Re-bonjour,
Merci beaucoup pour toutes ces infos ; tout suivi à la lettre (sauf pour placer RSIT.exe sur le bureau… j’ai zappé et exécuté depuis Mes docs/Téléchargements ; j’espère que ce n’est pas trop grave. Je l’ai relancé après depuis le bureau, mais le fichier info.txt ne se regénère pas. Je posterai donc ici l’unique version info.txt générée, et la dernière version du log).
En apéritif le résultat d’un scan kasperty (qui a remplacé temporairement antivir, dans sa version d’évaluation) :
État : Suspect (événements : 3)
17/05/2010 17:19:32 Suspect programme légitime pouvant être exploité par un individu mal intentionné afin de nuire à l’ordinateur ou à vos données PDM.Keylogger kernel mode memory patch Moyenne
17/05/2010 17:19:33 Suspect programme légitime pouvant être exploité par un individu mal intentionné afin de nuire à l’ordinateur ou à vos données PDM.DNS Query C:\WINDOWS\SYSTEM32\HKMD.EXE Faibles
17/05/2010 17:19:36 Suspect programme légitime pouvant être exploité par un individu mal intentionné afin de nuire à l’ordinateur ou à vos données PDM.Keylogger C:\WINDOWS\SYSTEM32\SVHOST.EXE Moyenne
État : En quarantaine (événements : 2)
17/05/2010 18:27:58 En quarantaine virus HEUR:Trojan.Script.Generic C:\Documents and Settings\XP\Local Settings\Temp\npsA.tmp Elevées
17/05/2010 18:27:58 En quarantaine virus HEUR:Trojan.Script.Generic C:\Documents and Settings\XP\Local Settings\Temp\npsA.tmp//data0000 Elevées
Le « kernel mode memory patch » me fait un peu peur…
Le rapport final de MBAM comme tu m’avais demandé :
Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4110
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
17/05/2010 23:44:00
mbam-log-2010-05-17 (23-44-00).txt
Type d’examen: Examen complet (C:|)
Elément(s) analysé(s): 164814
Temps écoulé: 2 heure(s), 53 minute(s), 4 seconde(s)
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 29
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 6
Processus mémoire infecté(s):
C:\WINDOWS\system32\svhost.exe (Trojan.Agent) → Unloaded process successfully.
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\epk_extr (Trojan.Skintrim) → Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
Dossier(s) infecté(s):
C:\Documents and Settings\XP\Application Data\FunWebProducts (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Documents and Settings\XP\Application Data\FunWebProducts\Data (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Documents and Settings\XP\Application Data\FunWebProducts\Data\XP (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) → Quarantined and deleted successfully.
Fichier(s) infecté(s):
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) → Quarantined and deleted successfully.
C:\WINDOWS\system32\hcgnamtw_nav.dat (Adware.NaviPromo) → Quarantined and deleted successfully.
C:\WINDOWS\system32\hcgnamtw_navps.dat (Adware.NaviPromo) → Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) → Quarantined and deleted successfully.
C:\WINDOWS\system32\svhost.exe (Trojan.Agent) → Delete on reboot.
/************************************************************************
- exécution de RSIT.exe, voici le fichier info.txt :
************************************************************************/
info.txt logfile of random’s system information tool 1.06 2010-05-17 23:49:06
======Uninstall list======
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Brother MFL-Pro Suite DCP-387C–>« C:\Program Files\InstallShield Installation Information{3A08B59E-A9F0-4F4D-B7E5-6875D7F13327}\Setup.exe » -runfromtemp -l0x040c UNINSTALL Reg=BH9_C1 -removeonly
CCleaner (remove only)–>« C:\Program Files\CCleaner\uninst.exe »
DEXXA Webcam–>MsiExec.exe /I{43A9F944-0398-425E-9E22-201F65FE0CCA}
DivX Plus Web Player–>C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eMule–>« C:\Program Files\eMule\Uninstall.exe »
EPSON Logiciel imprimante–>C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /r
EPSON Logiciel imprimante–>C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
HijackThis 2.0.2–>« C:\Program Files\Trend Micro\HijackThis\HijackThis.exe » /uninstall
ICQ6.5–>« C:\Program Files\InstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe » -runfromtemp -l0x0009 -removeonly
J2SE Runtime Environment 5.0 Update 17–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150170}
Java™ 6 Update 13–>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Kaspersky Anti-Virus 2010–>MsiExec.exe /I{943B6738-4801-4982-90EC-0442EF7AEB16}
Kaspersky Anti-Virus 2010–>MsiExec.exe /I{943B6738-4801-4982-90EC-0442EF7AEB16}
K-Meleon 1.5.4 fr-FR (supprimer uniquement)–>C:\Program Files\K-Meleon\uninstall.exe
Lecteur Windows Media 11–>« C:\Program Files\Windows Media Player\Setup_wm.exe » /Uninstall
LimeWire 5.5.8–>« C:\Program Files\LimeWire\uninstall.exe »
Macromedia Shockwave Player–>C:\WINDOWS\system32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~1\Install.log
Malwarebytes’ Anti-Malware–>« C:\Program Files\Malwarebytes_Anti-Malware\unins000.exe »
Many Faces of Go 12–>MsiExec.exe /I{59772D11-9D88-4020-838C-6F4864D0DE8A}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office Access MUI (French) 2007–>MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Enterprise 2007–>« C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe » /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007–>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007–>MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Groove MUI (French) 2007–>MsiExec.exe /X{90120000-00BA-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007–>MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office OneNote MUI (French) 2007–>MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007–>MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007–>MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007–>MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007–>MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007–>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007–>MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007–>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007–>MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007–>MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007–>MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007–>MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007–>MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17–>MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.6.3)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
PaperPort Image Printer–>MsiExec.exe /X{2BC2781A-F7F6-452E-95EB-018A522F1B2C}
PeaZip 3.1–>« C:\Program Files\PeaZip\unins000.exe »
PerfectDisk 10 Professional–>MsiExec.exe /I{7B738CD9-D107-48C7-8E65-2E6639A39C8D}
Picasa 3–>« C:\Program Files\Google\Picasa3\Uninstall.exe »
Pidgin–>C:\Program Files\Pidgin\pidgin-uninst.exe
PowerDVD–>RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup « C:\Program Files\InstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe » -uninstall
Real Alternative 2.0.2–>« C:\Program Files\Real Alternative\unins000.exe »
ScanSoft PaperPort 11–>MsiExec.exe /I{7A8FF745-BBC5-482B-88E4-18D3178249A9}
SCRABBLE® Interactif EDITION 2007 Désinstaller–>C:\Program Files\SCRABBLE® Interactif EDITION 2007\uninstall.exe
Skype 3.8–>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SoundMAX–>RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup « C:\Program Files\InstallShield Installation Information{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe »
SumatraPDF–>« C:\Program Files\SumatraPDF\uninstall.exe »
Trillian–>C:\Program Files\Trillian\Trillian.exe /uninstall
ULi AC’97 Audio Controller Driver–>C:\Program Files\InstallShield Installation Information\ULi AC’97 Audio Controller Driver\setup.exe
ULi PCI 10-100 Fast Ethernet Controller Driver–>C:\Program Files\InstallShield Installation Information\ULi PCI 10-100 Fast Ethernet Controller Driver\setup.exe
ULi PCI to AGP Controller Driver–>C:\Program Files\InstallShield Installation Information\ULi PCI to AGP Controller Driver\setup.exe
ULi USB2.0 Controller Driver–>C:\WINDOWS\system32\unusb20.EXE C:\WINDOWS\IsUninst.exe -y -fC:\WINDOWS\system32\ALiEHCI.isu
VC80CRTRedist - 8.0.50727.4053–>MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
Visual C++ 8.0 ATL (x86) WinSXS MSM Beta2–>MsiExec.exe /I{97F81AF1-0E47-DC99-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 ATL.Policy (x86) WinSXS MSM Beta2–>MsiExec.exe /I{66332652-9C28-58B1-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 CRT (x86) WinSXS MSM Beta2–>MsiExec.exe /I{98CB24AD-52FB-DB5F-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM Beta2–>MsiExec.exe /I{63E949F6-03BC-5C40-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 MFC (x86) WinSXS MSM Beta2–>MsiExec.exe /I{9BAE13A2-E7AF-D6C3-FF1F-C8B3B9A1E18E}
Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM Beta2–>MsiExec.exe /I{68B7C6D9-1DF2-54C1-FF1F-C8B3B9A1E18E}
VLC media player 1.0.5–>C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Media Format 11 runtime–>« C:\Program Files\Windows Media Player\wmsetsdk.exe » /UninstallAll
Windows Messenger 5.1–>MsiExec.exe /I{6E127288-02BD-4DB8-B46B-D9B2BB3C268C}
WordBiz version 1.8–>« C:\Program Files\WordBiz\unins000.exe »
======Hosts File======
127.0.0.1 localhost
======Security center information======
AV: Kaspersky Anti-Virus
======System event log======
Computer Name: WINDOWS
Event Code: 26
Message: Application popup : hkmd.exe - L’initialisation de la DLL a échoué : L’application n’a pas pu s’initialiser car la station de travail est en train d’être arrêtée.
Record Number: 71115
Source Name: Application Popup
Time Written: 20100428211408.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 26
Message: Application popup : svhost.exe - L’initialisation de la DLL a échoué : L’application n’a pas pu s’initialiser car la station de travail est en train d’être arrêtée.
Record Number: 71114
Source Name: Application Popup
Time Written: 20100428211408.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 26
Message: Application popup : hkmd.exe - L’initialisation de la DLL a échoué : L’application n’a pas pu s’initialiser car la station de travail est en train d’être arrêtée.
Record Number: 71113
Source Name: Application Popup
Time Written: 20100428211408.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 26
Message: Application popup : svhost.exe - L’initialisation de la DLL a échoué : L’application n’a pas pu s’initialiser car la station de travail est en train d’être arrêtée.
Record Number: 71112
Source Name: Application Popup
Time Written: 20100428211408.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 26
Message: Application popup : hkmd.exe - L’initialisation de la DLL a échoué : L’application n’a pas pu s’initialiser car la station de travail est en train d’être arrêtée.
Record Number: 71111
Source Name: Application Popup
Time Written: 20100428211408.000000+120
Event Type: Informations
User:
=====Application event log=====
Computer Name: WINDOWS
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.
Record Number: 12939
Source Name: SecurityCenter
Time Written: 20090724122710.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 0
Message: Service started
Record Number: 12938
Source Name: PDAgent
Time Written: 20090724122709.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 4
Message:
Record Number: 12937
Source Name: LightScribeService
Time Written: 20090724122709.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 0
Message:
Record Number: 12936
Source Name: ICQ Service
Time Written: 20090724122706.000000+120
Event Type: Informations
User:
Computer Name: WINDOWS
Event Code: 1517
Message: Windows a sauvegardé le Registre utilisateur WINDOWS\XP alors qu’une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l’utilisateur n’a pas été libérée. le Registre sera déchargé lorsqu’il ne sera plus utilisé.
Cela est souvent causé par des services s’exécutant en tant que compte d’utilisateur, essayez de configurer les services pour s’exécuter dans le compte service réseau ou service local.
Record Number: 12935
Source Name: Userenv
Time Written: 20090724001749.000000+120
Event Type: Avertissement
User: AUTORITE NT\SYSTEM
======Environment variables======
« ComSpec »=%SystemRoot%\system32\cmd.exe
« Path »=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem
« windir »=%SystemRoot%
« OS »=Windows_NT
« PROCESSOR_ARCHITECTURE »=x86
« PROCESSOR_LEVEL »=15
« PROCESSOR_IDENTIFIER »=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
« PROCESSOR_REVISION »=2c02
« NUMBER_OF_PROCESSORS »=1
« PATHEXT »=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
« TEMP »=%SystemRoot%\TEMP
« TMP »=%SystemRoot%\TEMP
« FP_NO_HOST_CHECK »=NO
-----------------EOF-----------------
/************************************************************************
- Puis le fichier log.txt :
************************************************************************/
Logfile of random’s system information tool 1.07 (written by random/random)
Run by XP at 2010-05-17 23:52:32
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 11 GB (55%) free of 19 GB
Total RAM: 511 MB (45% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:52:34, on 17/05/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\XP\Bureau\RSIT.exe
C:\Program Files\trend micro\XP.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = google.icq.com…
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = google.icq.com…
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr…
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM..\Run: [PPort11reminder] « C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe » -r « C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini »
O4 - HKLM..\Run: [AVP] « C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe »
O4 - HKUS\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‹ SERVICE LOCAL ›)
O4 - HKUS\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‹ SERVICE RÉSEAU ›)
O4 - HKUS\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‹ SYSTEM ›)
O4 - HKUS.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‹ Default user ›)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\system32\GPhotos.scr…
O8 - Extra context menu item: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE…
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra ‹ Tools › menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra ‹ Tools › menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‹ Tools › menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - go.microsoft.com…
O17 - HKLM\System\CCS\Services\Tcpip..{1FD71114-D04D-4219-82B2-ECAE2CD1467B}: NameServer = 80.10.246.2,80.10.246.129
O17 - HKLM\System\CS1\Services\Tcpip..{1FD71114-D04D-4219-82B2-ECAE2CD1467B}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: Service d’administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d’aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe
–
End of file - 7636 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll [2009-10-20 68112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll [2009-10-20 268816]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
« PPort11reminder »=C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-08-31 328992]
« AVP »=C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-10-20 340456]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2008-02-19 1089536]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2007-12-21 86016]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EoWeather]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2007-10-11 46368]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ORAHSSSessionManager]
C:\Program Files\Orange\Connexion Internet Orange\SessionManager\SessionManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2007-10-11 29984]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2008-09-29 21755688]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^XP^Menu Démarrer^Programmes^Accessoires^Démarrage^K-Meleon Loader.lnk]
C:\PROGRA~1\K-Meleon\loader.exe [2007-04-15 32768]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
« Boonty Games »=3
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
« AppInit_DLLS »=« C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll »
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2009-10-20 219664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
« {B5A7F190-DDA6-4420-B3BA-52453494E6CD} »=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
« dontdisplaylastusername »=0
« legalnoticecaption »=
« legalnoticetext »=
« shutdownwithoutlogon »=1
« undockwithoutlogon »=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
« NoDriveTypeAutoRun »=0x95000000
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
« %windir%\system32\sessmgr.exe »=« %windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019"
« C:\Program Files\ICQLite\ICQLite.exe »="C:\Program Files\ICQLite\ICQLite.exe::Enabled:ICQ Lite »
« C:\Program Files\eMule\emule.exe »=« C:\Program Files\eMule\emule.exe::Enabled:eMule"
« C:\WINDOWS\System32\rtcshare.exe »="C:\WINDOWS\System32\rtcshare.exe::Enabled:Partage de l’application RTC »
« C:\Program Files\BitTorrent\bittorrent.exe »=« C:\Program Files\BitTorrent\bittorrent.exe::Enabled:BitTorrent"
« C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe »="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe::Enabled:Yahoo! Messenger »
« C:\Program Files\Yahoo!\Messenger\YServer.exe »=« C:\Program Files\Yahoo!\Messenger\YServer.exe::Enabled:Yahoo! FT Server"
« C:\DOCUME~1\XP\LOCALS~1\Temp\services.exe »="C:\DOCUME~1\XP\LOCALS~1\Temp\services.exe::Enabled:Flash Player2 »
« C:\Program Files\Real\RealPlayer\RealPlay.exe »=« C:\Program Files\Real\RealPlayer\RealPlay.exe::Disabled:RealPlayer"
« C:\Program Files\Ubisoft\Chessmaster Grandmaster Edition\game.exe »="C:\Program Files\Ubisoft\Chessmaster Grandmaster Edition\game.exe::Disabled:Chessmaster: Grandmaster Edition »
« C:\Program Files\ICQ6\ICQ.exe »=« C:\Program Files\ICQ6\ICQ.exe::Enabled:ICQ6"
« C:\WINDOWS\System32\dpvsetup.exe »="C:\WINDOWS\System32\dpvsetup.exe::Enabled:Microsoft DirectPlay Voice Test »
« C:\WINDOWS\System32\rundll32.exe »=« C:\WINDOWS\System32\rundll32.exe::Enabled:Exécuter une DLL en tant qu’application"
« C:\Program Files\uTorrent\uTorrent.exe »="C:\Program Files\uTorrent\uTorrent.exe::Enabled:µTorrent »
« C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\HelpCtr.exe »=« C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\HelpCtr.exe::Enabled:Assistance à distance - Windows Messenger et voix"
« C:\Program Files\ICQ6.5\ICQ.exe »="C:\Program Files\ICQ6.5\ICQ.exe::Enabled:ICQ6 »
« C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE »=« C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE::Enabled:Microsoft Office Outlook"
« C:\Program Files\Microsoft Office\Office12\groove.exe »="C:\Program Files\Microsoft Office\Office12\groove.exe::Enabled:Microsoft Office Groove »
« C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE »=« C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE::Enabled:Microsoft Office OneNote"
« C:\Program Files\Messenger\Msmsgs.exe »="C:\Program Files\Messenger\Msmsgs.exe::Enabled:Windows Messenger »
« C:\Program Files\LimeWire\LimeWire.exe »=« C:\Program Files\LimeWire\LimeWire.exe::Enabled:LimeWire"
« C:\Program Files\Orange\Connexion Internet Orange\Connectivity\ConnectivityManager.exe »="C:\Program Files\Orange\Connexion Internet Orange\Connectivity\ConnectivityManager.exe::enabled:CSS »
« C:\Program Files\Skype\Phone\Skype.exe »=« C:\Program Files\Skype\Phone\Skype.exe::Enabled:Skype"
« C:\Program Files\eDonkey2000\edonkey2000.exe »="C:\Program Files\eDonkey2000\edonkey2000.exe::Disabled:edonkey2000 »
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
« %windir%\system32\sessmgr.exe »=« %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 »
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{0cf9b7b0-2bfb-11dc-b9ab-0015f24763f5}]
shell\Auto\command - AdobeR.exe e
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{336a3174-c278-11da-b5f8-00073aa68f17}]
shell\AutoRun\command - hkiakubk.exe
shell\explore\command - hkiakubk.exe
shell\open\command - hkiakubk.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{6ea21fbc-1955-11df-be75-0015f24763f5}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL eTudiaNt.exE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{8a3c91d4-ec94-11dc-bafb-0015f24763f5}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{fc75c48c-0a2c-11dc-b96f-0015f24763f5}]
shell\AutoRun\command - F:\LaunchU3.exe -a
======List of files/folders created in the last 3 months======
2010-05-17 23:48:37 ----D---- C:\rsit
2010-05-17 20:42:05 ----D---- C:\Documents and Settings\XP\Application Data\Malwarebytes
2010-05-17 20:41:41 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-05-17 20:41:40 ----D---- C:\Program Files\Malwarebytes_Anti-Malware
2010-05-17 17:15:30 ----D---- C:\Program Files\Kaspersky Lab
2010-05-17 17:15:30 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2010-05-17 17:06:12 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-05-17 16:16:26 ----SHD---- C:\FOUND.008
2010-05-17 14:38:32 ----D---- C:\Program Files\Pidgin
2010-05-17 14:33:07 ----D---- C:\Documents and Settings\XP\Application Data.purple
2010-05-17 13:55:54 ----D---- C:\Documents and Settings\XP\Application Data\K-Meleon
2010-05-17 13:55:41 ----D---- C:\Program Files\K-Meleon
2010-05-17 13:51:40 ----D---- C:\Documents and Settings\XP\Application Data\midori
2010-05-15 15:54:15 ----A---- C:\WINDOWS\system32\VB6STKIT.DLL
2010-05-15 15:54:15 ----A---- C:\WINDOWS\system32\SSubTmr6.dll
2010-05-15 15:54:15 ----A---- C:\WINDOWS\system32\inetfr.DLL
2010-05-15 15:54:14 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL
2010-05-15 15:54:13 ----D---- C:\Documents and Settings\XP\Application Data\FreeBurner
2010-05-15 13:52:17 ----A---- C:\WINDOWS\kit.ini
2010-05-15 10:13:42 ----D---- C:\Documents and Settings\XP\Application Data\PeaZip
2010-05-15 10:10:54 ----D---- C:\Program Files\PeaZip
2010-05-14 22:06:52 ----D---- C:\Documents and Settings\XP\Application Data\SumatraPDF
2010-05-14 22:06:48 ----D---- C:\Program Files\SumatraPDF
2010-05-14 21:53:23 ----D---- C:\Documents and Settings\XP\Application Data\vlc
2010-05-14 21:51:55 ----D---- C:\Program Files\VideoLAN
2010-05-14 21:49:51 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2010-05-14 21:49:51 ----A---- C:\WINDOWS\system32\pndx5032.dll
2010-05-14 21:49:51 ----A---- C:\WINDOWS\system32\pndx5016.dll
2010-05-14 21:49:51 ----A---- C:\WINDOWS\system32\pncrt.dll
2010-05-14 21:49:49 ----D---- C:\Program Files\Real Alternative
2010-04-12 16:08:18 ----SHD---- C:\FOUND.007
2010-04-04 11:05:06 ----SHD---- C:\FOUND.006
2010-03-31 18:21:05 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
2010-03-31 16:41:26 ----SHD---- C:\FOUND.005
2010-03-03 17:23:02 ----D---- C:\WNISCORE
2010-02-25 14:30:26 ----D---- C:\Documents and Settings\All Users\Application Data\Norton
2010-02-25 14:30:25 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2010-02-25 14:30:18 ----D---- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2010-02-20 17:23:35 ----D---- C:\Documents and Settings\XP\Application Data\MSN6
2010-02-20 17:23:35 ----D---- C:\Documents and Settings\All Users\Application Data\MSN6
======List of files/folders modified in the last 3 months======
2010-05-17 23:45:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-17 23:44:40 ----A---- C:\Documents and Settings\XP\Application Data\IPs.txt
2010-05-17 15:07:46 ----ASH---- C:\boot.ini
2010-05-17 15:07:46 ----A---- C:\WINDOWS\win.ini
2010-05-17 15:07:46 ----A---- C:\WINDOWS\system.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 kl1;Kl1; ??\C:\WINDOWS\system32\drivers\kl1.sys
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2010-05-17 315408]
R2 ALIEHCD;ULi PCI to USB Enhanced Host Controller; C:\WINDOWS\System32\Drivers\ALIEHCI.sys [2005-02-21 83596]
R2 DefragFS;DefragFS; C:\WINDOWS\system32\drivers\DefragFS.sys [2009-08-20 73232]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 aliroothub;USB 2.0 Root Hub; C:\WINDOWS\system32\DRIVERS\AliRtHub.sys [2005-02-21 5331]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-04-19 602880]
R3 ULI5261XP;ULi M526X Ethernet NT Driver; C:\WINDOWS\system32\DRIVERS\ULILAN51.SYS [2005-03-22 28672]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys
S3 ar03upwi;ar03upwi; C:\WINDOWS\system32\drivers\ar03upwi.sys
S3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys [2004-10-15 15295]
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4.sys [2001-08-17 731648]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; ??\C:\WINDOWS\system32\PCAMPR5.SYS
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; ??\C:\WINDOWS\system32\PCANDIS5.SYS
S3 QCDonner;Logitech QuickCam Express; C:\WINDOWS\system32\DRIVERS\OVCD.sys [2001-08-17 28032]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS
S3 ULI5261;ULi Based Ethernet NT Driver; C:\WINDOWS\system32\DRIVERS\ULILAN.SYS [2004-12-31 28160]
S3 USB_RNDIS;Inventel Gateway; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-03 12672]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Classe d’imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\System32\DRIVERS\sr.sys [2004-08-19 73600]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AVP;Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-10-20 340456]
R2 EPSONStatusAgent2;EPSON Printer Status Agent2; C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe [2000-11-17 114688]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 PDAgent;PDAgent; C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe [2009-10-07 939272]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-31 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PDEngine;PDEngine; C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe [2009-10-07 1033480]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-19 14336]
S4 Boonty Games;Boonty Games; C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
-----------------EOF-----------------
à première vue tout est rentré dans l’ordre,
j’attends ta confirmation 
Bonne nuit
Edité le 18/05/2010 à 00:09
