Win32:Rootkit-gen [Résolu]

TOFFY · le 24 Mai 2010 22:19

Bonjour,
depuis 2 jours je suis infecté par Win32:Rootkit-gen. Avast le bloque et le supprime mais le soucis et qu'il revient contamment. J'ai lané une recherche par Malwarebytes et idem, il me trouve des éléments infectés, les supprime mais ça revient tjrs.... Grrrrrr
Pouvez-vous m'aider ???

jeanmimigab · le 25 Mai 2010 06:43

salut et bienvenue sur PC infopratique :wink:

Fais cela stp...

Télécharge >> TFC.exe << impérativement sur ton bureau

Ferme tous les programmes en cour de fonctionnement...

Fais un double-clic sur l'icône de TFC pour le lancer

Une demande va apparaitre pour te demander de redémarrer ton pc, cliques sur [g]"YES"[/g] et laisse faire TFC.

ensuite....

* Télécharge >> OTL <<sur ton bureau.

* Fait un double-clic sur l'icône d'OTL pour le lancer

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "rapport minimal " soit cochée.

* Coches les case situées devant "Tous les utilisateurs", " Recherche LOP" et "Recherche Purity".

* Copier et colle le contenue de cette citation dans la partie inférieure d'OTL "personnalisation"

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
Sfloppy.sys
Changer.sys
cdrom.sys
disk.sys
ndis.sys
usbscan.sys
usbprint.sys
tdtcp.sys
tdpipe.sys
swmidi.sys
splitter.sys
rdpwd.sys
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
RASACD.SYS
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

* Cliques sur l'icône "Analyse" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).
* Copie et colle le ou les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

@ ce soir :wink:

TOFFY · le 25 Mai 2010 12:31

Bonjour et merci pour votre aide

.
Voici les résultats des 2 rapports "OTL.Txt" et "Extras.Txt"

Rapport OTL.Txt

Code: Tout sélectionner: OTL logfile created on: 25/05/2010 12:52:12 - Run 1 OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\buddy\Bureau Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 959,00 Mb Total Physical Memory | 516,00 Mb Available Physical Memory | 54,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 66,71 Gb Total Space | 42,80 Gb Free Space | 64,16% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: 729402210236 Current User Name: buddy Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - C:\Documents and Settings\buddy\Bureau\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) PRC - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) PRC - C:\Program Files\SFR\Kit\9props.exe (SFR) PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\VTTrayp.exe (S3 Graphics Co., Ltd.) PRC - C:\WINDOWS\system32\drivers\Icon.exe () PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe (Cyberlink) PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink) PRC - c:\APPS\Powercinema\Kernel\TV\CLSched.exe () PRC - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe () PRC - C:\APPS\Powercinema\PCMService.exe (CyberLink Corp.) PRC - C:\WINDOWS\system32\slmdmsr.exe ( ) PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) PRC - C:\WINDOWS\system32\VTTimer.exe (S3 Graphics, Inc.) PRC - c:\APPS\HIDSERVICE\HidService.exe () PRC - C:\WINDOWS\system32\drivers\STDSB.exe () PRC - C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.) [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - C:\Documents and Settings\buddy\Bureau\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) MOD - C:\WINDOWS\system32\drivers\mxkeybd.dll () [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software) SRV - (Apple Mobile Device) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (Adobe LM Service) -- C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe () SRV - (CyberLink Media Library Service) -- C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink) SRV - (CLSched) CyberLink Task Scheduler (CTS) -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe () SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe () SRV - (SLService) -- C:\WINDOWS\System32\slmdmsr.exe ( ) SRV - (GenericHidService) -- c:\APPS\HIDSERVICE\HidService.exe () SRV - (MySqlInventime) -- c:\mysql\bin\mysqld-max-nt.exe () SRV - (ose) -- C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - (aswTdi) -- C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software) DRV - (aswSP) -- C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software) DRV - (aswRdr) -- C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software) DRV - (aswMon2) -- C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software) DRV - (aswFsBlk) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software) DRV - (Aavmker4) -- C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys () DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (ASCTRM) -- C:\WINDOWS\system32\drivers\asctrm.sys (Windows (R) 2000 DDK provider) DRV - (RT61) -- C:\WINDOWS\system32\drivers\rt61.sys (Ralink Technology Inc.) DRV - (STDSB) -- C:\WINDOWS\system32\drivers\STDSB.sys () DRV - (MTC0007_STDSB) -- C:\WINDOWS\system32\drivers\STDSB.sys () DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.) DRV - (Mtlstrm) -- C:\WINDOWS\system32\drivers\SLDRV\mtlstrm.sys ( ) DRV - (Slntamr) -- C:\WINDOWS\system32\drivers\SLDRV\slntamr.sys ( ) DRV - (RecAgent) -- C:\WINDOWS\system32\DRIVERS\SLDRV\RecAgent.sys ( ) DRV - (Mtlmnt5) -- C:\WINDOWS\system32\drivers\SLDRV\mtlmnt5.sys ( ) DRV - (SlNtHal) -- C:\WINDOWS\system32\drivers\SLDRV\slnthal.sys ( ) DRV - (SlWdmSup) -- C:\WINDOWS\system32\drivers\SLDRV\slwdmsup.sys ( ) DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (viaagp1) -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.) DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 8B DE D9 03 2D 5D 36 45 B4 E2 54 08 26 D4 AC 82 [binary data] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 8B DE D9 03 2D 5D 36 45 B4 E2 54 08 26 D4 AC 82 [binary data] IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 8B DE D9 03 2D 5D 36 45 B4 E2 54 08 26 D4 AC 82 [binary data] IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 8B DE D9 03 2D 5D 36 45 B4 E2 54 08 26 D4 AC 82 [binary data] IE - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ IE - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 8B DE D9 03 2D 5D 36 45 B4 E2 54 08 26 D4 AC 82 [binary data] IE - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://www.google.fr" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {1a98d168-0709-4399-bc49-4e87241319db}:1.0 FF - prefs.js..keyword.URL: "http://redirecterror.sfr.fr/?q=" FF - user.js..keyword.URL: "http://redirecterror.sfr.fr/?q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/23 22:26:01 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/23 22:26:01 | 000,000,000 | ---D | M] [2009/06/11 20:41:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\Mozilla\Extensions [2008/07/25 22:08:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\Mozilla\Extensions\home2@tomtom.com [2009/06/11 20:41:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\Mozilla\Extensions\mozswing@mozswing.org [2010/05/22 00:23:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\Mozilla\Firefox\Profiles\dv8sb94s.default\extensions [2010/05/22 10:22:53 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\buddy\Application Data\Mozilla\Firefox\Profiles\dv8sb94s.default\extensions\{1a98d168-0709-4399-bc49-4e87241319db} [2010/04/28 23:27:00 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\buddy\Application Data\Mozilla\Firefox\Profiles\dv8sb94s.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010/05/22 00:23:00 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/04/21 22:08:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2010/03/17 00:22:47 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml [2010/03/17 00:22:47 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml [2010/03/17 00:22:47 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml [2009/08/17 00:05:20 | 000,000,748 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MediaDICO-fr.xml [2010/03/17 00:22:47 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml [2010/03/28 00:36:07 | 000,000,956 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml O1 HOSTS File: ([2004/08/05 14:00:00 | 000,000,790 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {03D9DE8B-5D2D-4536-B4E2-540826D4AC82} - C:\WINDOWS\System32\dot3gpclnt32.dll File not found O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Objet d'aide à la navigation SFR) - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll (SFR) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.) O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O3 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O3 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.) O3 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe File not found O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software) O4 - HKLM..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe () O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation) O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.) O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation) O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe () O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.) O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.) O4 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006..\Run: [Connexion SFR 9props.exe] C:\Program Files\SFR\Kit\9props.exe (SFR) O4 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2891194784-769547661-2943159236-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214591457281 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1214593656750 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} http://aol.pixum.fr/apps/EasyUploadX.cab (Pixum EasyUploadX Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Fichiers communs\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\WINDOWS\system32\imagehlp32.dll) - C:\WINDOWS\System32\imagehlp32.dll File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\cc530681924: DllName - C:\WINDOWS\system32\imagehlp32.dll - C:\WINDOWS\System32\imagehlp32.dll File not found O24 - Desktop Components:0 (Ma page d'accueil) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\buddy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\buddy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{3090ac02-fad4-11dd-a43e-001060af71fc}\Shell - "" = AutoRun O33 - MountPoints2\{3090ac02-fad4-11dd-a43e-001060af71fc}\Shell\AutoRun\command - "" = E:\GENES.exe -- File not found O33 - MountPoints2\{c48eddb1-5a84-11dd-a307-001060af71fc}\Shell\AutoRun\command - "" = E:\InstallTomTomHOME.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/06/27 19:57:01 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation) NetSvcs: WmdmPmSp - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010/05/25 12:48:20 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\buddy\Bureau\OTL.exe [2010/05/25 12:35:43 | 000,444,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\buddy\Bureau\TFC.exe [2010/05/23 22:38:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Application Data\Malwarebytes [2010/05/23 22:37:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/05/23 22:37:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/05/23 22:37:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/05/23 22:37:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/05/22 15:07:13 | 000,164,048 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2010/05/22 15:07:13 | 000,019,024 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [2010/05/22 15:07:12 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2010/05/22 15:07:12 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2010/05/22 15:07:10 | 000,100,432 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2010/05/22 15:07:10 | 000,094,800 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2010/05/22 15:07:10 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2010/05/22 15:06:45 | 000,165,032 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe [2010/05/22 15:06:45 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\avastSS.scr [2010/05/22 15:06:34 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software [2010/05/22 15:06:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2010/05/22 14:39:31 | 000,000,000 | ---D | C] -- C:\VundoFix Backups [2010/05/22 09:56:53 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2010/05/22 09:56:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2010/05/22 00:24:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Mes documents\Téléchargements [2010/05/17 13:45:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Bureau\OXFORD Mai 2010 [2010/05/13 08:29:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Bureau\Elise [2010/05/11 13:16:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Bureau\IMPRESSIONS [2010/05/01 17:01:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Bureau\House Mamy [2010/05/01 17:00:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Bureau\Paques 2010 [2010/04/28 13:26:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\buddy\Bureau\Clé USB violette [2006/08/24 16:44:58 | 000,015,000 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010/05/25 12:48:27 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\buddy\Bureau\OTL.exe [2010/05/25 12:46:06 | 000,003,768 | -HS- | M] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924P.manifest [2010/05/25 12:45:37 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/05/25 12:45:31 | 000,000,051 | -HS- | M] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924C.manifest [2010/05/25 12:45:31 | 000,000,011 | -HS- | M] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924S.manifest [2010/05/25 12:45:31 | 000,000,011 | -HS- | M] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924O.manifest [2010/05/25 12:45:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/05/25 12:45:17 | 1006,157,824 | -HS- | M] () -- C:\hiberfil.sys [2010/05/25 12:44:35 | 004,194,304 | -H-- | M] () -- C:\Documents and Settings\buddy\NTUSER.DAT [2010/05/25 12:44:35 | 000,000,184 | -HS- | M] () -- C:\Documents and Settings\buddy\ntuser.ini [2010/05/25 12:35:50 | 000,444,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\buddy\Bureau\TFC.exe [2010/05/24 23:37:19 | 005,333,514 | -H-- | M] () -- C:\Documents and Settings\buddy\Local Settings\Application Data\IconCache.db [2010/05/24 22:07:23 | 000,002,187 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Safari.lnk [2010/05/23 22:38:04 | 000,000,699 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk [2010/05/23 10:23:17 | 000,000,059 | ---- | M] () -- C:\WINDOWS\System32\1cd30186 [2010/05/22 15:07:13 | 000,001,703 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\avast! Free Antivirus.lnk [2010/05/22 15:07:11 | 000,003,121 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2010/05/22 14:59:51 | 045,798,744 | ---- | M] () -- C:\Documents and Settings\buddy\Bureau\setup_av_free_fre.exe [2010/05/22 10:59:57 | 000,000,190 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010/05/22 09:57:04 | 000,000,936 | ---- | M] () -- C:\Documents and Settings\buddy\Bureau\Spybot - Search & Destroy.lnk [2010/05/17 13:45:17 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/05/11 12:57:56 | 000,039,424 | ---- | M] () -- C:\Documents and Settings\buddy\Mes documents\LUNDI 17 MAI 2010.doc [2010/05/10 20:32:50 | 000,510,980 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat [2010/05/10 20:32:49 | 001,121,548 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/05/10 20:32:49 | 000,441,458 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/05/10 20:32:49 | 000,084,964 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat [2010/05/10 20:32:49 | 000,071,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/05/06 22:59:57 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\avastSS.scr [2010/05/06 22:59:36 | 000,165,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe [2010/05/06 22:39:23 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2010/05/06 22:39:00 | 000,164,048 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2010/05/06 22:34:27 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2010/05/06 22:33:59 | 000,100,432 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2010/05/06 22:33:55 | 000,094,800 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2010/05/06 22:33:47 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [2010/05/06 22:33:29 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2010/05/02 08:54:24 | 000,491,328 | ---- | M] () -- C:\Documents and Settings\buddy\Bureau\DSC04307.JPG [2010/04/29 19:01:04 | 012,652,032 | ---- | M] () -- C:\Documents and Settings\buddy\Bureau\anniv luois oceane.doc [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010/05/23 22:38:04 | 000,000,699 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\Malwarebytes' Anti-Malware.lnk [2010/05/22 15:07:13 | 000,001,703 | ---- | C] () -- C:\Documents and Settings\All Users\Bureau\avast! Free Antivirus.lnk [2010/05/22 14:51:45 | 045,798,744 | ---- | C] () -- C:\Documents and Settings\buddy\Bureau\setup_av_free_fre.exe [2010/05/22 10:59:56 | 000,000,190 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010/05/22 09:57:04 | 000,000,936 | ---- | C] () -- C:\Documents and Settings\buddy\Bureau\Spybot - Search & Destroy.lnk [2010/05/21 23:48:02 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\1cd30186 [2010/05/21 21:51:03 | 000,003,768 | -HS- | C] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924P.manifest [2010/05/21 21:51:03 | 000,000,051 | -HS- | C] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924C.manifest [2010/05/21 21:51:03 | 000,000,011 | -HS- | C] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924S.manifest [2010/05/21 21:51:03 | 000,000,011 | -HS- | C] () -- C:\Documents and Settings\buddy\Application Data\02000000a7bcc5bb924O.manifest [2010/05/11 12:57:56 | 000,039,424 | ---- | C] () -- C:\Documents and Settings\buddy\Mes documents\LUNDI 17 MAI 2010.doc [2010/05/02 08:54:23 | 000,491,328 | ---- | C] () -- C:\Documents and Settings\buddy\Bureau\DSC04307.JPG [2010/04/29 19:01:02 | 012,652,032 | ---- | C] () -- C:\Documents and Settings\buddy\Bureau\anniv luois oceane.doc [2008/08/31 15:09:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\setup32.INI [2008/06/27 17:04:55 | 000,000,385 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008/06/27 15:59:38 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2008/06/27 11:13:33 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2007/10/10 14:37:54 | 000,278,528 | ---- | C] () -- C:\WINDOWS\ImgUploaderLang_3.dll [2007/10/10 14:37:54 | 000,278,528 | ---- | C] () -- C:\WINDOWS\ImgUploaderLang_2.dll [2007/10/10 14:37:54 | 000,278,528 | ---- | C] () -- C:\WINDOWS\ImgUploaderLang_1.dll [2007/06/27 12:22:54 | 000,692,224 | ---- | C] () -- C:\WINDOWS\libcurl.dll [2006/08/24 17:10:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006/08/24 16:55:09 | 000,036,864 | ---- | C] () -- C:\WINDOWS\jRegistryKey.dll [2006/08/24 16:55:09 | 000,000,289 | ---- | C] () -- C:\WINDOWS\my.ini [2006/08/24 16:54:01 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll [2006/08/24 16:53:36 | 000,000,501 | ---- | C] () -- C:\WINDOWS\System32\SETUPPC.INI [2006/08/24 16:47:28 | 000,007,584 | ---- | C] () -- C:\WINDOWS\HDReg.ini [2006/08/24 16:44:58 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll [2006/08/24 16:44:58 | 000,225,280 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll [2006/08/24 16:36:31 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\slmdmsp.dll [2006/08/24 16:36:31 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\slmdmgx.dll [2006/08/24 16:36:31 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\slmdmco.dll [2006/08/24 16:35:09 | 000,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2006/08/24 16:34:02 | 000,011,279 | R--- | C] () -- C:\WINDOWS\System32\drivers\STDSB.sys [2006/08/24 16:34:02 | 000,003,584 | R--- | C] () -- C:\WINDOWS\System32\drivers\mxkeybd.dll [2006/08/24 16:34:01 | 000,001,495 | R--- | C] () -- C:\WINDOWS\System32\drivers\HotKey.ini [2005/06/17 11:41:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll [2005/05/20 14:05:02 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2004/08/16 18:25:16 | 000,000,829 | ---- | C] () -- C:\WINDOWS\orun32.ini [2004/06/23 14:14:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [color=#E56717]========== LOP Check ==========[/color] [2010/05/22 15:06:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2009/06/11 22:07:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations [2008/06/27 19:52:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OD2 [2008/07/25 22:08:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom [2010/04/23 22:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009/10/03 19:47:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009/05/07 22:53:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [2009/06/22 22:35:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\AdSigner [2008/06/27 15:59:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\DAEMON Tools [2010/02/06 13:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\KompoZer [2008/07/21 21:17:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\Leadertech [2008/07/08 23:17:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\OD2 [2008/07/25 22:08:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\buddy\Application Data\TomTom [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< MD5 for: AGP440.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/04/13 11:36:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 11:36:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 11:40:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [color=#A23BEC]< MD5 for: CDROM.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:cdrom.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:cdrom.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:cdrom.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:cdrom.sys [2008/04/13 11:40:48 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\ServicePackFiles\i386\cdrom.sys [2008/04/13 11:40:48 | 000,062,976 | ---- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE -- C:\WINDOWS\system32\drivers\cdrom.sys [2004/08/05 14:00:00 | 000,049,536 | ---- | M] (Microsoft Corporation) MD5=AF9C19B3100FE010496B1A27181FBF72 -- C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys [color=#A23BEC]< MD5 for: CHANGER.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Changer.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Changer.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:Changer.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Changer.sys [2008/04/13 11:41:00 | 000,008,192 | ---- | M] (Microsoft Corporation) MD5=2A5815CA6FFF24B688C01F828B96819C -- C:\WINDOWS\ServicePackFiles\i386\changer.sys [color=#A23BEC]< MD5 for: DISK.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:disk.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys [2004/08/05 14:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys [2008/04/13 11:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys [2008/04/13 11:40:48 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys [color=#A23BEC]< MD5 for: EVENTLOG.DLL >[/color] [2004/08/05 14:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=21E83876A6287F15538EF187D286FE11 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll [2008/04/13 19:33:26 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/13 19:33:26 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=4EC800BDF80521B0207BD2301DFC7D14 -- C:\WINDOWS\system32\eventlog.dll [color=#A23BEC]< MD5 for: NDIS.SYS >[/color] [2008/04/13 12:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys [2008/04/13 12:20:38 | 000,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys [2004/08/05 14:00:00 | 000,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color] [2008/04/13 19:33:36 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/13 19:33:36 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=04821179C3171554C1BD1F9888A113E2 -- C:\WINDOWS\system32\netlogon.dll [2004/08/05 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=FAF07FDCDE76000621A28D19F8E2E8EB -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll [color=#A23BEC]< MD5 for: RASACD.SYS >[/color] [2004/08/05 14:00:00 | 000,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\drivers\rasacd.sys [color=#A23BEC]< MD5 for: RDPWD.SYS >[/color] [2005/06/10 06:06:01 | 000,139,528 | ---- | M] (Microsoft Corporation) MD5=047BEA21274C8A4A233674A76C958C2C -- C:\WINDOWS\$hf_mig$\KB899591\SP2QFE\rdpwd.sys [2008/04/13 19:34:56 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=6728E45B66F93C08F11DE2E316FC70DD -- C:\WINDOWS\ServicePackFiles\i386\rdpwd.sys [2008/04/13 19:34:56 | 000,139,656 | ---- | M] (Microsoft Corporation) MD5=6728E45B66F93C08F11DE2E316FC70DD -- C:\WINDOWS\system32\drivers\rdpwd.sys [2005/06/10 06:11:22 | 000,139,528 | ---- | M] (Microsoft Corporation) MD5=B54CD38A9EBFBF2B3561426E3FE26F62 -- C:\WINDOWS\$NtServicePackUninstall$\rdpwd.sys [2004/08/05 14:00:00 | 000,139,400 | ---- | M] (Microsoft Corporation) MD5=D4F5643D7714EF499AE9527FDCD50894 -- C:\WINDOWS\$NtUninstallKB899591$\rdpwd.sys [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color] [2008/04/13 19:33:42 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/13 19:33:42 | 000,187,392 | ---- | M] (Microsoft Corporation) MD5=973B36634C544948C663E8269AA1B3A3 -- C:\WINDOWS\system32\scecli.dll [2004/08/05 14:00:00 | 000,186,368 | ---- | M] (Microsoft Corporation) MD5=DEC0397F35D027874804EC72979D03CC -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [color=#A23BEC]< MD5 for: SFLOPPY.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:Sfloppy.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:Sfloppy.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:Sfloppy.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:Sfloppy.sys [2004/08/05 14:00:00 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=0D13B6DF6E9E101013A7AFB0CE629FE0 -- C:\WINDOWS\$NtServicePackUninstall$\sfloppy.sys [2008/04/13 11:40:50 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\ServicePackFiles\i386\sfloppy.sys [2008/04/13 11:40:50 | 000,011,392 | ---- | M] (Microsoft Corporation) MD5=8E6B8C671615D126FDC553D1E2DE5562 -- C:\WINDOWS\system32\drivers\sfloppy.sys [color=#A23BEC]< MD5 for: SPLITTER.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:splitter.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:splitter.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:splitter.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:splitter.sys [2006/06/14 10:47:46 | 000,006,400 | ---- | M] (Microsoft Corporation) MD5=0CE218578FFF5F4F7E4201539C45C78F -- C:\WINDOWS\$NtServicePackUninstall$\splitter.sys [2004/08/03 23:07:48 | 000,006,400 | ---- | M] (Microsoft Corporation) MD5=8E186B8F23295D1E42C573B82B80D548 -- C:\WINDOWS\$NtUninstallKB920872$\splitter.sys [2006/06/14 10:50:19 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=9BB1DD670CB7505A90FC4E61D4AA8227 -- C:\WINDOWS\$hf_mig$\KB920872\SP2QFE\splitter.sys [2008/04/13 11:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\ServicePackFiles\i386\splitter.sys [2008/04/13 11:45:08 | 000,006,272 | ---- | M] (Microsoft Corporation) MD5=AB8B92451ECB048A4D1DE7C3FFCB4A9F -- C:\WINDOWS\system32\drivers\splitter.sys [color=#A23BEC]< MD5 for: SWMIDI.SYS >[/color] [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:swmidi.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:swmidi.sys [2008/04/13 11:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\ServicePackFiles\i386\swmidi.sys [2008/04/13 11:45:10 | 000,056,576 | ---- | M] (Microsoft Corporation) MD5=8CE882BCC6CF8A62F2B2323D95CB3D01 -- C:\WINDOWS\system32\drivers\swmidi.sys [2001/08/17 22:00:52 | 000,054,272 | ---- | M] (Microsoft Corporation) MD5=94ABC808FC4B6D7D2BBF42B85E25BB4D -- C:\WINDOWS\$NtServicePackUninstall$\swmidi.sys [color=#A23BEC]< MD5 for: TDPIPE.SYS >[/color] [2004/08/05 14:00:00 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=38D437CF2D98965F239B0ABCD66DCB0F -- C:\WINDOWS\$NtServicePackUninstall$\tdpipe.sys [2008/04/13 19:34:54 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\ServicePackFiles\i386\tdpipe.sys [2008/04/13 19:34:54 | 000,012,040 | ---- | M] (Microsoft Corporation) MD5=6471A66807F5E104E4885F5B67349397 -- C:\WINDOWS\system32\drivers\tdpipe.sys [color=#A23BEC]< MD5 for: TDTCP.SYS >[/color] [2008/04/13 19:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\ServicePackFiles\i386\tdtcp.sys [2008/04/13 19:34:54 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=C56B6D0402371CF3700EB322EF3AAF61 -- C:\WINDOWS\system32\drivers\tdtcp.sys [2004/08/05 14:00:00 | 000,021,896 | ---- | M] (Microsoft Corporation) MD5=ED0580AF02502D00AD8C4C066B156BE9 -- C:\WINDOWS\$NtServicePackUninstall$\tdtcp.sys [color=#A23BEC]< MD5 for: USBPRINT.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbprint.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbprint.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:usbprint.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbprint.sys [2008/04/13 11:47:38 | 000,025,856 | ---- | M] (Microsoft Corporation) MD5=A717C8721046828520C9EDF31288FC00 -- C:\WINDOWS\ServicePackFiles\i386\usbprint.sys [color=#A23BEC]< MD5 for: USBSCAN.SYS >[/color] [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbscan.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbscan.sys [2004/08/05 14:00:00 | 018,779,217 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:usbscan.sys [2008/04/13 19:47:24 | 020,102,028 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbscan.sys [2008/04/13 11:45:36 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\ServicePackFiles\i386\usbscan.sys [2008/04/13 11:45:36 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\system32\dllcache\usbscan.sys [2008/04/13 11:45:36 | 000,015,104 | ---- | M] (Microsoft Corporation) MD5=A0B8CF9DEB1184FBDD20784A58FA75D4 -- C:\WINDOWS\system32\drivers\usbscan.sys [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color] [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color] < End of report >

Et le second : "Extras.Txt"

Code: Tout sélectionner: OTL Extras logfile created on: 25/05/2010 12:52:12 - Run 1 OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\buddy\Bureau Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 959,00 Mb Total Physical Memory | 516,00 Mb Available Physical Memory | 54,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 66,71 Gb Total Space | 42,80 Gb Free Space | 64,16% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: 729402210236 Current User Name: buddy Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_USERS\S-1-5-21-2891194784-769547661-2943159236-1006\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "AntiVirusDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Shell -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%ProgramFiles%\AOL 9.0\aol.exe" = %ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL -- File not found "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe" = %ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA -- File not found "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe" = %ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:PANDORA -- File not found "C:\APPS\Inventime\my.exe" = C:\APPS\Inventime\my.exe:*:Enabled:INVENTIME -- (Inventime) "C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- File not found "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.) "C:\Program Files\QuickTime\QuickTimePlayer.exe" = C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player -- (Apple Inc.) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{0BD83598-C2EF-3343-847B-7D2E84599128}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA "{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 20 "{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime "{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3E31821C-7917-367E-938E-E65FC413EA31}" = Microsoft .NET Framework 3.5 Language Pack SP1 - fra "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel "{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{72AD53CC-CCC0-3757-8480-9EE176866A7C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA "{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour "{7D1D6A24-65D4-454C-8815-4F08A5FFF12C}" = Macromedia Shockwave Player "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8D774B5B-A1D9-45B3-AFB4-3F85604961BC}" = Add-in ODF pour Microsoft Word "{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules "{9011040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{91490409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Primary Interop Assemblies "{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow! "{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari "{AC76BA86-1033-F400-7760-000000000001}" = Adobe Acrobat 6.0 Professional - English, Français, Deutsch "{AC76BA86-7AD7-1036-7B44-A92000000001}" = Adobe Reader 9.2 - Français "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite "{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11 "Adobe SVG Viewer" = Adobe SVG Viewer 3.0 "avast5" = avast! Free Antivirus "Fimbles - Viens jouer avec les Fimbles" = Fimbles - Viens jouer avec les Fimbles "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "Lapin Malin Maternelle 1 v2" = Lapin Malin Maternelle 1 v2 "Lien vers le site TLC-Edusoft" = Lien vers le site TLC-Edusoft "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "McDonald's Fairies " = McDonald's Fairies "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 Language Pack SP1 - fra" = Module linguistique Microsoft .NET Framework 3.5 SP1- fra "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "SFR_Kit" = SFR - Kit de connexion "SLAMRMO" = Smart Link 56K Modem "TomTom HOME" = TomTom HOME 2.7.3.1894 "VIA/S3G UniChrome Family Win2K/XP Display" = VIA/S3G Display Driver "VLC media player" = VLC media player 1.0.1 "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Lecteur Windows Media 11 "Windows XP Service" = Windows XP Service Pack 3 "WinRAR archiver" = Archiveur WinRAR "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 21/05/2010 17:50:09 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante explorer.exe, version 6.0.2900.5512, module défaillant imagehlp32.dll, version 0.0.0.0, adresse de défaillance 0x0000f913. Error - 22/05/2010 03:02:12 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante explorer.exe, version 6.0.2900.5512, module défaillant imagehlp32.dll, version 0.0.0.0, adresse de défaillance 0x0000f913. Error - 22/05/2010 05:04:02 | Computer Name = 729402210236 | Source = Application Hang | ID = 1002 Description = Application bloquée SpybotSD.exe, version 1.6.2.46, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000. Error - 22/05/2010 05:11:16 | Computer Name = 729402210236 | Source = Application Hang | ID = 1002 Description = Application bloquée SpybotSD.exe, version 1.6.2.46, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000. Error - 23/05/2010 16:26:56 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante explorer.exe, version 6.0.2900.5512, module défaillant imagehlp32.dll, version 0.0.0.0, adresse de défaillance 0x0000f913. Error - 23/05/2010 16:56:41 | Computer Name = 729402210236 | Source = Bonjour Service | ID = 100 Description = 248: ERROR: read_msg errno 10054 (Une connexion existante a dû être fermée par l'hôte distant.) Error - 23/05/2010 17:03:49 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante explorer.exe, version 6.0.2900.5512, module défaillant imagehlp32.dll, version 0.0.0.0, adresse de défaillance 0x0000f913. Error - 23/05/2010 17:04:28 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d. Error - 24/05/2010 05:24:39 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante explorer.exe, version 6.0.2900.5512, module défaillant imagehlp32.dll, version 0.0.0.0, adresse de défaillance 0x0000f913. Error - 24/05/2010 05:25:05 | Computer Name = 729402210236 | Source = Application Error | ID = 1000 Description = Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d. [ System Events ] Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service CyberLink Media Library Service s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service Generic Service for HID Keyboard Input Collections s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service Service Bonjour s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service SmartLinkService s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service TomTomHOMEService s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service CyberLink Task Scheduler (CTS) s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:29 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service Java Quick Starter s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:36:30 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7034 Description = Le service Service de l’iPod s'est terminé de façon inattendue pour la 1ème fois. Error - 25/05/2010 06:45:28 | Computer Name = 729402210236 | Source = Dhcp | ID = 1002 Description = Le bail de l'adresse IP 192.168.1.23 pour la carte réseau dont l'adresse réseau est 001060AF71FC a été refusé par le serveur DHCP 192.168.2.1 (celui-ci a envoyé un message DHCPNACK). Error - 25/05/2010 06:45:43 | Computer Name = 729402210236 | Source = Service Control Manager | ID = 7000 Description = Le service STDSB n'a pas pu démarrer en raison de l'erreur : %%2 < End of report >

jeanmimigab · le 25 Mai 2010 17:19

bonsoir,

il est bien caché le bougre :-?

* Fait un double-clic sur l'icône d'OTL pour le lancer
/!\ pour Vista/Seven fais un clic-droit sur l'icône d'OTL et choisis "Exécuter en tant qu'administrateur"

* Assure toi d'avoir fermé toutes les applications en court de fonctionnement.

* Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "Rapport minimal" soit cochée.

* Copies et colles le contenue de cette citation dans la partie inférieure d'OTL "Personnalisation"

:Files
C:\WINDOWS\System32\1cd30186

:OTL
O2 - BHO: (no name) - {03D9DE8B-5D2D-4536-B4E2-540826D4AC82} - C:\WINDOWS\System32\dot3gpclnt32.dll File not found
O20 - AppInit_DLLs: (C:\WINDOWS\system32\imagehlp32.dll) - C:\WINDOWS\System32\imagehlp32.dll File not found
O20 - Winlogon\Notify\cc530681924: DllName - C:\WINDOWS\system32\imagehlp32.dll - C:\WINDOWS\System32\imagehlp32.dll File not found
O33 - MountPoints2\{3090ac02-fad4-11dd-a43e-001060af71fc}\Shell - "" = AutoRun

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit"="C:\WINDOWS\system32\userinit.exe,"

:Commands
[EMPTYTEMP]
[EMPTYFLASH]

* Cliques sur l'icône "Correction" (en haut à gauche) .
* Laisse le scan aller à son terme sans te servir du PC
* A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).
* Copie et colle le ou les rapports dans ta réponse stp...
* Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés

ensuite...

désactive ton Anti-virus le temps de faire ces manipulations.

>>Télécharge Winsockxpfix sur ton bureau et passe à la suite.

========================================================================================================

ensuite...

Télécharge Combofix sur ton Bureau (et pas ailleurs)en le renommant [b]avant qu'il n'atterrisse sur ton bureau. [/b]
pour cela fais un clic droit sur Combofix.exe ,choisis "enregistrer la cible du lien sous..." et renomme le en machin.exe pour l'emplacement choisis ton bureau et cliques sur "enregistrer"

Double clique ComboFix.exe pour démarrer le scan et suis les instructions indiquées par combofix.
Si Combofix te demande te demande l'autorisation de télécharger et installer la console de récupération Windows, acceptes et suis les instructions.
Lorsque le scan sera complet, un rapport apparaîtra, enregistre le sur ton bureau.
Redémarre impérativement ton pc !!
Copie/colle le rapport combofix dans ta prochaine réponse

NOTE : Le rapport se trouve également ici : C:\Combofix.txt
NOTE : Ne pas cliquer dans la fenêtre de Combofix durant l'analyse ; ceci provoquerait le gel du programme.

========================================================================================================

si a tout hasard ta connexion internet n'est plus active après le redémarrage du pc fait cela pour la réparer...

Fait un double clic sur l'icône

de WinsockXPFix.

>>clique sur "Fix" > et si ton pc ne redémarre pas,redémarre le manuellement.

@++

TOFFY · le 25 Mai 2010 19:08

Voici les résultats avec OTL, je vais télécharger Combofix et t'envoie le rapport

Code: Tout sélectionner: All processes killed ========== FILES ========== C:\WINDOWS\System32\1cd30186 moved successfully. ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03D9DE8B-5D2D-4536-B4E2-540826D4AC82}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03D9DE8B-5D2D-4536-B4E2-540826D4AC82}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\WINDOWS\system32\imagehlp32.dll deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cc530681924\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3090ac02-fad4-11dd-a43e-001060af71fc}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3090ac02-fad4-11dd-a43e-001060af71fc}\ not found. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\"UserInit"|"C:\WINDOWS\system32\userinit.exe," /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: buddy ->Temp folder emptied: 401 bytes ->Temporary Internet Files folder emptied: 1906287 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 434 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 2,00 mb [EMPTYFLASH] User: All Users User: buddy ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.5.0 log created on 05252010_195617 Files\Folders moved on Reboot... File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot...

TOFFY · le 25 Mai 2010 19:40

et voici le rapport de Combofix...

Code: Tout sélectionner: ComboFix 10-05-24.07 - buddy 25/05/2010 20:19:19.1.1 - x86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.959.684 [GMT 2:00] Lancé depuis: c:\documents and settings\buddy\Bureau\machin.exe AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\buddy\Application Data\02000000a7bcc5bb924C.manifest c:\documents and settings\buddy\Application Data\02000000a7bcc5bb924O.manifest c:\documents and settings\buddy\Application Data\02000000a7bcc5bb924P.manifest c:\documents and settings\buddy\Application Data\02000000a7bcc5bb924S.manifest c:\windows\system32\Thumbs.db . ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-25 au 2010-05-25 )))))))))))))))))))))))))))))))))))) . 2010-05-25 17:56 . 2010-05-25 17:56 -------- d-----w- C:\_OTL 2010-05-23 20:38 . 2010-05-23 20:38 -------- d-----w- c:\documents and settings\buddy\Application Data\Malwarebytes 2010-05-23 20:37 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-05-23 20:37 . 2010-05-23 20:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-05-23 20:37 . 2010-05-23 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-05-23 20:37 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-05-22 13:07 . 2010-05-06 20:39 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys 2010-05-22 13:07 . 2010-05-06 20:33 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2010-05-22 13:07 . 2010-05-06 20:39 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2010-05-22 13:07 . 2010-05-06 20:34 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2010-05-22 13:07 . 2010-05-06 20:33 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2010-05-22 13:07 . 2010-05-06 20:33 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys 2010-05-22 13:07 . 2010-05-06 20:33 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2010-05-22 13:06 . 2010-05-06 20:59 38848 ----a-w- c:\windows\system32\avastSS.scr 2010-05-22 13:06 . 2010-05-06 20:59 165032 ----a-w- c:\windows\system32\aswBoot.exe 2010-05-22 13:06 . 2010-05-22 13:06 -------- d-----w- c:\program files\Alwil Software 2010-05-22 13:06 . 2010-05-22 13:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software 2010-05-22 12:39 . 2010-05-22 12:39 -------- d-----w- C:\VundoFix Backups 2010-05-22 09:35 . 2010-05-22 09:35 503808 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-243a5251-n\msvcp71.dll 2010-05-22 09:35 . 2010-05-22 09:35 499712 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-243a5251-n\jmc.dll 2010-05-22 09:35 . 2010-05-22 09:35 61440 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7b6c86a6-n\decora-sse.dll 2010-05-22 09:35 . 2010-05-22 09:35 348160 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-243a5251-n\msvcr71.dll 2010-05-22 09:35 . 2010-05-22 09:35 12800 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7b6c86a6-n\decora-d3d.dll 2010-05-22 07:56 . 2010-05-22 08:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-05-22 07:56 . 2010-05-22 08:02 -------- d-----w- c:\program files\Spybot - Search & Destroy . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-21 19:29 . 2009-08-25 20:29 -------- d-----w- c:\documents and settings\buddy\Application Data\vlc 2010-05-10 18:32 . 2004-08-16 15:41 510980 ----a-w- c:\windows\system32\perfh00C.dat 2010-05-10 18:32 . 2004-08-16 15:41 84964 ----a-w- c:\windows\system32\perfc00C.dat 2010-04-23 20:32 . 2010-04-23 20:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-04-23 20:32 . 2010-04-23 20:30 -------- d-----w- c:\program files\iTunes 2010-04-23 20:30 . 2010-04-23 20:30 -------- d-----w- c:\program files\iPod 2010-04-23 20:30 . 2008-07-02 19:34 -------- d-----w- c:\program files\Fichiers communs\Apple 2010-04-23 20:25 . 2010-04-23 20:25 -------- d-----w- c:\program files\QuickTime 2010-04-23 20:20 . 2010-04-23 20:20 -------- d-----w- c:\program files\Bonjour 2010-04-23 20:17 . 2010-04-23 20:17 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe 2010-04-23 20:15 . 2009-07-10 20:07 -------- d-----w- c:\program files\Safari 2010-04-23 20:12 . 2010-04-23 20:12 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe 2010-04-21 20:08 . 2008-06-27 17:50 -------- d-----w- c:\program files\Java 2010-04-12 15:29 . 2010-04-21 20:08 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-04-03 08:12 . 2008-06-27 17:50 -------- d-----w- c:\program files\Fichiers communs\Java 2010-04-03 08:12 . 2010-04-03 08:12 503808 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5f7174ae-n\msvcp71.dll 2010-04-03 08:12 . 2010-04-03 08:12 499712 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5f7174ae-n\jmc.dll 2010-04-03 08:12 . 2010-04-03 08:12 348160 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5f7174ae-n\msvcr71.dll 2010-04-03 08:12 . 2010-04-03 08:12 61440 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5c5dcfaa-n\decora-sse.dll 2010-04-03 08:12 . 2010-04-03 08:12 12800 ----a-w- c:\documents and settings\buddy\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5c5dcfaa-n\decora-d3d.dll 2010-03-10 06:16 . 2004-08-16 15:41 420352 ----a-w- c:\windows\system32\vbscript.dll 2010-03-03 21:01 . 2008-06-27 09:02 50224 ----a-w- c:\documents and settings\buddy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-25 06:17 . 2004-08-16 15:41 916480 ----a-w- c:\windows\system32\wininet.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] 2009-10-15 08:53 165184 ----a-w- c:\program files\SFR\Kit\SFRNavErrorHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-25 68856] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144] "Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-10-15 959808] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218] "VTTimer"="VTTimer.exe" [2005-03-08 53248] "VTTrayp"="VTtrayp.exe" [2005-09-14 167936] "STDSB"="c:\windows\system32\drivers\STDSB.exe" [2003-12-17 28672] "Icon"="c:\windows\system32\drivers\Icon.exe" [2005-08-23 221184] "SoundMan"="SOUNDMAN.EXE" [2005-08-17 90112] "PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-02-18 248040] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120] "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 110592] Assistant d'Acrobat.lnk - c:\program files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\\AOL 9.0\\aol.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"= "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\APPS\\Inventime\\my.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"= R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [22/05/2010 15:07 164048] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [22/05/2010 15:07 19024] R2 MTC0007_STDSB;Scroll Bar Driver;c:\windows\system32\drivers\STDSB.sys [24/08/2006 16:34 11279] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 13:31 92008] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27/06/2008 15:59 717296] S2 STDSB;STDSB;c:\windows\system32\drivers\STDSB.sys [24/08/2006 16:34 11279] . Contenu du dossier 'Tâches planifiées' 2010-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 DPF: {DAF94F73-2AA6-44D8-A562-A28831820D34} - hxxp://aol.pixum.fr/apps/EasyUploadX.cab FF - ProfilePath - c:\documents and settings\buddy\Application Data\Mozilla\Firefox\Profiles\dv8sb94s.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q= FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- FF - user.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q= c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); . - - - - ORPHELINS SUPPRIMES - - - - HKLM-Run-Adobe ARM - c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe Notify-cc530681924 - c:\windows\system32\imagehlp32.dll ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-05-25 20:24 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySqlInventime] "ImagePath"="c:\mysql\bin\mysqld-max-nt MySqlInventime" . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-2891194784-769547661-2943159236-1006\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*] "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . Heure de fin: 2010-05-25 20:26:39 ComboFix-quarantined-files.txt 2010-05-25 18:26 Avant-CF: 45 838 327 808 octets libres Après-CF: 45 796 352 000 octets libres - - End Of File - - 14C97ECA700B069ADEB8422EA96B2CC7

jeanmimigab · le 25 Mai 2010 19:58

humm, vraiment bizarre, pas de trace de rootkit...

tu peux refaire un scan rapide Malwarebyte et me poster le rapport...

dit moi aussi si Avast détecte toujours ce rootkit.gen, et si oui donne moi le nom du fichier détecté et l'emplacement de ce fichier qui est indiqué par Avast :wink:

TOFFY · le 25 Mai 2010 21:17

En effet Avast ne détecte plus rien depuis les 2 dernères manip avec OTL, Winsockxpfix et combofix...
Malwarebyte ne détecte rien non plus en examen rapide :

Code: Tout sélectionner: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Version de la base de données: 4139 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 25/05/2010 22:12:02 mbam-log-2010-05-25 (22-12-02).txt Type d'examen: Examen rapide Elément(s) analysé(s): 120266 Temps écoulé: 8 minute(s), 31 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 0 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): (Aucun élément nuisible détecté)

Je vais lancer un examen complet pour voir...

TOFFY · le 25 Mai 2010 21:20

hier l'examen complet me donnait ça :

Code: Tout sélectionner: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Version de la base de données: 4134 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 24/05/2010 13:28:45 mbam-log-2010-05-24 (13-28-45).txt Type d'examen: Examen complet (C:\|) Elément(s) analysé(s): 198623 Temps écoulé: 59 minute(s), 24 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 12 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\Documents and Settings\buddy\Local Settings\Temp\1C.tmp (Trojan.Tracur) -> Quarantined and deleted successfully. C:\Program Files\Adobe\Adobe Illustrator CS\Modules\Filtres Photoshop\Accentuation.8bf (Trojan.Spambot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP185\A0128637.exe (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP185\A0128639.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP186\A0128664.exe (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0129961.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0130013.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0129980.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0129997.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0130030.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0131030.dll (Trojan.Tracur) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP187\A0131043.dll (Trojan.Tracur) -> Quarantined and deleted successfully.

TOFFY · le 25 Mai 2010 21:22

je lance le complet et te poste le rapport...

TOFFY · le 25 Mai 2010 22:13

et voila le résultat :cry:

:

Code: Tout sélectionner: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Version de la base de données: 4139 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 25/05/2010 23:09:07 mbam-log-2010-05-25 (23-09-07).txt Type d'examen: Examen complet (C:\|) Elément(s) analysé(s): 193320 Temps écoulé: 39 minute(s), 45 seconde(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 0 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 0 Fichier(s) infecté(s): 5 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): (Aucun élément nuisible détecté) Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): (Aucun élément nuisible détecté) Fichier(s) infecté(s): C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP188\A0131063.dll (Trojan.Tracur) -> No action taken. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP188\A0131103.dll (Trojan.Tracur) -> No action taken. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP188\A0131175.dll (Trojan.Tracur) -> No action taken. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP188\A0131191.dll (Trojan.Tracur) -> No action taken. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP188\A0131225.dll (Trojan.Tracur) -> No action taken.

jeanmimigab · le 25 Mai 2010 22:17

arf, c'est rien, juste des points de restaurations infectés, on les virera en fin de désinfection :wink:

jeanmimigab · le 25 Mai 2010 22:23

Il nous reste a désinstaller de manière automatique tous les outils utilisés pour la désinfection...

pour cela...

télécharge >>> ToolsCleaner <<< (de A.Rothstein & dj QUIOU)

fait un double-clique dessus pour lancer le programme

Clique sur Recherche et laisse le scan se terminer (il peut durer une dizaine de minutes au maximum).

une fois la recherche lancée, ne clique pas dans la fenêtre, cela provoquerait un léger bug du programme.

Si toutes fois la mention (ne réponds pas) apparaissait dans le titre de la fenêtre ToolsCleaner, ne t'en occupes pas et laisse quand même le programme terminer son travail

à demain, bonne nuit :wink:

TOFFY · le 26 Mai 2010 12:36

le rapport Toolscleaner me donne ça :

Code: Tout sélectionner: [ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ] --> Recherche: C:\VundoFix.txt: trouvé ! C:\Combofix.txt: trouvé ! C:\Vundofix backups: trouvé ! C:\Qoobox: trouvé ! C:\Qoobox\Quarantine\catchme.log: trouvé ! C:\WINDOWS\mbr.exe: trouvé !

que faut-il faire... les supprimer ?
Merci

jeanmimigab · le 26 Mai 2010 17:01

salut

c'est ok, tu peux supprimer ce que ToolsCleanner a trouvés

ensuite...

pour éviter les détections de malwarebytes dans tes points de restauration et pour avoir un point de restauration propre fais cela...

Il faut purger ta Restauration du système pour qu'elle soit exempte d'infections, pour ce faire:

Clique simultanément sur les touches Windows + Pause du clavier, puis coche la case
indiquée puis clique sur Appliquer et Ok.
Redémarre ton PC, décoche la case Appliquer puis clique sur Ok.

=====================================================================================================

Procède à une Défragmentation afin d'optimiser les temps d'accès du disque dur lors de la lecture des :

Pour lancer une défragmentation, double-clique sur Poste de Travail,clic-droit sur le disque à défragmenter puis sur Propriétés.
Choisis l'onglet Outils puis clique sur défragmenter maintenant .
Cette opération est à renouveler régulièrement ( Environs une fois par mois ).

=====================================================================================================

Ne pas oublier de créer un point de restauration après cette manip, pour ce faire:

Clique sur Démarrer, puis Exécuter, saisir: restore/rstrui.exe valider par Entrée>>
Cocher Créer un point de restauration>>cliquer sur Suivant

Saisir un nom pour le point de restauration puis cliquer sur Créer.

=====================================================================================================

Pense à mettre à jours Windows:

La méthode la plus simple et l'utilisation de "Windows Update" qui se trouve dans ton menu démarrer

Pense à mettre à jours Java:

La méthode la plus simple et l'utilisation de >> JavaRa <<

Pense à mettre à jour Acrobat reader si il est installé sur ton PC de cette manière:

Ouvre Acrobat reader, clique sur "aide" et choisis "rechercher des mises à jours..."

un peu de lecture sur la manière de protéger ton surf et ton ordinateur:

un Compte Utilisateur limité accroît la sécurité de l'ordinateur.
Quelques mesures préventives pour surfer couvert.
Comment éviter les imprudences d'installation.
Reconnaitre et éviter les infections Msn.
Si tu utilises "Face Book", lis >> cet article << afin de ne pas te faire piéger

@++

Win32:Rootkit-gen [Résolu]

Win32:Rootkit-gen [Résolu]

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Re: Win32:Rootkit-gen

Sujets similaires

Qui est en ligne