/10/2002 - 19:46:28 ---A- . (.Ralink Technology, Corp. - Ralink 802.11 USB Wireless Adapter Driver.) -- C:\WINNT\system32\drivers\rt73.sys [252928]
O58 - SDL:[MD5.890CADA2AB7ACF53A5F9CCE7515522A2] - 29/10/2002 - 13:50:20 ---A- . (.Macrovision Europe Ltd - Macrovision SECURITY Driver.) -- C:\WINNT\system32\drivers\SECDRV.SYS [12464]
O58 - SDL:[MD5.5347889F06F2EA2D87D184CA9836E31D] - 29/10/2002 - 09:11:02 R--A- . (.Silicon Integrated Systems Corporation - SiS NT AGP Filter.) -- C:\WINNT\system32\drivers\SISAGP.SYS [23415]
O58 - SDL:[MD5.7931460CC1BE8E6D6CE59BE3630D3929] - 29/10/2002 - 10:53:10 R--A- . (.SiS Corporation - SiS PCI Fast Ethernet Adapter Driver.) -- C:\WINNT\system32\drivers\sisnic.sys [34915]
O58 - SDL:[MD5.9504A852C45AFF5C61A3183445FB34A7] - 29/10/2002 - 05:14:52 R--A- . (.Texas Instruments - TI ACX100 WLAN Driver.) -- C:\WINNT\system32\drivers\TNET1130.sys [396623]
O58 - SDL:[MD5.30F4123FA4E82F72CD3B3554B17D27D5] - 29/10/2002 - 00:00:00 ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINNT\system32\drivers\tsbvcap.sys [22000]
O58 - SDL:[MD5.0B1065656E0F9AA72DB73AA6A7C93DF4] - 29/10/2002 - 00:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINNT\system32\drivers\vdmindvd.sys [59280]
O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\ansi.sys [9037]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\country.sys [27097]
O58 - SDL:[MD5.C6D29F29DE7427B1B0775E53E577B623] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\himem.sys [4912]
O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\key01.sys [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\KEYBOARD.SYS [42537]
O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\NTDOS.SYS [27866]
O58 - SDL:[MD5.F95818D2D4F032458DEA3C6086B68C34] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\ntdos404.sys [29146]
O58 - SDL:[MD5.51737453EC885A127194D4981B2D2890] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\ntdos411.sys [29370]
O58 - SDL:[MD5.F50815636C53F200A3DF46B2ABACB66E] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\ntdos412.sys [29274]
O58 - SDL:[MD5.51C48AB85E0AAAE601AC2FA22DE5B422] - 29/10/2002 - 00:00:00 ---A- . (...) -- C:\WINNT\system32\ntdos804.sys [29146]
O58 - SDL:[MD5.B11D8D063B76F9DF41BB4AB85FE7C3BB] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\NTIO.SYS [33824]
O58 - SDL:[MD5.E0BD6AD1524C84650DDE1958DC2AF495] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\ntio404.sys [34544]
O58 - SDL:[MD5.0879C7C88665DF39C1F8AC6874D7B915] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\ntio411.sys [35648]
O58 - SDL:[MD5.08A0B881AAE6CA0A4FFB4EE1D20D35D1] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\ntio412.sys [35408]
O58 - SDL:[MD5.92579AC40036F1A547C75FBD842C7A66] - 29/10/2002 - 11:05:04 ---A- . (...) -- C:\WINNT\system32\ntio804.sys [34544]
O58 - SDL:[MD5.81A6B927FA784693FBE439574D534888] - 29/10/2002 - 20:45:18 ---A- . (.Printing Communications Assoc., Inc. (PCAUS - PCAUSA NDIS 5.0 Protocol Driver.) -- C:\WINNT\system32\ZDBRGSYS.sys [19200]
O58 - SDL:[MD5.29C917279D79848B3DD94909FC00E2A8] - 29/10/2002 - 10:30:00 ---A- . (.Printing Communications Assoc., Inc. (PCAUS - PCAUSA NDIS 5.0 Protocol Driver.) -- C:\WINNT\system32\ZDPNDIS5.sys [17151]
~ Scan Drivers in 00mn 00s
---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 1.28 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ Scan ADS in 00mn 00s
---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - 08/01/2009 - C:\WINNT\system32\DRIVERS\AegisP.sys - AEGIS Protocol (IEEE 802.1x) v3.4.3.0(AegisP) .(.Meetinghouse Data Communications - IEEE 802.1X Protocol Driver.) - LEGACY_AEGISP
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\drivers\afd.sys (.not file.) - Environnement de prise en charge de réseau AFD (AFD) .(...) - LEGACY_AFD
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Avertissement (Alerter) .(...) - LEGACY_ALERTER
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\services.exe (.not file.) - Gestion d'applications (AppMgmt) .(...) - LEGACY_APPMGMT
O64 - Services: CurCS - ??/??/???? - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bfastfao.sys (.not file.) - No object (No service) .(...) - LEGACY_BFASTFAO
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\svchost.exe (.not file.) - Service de transfert intelligent en arrière-plan (BITS) .(...) - LEGACY_BITS
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Explorateur d'ordinateur (Browser) .(...) - LEGACY_BROWSER
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Client DHCP (Dhcp) .(...) - LEGACY_DHCP
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\dmadmin.exe (.not file.) - Service d'administration du Gestionnaire de disque logique (dmadmin) .(...) - LEGACY_DMADMIN
O64 - Services: CurCS - 19/06/2003 - C:\WINNT\system32\drivers\dmboot.sys - dmboot(dmboot) .(.VERITAS Software Corp. - Pilote de démarrage du gestionnaire de disq.) - LEGACY_DMBOOT
O64 - Services: CurCS - 19/06/2003 - C:\WINNT\system32\drivers\dmload.sys - dmload(dmload) .(.VERITAS Software Corp. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Gestionnaire de disque logique (dmserver) .(...) - LEGACY_DMSERVER
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Client DNS (Dnscache) .(...) - LEGACY_DNSCACHE
O64 - Services: CurCS - 09/08/2011 - C:\WINNT\system32\DRIVERS\eamon.sys - eamon(eamon) .(.ESET - Amon monitor.) - LEGACY_EAMON
O64 - Services: CurCS - 04/08/2011 - C:\WINNT\system32\DRIVERS\ehdrv.sys - ehdrv(ehdrv) .(.ESET - ESET Helper driver.) - LEGACY_EHDRV
O64 - Services: CurCS - 06/09/2011 - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe - ESET Service(ekrn) .(.ESET - ESET Service.) - LEGACY_EKRN
O64 - Services: CurCS - ??/??/???? - C:\OCEASOFT\ThermoServer\emul_local\smartsvc.exe (.not file.) - emul_local (emul_local) .(...) - LEGACY_EMUL_LOCAL
O64 - Services: CurCS - 04/08/2011 - C:\WINNT\system32\DRIVERS\epfwtdir.sys - No object(No service) .(.ESET - ESET Antivirus Network Redirector.) - LEGACY_EPFWTDIR
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\faxsvc.exe (.not file.) - Service de télécopie (Fax) .(...) - LEGACY_FAX
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Serveur (LanmanServer) .(...) - LEGACY_LANMANSERVER
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Station de travail (LanmanWorkstation) .(...) - LEGACY_LANMANWORKSTATION
O64 - Services: CurCS - 15/05/2007 - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe - LightScribeService Direct Disc Labeling Service(LightScribeService) .(.Hewlett-Packard Company - LightScribe Service.) - LEGACY_LIGHTSCRIBESERVICE
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Service d'application d'assistance TCP/IP NetBIOS (LmHosts) .(...) - LEGACY_LMHOSTS
O64 - Services: CurCS - ??/??/???? - C:\WINNT\system32\drivers\mbamswissarmy.sys (.not file.) - MBAMSwissArmy (MBAMSwissArmy) .(...) - LEGACY_MBAMSWISSARMY
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Affichage des messages (Messenger) .(...) - LEGACY_MESSENGER
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\svchost.exe (.not file.) - Connexions réseau (Netman) .(...) - LEGACY_NETMAN
O64 - Services: CurCS - 01/06/2007 - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe - NMIndexingService(NMIndexingService) .(.Nero AG - Nero Home.) - LEGACY_NMINDEXINGSERVICE
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\svchost.exe (.not file.) - Médias amovibles (NtmsSvc) .(...) - LEGACY_NTMSSVC
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Service client pour NetWare (NWCWorkstation) .(...) - LEGACY_NWCWORKSTATION
O64 - Services: CurCS - ??/??/???? - C:\WINNT\system32\PCANDIS5.sys (.not file.) - PCANDIS5 NDIS Protocol Driver (PCANDIS5) .(...) - LEGACY_PCANDIS5
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\lsass.exe (.not file.) - Agent de stratégie IPSEC (PolicyAgent) .(...) - LEGACY_POLICYAGENT
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\services.exe (.not file.) - Emplacement protégé (ProtectedStorage) .(...) - LEGACY_PROTECTEDSTORAGE
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\svchost.exe (.not file.) - Gestionnaire de connexions d'accès distant (RasMan) .(...) - LEGACY_RASMAN
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\svchost.exe (.not file.) - Routage et accès distant (RemoteAccess) .(...) - LEGACY_REMOTEACCESS
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\regsvc.exe (.not file.) - Service d'accès à distance au Registre (RemoteRegistry) .(...) - LEGACY_REMOTEREGISTRY
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\lsass.exe (.not file.) - Gestionnaire de comptes de sécurité (SamSs) .(...) - LEGACY_SAMSS
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\SCardSvr.exe (.not file.) - Prise en charge des cartes à puces (SCardDrv) .(...) - LEGACY_SCARDDRV
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\SCardSvr.exe (.not file.) - Carte à puce (SCardSvr) .(...) - LEGACY_SCARDSVR
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\MSTask.exe (.not file.) - Planificateur de tâches (Schedule) .(...) - LEGACY_SCHEDULE
O64 - Services: CurCS - 29/07/2009 - C:\WINNT\system32\drivers\SECDRV.sys - SecDrv(SecDrv) .(.Macrovision Europe Ltd - Macrovision SECURITY Driver.) - LEGACY_SECDRV
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\services.exe (.not file.) - Service d'exécution par délégation (seclogon) .(...) - LEGACY_SECLOGON
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\svchost.exe (.not file.) - Notification d'événement système (SENS) .(...) - LEGACY_SENS
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\spoolsv.exe (.not file.) - Spouleur d'impression (Spooler) .(...) - LEGACY_SPOOLER
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\stisvc.exe (.not file.) - Still Image Service (StiSvc) .(...) - LEGACY_STISVC
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\smlogsvc.exe (.not file.) - Journaux et alertes de performance (SysmonLog) .(...) - LEGACY_SYSMONLOG
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\svchost.exe (.not file.) - Téléphonie (TapiSrv) .(...) - LEGACY_TAPISRV
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\services.exe (.not file.) - Client de suivi de lien distribué (TrkWks) .(...) - LEGACY_TRKWKS
O64 - Services: CurCS - ??/??/???? - C:\WINNT\system32\DRIVERS\UsbFltr.sys (.not file.) - WayTechUSBFilterDriver (UsbFltr) .(...) - LEGACY_USBFLTR
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\UtilMan.exe (.not file.) - Gestionnaire d'utilitaires (UtilMan) .(...) - LEGACY_UTILMAN
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\drivers\vga.sys (.not file.) - VgaSave (VgaSave) .(...) - LEGACY_VGASAVE
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\WBEM\WinMgmt.exe (.not file.) - Infrastructure de gestion Windows (WinMgmt) .(...) - LEGACY_WINMGMT
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\Services.exe (.not file.) - Extensions du pilote WMI (Wmi) .(...) - LEGACY_WMI
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\drivers\ws2ifsl.sys (.not file.) - Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0 (WS2IFSL) .(...) - LEGACY_WS2IFSL
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\system32\svchost.exe (.not file.) - Mises à jour automatiques (wuauserv) .(...) - LEGACY_WUAUSERV
~ Scan Services in 00mn 01s
---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (...) -- shell32.dll
O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (...) -- C:\WINNT\s\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (...) -- C:\WINNT\s\regedit.exe
O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (...) -- shell32.dll
O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> <htmlfile>[HKCR\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O67 - Shell Spawning: <.js> <JSFile>[HKCR\..\open\Command] (...) -- C:\WINNT\s\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (...) -- C:\WINNT\s\regedit.exe
~ Scan Keys in 00mn 00s
---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- (.Not Key.) (.not file.)
~ Scan Keys in 00mn 00s
---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.5D7625442B125D1A380CC8EE17C5A521] [SPRF][02/10/2011] (...) -- C:\Documents and Settings\Administrateur\Bureau\Navilog1.exe [231562]
[MD5.6A198D34A71DC6E8B067799899423EB9] [SPRF][29/10/2002] (.Kaspersky Lab ZAO - TDSS rootkit removing tool.) -- C:\Documents and Settings\Administrateur\Bureau\tdsskiller.exe [1548080]
[MD5.0B9C8962B4E91BDB3A7EB4F55D454F4B] [SPRF][22/09/2011] (.Nicolas Coolman - ZHPDiag.) -- C:\Documents and Settings\Administrateur\Bureau\ZHPDiag2.exe [2559314]
~ Scan Files in 00mn 00s
---\\ Scan Additionnel (O88)
Database Version : 8700 - (20/09/2011)
Clés trouvées (Keys found) : 7
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0
[HKLM\Software\Classes\toolband.easyhidebtn] =>Toolbar.Agent
[HKLM\Software\Classes\toolband.easyhidebtn.1] =>Toolbar.Agent
[HKLM\Software\Classes\toolband.skypeiehelper] =>Toolbar.Agent
[HKLM\Software\Classes\toolband.skypeiehelper.1] =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\PopCap Games] =>Adware.PopCap
[HKCU\Software\PopCap] =>Adware.PopCap
[HKLM\Software\PopCap] =>Adware.PopCap
~ Scan Additionnel in 00mn 31s
---\\ Recherche détournement de DNS routeur (O89)
Serveurÿ: dsldevice.lan
Address: 192.168.1.254
Nomÿ: www.l.google.com
Addresses: 74.125.39.103, 74.125.39.105, 74.125.39.104, 74.125.39.106
74.125.39.147, 74.125.39.99
Aliases: www.google.fr, www.google.com
~ Scan DNS in 00mn 02s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 0 | (Alerter) . (...) - C:\WINNT\s\System32\services.exe
SS - | Demand 0 | (AppMgmt) . (...) - C:\WINNT\s\system32\services.exe
SS - | Demand 0 | (BITS) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Auto 0 | (Browser) . (...) - C:\WINNT\s\System32\services.exe
SS - | Demand 0 | (ClipSrv) . (...) - C:\WINNT\s\system32\clipsrv.exe
SR - | Auto 0 | (Dhcp) . (...) - C:\WINNT\s\System32\services.exe
SS - | Demand 0 | (dmadmin) . (...) - C:\WINNT\s\System32\dmadmin.exe
SR - | Auto 0 | (dmserver) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 0 | (Dnscache) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 29/10/2002 974944 | (ekrn) . (.ESET.) - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
SS - | Demand 0 | (emul_local) . (...) - C:\OCEASOFT\ThermoServer\emul_local\smartsvc.exe
SR - | Auto 0 | (Eventlog) . (...) - C:\WINNT\s\system32\services.exe
SS - | Demand 0 | (Fax) . (...) - C:\WINNT\s\system32\faxsvc.exe
SR - | Auto 0 | (lanmanserver) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 0 | (lanmanworkstation) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 29/10/2002 79400 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
SR - | Auto 0 | (LmHosts) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 0 | (Messenger) . (...) - C:\WINNT\s\System32\services.exe
SS - | Demand 29/10/2002 792112 | (NBService) . (.Nero AG.) - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
SS - | Demand 0 | (NetDDE) . (...) - C:\WINNT\s\system32\netdde.exe
SS - | Demand 0 | (NetDDEdsdm) . (...) - C:\WINNT\s\system32\netdde.exe
SS - | Demand 0 | (Netlogon) . (...) - C:\WINNT\s\System32\lsass.exe
SR - | Demand 0 | (Netman) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Demand 29/10/2002 271920 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
SS - | Demand 0 | (NtLmSsp) . (...) - C:\WINNT\s\System32\lsass.exe
SR - | Auto 0 | (NtmsSvc) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Auto 0 | (NWCWorkstation) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 0 | (PlugPlay) . (...) - C:\WINNT\s\system32\services.exe
SR - | Auto 0 | (PolicyAgent) . (...) - C:\WINNT\s\System32\lsass.exe
SR - | Auto 0 | (ProtectedStorage) . (...) - C:\WINNT\s\system32\services.exe
SS - | Demand 0 | (RasAuto) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Demand 0 | (RasMan) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Auto 0 | (RemoteAccess) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Auto 0 | (RemoteRegistry) . (...) - C:\WINNT\s\system32\regsvc.exe
SS - | Demand 0 | (RpcLocator) . (...) - C:\WINNT\s\System32\locator.exe
SS - | Demand 0 | (RSVP) . (...) - C:\WINNT\s\System32\rsvp.exe
SR - | Auto 0 | (SamSs) . (...) - C:\WINNT\s\system32\lsass.exe
SS - | Demand 0 | (SCardDrv) . (...) - C:\WINNT\s\System32\SCardSvr.exe
SS - | Demand 0 | (SCardSvr) . (...) - C:\WINNT\s\System32\SCardSvr.exe
SR - | Auto 0 | (Schedule) . (...) - C:\WINNT\s\system32\MSTask.exe
SR - | Auto 0 | (seclogon) . (...) - C:\WINNT\s\system32\services.exe
SR - | Auto 0 | (SENS) . (...) - C:\WINNT\s\system32\svchost.exe
SS - | Demand 0 | (SharedAccess) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Auto 0 | (Spooler) . (...) - C:\WINNT\s\system32\spoolsv.exe
SS - | Demand 0 | (StiSvc) . (...) - C:\WINNT\s\system32\stisvc.exe
SS - | Demand 0 | (SysmonLog) . (...) - C:\WINNT\s\system32\smlogsvc.exe
SR - | Demand 0 | (TapiSrv) . (...) - C:\WINNT\s\System32\svchost.exe
SS - | Demand 0 | (TlntSvr) . (...) - C:\WINNT\s\system32\tlntsvr.exe
SR - | Auto 0 | (TrkWks) . (...) - C:\WINNT\s\system32\services.exe
SS - | Demand 0 | (UPS) . (...) - C:\WINNT\s\System32\ups.exe
SS - | Demand 0 | (UtilMan) . (...) - C:\WINNT\s\System32\UtilMan.exe
SS - | Demand 0 | (W32Time) . (...) - C:\WINNT\s\System32\services.exe
SR - | Auto 0 | (WinMgmt) . (...) - C:\WINNT\s\System32\WBEM\WinMgmt.exe
SS - | Demand 0 | (WmdmPmSN) . (...) - C:\WINNT\s\System32\svchost.exe
SR - | Demand 0 | (Wmi) . (...) - C:\WINNT\s\system32\Services.exe
SR - | Auto 0 | (wuauserv) . (...) - C:\WINNT\s\system32\svchost.exe
SS - | Demand 0 | (WZCSVC) . (...) - C:\WINNT\s\System32\svchost.exe
~ Scan Services in 00mn 02s
---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Administrateur at 29/10/2002 01:53:12
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS serial.sys ptilink.sys NDIS.sys tnet1130.sys TDI.SYS tcpip.sys openhci.sys
C:\WINNT\System32\DRIVERS\ptilink.sys Parallel Technologies, Inc. Microsoft(R) Windows (R) 2000 Operating System
C:\WINNT\System32\DRIVERS\tnet1130.sys Texas Instruments TI ACX100 WLAN Adapter
1 nt!IofCallDriver[0x8041FB8E] -> \Device\Harddisk0\DR0[0x82B09030]
3 CLASSPNP[0xF2020C60] -> nt!IofCallDriver[0x8041FB8E] -> \Device\00000019[0x82B017D0]
5 ACPI[0xBFFDE46B] -> nt!IofCallDriver[0x8041FB8E] -> \Device\Ide\IdeDeviceP0T0L0-2[0x82B018F0]
kernel: MBR read successfully
user & kernel MBR OK
~ Scan MBR in 00mn 04s
---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Administrateur at 29/10/2002 01:53:14
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ Scan MBR in 00mn 06s
End of the scan (893 lines in 05mn 34s)(0)
le 03 Oct 2011 20:31
[HKCU\Software\PopCap]
[HKLM\Software\PopCap]
O64 - Services: CurCS - ??/??/???? - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bfastfao.sys (.not file.) - No object (No service) .(...) - LEGACY_BFASTFAO
O64 - Services: CurCS - ??/??/???? - C:\WINNT\s\System32\services.exe (.not file.) - Service client pour NetWare (NWCWorkstation) .(...) - LEGACY_NWCWORKSTATION
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\PopCap Games]
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} . (...) -- (.not file.)
[HKLM\Software\Classes\toolband.easyhidebtn]
[HKLM\Software\Classes\toolband.easyhidebtn.1]
[HKLM\Software\Classes\toolband.skypeiehelper]
[HKLM\Software\Classes\toolband.skypeiehelper.1]
FirewallRaz
EmptyFlash
Emptytemp
HiddenFix
(« coller les lignes Helper ») le 03 Oct 2011 21:04
quand je clic sur le racourcis et bien il me met un message comme quoi le chemin d'acces n'est pas exact et sinon je ne trouve pas l'îcone dans zhpdiag le 03 Oct 2011 21:11
le 04 Oct 2011 05:01
le 04 Oct 2011 13:21
Autrement dit, si bien à jour, un excellent OS. Perso, je l'ai maintenu sur une de mes machinesPac428 a écrit:C'est un Windows 2000 Del ...
Faire Bugger les chatterbot (robot chatteur) Comment faire une vidange ? Mon écran se fiche de temps en temps Freezes au bout d'un temps Que faire avec un BIPro Xeon E5410 [Réglé] Temps de démarrage du BIOS très long que faire avec ancien modem adsl ?Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 30 invités
|
.: Nous contacter :: Flux RSS :: Données personnelles :. |
Mais j'ai essayé quand même et rien à faire 