Assiste.Forums

de **boumsky** » 08 Juil 2012, 11:08

bonjour je suis bloqué par une page office central de lutte contre la criminalité, jai suivi le tuto en mode sans echec car en mode normal je ne peux rien faire du tout.
voici les rapports.
Merci de votre aide.

rapport malwarebytes:
Malwarebytes Anti-Malware (Essai) 1.61.0.1400
http://www.malwarebytes.org

Version de la base de données: v2012.07.08.01

Windows 7 x86 NTFS (Mode sans échec/Réseau)
Internet Explorer 8.0.7600.16385
Philippe :: PHILIPPE-PC [administrateur]

Protection: Désactivé

08/07/2012 10:57:36
mbam-log-2012-07-08 (11-11-21).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 198506
Temps écoulé: 2 minute(s), 42 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 23
HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Aucune action effectuée.
HKCR\CLSID\{1602F07D-8BF3-4c08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\TypeLib\{C55CA95C-324B-451C-B2D2-6E895AA75FEC} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\ClickPotatoLiteAX.info.1 (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\ClickPotatoLiteAX.info (Adware.ClickPotato) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\CLSID\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\ClickPotatoLiteAX.UserProfiles.1 (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\ClickPotatoLiteAX.UserProfiles (Adware.ClickPotato) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\Typelib\{814BAA91-DC22-4350-87D6-0C86E93F7F08} (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\Interface\{419EDA30-6DFF-432C-B534-E15D899ABEE4} (Adware.ClickPotato) -> Aucune action effectuée.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Aucune action effectuée.
HKCR\MenuButtonIE.ButtonIE (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\MenuButtonIE.ButtonIE.1 (Adware.ClickPotato) -> Aucune action effectuée.
HKCR\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Aucune action effectuée.
HKCU\Software\clickpotatolitesa (Adware.ClickPotato) -> Aucune action effectuée.
HKLM\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ClickPotatoLiteSA (Adware.ClickPotato) -> Aucune action effectuée.

Valeur(s) du Registre détectée(s): 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run||65065205-2FC1-1C2F-B490-9B9D620E5615} (Trojan.ZbotR.Gen) -> Données: C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe -> Aucune action effectuée.
HKLM\SOFTWARE\Mozilla\Firefox\extensions|ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Données: C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions -> Aucune action effectuée.

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 10
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA (Adware.ClickPotato) -> Aucune action effectuée.
C:\Users\Philippe\AppData\Roaming\ClickPotatoLite (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0 (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\plugins (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato (Adware.ClickPotato) -> Aucune action effectuée.

Fichier(s) détecté(s): 17
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSAAX.dll (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll (Adware.ClickPotato) -> Aucune action effectuée.
C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe (Trojan.ZbotR.Gen) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA.dat (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_hpk.dat (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf.dat (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSA.exe (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSAHook.dll (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteUninstaller.exe (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Aucune action effectuée.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\plugins\npclntax_ClickPotatoLiteSA.dll (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\About Us.lnk (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Customer Support.lnk (Adware.ClickPotato) -> Aucune action effectuée.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Uninstall Instructions.lnk (Adware.ClickPotato) -> Aucune action effectuée.

(fin)

de **boumsky** » 08 Juil 2012, 11:09

rapport otl.txt:
OTL logfile created on: 08/07/2012 11:14:35 - Run 2
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Philippe\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 0000040c | Country: France | Language: FRA | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,56 Gb Available Physical Memory | 77,92% Memory free
4,00 Gb Paging File | 3,64 Gb Available in Paging File | 91,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,60 Gb Total Space | 22,96 Gb Free Space | 15,25% Space Free | Partition Type: NTFS
Drive D: | 147,49 Gb Total Space | 18,08 Gb Free Space | 12,26% Space Free | Partition Type: NTFS
Drive E: | 83,78 Gb Total Space | 9,95 Gb Free Space | 11,88% Space Free | Partition Type: NTFS
Drive F: | 149,10 Gb Total Space | 63,08 Gb Free Space | 42,30% Space Free | Partition Type: NTFS
Drive H: | 14,81 Gb Total Space | 2,59 Gb Free Space | 17,49% Space Free | Partition Type: NTFS

Computer Name: PHILIPPE-PC | User Name: Philippe | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/08 10:25:20 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Philippe\Desktop\OTL.exe
PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2009/08/16 17:06:02 | 000,141,312 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll

========== Win32 Services (SafeList) ==========

SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/08/18 19:25:25 | 000,311,680 | ---- | M] (Kaspersky Lab) [Auto | Stopped] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe -- (AVP)
SRV - [2010/06/25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010/05/19 23:34:43 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/09/17 11:33:26 | 000,651,776 | ---- | M] (Nokia) [Disabled | Stopped] -- D:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/01/29 17:54:44 | 000,102,400 | ---- | M] (PacketVideo) [On_Demand | Stopped] -- D:\Program Files\Nokia\Nokia Home Media Server\Media Server\twonkymedia.exe -- (TwonkyMedia)
SRV - [2007/06/11 10:14:52 | 000,517,040 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\lxdicoms.exe -- (lxdi_device)
SRV - [2007/05/31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (agab1huf)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/06/25 19:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2010/02/11 09:42:22 | 004,450,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/11/26 22:35:15 | 000,271,360 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/11/26 22:34:56 | 000,018,048 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/10/12 22:35:23 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/10/10 19:32:22 | 000,280,592 | ---- | M] (Kaspersky Lab) [File_System | System | Stopped] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2009/10/09 22:57:01 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2009/07/23 23:02:56 | 000,043,008 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2009/07/14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009/07/14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009/07/14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009/07/14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009/07/14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009/07/14 00:54:15 | 001,311,232 | ---- | M] (NXP Semiconductors) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)
DRV - [2009/07/14 00:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/06/15 14:01:00 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\kl1.sys -- (kl1)
DRV - [2009/05/16 20:59:34 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/05/15 18:50:22 | 000,021,008 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2009/02/09 09:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 09:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 09:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 09:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/12/15 20:41:32 | 000,033,808 | ---- | M] (Kaspersky Lab) [File_System | Boot | Stopped] -- C:\Windows\System32\drivers\klbg.sys -- (klbg)
DRV - [2008/08/26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2006/09/24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2005/08/17 08:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2005/08/17 08:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2005/08/17 08:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2004/05/06 00:15:04 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\PQNTDRV.sys -- (PQNTDrv)
DRV - [1996/04/03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=adj&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=upgrd&s={searchTerms}&f=4&hl={language}&src=chrm
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://fr.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E2 05 4F 1D 62 3A CB 01 [binary data]
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=adj&s={searchTerms}&f=4
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\..\SearchScopes\{55885489-3BAF-4046-B89C-9ADA2916B873}: "URL" = http://www.google.com/search?hl=en&q={searchTerms}
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\..\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}: "URL" = http://www.bing.com/search?q={searchTerms}&mkt=fr-FR&form=IE0004
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = socks=127.0.0.1:31038

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/webhp?hl=fr"
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.7
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.3.0.3
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.463
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110704
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: ClickPotatoLite@ClickPotatoLite.com:10.0.668.0
FF - prefs.js..extensions.enabledItems: cacaoweb@cacaoweb.org:1.0.12
FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0
FF - prefs.js..extensions.enabledItems: {99079a25-328f-4bd4-be04-00955acaa0a7}:4.6.1.01
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=362&systemid=406&sr=0&q="
FF - prefs.js..network.proxy.type: 4

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ClickPotatoLite@ClickPotatoLite.com: C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions [2011/04/04 18:39:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/25 18:24:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/25 18:24:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009/10/10 19:32:42 | 000,000,000 | ---D | M]

[2012/07/08 09:42:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philippe\AppData\Roaming\mozilla\Extensions
[2012/07/08 10:15:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions
[2011/07/12 21:49:46 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/12/12 20:49:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012/07/08 09:42:43 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/07/12 21:49:46 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/07/12 21:49:46 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2011/04/16 21:43:37 | 000,000,000 | ---D | M] (cacaoweb) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\cacaoweb@cacaoweb.org
[2009/12/23 21:45:09 | 000,000,000 | ---D | M] (readzik) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\undrm@readzik
[2011/02/03 18:31:11 | 000,002,650 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\searchplugins\bing.xml
[2012/07/08 09:42:35 | 000,002,519 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\searchplugins\Search_Results.xml
[2012/07/08 10:15:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010/12/10 20:11:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/02/05 22:58:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/11/13 21:29:37 | 000,000,000 | ---D | M] (Facemoods) -- C:\Program Files\mozilla firefox\extensions\ffxtlbr@Facemoods.com
[2009/10/10 19:33:03 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files\mozilla firefox\extensions\linkfilter@kaspersky.ru
[2011/04/04 18:39:45 | 000,000,000 | ---D | M] (ClickPotatoLite Component) -- C:\PROGRAM FILES\CLICKPOTATOLITE\BIN\10.0.668.0\FIREFOX\EXTENSIONS
[2012/07/08 09:42:58 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2011/03/22 22:30:20 | 000,087,344 | ---- | M] (Pinball Corporation.) -- C:\Program Files\mozilla firefox\plugins\npclntax_ClickPotatoLiteSA.dll
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/06/12 03:05:49 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2010/06/12 03:05:49 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/06/12 03:05:49 | 000,000,757 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2010/03/10 17:00:26 | 000,002,025 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012/07/08 09:42:35 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2010/06/12 03:05:49 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2010/06/12 03:05:49 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

========== Chrome ==========

CHR - default_search_provider: ()
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =

O1 HOSTS File: ([2012/01/02 20:36:58 | 000,000,927 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~1\SEARCH~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc)
O4 - HKLM..\Run: [lxdiamon] C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe ()
O4 - HKLM..\Run: [lxdimon.exe] C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe ()
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-3713559056-8340578-4178377159-1001..\Run: [|65065205-2FC1-1C2F-B490-9B9D620E5615}] C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe ()
O4 - HKU\S-1-5-21-3713559056-8340578-4178377159-1001..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E32787A4-F8A1-4244-83BC-1282536B6C1A}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E89DDC39-B0D2-40FB-8A46-FC6074D17A40}: DhcpNameServer = 192.168.0.254
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0327267b-b76f-11de-af09-0013d3df393e}\Shell - "" = AutoRun
O33 - MountPoints2\{0327267b-b76f-11de-af09-0013d3df393e}\Shell\AutoRun\command - "" = M:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 30 Days ==========

[2012/07/08 10:54:55 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/07/08 10:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/07/08 10:51:25 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2012/07/08 10:49:47 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Roaming\Malwarebytes
[2012/07/08 10:49:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/08 10:49:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/08 10:49:35 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/07/08 10:49:35 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/08 10:27:29 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Philippe\Desktop\OTL.exe
[2012/07/08 09:56:38 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Roaming\Ytlu
[2012/07/08 09:56:38 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Roaming\Awirvy
[2012/07/08 09:44:21 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\Ilivid Player
[2012/07/08 09:43:35 | 000,000,000 | ---D | C] -- C:\Program Files\iLivid
[2012/07/08 09:42:35 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012/07/08 09:42:34 | 000,000,000 | ---D | C] -- C:\Program Files\Searchqu Toolbar
[2012/07/08 09:32:06 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{80399DA6-095B-4912-9E1A-DDBA8E51B3E6}
[2012/07/08 09:31:54 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{107914A7-74E2-44EF-B6F6-08DA38379BC6}
[2012/07/07 19:29:40 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{17883A55-6819-478C-91E6-D9D032475864}
[2012/07/07 19:29:22 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{98795615-D724-4532-9580-09C0103CA312}
[2012/07/03 18:56:04 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{8222D7EC-E930-4434-82BC-A208C1AA9847}
[2012/07/03 18:55:49 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{807B41F4-354D-4C4F-89F4-4B14D9062372}
[2012/07/02 18:52:56 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{1D4B82CE-65C7-4649-B4E8-1E640E4BB6D7}
[2012/07/02 18:52:39 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{B101CD99-353A-40EF-9140-9A90DFCC13EA}
[2012/06/25 18:07:23 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{78F0B425-4E01-4A3F-9378-BA59C5785188}
[2012/06/25 18:07:09 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{9B1A1EBB-A2A9-463E-9D60-CC3CE58579CA}
[2012/06/23 20:30:29 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012/06/23 20:30:29 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012/06/23 20:30:11 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012/06/23 20:30:11 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012/06/23 20:30:11 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012/06/23 20:29:56 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012/06/23 20:29:56 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012/06/23 20:26:36 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{5F99ECA6-E235-437F-A9CD-65E7684126B0}
[2012/06/23 20:26:02 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{F3565C19-CC3C-45B8-BBF3-4193A297E70C}
[2012/06/20 18:55:24 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{DD212EB4-B45F-4DD8-A9BA-999D51899732}
[2012/06/20 18:55:05 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{058E2800-A88D-48CC-A16E-731A50095A2D}
[2012/06/18 19:15:37 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{F3024723-B70A-4610-A323-FECB050CFE23}
[2012/06/16 18:39:41 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{22F50C45-1081-4BB9-A283-4215EF82C001}
[2012/06/13 22:38:30 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{58450471-AD6D-4600-8CAB-CEF0B2E1D3B5}
[2012/06/13 22:38:16 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{C656831A-A0BC-4736-9DB3-839672D8D010}
[2012/06/13 22:25:11 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{C3CCDB8F-822A-400C-B804-D071A471E824}
[2012/06/13 22:24:56 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{05928510-E7DA-4D16-BA6F-A656989F5EFF}
[2012/06/13 22:15:27 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{6BEB83A7-53B6-4EEC-931A-69903EFA36B7}
[2012/06/13 22:15:14 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{A487103B-EBFA-4844-AAA1-DC4691818DF1}
[2012/06/13 21:04:18 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{DE60DBFD-9FE9-41D5-807E-47D48121C253}
[2012/06/13 21:04:05 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{471AFF96-B8EB-448F-A30B-6CF3A3C54642}
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/08 11:15:27 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012/07/08 10:51:34 | 000,001,070 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/07/08 10:51:26 | 000,000,890 | ---- | M] () -- C:\Users\Philippe\Desktop\NTREGOPT.lnk
[2012/07/08 10:51:26 | 000,000,871 | ---- | M] () -- C:\Users\Philippe\Desktop\ERUNT.lnk
[2012/07/08 10:49:37 | 000,001,063 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/08 10:33:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/08 10:33:33 | 1610,162,176 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/08 10:25:20 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Philippe\Desktop\OTL.exe
[2012/07/08 10:12:43 | 004,503,728 | ---- | M] () -- C:\ProgramData\go_0molg.pad
[2012/07/08 10:03:12 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/08 09:56:29 | 000,001,883 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012/07/08 09:44:19 | 000,001,140 | ---- | M] () -- C:\Users\Public\Desktop\Upgrade Facebook Chat Experience.lnk
[2012/07/08 09:44:19 | 000,000,959 | ---- | M] () -- C:\Users\Public\Desktop\iLivid.lnk
[2012/07/02 19:05:30 | 000,025,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/02 19:05:29 | 000,025,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/25 18:28:25 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/08 10:51:34 | 000,001,070 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/07/08 10:51:26 | 000,000,890 | ---- | C] () -- C:\Users\Philippe\Desktop\NTREGOPT.lnk
[2012/07/08 10:51:26 | 000,000,871 | ---- | C] () -- C:\Users\Philippe\Desktop\ERUNT.lnk
[2012/07/08 10:49:37 | 000,001,063 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/08 10:39:25 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012/07/08 09:56:29 | 004,503,728 | ---- | C] () -- C:\ProgramData\go_0molg.pad
[2012/07/08 09:56:29 | 000,001,883 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012/07/08 09:44:19 | 000,001,140 | ---- | C] () -- C:\Users\Public\Desktop\Upgrade Facebook Chat Experience.lnk
[2012/07/08 09:42:13 | 000,000,959 | ---- | C] () -- C:\Users\Public\Desktop\iLivid.lnk
[2012/04/18 22:06:53 | 001,187,840 | ---- | C] ( ) -- C:\Windows\System32\lxdiserv.dll
[2012/04/18 22:06:53 | 000,942,080 | ---- | C] ( ) -- C:\Windows\System32\lxdiusb1.dll
[2012/04/18 22:06:53 | 000,614,400 | ---- | C] ( ) -- C:\Windows\System32\lxdipmui.dll
[2012/04/18 22:06:53 | 000,532,480 | ---- | C] ( ) -- C:\Windows\System32\lxdilmpm.dll
[2012/04/18 22:06:53 | 000,356,352 | ---- | C] ( ) -- C:\Windows\System32\lxdiinpa.dll
[2012/04/18 22:06:53 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdiiesc.dll
[2012/04/18 22:06:53 | 000,311,296 | ---- | C] ( ) -- C:\Windows\System32\lxdihcp.dll
[2012/04/18 22:06:53 | 000,294,912 | ---- | C] () -- C:\Windows\System32\lxdiinst.dll
[2012/04/18 22:06:53 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdiprox.dll
[2012/04/18 22:06:53 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdipplc.dll
[2012/04/18 22:06:52 | 000,765,952 | ---- | C] ( ) -- C:\Windows\System32\lxdicomc.dll
[2012/04/18 22:06:52 | 000,671,744 | ---- | C] ( ) -- C:\Windows\System32\lxdihbn3.dll
[2012/04/18 22:06:52 | 000,517,040 | ---- | C] ( ) -- C:\Windows\System32\lxdicoms.exe
[2012/04/18 22:06:52 | 000,360,448 | ---- | C] ( ) -- C:\Windows\System32\lxdicomm.dll
[2012/04/18 22:06:52 | 000,340,912 | ---- | C] ( ) -- C:\Windows\System32\lxdicfg.exe
[2012/04/18 22:06:52 | 000,320,432 | ---- | C] ( ) -- C:\Windows\System32\lxdiih.exe
[2012/04/18 22:06:52 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdigrd.dll
[2011/10/25 18:24:41 | 000,000,412 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\All CPU Meter_Settings.ini
[2011/09/30 19:22:19 | 000,002,508 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\$_hpcst$.hpc
[2011/04/15 18:48:46 | 000,053,248 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\chrtmp
[2010/07/22 15:24:47 | 000,000,335 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010/03/02 23:50:38 | 000,007,621 | ---- | C] () -- C:\Users\Philippe\AppData\Local\Resmon.ResmonCfg
[2010/02/04 19:35:41 | 000,005,120 | ---- | C] () -- C:\Users\Philippe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/01 22:16:59 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Analog Pad
[2009/12/01 22:16:59 | 000,000,268 | RH-- | C] () -- C:\Users\Philippe\AppData\Roaming\Alerts
[2009/12/01 22:16:59 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2009/12/01 22:16:59 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Audio
[2009/12/01 22:14:33 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Ambient
[2009/12/01 22:14:33 | 000,000,268 | RH-- | C] () -- C:\Users\Philippe\AppData\Roaming\Action
[2009/12/01 22:14:33 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/12/01 22:14:33 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Applause and Laugher
[2009/11/22 13:31:46 | 000,002,327 | ---- | C] () -- C:\ProgramData\lxdi

========== LOP Check ==========

[2009/11/26 22:40:30 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Ascaron Entertainment
[2012/07/08 10:03:24 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Awirvy
[2009/10/17 22:06:21 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Blitware
[2011/04/16 21:43:31 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\cacaoweb
[2011/04/04 18:39:45 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\ClickPotatoLite
[2012/06/02 21:11:16 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\DAEMON Tools Lite
[2011/08/09 01:56:54 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Folding@home-x86
[2010/11/13 22:35:20 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\freeCompressor
[2011/02/02 19:35:42 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\GrabIt
[2009/10/13 21:45:44 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\ImgBurn
[2011/09/12 19:46:47 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\LEA
[2010/03/09 21:05:18 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Leadertech
[2012/04/16 18:23:30 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Lexmark Productivity Studio
[2009/10/15 00:49:06 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Megaupload
[2009/12/04 21:49:56 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Nikon
[2010/02/04 19:14:48 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Nokia
[2010/02/04 19:31:46 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Nseries
[2010/02/04 19:31:41 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\PC Suite
[2011/09/12 19:46:45 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\SoftPlug
[2009/12/03 10:17:00 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\SPORE
[2011/08/10 00:06:49 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Stellarium
[2012/06/07 15:15:05 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\SystemRequirementsLab
[2010/07/15 16:56:33 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\T2ViewerJVM
[2011/04/08 22:11:35 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\TuneUp Software
[2012/04/18 21:59:44 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\uTorrent
[2010/02/13 15:14:20 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Virtual City
[2012/07/08 09:56:38 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Ytlu
[2011/12/28 19:25:21 | 000,032,496 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: CTFMON.EXE >
[2009/07/14 03:14:16 | 000,008,704 | ---- | M] (Microsoft Corporation) MD5=4A3CDCEF8ED41B221F3DBEF5792FB52D -- C:\Windows\System32\ctfmon.exe
[2009/07/14 03:14:16 | 000,008,704 | ---- | M] (Microsoft Corporation) MD5=4A3CDCEF8ED41B221F3DBEF5792FB52D -- C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe

< MD5 for: EXPLORER.EXE >
[2011/02/26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe
[2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: IASTORV.SYS >
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< MD5 for: USERINIT.EXE >
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WININIT.EXE >
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< End of report >

de **boumsky** » 08 Juil 2012, 11:10

rapport extras.txt:
OTL Extras logfile created on: 08/07/2012 10:38:06 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Philippe\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 0000040c | Country: France | Language: FRA | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 63,35% Memory free
4,00 Gb Paging File | 3,30 Gb Available in Paging File | 82,46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,60 Gb Total Space | 23,14 Gb Free Space | 15,36% Space Free | Partition Type: NTFS
Drive D: | 147,49 Gb Total Space | 18,08 Gb Free Space | 12,26% Space Free | Partition Type: NTFS
Drive E: | 83,78 Gb Total Space | 9,95 Gb Free Space | 11,88% Space Free | Partition Type: NTFS
Drive F: | 149,10 Gb Total Space | 63,08 Gb Free Space | 42,30% Space Free | Partition Type: NTFS
Drive H: | 14,81 Gb Total Space | 2,60 Gb Free Space | 17,56% Space Free | Partition Type: NTFS

Computer Name: PHILIPPE-PC | User Name: Philippe | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{088AF6C8-1E8C-4F8A-A406-94D1DB8FF418}" = rport=137 | protocol=17 | dir=out | app=system |
"{09967AB3-94F9-4959-B269-295BD674FD0C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{0B4A061E-415A-4694-B959-055AE6C7206B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0B8B2446-89C6-4CF7-A416-7F83C0E28A56}" = lport=26675 | protocol=6 | dir=in | name=activesync service |
"{1881ACF7-0405-4494-B31D-A219BE90256F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3C6A081C-1B52-4DE6-ADAD-6ACC7A727210}" = lport=139 | protocol=6 | dir=in | app=system |
"{3CAC12AE-A43E-408C-A62F-B78709044D67}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4254B359-CB49-4551-A56F-FE532F90143E}" = rport=138 | protocol=17 | dir=out | app=system |
"{500AAD7E-21D6-465A-A0D8-9A1E1A0ACD07}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{5102D24F-75FC-4ACC-8544-C4AAAE7D9810}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{53576AA6-C276-4F1F-B25E-105F226551F1}" = lport=26675 | protocol=6 | dir=in | name=activesync service |
"{59C39D17-4EDE-4261-B762-35ED4D5B52D5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5E659844-ADB2-407C-BAA0-C35FCCFF7A06}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7131ED38-FAA9-4521-8399-955B91E9DB9F}" = lport=10243 | protocol=6 | dir=in | app=system |
"{740E86D7-757E-4EDA-A001-8048C0A30FAD}" = lport=137 | protocol=17 | dir=in | app=system |
"{7BA07B88-D656-4A83-96DB-38B644A72E1D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{80AB7B2B-618C-4E23-B7CB-D423C55FC6D5}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8292D051-6729-40EA-84B4-A1DD18452662}" = rport=139 | protocol=6 | dir=out | app=system |
"{82C2A2A0-C141-4D0F-BBE4-762F2249D6E4}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{87D01B9D-3221-4F08-8E8C-12B52E4F9F31}" = lport=138 | protocol=17 | dir=in | app=system |
"{BB01C841-9818-4489-AAC7-DB8CF806976A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CAA74FE6-8876-4B7B-9ECC-48A4F0DD6CDB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D362D8DC-BFCB-4420-97CA-BBB0E649B104}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{D878F53E-5538-4F3F-B196-DA2F998FBF9E}" = rport=445 | protocol=6 | dir=out | app=system |
"{F5FB99DD-30FF-4746-9508-EBA59E031387}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F69C9427-9D7D-4C7F-93D8-F6872DB6C7AB}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{F8E6750A-17E5-4B85-AC4C-99CBA0F8A518}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FC81B73A-2F42-40ED-A09D-7C40E7307421}" = lport=445 | protocol=6 | dir=in | app=system |
"{FC91872B-DADC-489A-BFE1-B72212C5D475}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FD8D0785-DA4A-4353-AA5F-6BF2B8E6C1FF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0337FFF6-3A9F-4F11-8A52-486C12EC3CC5}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{056445B6-FBBD-434F-B513-B4E1B61CB619}" = protocol=6 | dir=in | app=c:\program files\microsoft activesync\wcescomm.exe |
"{06348D58-E1C7-4E4E-B6D5-34D36BA038AC}" = protocol=17 | dir=in | app=d:\program files\nokia\nokia home media server\media server\twonkymedia.exe |
"{095C41BA-DAE3-414D-AB3D-8B5BFF9EE9E5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{0CF962FD-10C7-4B84-BBE5-F2922589CE24}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1133926A-CF47-4305-A331-6182DA085C69}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{113E88DC-671C-4E41-9CB5-8BB6AB52B903}" = protocol=6 | dir=in | app=d:\program files\nokia\nokia home media server\media server\twonkymedia.exe |
"{1C669331-2137-474B-BE8A-B87892E7642C}" = protocol=17 | dir=in | app=c:\program files\microsoft activesync\wcescomm.exe |
"{2246C899-3832-42B6-ABEF-B79EF2EBE456}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{22992901-5D63-4BFA-98D9-FE50F5802441}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{22CC7100-DC82-4CDB-B83A-3DA9929C6582}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2A6F6D2B-BE79-44CA-BA22-2452761B9D43}" = protocol=6 | dir=in | app=c:\program files\microsoft activesync\rapimgr.exe |
"{2BCAFC7C-E073-4773-9B6B-522E4304DCBE}" = protocol=17 | dir=in | app=c:\program files\microsoft activesync\rapimgr.exe |
"{30EDF9DA-71E6-46C6-98AF-962F244D66E2}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{38AE0071-F1B3-49B5-8EC4-0EE8D2AEAA59}" = protocol=6 | dir=in | app=c:\program files\lexmark 3500-4500 series\app4r.exe |
"{41ADDF28-61C0-441B-9561-5295F3C4E710}" = protocol=6 | dir=in | app=c:\windows\system32\lxdicoms.exe |
"{427B92CE-CEF4-4533-8974-DAA3C383B5C8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{434027FC-C613-4F25-B254-98453DA107E5}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{465DEEEF-AD98-4FC4-87BC-BCBDA1EBD01E}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{49A1AC53-A981-4DD9-88DB-8C3469F551B4}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{49DF9D90-CA1D-4511-A918-6FAE189926A2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E2C3687-412C-40B2-AC00-557C0DA99140}" = protocol=6 | dir=in | app=c:\program files\lexmark 3500-4500 series\lxdimon.exe |
"{5981279E-6F99-4E8A-B2E9-2957A8BB2940}" = protocol=17 | dir=in | app=d:\program files\nokia\nokia home media server\media server\twonkymediaserver.exe |
"{5A782395-3E80-4E3A-AE4D-5BA1D02B3271}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{5B054367-4D95-4687-8EA4-1ECDBA513CA6}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5D51FBDB-8FAB-4914-B3C9-4454DFA1BBED}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5EAC35F8-FD7E-49AC-AFF4-E6B8C2FC60CA}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{62B4244B-B55C-4621-A583-9B6F5F7B0F13}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{660C37F6-4B13-48A0-915A-904BDA05A0FF}" = protocol=17 | dir=in | app=c:\program files\lexmark 3500-4500 series\app4r.exe |
"{661EEEC0-C9C5-4AB6-8BD5-A4F8EC7F67EE}" = protocol=17 | dir=in | app=c:\program files\microsoft activesync\wcesmgr.exe |
"{674619F9-50EF-4BA8-A53B-3609D65E7D87}" = protocol=6 | dir=in | app=c:\program files\microsoft activesync\wcesmgr.exe |
"{6784B99F-8B89-4852-A32E-3BDC3D88633C}" = protocol=6 | dir=in | app=c:\windows\system32\lxdicfg.exe |
"{688AFAC2-1A4F-43D1-BD08-4B68F12F4139}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68E9BE47-376B-4BF9-987C-7A6B1DBC3B8D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{7555EDAF-267A-4FB7-B298-FDE7C6F84F10}" = protocol=17 | dir=in | app=c:\windows\system32\lxdicoms.exe |
"{7917CC3A-49EA-43FD-8547-36188F0C7325}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{796591A6-B9BD-40B9-8003-9BAE3ED52B5A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{7BA966D6-66EE-41B6-A37B-95149097E547}" = protocol=17 | dir=in | app=d:\mes documents\téléchargements\facemoods.exe |
"{7F9CA758-598C-406F-9679-FE7942CF7B44}" = protocol=17 | dir=in | app=c:\program files\lexmark 3500-4500 series\lxdiamon.exe |
"{818078E8-E844-4241-9B6C-6ACC980EB2E7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{8C03829A-E194-4E0A-B8FF-6027BE3A7CD8}" = protocol=17 | dir=in | app=c:\program files\microsoft activesync\wcesmgr.exe |
"{96136690-D9B1-48DD-BEED-5F474405BCC3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9D8321E3-9374-4843-BD3A-64790AA10A25}" = protocol=17 | dir=in | app=c:\program files\microsoft activesync\wcescomm.exe |
"{9D84ADDD-4090-4E3B-8D82-BFDBF0254274}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A25FEC75-DBCB-4C9A-AC91-95D95129BB50}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A464AA12-E088-46D5-944F-D0DA678507C5}" = protocol=6 | dir=in | app=d:\program files\nokia\nokia home media server\media server\twonkymediaserver.exe |
"{A696BD01-2EC1-48FC-9CFC-65008833B85A}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A741B300-7F94-4531-A715-8EB102F51B05}" = protocol=6 | dir=in | app=c:\program files\searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{AA75D4D2-3F4C-40A3-9DC3-61A184C4811A}" = protocol=17 | dir=in | app=c:\program files\microsoft activesync\rapimgr.exe |
"{B5175E13-8AA3-433D-9C49-7CACC09AFC88}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B67CB5D8-3F62-4B58-9459-C24EE87D60AF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{B691F403-9F92-4C28-8268-0B87BDC6560D}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{C364C3E1-27F8-4503-A167-BD88082F4736}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C6CD8EBC-7E56-4AB9-9EF8-8E7946E7F8ED}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C72E453D-CDA9-4C35-909A-7621D20E24CE}" = protocol=17 | dir=in | app=c:\program files\lexmark 3500-4500 series\lxdimon.exe |
"{C8CADA1F-34AE-466A-BE72-E1E288447033}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{C9490849-0717-4C10-833C-CD2B4A2FAEA6}" = protocol=6 | dir=out | app=system |
"{CF09E465-7297-4A06-A6E4-1FB41B4C9774}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{D1636AE6-D6BD-490B-955A-099E80373772}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{DF823B32-82AC-4318-BBA6-7D119F6F5127}" = protocol=6 | dir=in | app=d:\mes documents\téléchargements\facemoods.exe |
"{E30A69BF-5AD8-4B7E-A15B-20AD1E7646A5}" = protocol=6 | dir=in | app=c:\program files\microsoft activesync\rapimgr.exe |
"{E8A793A2-D413-43B6-8EC2-CAADA679EA6E}" = protocol=17 | dir=in | app=c:\windows\system32\lxdicfg.exe |
"{EB3724F9-51A0-49B5-83C8-D00868ADDA59}" = protocol=6 | dir=in | app=c:\program files\lexmark 3500-4500 series\lxdiamon.exe |
"{EC07CC8A-1599-47D7-BA16-C63850D92366}" = protocol=6 | dir=in | app=c:\program files\microsoft activesync\wcesmgr.exe |
"{F06DCFF2-9C15-464E-8FC5-D8D3F6E9D768}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{F55109C8-B950-4671-AE69-74C42CE680FC}" = protocol=17 | dir=in | app=c:\program files\searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{F85EC9CE-B08B-4B22-B7D8-A4EAD7139D8B}" = protocol=6 | dir=in | app=c:\program files\microsoft activesync\wcescomm.exe |
"{FD9D5079-ABF9-47C2-A950-A599EDF89B18}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03528A01-7E5E-4C5F-94DF-1D8012E969EF}" = Nokia Map Loader
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0EABFEF6-6D10-4C12-8667-3029C481D355}" = Nokia Photos
"{0EEB3C40-2A8C-4045-B3F9-13C4A5C490C0}" = Nokia Home Media Server
"{0FFAC7BB-50DC-CB54-6CA7-A8B74513280B}" = CCC Help Chinese Traditional
"{11DA34AE-A565-4659-86BE-11252557783F}" = Larousse Médical
"{1597D0AE-34A7-4A8B-A395-2E30EB745470}" = Nokia Connectivity Cable Driver
"{1C802083-6D79-78ED-BF1C-601DDF908DD1}" = Catalyst Control Center Core Implementation
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DBBDD6-93A5-4326-9A04-C9A5C9148502}" = Norton PartitionMagic
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v1.5.2.3456
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 23
"{282C4EAA-F162-F52F-7BAF-C7B50DAAA00A}" = ccc-utility
"{28728178-FF15-218B-0B63-012692F42C28}" = CCC Help Danish
"{32851025-1E46-83A3-1320-471619254E39}" = Catalyst Control Center Localization All
"{32AE58D5-49F5-45A6-B697-259EE62B015C}_is1" = WADder 2.7.3
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{3762698E-E9DF-4DD8-99F1-8192D0F8EE06}" = Nokia_Multimedia_Common_Components_2_5
"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager
"{40217B2F-462B-94A4-E84E-6A1C6EDBCE2F}" = CCC Help Swedish
"{42B74521-4706-412A-9A27-AED12B83E886}" = Nokia Ovi Application Installer
"{47FDEFC7-BFE6-FD75-41D1-28DD572BD2D9}" = ATI Catalyst Install Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5343A801-92E5-C234-9F27-AB27EC738BF6}" = CCC Help Japanese
"{5D22226D-EBC1-C95F-7746-2E3A9F4C97BA}" = CCC Help Russian
"{5DC0DF76-3B2F-4C38-BE34-58627949BC1A}" = Mega Manager
"{600C37F2-098B-A165-C1DB-6AE2B89D8D49}" = Catalyst Control Center Graphics Previews Common
"{60DD2787-197D-4303-ABAC-7B4DAA373CB2}" = Navman SmartST Desktop 2006 SE
"{61F8CA2C-9A80-8A1B-D3B9-347530CB387F}" = CCC Help Norwegian
"{6442DEDF-AC2F-4CBA-85DE-42E459C5006C}" = Nokia Ovi Content Copier
"{674B407D-EAB1-B6B6-F9BF-C34CEE4CD83F}" = Catalyst Control Center Graphics Light
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69F411C5-4851-6DA9-EA4C-160BEF8788AA}" = CCC Help French
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6B755EC3-C709-4F5C-BC58-BC0D3967B6B6}" = Folding@home-x86
"{6DD27E54-2598-0FEC-7CE1-BE00924C0570}" = Catalyst Control Center Graphics Previews Vista
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7C27114E-6FC8-21F5-E501-FE48F09243DF}" = CCC Help Dutch
"{80237C20-CBF3-F841-4AD5-E727AA86FBD1}" = CCC Help Italian
"{802EE127-D32A-1447-09DC-77419772BCDC}" = CCC Help Portuguese
"{836AFA32-7B8B-2C19-99D9-36EF32B42EB8}" = CCC Help Thai
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{876D774C-04D0-4796-B6A0-B7945340847D}" = SoftPlug V3.1.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E3395D1-104C-4625-8419-CA6D197179F2}" = AGEIA PhysX v6.11.01
"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = THE SETTLERS - L'Héritage des Rois
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0015-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_ENTERPRISE_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_ENTERPRISE_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0044-040C-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (French) 2007
"{90120000-0044-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_ENTERPRISE_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007
"{90120000-00A1-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-040C-0000-0000000FF1CE}" = Microsoft Office Groove MUI (French) 2007
"{90120000-00BA-040C-0000-0000000FF1CE}_ENTERPRISE_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Gestionnaire pour appareils Windows Mobile
"{91DA7D80-93D3-4327-99D2-CCC9F82F9601}_is1" = readzik 1.0
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{946942CB-D078-F33A-A3CD-27E0393507FD}" = CCC Help Turkish
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9682B99B-BB28-AD37-CA50-C1CB5BFF0FA6}" = Catalyst Control Center Graphics Full New
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D6B740F-D9A2-45A6-BDC4-0A453D499FE6}" = PC Connectivity Solution
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{9F59C3AE-81B0-4EF6-9762-D674BB079705}" = Nokia Software Updater
"{A02CC93A-134F-0319-1438-B1E895B52577}" = CCC Help German
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A528306A-C5EC-481C-A619-6106334E6800}" = Nokia Ovi Player
"{A7E1ADB8-162B-7C33-60FB-0561A17BD876}" = CCC Help Spanish
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96EEF55-155C-552E-ABB1-6FDAEF5BD944}" = CCC Help Polish
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{AC76BA86-7AD7-1036-7B44-A94000000001}" = Adobe Reader 9.4.1 - Français
"{ADB25FF0-AEC4-2CFB-130C-2C60D80C5934}" = CCC Help Greek
"{B04D5DA5-11DA-830C-85C6-0FF9185787E7}" = Skins
"{B208806F-A231-4FA0-AB3F-5C1B8979223E}" = Microsoft ActiveSync 4.0
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{BB603E9F-ECE8-7713-B0AC-7E0614E8C058}" = Catalyst Control Center HydraVision Full
"{BE232D60-AEA5-502F-ACBF-9AC188A82C21}" = CCC Help Finnish
"{C15C4AB5-EF5D-5050-273C-4636E3FBE301}" = CCC Help Czech
"{C4B045DB-C2C0-4A05-8DA5-754B4733EE31}" = Nokia Ovi One Touch Access
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0198889-7766-424B-AB81-F16F8EDDFEF4}" = Facemoods
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D3F83A1D-015B-70C4-21F8-8241C74FAB81}" = Dreadcast Atome
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E09CD13D-7CE3-351C-1625-8DC7F21A99C0}" = ccc-core-static
"{E373E0E2-20F5-90DF-B315-615EA6E52101}" = Catalyst Control Center Graphics Full Existing
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E6DA746E-1175-88BD-2B16-1DC62018E060}" = CCC Help Chinese Standard
"{E7044E25-3038-4A76-9064-344AC038043E}" = Mise à jour du pilote du Gestionnaire pour appareils Windows Mobile
"{E8EBC005-B58D-4E11-9B59-9BFE16F75090}" = Virtual Weather Station
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{F053BFD9-4357-6A82-6042-CF919667448F}" = CCC Help English
"{F17EB02C-DA0D-EDEF-2E16-501FB700A710}" = CCC Help Hungarian
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F5DDC0CD-F13A-83F0-5103-563A17EA306F}" = CCC Help Korean
"{F9EA1C47-64A6-45E4-9A80-8CC1575B971D}" = Nokia Ovi System Utilities
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"504244733D18C8F63FF584AEB290E3904E791693" = Package de pilotes Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"ClickPotatoLiteSA" = ClickPotato
"com.adobe.example.DreadcastAtome.D3A1F00E81052D1BF4D536C930E26AC7BBE6FEB0.1" = Dreadcast Atome
"DVD Shrink_is1" = DVD Shrink 3.2
"ENTERPRISE" = Microsoft Office Enterprise 2007
"facemoods" = facemoods
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome" = Google Chrome
"GrabIt_is1" = GrabIt 1.7.2 Beta 4 (build 997)
"GraphWeather_is1" = GraphWeather Version 2.0.321
"HGM_TSH" = Haegemonia - The Solon Heritage
"HijackThis" = HijackThis 2.0.2
"iLivid" = iLivid
"ImgBurn" = ImgBurn
"InstallShield_{21DBBDD6-93A5-4326-9A04-C9A5C9148502}" = Norton PartitionMagic 8.0
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"JDownloader" = JDownloader
"JMHL Loader" = JMHL Loader
"Le Maître de l'Olympe - Zeus." = Le Maître de l'Olympe - Zeus.
"Lexmark 3500-4500 Series" = Lexmark 3500-4500 Series
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"Nokia Ovi Application Installer" = Nokia Ovi Application Installer 6.85.3011
"Nokia Ovi Content Copier" = Nokia Ovi Content Copier 6.85.3011
"Nokia Ovi One Touch Access" = Nokia Ovi One Touch Access 6.85.3019
"Nokia Ovi System Utilities" = Nokia Ovi System Utilities 6.85.3018
"PhotoFiltre" = PhotoFiltre
"Picasa 3" = Picasa 3
"Ri4m v5.0.1d" = Ri4m v5.0.1d
"SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set
"Searchqu Toolbar" = Searchqu Toolbar
"ShalSoft.GigaTribe_is1" = GigaTribe 3.19
"Sleepy" = Sleepy
"SpeedFan" = SpeedFan (remove only)
"StarCraft II" = StarCraft II
"Stellarium_is1" = Stellarium 0.10.6.1
"Tortuga - Two Treasures_is1" = Tortuga - Two Treasures
"TwonkyvisionUPnPTwonkyMedia" = TwonkyMedia
"VirtualCity1.0" = VirtualCity
"VLC media player" = VLC media player 1.1.8
"Votre santé au quotidien" = Votre santé au quotidien
"WBFS Manager 3.0" = WBFS Manager 3.0
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite" = Windows Live
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = Logiciel d'archivage WinRAR

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3713559056-8340578-4178377159-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Notification de cadeaux MSN" = Notification de cadeaux MSN

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 08/07/2012 04:04:04 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante WerFault.exe, version : 6.1.7600.16385,
horodatage : 0x4a5bc2d9 Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b3e06f0 ID du processus défaillant : 0x1218 Heure de début de l’application défaillante
: 0x01cd5ce036c3f30b Chemin d’accès de l’application défaillante : C:\Windows\system32\WerFault.exe
Chemin
d’accès du module défaillant: IEBHO.dll ID de rapport : 7b61758b-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:04 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante wmpnscfg.exe, version : 12.0.7600.16385,
horodatage : 0x4a5bccbc Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b35f5e0 ID du processus défaillant : 0xd98 Heure de début de l’application défaillante
: 0x01cd5ce024e7ad56 Chemin d’accès de l’application défaillante : C:\Program Files\Windows
Media Player\wmpnscfg.exe Chemin d’accès du module défaillant: IEBHO.dll ID de rapport
: 7ba43763-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:04 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante wmpnscfg.exe, version : 12.0.7600.16385,
horodatage : 0x4a5bccbc Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b35f5e0 ID du processus défaillant : 0xd58 Heure de début de l’application défaillante
: 0x01cd5ce024c8aec4 Chemin d’accès de l’application défaillante : C:\Program Files\Windows
Media Player\wmpnscfg.exe Chemin d’accès du module défaillant: IEBHO.dll ID de rapport
: 7ba699bd-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:05 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante dw20.exe, version : 2.0.50727.4927,
horodatage : 0x4a275ab7 Nom du module défaillant : ntdll.dll, version : 6.1.7600.16915,
horodatage : 0x4ec49caf Code d’exception : 0xc015000f Décalage d’erreur : 0x000814c5
ID
du processus défaillant : 0xdb0 Heure de début de l’application défaillante : 0x01cd5ce02aaff55c
Chemin
d’accès de l’application défaillante : C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
Chemin
d’accès du module défaillant: C:\Windows\SYSTEM32\ntdll.dll ID de rapport : 7c0abc81-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:05 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante dw20.exe, version : 2.0.50727.4927,
horodatage : 0x4a275ab7 Nom du module défaillant : ntdll.dll, version : 6.1.7600.16915,
horodatage : 0x4ec49caf Code d’exception : 0xc015000f Décalage d’erreur : 0x000814c5
ID
du processus défaillant : 0x1198 Heure de début de l’application défaillante : 0x01cd5ce034bc3267
Chemin
d’accès de l’application défaillante : C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
Chemin
d’accès du module défaillant: C:\Windows\SYSTEM32\ntdll.dll ID de rapport : 7c1b6cf7-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:05 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante wmpnscfg.exe, version : 12.0.7600.16385,
horodatage : 0x4a5bccbc Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b35f5e0 ID du processus défaillant : 0xd58 Heure de début de l’application défaillante
: 0x01cd5ce024c8aec4 Chemin d’accès de l’application défaillante : C:\Program Files\Windows
Media Player\wmpnscfg.exe Chemin d’accès du module défaillant: IEBHO.dll ID de rapport
: 7c43f4f1-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:05 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante wmpnscfg.exe, version : 12.0.7600.16385,
horodatage : 0x4a5bccbc Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b35f5e0 ID du processus défaillant : 0xd98 Heure de début de l’application défaillante
: 0x01cd5ce024e7ad56 Chemin d’accès de l’application défaillante : C:\Program Files\Windows
Media Player\wmpnscfg.exe Chemin d’accès du module défaillant: IEBHO.dll ID de rapport
: 7c62f383-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:09 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante taskhost.exe, version : 6.1.7600.16385,
horodatage : 0x4a5bc0f9 Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b35f5e0 ID du processus défaillant : 0x17cc Heure de début de l’application défaillante
: 0x01cd5ce03f0c3c51 Chemin d’accès de l’application défaillante : C:\Windows\system32\taskhost.exe
Chemin
d’accès du module défaillant: IEBHO.dll ID de rapport : 7e553efd-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:09 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante taskhost.exe, version : 6.1.7600.16385,
horodatage : 0x4a5bc0f9 Nom du module défaillant : IEBHO.dll_unloaded, version :
0.0.0.0, horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur
: 0x6b35f5e0 ID du processus défaillant : 0x17cc Heure de début de l’application défaillante
: 0x01cd5ce03f0c3c51 Chemin d’accès de l’application défaillante : C:\Windows\system32\taskhost.exe
Chemin
d’accès du module défaillant: IEBHO.dll ID de rapport : 7e790243-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:04:12 | Computer Name = Philippe-PC | Source = Application Error | ID = 1000
Description = Nom de l’application défaillante iexplore.exe, version : 8.0.7600.16968,
horodatage : 0x4f4c5103 Nom du module défaillant : IEBHO.dll, version : 1.0.0.1,
horodatage : 0x4fcf245a Code d’exception : 0xc0000005 Décalage d’erreur : 0x0002e802
ID
du processus défaillant : 0x338 Heure de début de l’application défaillante : 0x01cd5ce026d49b85
Chemin
d’accès de l’application défaillante : C:\Program Files\internet explorer\iexplore.exe
Chemin
d’accès du module défaillant: C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll ID de rapport
: 806db017-c8d3-11e1-83f1-0013d3df393e

Error - 08/07/2012 04:14:53 | Computer Name = Philippe-PC | Source = Winlogon | ID = 4103
Description = Échec de l’activation de la licence Windows. Erreur 0x80070005.

Error - 08/07/2012 04:33:47 | Computer Name = Philippe-PC | Source = Winlogon | ID = 4103
Description = Échec de l’activation de la licence Windows. Erreur 0x80070005.

[ OSession Events ]
Error - 26/01/2012 06:42:10 | Computer Name = Philippe-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 357
seconds with 300 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 08/07/2012 04:33:49 | Computer Name = Philippe-PC | Source = Service Control Manager | ID = 7001
Description = Le service Explorateur d’ordinateurs dépend du service Serveur qui
n’a pas pu démarrer en raison de l’erreur : %%1068

Error - 08/07/2012 04:33:49 | Computer Name = Philippe-PC | Source = Service Control Manager | ID = 7001
Description = Le service Explorateur d’ordinateurs dépend du service Serveur qui
n’a pas pu démarrer en raison de l’erreur : %%1068

Error - 08/07/2012 04:33:49 | Computer Name = Philippe-PC | Source = Service Control Manager | ID = 7001
Description = Le service Explorateur d’ordinateurs dépend du service Serveur qui
n’a pas pu démarrer en raison de l’erreur : %%1068

Error - 08/07/2012 04:33:50 | Computer Name = Philippe-PC | Source = DCOM | ID = 10005
Description =

Error - 08/07/2012 04:33:57 | Computer Name = Philippe-PC | Source = DCOM | ID = 10005
Description =

Error - 08/07/2012 04:33:59 | Computer Name = Philippe-PC | Source = DCOM | ID = 10005
Description =

Error - 08/07/2012 04:33:59 | Computer Name = Philippe-PC | Source = DCOM | ID = 10005
Description =

Error - 08/07/2012 04:33:59 | Computer Name = Philippe-PC | Source = Service Control Manager | ID = 7001
Description = Le service Fournisseur HomeGroup dépend du service Hôte du fournisseur
de découverte de fonctions qui n’a pas pu démarrer en raison de l’erreur : %%1068

Error - 08/07/2012 04:36:57 | Computer Name = Philippe-PC | Source = DCOM | ID = 10005
Description =

Error - 08/07/2012 04:36:57 | Computer Name = Philippe-PC | Source = DCOM | ID = 10005
Description =

< End of report >

de **nickW** » 09 Juil 2012, 22:21

Bonsoir,

Nouvelle analyse:

Étape 1: RogueKiller (de Tigzy), téléchargement

Télécharger RogueKiller depuis la page ci-dessous:
http://www.sur-la-toile.com/RogueKiller/

(cliquer sur

)

Enregistrer le fichier sur le Bureau.

Étape 2: RogueKiller (de Tigzy), analyse
Fermer toutes les applications actives, tous les navigateurs.
Faire un clic droit sur le fichier RogueKiller.exe téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

Attendre la fin de l'analyse préliminaire "Préscan".

Accepter la licence d'utilisation en cliquant sur "Accept":

Dans l'écran principal de RogueKiller, cliquer sur "Scan":

Lorsque l'analyse est terminée, cliquer sur le bouton "Rapport":

Une fenêtre du Bloc-notes s'ouvre, et affiche le rapport d'analyse.
Fermer le Bloc-notes.
Fermer RogueKiller.

Étape 3: Résultat
Envoyer en réponse:
*- le rapport de RogueKiller (contenu du fichier RKreport[n].txt situé sur le Bureau - n est un numéro d'ordre)

A suivre,

de **boumsky** » 10 Juil 2012, 18:16

Bonsoir merci de votre aide.

voici le rapport de roguekiller:

RKreport[1]

RogueKiller V7.6.3 [08/07/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows 7 (6.1.7600 ) 32 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur: Philippe [Droits d'admin]
Mode: Recherche -- Date: 10/07/2012 19:57:19

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Entrees de registre: 7 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : |65065205-2FC1-1C2F-B490-9B9D620E5615} (C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3713559056-8340578-4178377159-1001[...]\Run : |65065205-2FC1-1C2F-B490-9B9D620E5615} (C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe) -> FOUND
[SUSP PATH] ctfmon.lnk @Philippe : C:\Windows\System32\rundll32.exe|C:\Users\Philippe\AppData\Local\Temp\glom0_og.exe -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (socks=127.0.0.1:31038) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver: [NON CHARGE] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 genuine.microsoft.com
127.0.0.1 mpa.one.microsoft.com
127.0.0.1 sls.microsoft.com

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD321KJ ATA Device +++++
--- User ---
[MBR] f3d31ede9b34573cfdc69df85b58eba5
[BSP] cd6fa63a7a0228ba2cd33d3dbaecd512 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 154217 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 315837900 | Size: 151025 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: ST3250823AS ATA Device +++++
--- User ---
[MBR] 6c21faa2581296f2e10588358a78ec53
[BSP] efb0cf03fccde2245acf4e05b65edcb5 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 85792 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 175702905 | Size: 152680 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[1].txt >>
RKreport[1].txt

de **nickW** » 12 Juil 2012, 00:16

Bonsoir,

Premiers nettoyages:

Étape 1: Pas de processus de contrôle en temps réel
Si nécessaire, désactiver le module résident de l'antivirus.

Kaspersky: clic droit sur l'icône dans la SysBarre (à coté de l'horloge), puis "Suspendre la protection...", "A la demande de l'utilisateur/Reprendre manuellement".

Étape 2: RogueKiller (de Tigzy), nettoyage
Fermer toutes les applications actives, tous les navigateurs.
Faire un clic droit sur le fichier RogueKiller.exe téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

Attendre la fin de l'analyse préliminaire Préscan.

Accepter la licence d'utilisation en cliquant sur Accept:

Dans l'écran principal de RogueKiller, cliquer sur Scan:

Dans l'écran principal de RogueKiller,Cliquer sur l'onglet Registre

et dé-cocher les lignes:

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

Dans l'écran principal de RogueKiller, cliquer sur Suppression:

Dans l'écran principal de RogueKiller, cliquer sur Host RAZ:

Étape 3: Malwarebytes' Anti-Malware, nettoyage
Fermer toutes les fenêtres de programme ouvertes.
Lancer Malwarebytes' Anti-Malware via le Menu Démarrer.
Dans l'onglet Paramètres, vérifier que toutes les cases sont cochées sauf "Créer une option dans le menu contextuel pour analyser des fichiers (clic droit)".
Dans l'onglet Mise à jour, cliquer sur le bouton Recherche de mise à jour et installer toutes les mises à jour trouvées.
Dans l'onglet Recherche, cocher le bouton radio situé devant "Exécuter un examen rapide" puis cliquer sur le bouton Rechercher, comme ceci:

Attendre sans rien faire d'autre la fin de la recherche; dans la fenêtre annonçant la fin de l'analyse, cliquer sur OK; puis cliquer sur le bouton "Afficher les résultats":

Si des éléments nuisibles ont été détectés, cliquer sur le bouton "Supprimer la sélection":

Attendre patiemment sans rien faire d'autre la fin du nettoyage.
Un redémarrage est parfois nécessaire. Accepter.
Une fenêtre du Bloc-notes s'ouvre pour afficher le rapport. Fermer le Bloc-notes.
Cliquer sur le bouton "Quitter" pour fermer Malwarebytes' Anti-Malware.

Étape 4: Processus de contrôle en temps réel
Important: Réactiver le module résident de l'antivirus.

Étape 5: OTL (de OldTimer), analyse rapide
Fermer toutes les fenêtres de programme ouvertes.

Faire un clic droit sur OTL.exe puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

L'écran principal de OTL s'affiche:

Cliquer sur le bouton Analyse rapide:

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer le Bloc-notes.
Fermer la fenêtre de OTL.

Étape 6: Résultats
Envoyer en réponse:
*- les rapports de RogueKiller (contenu des fichiers RKreport[n].txt situé sur le Bureau - n est un numéro d'ordre - qui doit être supérieur à 1)
*- le rapport de Malwarebytes' Anti-Malware (contenu du fichier mbam-log-****-**-** (**-**-**).txt situé dans le dossier %SystemDrive%\Users\<tonprofil>\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs où ****-**-** (**-**-**) représente la date [année-mois-jour] et l'heure [hh-mn-ss])
[%SystemDrive% représente la partition sur laquelle est installé le système, généralement C:]

Envoyer ensuite en réponse dans un message distinct (à cause de la longueur du fichier):
*- le rapport principal de OTL (contenu du fichier OTL.Txt situé sur le Bureau).
Le rapport envoyé sur le forum doit se terminer par une ligne contenant <End of report>. Si ce n'est pas le cas, il est incomplet, et doit alors être découpé en plusieurs messages.

Note importante: Pour l'envoi de ta(tes) réponse(s), il ne faut pas créer un nouveau sujet, mais cliquer sur le bouton "Répondre"

pour continuer dans ce fil de discussion.

Dans ta réponse, n'oublie pas de donner le plus d'informations possible sur l'état du PC: amélioration / disparition / aggravation des symptômes d'infection.

A suivre,

de **boumsky** » 12 Juil 2012, 20:26

bonsoir, j'ai effectué tout ce que vous avez demandé, voici les rapports roguekiller:

RKreport[2]

RogueKiller V7.6.3 [08/07/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows 7 (6.1.7600 ) 32 bits version
Demarrage : Mode sans echec
Utilisateur: Philippe [Droits d'admin]
Mode: Recherche -- Date: 12/07/2012 21:41:16

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Entrees de registre: 7 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : |65065205-2FC1-1C2F-B490-9B9D620E5615} (C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-3713559056-8340578-4178377159-1001[...]\Run : |65065205-2FC1-1C2F-B490-9B9D620E5615} (C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe) -> FOUND
[SUSP PATH] ctfmon.lnk @Philippe : C:\Windows\System32\rundll32.exe|C:\Users\Philippe\AppData\Local\Temp\glom0_og.exe -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (socks=127.0.0.1:31038) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver: [NON CHARGE] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 genuine.microsoft.com
127.0.0.1 mpa.one.microsoft.com
127.0.0.1 sls.microsoft.com

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD321KJ ATA Device +++++
--- User ---
[MBR] f3d31ede9b34573cfdc69df85b58eba5
[BSP] cd6fa63a7a0228ba2cd33d3dbaecd512 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 154217 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 315837900 | Size: 151025 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: ST3250823AS ATA Device +++++
--- User ---
[MBR] 6c21faa2581296f2e10588358a78ec53
[BSP] efb0cf03fccde2245acf4e05b65edcb5 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 85792 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 175702905 | Size: 152680 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

RKreport[3]

RogueKiller V7.6.3 [08/07/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows 7 (6.1.7600 ) 32 bits version
Demarrage : Mode sans echec
Utilisateur: Philippe [Droits d'admin]
Mode: Suppression -- Date: 12/07/2012 21:44:24

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Entrees de registre: 6 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : |65065205-2FC1-1C2F-B490-9B9D620E5615} (C:\Users\Philippe\AppData\Roaming\Ytlu\sawuv.exe) -> DELETED
[SUSP PATH] ctfmon.lnk @Philippe : C:\Windows\System32\rundll32.exe|C:\Users\Philippe\AppData\Local\Temp\glom0_og.exe -> DELETED
[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> NOT REMOVED, USE PROXYFIX
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (socks=127.0.0.1:31038) -> NOT REMOVED, USE PROXYFIX
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver: [NON CHARGE] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 genuine.microsoft.com
127.0.0.1 mpa.one.microsoft.com
127.0.0.1 sls.microsoft.com

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD321KJ ATA Device +++++
--- User ---
[MBR] f3d31ede9b34573cfdc69df85b58eba5
[BSP] cd6fa63a7a0228ba2cd33d3dbaecd512 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 154217 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 315837900 | Size: 151025 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: ST3250823AS ATA Device +++++
--- User ---
[MBR] 6c21faa2581296f2e10588358a78ec53
[BSP] efb0cf03fccde2245acf4e05b65edcb5 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 85792 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 175702905 | Size: 152680 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

RKreport[4]

RogueKiller V7.6.3 [08/07/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion- ... ntees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows 7 (6.1.7600 ) 32 bits version
Demarrage : Mode sans echec
Utilisateur: Philippe [Droits d'admin]
Mode: HOSTS RAZ -- Date: 12/07/2012 21:45:21

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Driver: [NON CHARGE] ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 genuine.microsoft.com
127.0.0.1 mpa.one.microsoft.com
127.0.0.1 sls.microsoft.com

¤¤¤ Nouveau fichier HOSTS: ¤¤¤
127.0.0.1 localhost

Termine : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

Rapport malwarebytes :

Malwarebytes Anti-Malware (Essai) 1.61.0.1400
www.malwarebytes.org

Version de la base de données: v2012.07.08.01

Windows 7 x86 NTFS (Mode sans échec)
Internet Explorer 8.0.7600.16385
Philippe :: PHILIPPE-PC [administrateur]

Protection: Désactivé

12/07/2012 21:49:15
mbam-log-2012-07-12 (21-49-15).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 198200
Temps écoulé: 3 minute(s), 21 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 23
HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Mis en quarantaine et supprimé avec succès.
HKCR\CLSID\{1602F07D-8BF3-4c08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\TypeLib\{C55CA95C-324B-451C-B2D2-6E895AA75FEC} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\ClickPotatoLiteAX.info.1 (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\ClickPotatoLiteAX.info (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\CLSID\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\ClickPotatoLiteAX.UserProfiles.1 (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\ClickPotatoLiteAX.UserProfiles (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\Typelib\{814BAA91-DC22-4350-87D6-0C86E93F7F08} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\Interface\{419EDA30-6DFF-432C-B534-E15D899ABEE4} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Mis en quarantaine et supprimé avec succès.
HKCR\MenuButtonIE.ButtonIE (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\MenuButtonIE.ButtonIE.1 (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCR\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKCU\Software\clickpotatolitesa (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ClickPotatoLiteSA (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 1
HKLM\SOFTWARE\Mozilla\Firefox\extensions|ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Données: C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions -> Mis en quarantaine et supprimé avec succès.

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 10
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Philippe\AppData\Roaming\ClickPotatoLite (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0 (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\plugins (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.

Fichier(s) détecté(s): 16
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSAAX.dll (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\Mozilla Firefox\plugins\npclntax_ClickPotatoLiteSA.dll (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA.dat (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_hpk.dat (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf.dat (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSA.exe (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSAHook.dll (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteUninstaller.exe (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\plugins\npclntax_ClickPotatoLiteSA.dll (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\About Us.lnk (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Customer Support.lnk (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Uninstall Instructions.lnk (Adware.ClickPotato) -> Mis en quarantaine et supprimé avec succès.

(fin)

de **boumsky** » 12 Juil 2012, 20:28

Rapport otl :

OTL logfile created on: 12/07/2012 21:12:57 - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = C:\Users\Philippe\Desktop
Windows 7 Ultimate (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 0000040c | Country: France | Language: FRA | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 37,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 65,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 150,60 Gb Total Space | 23,00 Gb Free Space | 15,27% Space Free | Partition Type: NTFS
Drive D: | 147,49 Gb Total Space | 18,08 Gb Free Space | 12,26% Space Free | Partition Type: NTFS
Drive E: | 83,78 Gb Total Space | 9,95 Gb Free Space | 11,88% Space Free | Partition Type: NTFS
Drive F: | 149,10 Gb Total Space | 63,08 Gb Free Space | 42,30% Space Free | Partition Type: NTFS
Drive G: | 436,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: PHILIPPE-PC | User Name: Philippe
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand] -- -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/08/18 19:25:25 | 000,311,680 | ---- | M] (Kaspersky Lab) [Auto] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe -- (AVP)
SRV - [2010/05/19 23:34:43 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/09/17 11:33:26 | 000,651,776 | ---- | M] (Nokia) [Disabled] -- D:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/01/29 17:54:44 | 000,102,400 | ---- | M] (PacketVideo) [On_Demand] -- D:\Program Files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -- (TwonkyMedia)
SRV - [2007/06/11 10:14:52 | 000,517,040 | ---- | M] ( ) [Auto] -- C:\Windows\System32\lxdicoms.exe -- (lxdi_device)
SRV - [2007/05/31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (a4zx2z2e)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/06/25 19:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2010/02/11 09:42:22 | 004,450,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/11/26 22:35:15 | 000,271,360 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/11/26 22:34:56 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/10/12 22:35:23 | 000,721,904 | ---- | M] () [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/10/10 19:32:22 | 000,280,592 | ---- | M] (Kaspersky Lab) [File_System | System] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2009/10/09 22:57:01 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2009/07/23 23:02:56 | 000,043,008 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2009/07/14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009/07/14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009/07/14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009/07/14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009/07/14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009/07/14 00:54:15 | 001,311,232 | ---- | M] (NXP Semiconductors) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)
DRV - [2009/07/14 00:02:53 | 000,545,792 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009/06/15 14:01:00 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System] -- C:\Windows\System32\drivers\kl1.sys -- (kl1)
DRV - [2009/05/16 20:59:34 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/05/15 18:50:22 | 000,021,008 | ---- | M] (Kaspersky Lab) [Kernel | System] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2009/02/09 09:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 09:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 09:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 09:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/12/15 20:41:32 | 000,033,808 | ---- | M] (Kaspersky Lab) [File_System | Boot] -- C:\Windows\System32\drivers\klbg.sys -- (klbg)
DRV - [2008/08/26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2006/09/24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot] -- C:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2005/08/17 08:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2005/08/17 08:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2005/08/17 08:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
DRV - [2004/05/06 00:15:04 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System] -- C:\Windows\System32\drivers\PQNTDRV.sys -- (PQNTDrv)
DRV - [1996/04/03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot] -- C:\Windows\System32\giveio.sys -- (giveio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=adj&s={searchTerms}&f=4

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://fr.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E2 05 4F 1D 62 3A CB 01 [binary data]
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-3713559056-8340578-4178377159-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = socks=127.0.0.1:31038

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.7
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.3.0.3
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.463
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110704
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: cacaoweb@cacaoweb.org:1.0.12
FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0
FF - prefs.js..extensions.enabledItems: {99079a25-328f-4bd4-be04-00955acaa0a7}:4.6.1.01
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=362&systemid=406&sr=0&q="
FF - prefs.js..network.proxy.type: 4

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/25 18:24:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/25 18:24:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009/10/10 19:32:42 | 000,000,000 | ---D | M]

[2012/07/08 09:42:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philippe\AppData\Roaming\mozilla\Extensions
[2012/07/08 10:15:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions
[2011/07/12 21:49:46 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/12/12 20:49:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012/07/08 09:42:43 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/07/12 21:49:46 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/07/12 21:49:46 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2011/04/16 21:43:37 | 000,000,000 | ---D | M] (cacaoweb) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\cacaoweb@cacaoweb.org
[2009/12/23 21:45:09 | 000,000,000 | ---D | M] (readzik) -- C:\Users\Philippe\AppData\Roaming\mozilla\Firefox\Profiles\32kceood.default\extensions\undrm@readzik
[2011/02/03 18:31:11 | 000,002,650 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\searchplugins\bing.xml
[2012/07/08 09:42:35 | 000,002,519 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\searchplugins\Search_Results.xml
[2012/07/08 10:15:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010/12/10 20:11:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/02/05 22:58:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/11/13 21:29:37 | 000,000,000 | ---D | M] (Facemoods) -- C:\Program Files\mozilla firefox\extensions\ffxtlbr@Facemoods.com
[2009/10/10 19:33:03 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files\mozilla firefox\extensions\linkfilter@kaspersky.ru
[2012/07/08 09:42:58 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/06/12 03:05:49 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2010/06/12 03:05:49 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/06/12 03:05:49 | 000,000,757 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2010/03/10 17:00:26 | 000,002,025 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012/07/08 09:42:35 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2010/06/12 03:05:49 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2010/06/12 03:05:49 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2012/07/12 21:45:21 | 000,000,843 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~1\SEARCH~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc)
O4 - HKLM..\Run: [lxdiamon] C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe ()
O4 - HKLM..\Run: [lxdimon.exe] C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-3713559056-8340578-4178377159-1001..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O9 - Extra Button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 13:06:41 | 000,000,053 | R--- | M] () - G:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{0327267b-b76f-11de-af09-0013d3df393e}\Shell - "" = AutoRun
O33 - MountPoints2\{0327267b-b76f-11de-af09-0013d3df393e}\Shell\AutoRun\command - "" = M:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/07/12 22:01:29 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{160B0B35-9433-4C80-8C30-49C8EAA6C2C1}
[2012/07/12 22:01:24 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{D0FDDCE7-E784-41D5-A3C9-6D216D33C8C4}
[2012/07/12 21:12:33 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\Users\Philippe\Desktop\framedyn.dll
[2012/07/12 21:12:32 | 002,237,440 | ---- | C] (OldTimer Tools) -- C:\Users\Philippe\Desktop\OTLPE.exe
[2012/07/10 19:56:10 | 000,000,000 | ---D | C] -- C:\Users\Philippe\Desktop\RK_Quarantine
[2012/07/10 04:06:16 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/07/08 10:54:55 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/07/08 10:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/07/08 10:51:25 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2012/07/08 10:49:47 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Roaming\Malwarebytes
[2012/07/08 10:49:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/08 10:49:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/08 10:49:35 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/07/08 10:49:35 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/08 09:56:38 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Roaming\Ytlu
[2012/07/08 09:56:38 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Roaming\Awirvy
[2012/07/08 09:44:21 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\Ilivid Player
[2012/07/08 09:43:35 | 000,000,000 | ---D | C] -- C:\Program Files\iLivid
[2012/07/08 09:42:35 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012/07/08 09:42:34 | 000,000,000 | ---D | C] -- C:\Program Files\Searchqu Toolbar
[2012/07/08 09:32:06 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{80399DA6-095B-4912-9E1A-DDBA8E51B3E6}
[2012/07/08 09:31:54 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{107914A7-74E2-44EF-B6F6-08DA38379BC6}
[2012/07/07 19:29:40 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{17883A55-6819-478C-91E6-D9D032475864}
[2012/07/07 19:29:22 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{98795615-D724-4532-9580-09C0103CA312}
[2012/07/03 18:56:04 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{8222D7EC-E930-4434-82BC-A208C1AA9847}
[2012/07/03 18:55:49 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{807B41F4-354D-4C4F-89F4-4B14D9062372}
[2012/07/02 18:52:56 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{1D4B82CE-65C7-4649-B4E8-1E640E4BB6D7}
[2012/07/02 18:52:39 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{B101CD99-353A-40EF-9140-9A90DFCC13EA}
[2012/06/25 18:07:23 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{78F0B425-4E01-4A3F-9378-BA59C5785188}
[2012/06/25 18:07:09 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{9B1A1EBB-A2A9-463E-9D60-CC3CE58579CA}
[2012/06/23 20:30:29 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012/06/23 20:30:29 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012/06/23 20:30:11 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012/06/23 20:30:11 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012/06/23 20:30:11 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012/06/23 20:29:56 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012/06/23 20:29:56 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012/06/23 20:26:36 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{5F99ECA6-E235-437F-A9CD-65E7684126B0}
[2012/06/23 20:26:02 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{F3565C19-CC3C-45B8-BBF3-4193A297E70C}
[2012/06/20 18:55:24 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{DD212EB4-B45F-4DD8-A9BA-999D51899732}
[2012/06/20 18:55:05 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{058E2800-A88D-48CC-A16E-731A50095A2D}
[2012/06/18 19:15:37 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{F3024723-B70A-4610-A323-FECB050CFE23}
[2012/06/16 18:39:41 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{22F50C45-1081-4BB9-A283-4215EF82C001}
[2012/06/13 22:38:30 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{58450471-AD6D-4600-8CAB-CEF0B2E1D3B5}
[2012/06/13 22:38:16 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{C656831A-A0BC-4736-9DB3-839672D8D010}
[2012/06/13 22:25:11 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{C3CCDB8F-822A-400C-B804-D071A471E824}
[2012/06/13 22:24:56 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{05928510-E7DA-4D16-BA6F-A656989F5EFF}
[2012/06/13 22:15:27 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{6BEB83A7-53B6-4EEC-931A-69903EFA36B7}
[2012/06/13 22:15:14 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{A487103B-EBFA-4844-AAA1-DC4691818DF1}
[2012/06/13 21:04:18 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{DE60DBFD-9FE9-41D5-807E-47D48121C253}
[2012/06/13 21:04:05 | 000,000,000 | ---D | C] -- C:\Users\Philippe\AppData\Local\{471AFF96-B8EB-448F-A30B-6CF3A3C54642}
[2012/04/18 22:06:53 | 001,187,840 | ---- | C] ( ) -- C:\Windows\System32\lxdiserv.dll
[2012/04/18 22:06:53 | 000,942,080 | ---- | C] ( ) -- C:\Windows\System32\lxdiusb1.dll
[2012/04/18 22:06:53 | 000,614,400 | ---- | C] ( ) -- C:\Windows\System32\lxdipmui.dll
[2012/04/18 22:06:53 | 000,532,480 | ---- | C] ( ) -- C:\Windows\System32\lxdilmpm.dll
[2012/04/18 22:06:53 | 000,356,352 | ---- | C] ( ) -- C:\Windows\System32\lxdiinpa.dll
[2012/04/18 22:06:53 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdiiesc.dll
[2012/04/18 22:06:53 | 000,311,296 | ---- | C] ( ) -- C:\Windows\System32\lxdihcp.dll
[2012/04/18 22:06:53 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdiprox.dll
[2012/04/18 22:06:53 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdipplc.dll
[2012/04/18 22:06:52 | 000,765,952 | ---- | C] ( ) -- C:\Windows\System32\lxdicomc.dll
[2012/04/18 22:06:52 | 000,671,744 | ---- | C] ( ) -- C:\Windows\System32\lxdihbn3.dll
[2012/04/18 22:06:52 | 000,517,040 | ---- | C] ( ) -- C:\Windows\System32\lxdicoms.exe
[2012/04/18 22:06:52 | 000,360,448 | ---- | C] ( ) -- C:\Windows\System32\lxdicomm.dll
[2012/04/18 22:06:52 | 000,340,912 | ---- | C] ( ) -- C:\Windows\System32\lxdicfg.exe
[2012/04/18 22:06:52 | 000,320,432 | ---- | C] ( ) -- C:\Windows\System32\lxdiih.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/12 22:00:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/07/12 22:00:08 | 1610,162,176 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/12 21:15:22 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/12 21:11:18 | 000,000,130 | -HS- | M] () -- C:\Windows\klif.spi
[2012/07/10 18:53:14 | 001,558,016 | ---- | M] () -- C:\Users\Philippe\Desktop\RogueKiller.exe
[2012/07/08 11:15:27 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012/07/08 10:51:34 | 000,001,070 | ---- | M] () -- C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/07/08 10:51:26 | 000,000,890 | ---- | M] () -- C:\Users\Philippe\Desktop\NTREGOPT.lnk
[2012/07/08 10:51:26 | 000,000,871 | ---- | M] () -- C:\Users\Philippe\Desktop\ERUNT.lnk
[2012/07/08 10:51:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/07/08 10:49:37 | 000,001,063 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/08 10:49:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/08 10:12:43 | 004,503,728 | ---- | M] () -- C:\ProgramData\go_0molg.pad
[2012/07/08 09:44:19 | 000,001,140 | ---- | M] () -- C:\Users\Public\Desktop\Upgrade Facebook Chat Experience.lnk
[2012/07/08 09:44:19 | 000,000,959 | ---- | M] () -- C:\Users\Public\Desktop\iLivid.lnk
[2012/07/02 19:05:30 | 000,025,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/02 19:05:29 | 000,025,808 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/25 18:29:22 | 000,002,476 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/06/25 18:28:25 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/12 21:12:33 | 000,001,146 | ---- | C] () -- C:\Users\Philippe\Desktop\Start.cmd
[2012/07/12 21:11:18 | 000,000,130 | -HS- | C] () -- C:\Windows\klif.spi
[2012/07/10 19:56:04 | 001,558,016 | ---- | C] () -- C:\Users\Philippe\Desktop\RogueKiller.exe
[2012/07/08 10:51:34 | 000,001,070 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/07/08 10:51:26 | 000,000,890 | ---- | C] () -- C:\Users\Philippe\Desktop\NTREGOPT.lnk
[2012/07/08 10:51:26 | 000,000,871 | ---- | C] () -- C:\Users\Philippe\Desktop\ERUNT.lnk
[2012/07/08 10:49:37 | 000,001,063 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/08 10:39:25 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012/07/08 09:56:29 | 004,503,728 | ---- | C] () -- C:\ProgramData\go_0molg.pad
[2012/07/08 09:44:19 | 000,001,140 | ---- | C] () -- C:\Users\Public\Desktop\Upgrade Facebook Chat Experience.lnk
[2012/07/08 09:42:13 | 000,000,959 | ---- | C] () -- C:\Users\Public\Desktop\iLivid.lnk
[2012/04/18 22:06:53 | 000,294,912 | ---- | C] () -- C:\Windows\System32\lxdiinst.dll
[2012/04/18 22:06:52 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdigrd.dll
[2011/10/25 18:24:41 | 000,000,412 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\All CPU Meter_Settings.ini
[2011/09/30 19:22:19 | 000,002,508 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\$_hpcst$.hpc
[2011/04/15 18:48:46 | 000,053,248 | ---- | C] () -- C:\Users\Philippe\AppData\Roaming\chrtmp
[2010/07/22 15:24:47 | 000,000,335 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010/06/25 19:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2010/03/06 21:52:02 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2010/03/02 23:50:38 | 000,007,621 | ---- | C] () -- C:\Users\Philippe\AppData\Local\Resmon.ResmonCfg
[2010/02/11 07:30:38 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2010/02/04 19:35:41 | 000,005,120 | ---- | C] () -- C:\Users\Philippe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/01 22:16:59 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Analog Pad
[2009/12/01 22:16:59 | 000,000,268 | RH-- | C] () -- C:\Users\Philippe\AppData\Roaming\Alerts
[2009/12/01 22:16:59 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2009/12/01 22:16:59 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Audio
[2009/12/01 22:14:33 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Ambient
[2009/12/01 22:14:33 | 000,000,268 | RH-- | C] () -- C:\Users\Philippe\AppData\Roaming\Action
[2009/12/01 22:14:33 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/12/01 22:14:33 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Applause and Laugher
[2009/11/26 22:35:15 | 000,271,360 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009/11/26 22:34:56 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009/11/22 13:31:46 | 000,002,327 | ---- | C] () -- C:\ProgramData\lxdi
[2009/10/10 19:34:04 | 000,604,140 | -HS- | C] () -- C:\Windows\System32\drivers\ISwift3.dat
[2009/10/10 19:32:59 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2009/10/10 19:32:59 | 000,097,961 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2009/10/09 22:57:43 | 000,154,144 | ---- | C] () -- C:\Windows\System32\RTLCPAPI.dll
[2009/10/09 21:37:09 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/07/14 10:39:49 | 000,705,848 | ---- | C] () -- C:\Windows\System32\perfh00C.dat
[2009/07/14 10:39:49 | 000,344,522 | ---- | C] () -- C:\Windows\System32\perfi00C.dat
[2009/07/14 10:39:49 | 000,131,746 | ---- | C] () -- C:\Windows\System32\perfc00C.dat
[2009/07/14 10:39:49 | 000,038,160 | ---- | C] () -- C:\Windows\System32\perfd00C.dat
[2009/07/14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 06:33:53 | 000,426,088 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 04:05:48 | 000,618,222 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/14 04:05:48 | 000,107,604 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009/07/14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/07/14 01:41:47 | 000,001,536 | ---- | C] () -- C:\Windows\System32\winver.exe
[2009/07/03 15:45:12 | 000,027,507 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat
[2009/06/10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/04/24 00:29:16 | 000,189,051 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006/10/31 15:02:22 | 000,053,248 | ---- | C] () -- C:\Windows\System32\PhysXLoader.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2006/10/17 17:29:00 | 000,045,056 | R--- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[1996/04/03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2009/11/26 22:40:30 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Ascaron Entertainment
[2012/07/08 10:03:24 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Awirvy
[2009/10/17 22:06:21 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Blitware
[2011/04/16 21:43:31 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\cacaoweb
[2012/06/02 21:11:16 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\DAEMON Tools Lite
[2011/08/09 01:56:54 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Folding@home-x86
[2010/11/13 22:35:20 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\freeCompressor
[2011/02/02 19:35:42 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\GrabIt
[2009/10/13 21:45:44 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\ImgBurn
[2011/09/12 19:46:47 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\LEA
[2010/03/09 21:05:18 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Leadertech
[2012/04/16 18:23:30 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Lexmark Productivity Studio
[2009/10/15 00:49:06 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Megaupload
[2009/12/04 21:49:56 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Nikon
[2010/02/04 19:14:48 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Nokia
[2010/02/04 19:31:46 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Nseries
[2010/02/04 19:31:41 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\PC Suite
[2011/09/12 19:46:45 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\SoftPlug
[2009/12/03 10:17:00 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\SPORE
[2011/08/10 00:06:49 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Stellarium
[2012/06/07 15:15:05 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\SystemRequirementsLab
[2010/07/15 16:56:33 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\T2ViewerJVM
[2011/04/08 22:11:35 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\TuneUp Software
[2012/04/18 21:59:44 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\uTorrent
[2010/02/13 15:14:20 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Virtual City
[2012/07/08 09:56:38 | 000,000,000 | ---D | M] -- C:\Users\Philippe\AppData\Roaming\Ytlu
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/07/08 09:42:35 | 000,000,000 | ---D | M] -- C:\ProgramData\boost_interprocess
[2009/10/09 21:43:40 | 000,000,000 | -HSD | M] -- C:\ProgramData\Bureau
[2009/10/12 22:44:17 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2011/05/22 19:07:26 | 000,000,000 | ---D | M] -- C:\ProgramData\Easy Driver Pro
[2009/12/03 10:14:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2009/12/01 22:16:59 | 000,000,000 | ---D | M] -- C:\ProgramData\EnterNHelp
[2009/10/09 21:43:40 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoris
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/04/14 16:50:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Lx_cats
[2009/10/09 21:43:40 | 000,000,000 | -HSD | M] -- C:\ProgramData\Menu Démarrer
[2009/10/09 21:43:40 | 000,000,000 | -HSD | M] -- C:\ProgramData\Modèles
[2011/02/17 21:07:56 | 000,000,000 | ---D | M] -- C:\ProgramData\National Instruments
[2009/12/01 22:16:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Nikon
[2010/02/04 19:08:09 | 000,000,000 | ---D | M] -- C:\ProgramData\NokiaMusic
[2010/02/04 19:31:46 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2010/03/07 18:33:34 | 000,000,000 | ---D | M] -- C:\ProgramData\ReviverSoft
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/07/14 06:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/04/08 22:15:54 | 000,000,000 | ---D | M] -- C:\ProgramData\TuneUp Software
[2009/12/01 22:16:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Ultima_T15
[2011/04/08 22:09:48 | 000,000,000 | -HSD | M] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2011/12/28 19:25:21 | 000,032,496 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Voila pour les rapports.

Suite a ces manipulations le pc démarre normalement, ca a l'air de bien fonctionner. J'ai quand meme une chose que je n'avais pas avant, quand firefox ne trouve pas l'adresse web il me dit qu'il n'a pu etablir a la connection avec www.searchqu.com.

de **nickW** » 13 Juil 2012, 18:55

Bonjour,

Pourquoi as-tu téléchargé et utilisé OTLPE et non OTL?

Nouvelle analyse:

Étape 1: AdwCleaner (de Xplode), téléchargement
Télécharger AdwCleaner depuis la page ci-dessous:
http://general-changelog-team.fr/fr/dow ... adwcleaner
Enregistrer le fichier adwcleaner.exe sur le Bureau.

Étape 2: AdwCleaner (de Xplode), analyse
Faire un clic droit sur adwcleaner.exe puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

L'écran principal d'AdwCleaner s'affiche:

Cliquer sur le bouton Recherche.

Laisser l'outil travailler sans l'interrompre.
Lorsque l'outil a terminé, il y a ouverture d'une fenêtre du Bloc-notes contenant un rapport (log).
Fermer la fenêtre d'AdwCleaner.
Fermer le Bloc-notes.

Étape 3: Résultat
Envoyer en réponse:
*- le rapport d'analyse d'AdwCleaner (contenu du fichier %SystemDrive%\AdwCleaner[Rn].txt, n étant un numéro d'ordre).
[%SystemDrive% représente la partition sur laquelle est installé le système, généralement C:]

A suivre,

de **boumsky** » 13 Juil 2012, 20:55

Bonsoir, j'avais téléchargé un cd bootable et c'était dessus, je pensais que c'était le même programme, il avait la même interface, désolé.
voila le rapport deadwcleaner:

AdwCleaner[R1]

# AdwCleaner v1.702 - Rapport créé le 13/07/2012 à 21:44:16
# Mis à jour le 13/07/2012 par Xplode
# Système d'exploitation : Windows 7 Ultimate (32 bits)
# Nom d'utilisateur : Philippe - PHILIPPE-PC
# Exécuté depuis : C:\Users\Philippe\Desktop\adwcleaner0.exe
# Option [Recherche]

***** [Services] *****

***** [Fichiers / Dossiers] *****

Dossier Présent : C:\Users\Philippe\AppData\Local\Ilivid Player
Dossier Présent : C:\Users\Philippe\AppData\LocalLow\facemoods.com
Dossier Présent : C:\Users\Philippe\AppData\LocalLow\searchquband
Dossier Présent : C:\Users\Philippe\AppData\LocalLow\Searchqutoolbar
Dossier Présent : C:\Users\Philippe\AppData\Roaming\cacaoweb
Dossier Présent : C:\Users\Philippe\AppData\Roaming\FreeCompressor
Dossier Présent : C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\Searchqutoolbar
Dossier Présent : C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Dossier Présent : C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\extensions\cacaoweb@cacaoweb.org
Dossier Présent : C:\ProgramData\boost_interprocess
Dossier Présent : C:\Program Files\DAEMON Tools Toolbar
Dossier Présent : C:\Program Files\facemoods.com
Dossier Présent : C:\Program Files\Ilivid
Dossier Présent : C:\Program Files\Searchqu Toolbar
Dossier Présent : C:\Program Files\Common Files\Nosibay
Fichier Présent : C:\Users\Philippe\AppData\Local\Temp\Searchqu.ini
Fichier Présent : C:\Users\Philippe\AppData\Local\Temp\searchqutoolbar-manifest.xml
Fichier Présent : C:\Users\Philippe\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
Fichier Présent : C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\searchplugins\Search_Results.xml
Fichier Présent : C:\Program Files\Mozilla Firefox\.autoreg
Fichier Présent : C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml
Fichier Présent : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml

***** [Registre] *****

Clé Présente : HKCU\Software\AppDataLow\Software\searchqutoolbar
Clé Présente : HKCU\Software\cacaoweb
Clé Présente : HKCU\Software\DataMngr
Clé Présente : HKCU\Software\DataMngr_Toolbar
Clé Présente : HKCU\Software\facemoods.com
Clé Présente : HKCU\Software\ilivid
Clé Présente : HKCU\Software\Spointer
Clé Présente : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Clé Présente : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Clé Présente : HKLM\SOFTWARE\Classes\escort.escortIEPane
Clé Présente : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Clé Présente : HKLM\SOFTWARE\Classes\escort.escrtBtn
Clé Présente : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Clé Présente : HKLM\SOFTWARE\Classes\esrv.escrtSrvc
Clé Présente : HKLM\SOFTWARE\Classes\esrv.escrtSrvc.1
Clé Présente : HKLM\SOFTWARE\Classes\facemoods.dskBnd
Clé Présente : HKLM\SOFTWARE\Classes\facemoods.dskBnd.1
Clé Présente : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr
Clé Présente : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr.1
Clé Présente : HKLM\SOFTWARE\Classes\facemoods.xtrnl
Clé Présente : HKLM\SOFTWARE\Classes\facemoods.xtrnl.1
Clé Présente : HKLM\SOFTWARE\Classes\facemoodsApp.appCore
Clé Présente : HKLM\SOFTWARE\Classes\facemoodsApp.appCore.1
Clé Présente : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Clé Présente : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Clé Présente : HKLM\SOFTWARE\DataMngr
Clé Présente : HKLM\SOFTWARE\DT Soft
Clé Présente : HKLM\SOFTWARE\facemoods.com
Clé Présente : HKLM\SOFTWARE\Google\chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif
Clé Présente : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Clé Présente : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Clé Présente : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Clé Présente : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facemoods
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Clé Présente : HKLM\SOFTWARE\SearchquMediabarTb
Valeur Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

***** [Registre - GUID] *****

Clé Présente : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Clé Présente : HKLM\SOFTWARE\Classes\AppID\{AD25754E-D76C-42B3-A335-2F81478B722F}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{64182481-4F71-486B-A045-B233BD0DA8FC}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{AD20D01C-C939-4DD2-8C55-56935A48987E}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{618AAD04-921F-44C2-BE38-C0818AF69861}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{B5D2ED96-62F9-4C2C-956D-E425B1F67337}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{D3A412E8-1E4B-47D2-9B12-F88291F5AFBB}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4F05-9A6E-5D3B778EC567}
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486B-A045-B233BD0DA8FC}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{64182481-4F71-486B-A045-B233BD0DA8FC}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64182481-4F71-486B-A045-B233BD0DA8FC}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}]

***** [Navigateurs] *****

-\\ Internet Explorer v8.0.7600.16385

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchnu.com/406
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://start.facemoods.com/?a=adj&f=2
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://start.facemoods.com/?a=adj&s={searchTerms}&f=4

-\\ Mozilla Firefox v3.6.6 (fr)

Nom du profil : default
Fichier : C:\Users\Philippe\AppData\Roaming\Mozilla\Firefox\Profiles\32kceood.default\prefs.js

Présente : user_pref("extensions.facemoods.aflt", "_#adj");
Présente : user_pref("extensions.facemoods.firstRun", false);
Présente : user_pref("extensions.facemoods.lastActv", "4");
Présente : user_pref("extensions.facemoods.update", "_#v1.2.0");
Présente : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=362&systemid=406&sr=0&q=");

-\\ Google Chrome v20.0.1132.57

Fichier : C:\Users\Philippe\AppData\Local\Google\Chrome\User Data\Default\Preferences

Présente : "homepage" : "hxxp://www.searchnu.com/406",
Présente : "hxxp://www.searchnu.com/406"
Présente : "name" : "Search Results",
Présente : "search_url" : "hxxp://dts.search-results.com/sr?src=crb&appid=362&systemid=406&sr=0&q={sear[...]
Présente : "homepage" : "hxxp://www.searchnu.com/406",
Présente : "hxxp://www.searchnu.com/406"

*************************

AdwCleaner[R1].txt - [11645 octets] - [13/07/2012 21:44:16]

########## EOF - C:\AdwCleaner[R1].txt - [11774 octets] ##########

Assiste.Forums

demandes d'étude de rapports d'analyse [ok]

demandes d'étude de rapports d'analyse [ok]

Re: demande d'etude de rapport d'analyse

Re: demande d'etude de rapport d'analyse

Re: demandes d'étude de rapports d'analyse

Re: demandes d'étude de rapports d'analyse

Re: demandes d'étude de rapports d'analyse

Re: demandes d'étude de rapports d'analyse

Re: demandes d'étude de rapports d'analyse

Re: demandes d'étude de rapports d'analyse

Re: demandes d'étude de rapports d'analyse

Qui est en ligne