[Résolu] malware Lkckclckl1i1i.com

[MoJac]

Bonjour strat333,

OTL ne semble pas venir à bout de cette peste ...

On va essayer plus costaud:

Désactive tous tes logiciels de sécurité le temps de télécharger et exécuter ComboFix. Ceci afin qu'ils ne gênent pas l'outil quand il travaille.

- Au besoin réfère toi à ce tuto de nickW:

http://assiste.forum.free.fr/viewtopic.php?t=27097

• Télécharge ComboFix de sUBs sur ton bureau (et pas ailleurs).
  
  
• Avant de l'exécuter consulte attentivement ce tuto détaillé sur l'utilisation du logiciel. Il t'explique dans le détail ce que tu dois faire et ne pas faire durant le scan.
  
• Ferme toutes les fenêtres de tous les programmes en cours d'exécution.
  
• Double-clique sur ComboFix.exe pour le lancer. Les conditions d'utilisations du programme vont s'afficher. Accepte les en cliquant sur OK.
  
• Si l'outil te propose d'installer la console de récupération de XP. Accepte.
  
  
  
• Suite à ça, le scan va commencer. Patiente le temps que l'outil travaille sans l'interrompre et sans rien toucher.
  
  Ne clique pas dans la fenêtre de ComboFix quand il est en train de s'exécuter: Ça pourrait planter Windows
  
• A la fin du scan, un rapport va être généré: C:\ComboFix.txt
  Poste ce rapport dans ta prochaine réponse.

Il est possible que ComboFix relance plusieurs fois ta machine et refasse les 50 étapes du scan, ceci est normal compte tenu de la difficulté d'éradication des nouveaux mawares. Patiente ...

En cas de difficulté avec la connexion Internet, rappel de la procédure de réparation:




Après redémarrage de la machine:

Relance OTL et clic sur Analyse Rapide

Un rapport (assez court) sera produit.

[*]Lors du redémarrage le bloc-note sera ouvert avec le contenu du fichier OTL.txt

Sont donc attendus:

• Le rapport ComboFix
• Le dernier rapport de contrôle OTL

A plus

[strat333]

salut
ça a l'air d'aller mieux, je n'ai pas eu de réapparition de cette fenêtre........
juste un truc en passant, au cas ou il y aurait un lien
j'ai Media player Classic qui fait un truc qu'il ne faisait pas avant:
je suis en mode plein écran et tout d'un coup il "sort" du mode plein écran et en bas de la fenêtre MPC il y a un message qui s'affiche" Lost focus to explorer.exe"
cependant internet explorer n'est pas lancer et le gestionnaire de tache n'indique pas qu un autre programme fonctionne ne même temps
Bon si tu n peux rien faire pour ca , pas de problèmes , c'est un problème mineur....tu m'as déjà bien aide
merci encore

[strat333]

zut j'avais pas vu ton message au dessus, on a poste notre message en meme tps
je fais les manips et je reviens vers toi

Merci

[strat333]

log de conbo
http://cjoint.com/?ADrx7uxLOXT


rapport OTL


OTL logfile created on: 17/04/2011 23:51:39 - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Admin\Desktop\EXE\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1 023,00 Mb Total Physical Memory | 602,00 Mb Available Physical Memory | 59,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111,79 Gb Total Space | 14,12 Gb Free Space | 12,63% Space Free | Partition Type: NTFS
Drive E: | 14,95 Gb Total Space | 12,44 Gb Free Space | 83,22% Space Free | Partition Type: FAT32
Drive F: | 446,77 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 297,44 Gb Total Space | 2,51 Gb Free Space | 0,85% Space Free | Partition Type: NTFS

Computer Name: DAMIEN | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/15 21:38:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\EXE\OTL\OTL.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | ---- | M] (TuneUp Software) -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | ---- | M] (TuneUp Software) -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesService32.exe
PRC - [2010/10/24 22:58:19 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/11/24 10:53:34 | 000,348,160 | ---- | M] () -- C:\Program Files\Creative\Shared Files\AVCManU.exe
PRC - [2009/11/13 13:31:14 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009/08/17 10:52:08 | 000,098,304 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
PRC - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
PRC - [2009/02/06 14:23:36 | 000,727,720 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009/02/06 14:23:12 | 002,021,400 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008/06/24 04:26:10 | 000,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe
PRC - [2008/05/21 13:42:56 | 000,064,000 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/30 12:28:58 | 000,774,144 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Professional 5\PdfPro5Hook.exe
PRC - [2008/03/30 12:28:58 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Professional 5\PDFProFiltSrv.exe
PRC - [2007/04/02 08:15:40 | 000,061,440 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe
PRC - [2002/03/07 14:49:06 | 000,171,665 | ---- | M] (Compaq) -- C:\Program Files\COMPAQ\EAB\eabservr.exe
PRC - [2002/02/26 17:08:48 | 000,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2002/02/14 12:42:50 | 000,315,392 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\system32\atiptaxx.exe


========== Modules (SafeList) ==========

MOD - [2011/04/15 21:38:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\EXE\OTL\OTL.exe
MOD - [2010/08/23 18:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2002/02/26 17:08:28 | 000,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2010/10/27 18:23:16 | 001,483,072 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/09/12 15:30:52 | 000,251,248 | ---- | M] (CybelSoft) [On_Demand | Stopped] -- C:\Program Files\ma-config.com\maconfservice.exe -- (maconfservice)
SRV - [2009/11/13 13:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009/08/17 10:52:08 | 000,098,304 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe -- (WDSmartWareBackgroundService)
SRV - [2009/02/06 14:27:06 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009/02/06 14:23:36 | 000,727,720 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2008/05/21 13:42:56 | 000,064,000 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe -- (CTUPnPSv)
SRV - [2008/03/30 12:28:58 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files\Nuance\PDF Professional 5\PDFProFiltSrv.exe -- (PDFProFiltSrv)
SRV - [2007/04/02 08:15:40 | 000,061,440 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe -- (CTDevice_Srv)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Unknown | Running] -- -- (vkquwexg)
DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2010/10/07 13:34:32 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010/08/30 12:19:54 | 000,014,336 | ---- | M] (CybelSoft) [Kernel | On_Demand | Stopped] -- C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys -- (driverhardwarev2)
DRV - [2009/02/13 12:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2009/02/06 14:24:24 | 000,093,336 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2009/02/06 14:23:18 | 000,106,208 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009/02/06 14:19:52 | 000,113,448 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2005/12/21 10:16:34 | 000,470,048 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2004/08/03 22:41:36 | 000,606,684 | ---- | M] (LT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2002/02/20 14:07:34 | 000,381,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2002/02/12 09:09:12 | 000,006,960 | ---- | M] (Compaq Computer Corp.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EABFILTR.SYS -- (EABFiltr)
DRV - [2002/01/28 16:43:58 | 000,005,168 | ---- | M] (Compaq Computer Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EABUSB.SYS -- (eabusb)
DRV - [2002/01/16 14:48:54 | 000,054,222 | ---- | M] (Compaq Computer Corp) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\ClntMgmt.sys -- (ClntMgmt.sys)
DRV - [2001/10/04 00:00:06 | 000,585,200 | ---- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2001/08/17 13:48:56 | 000,289,664 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atimpab.sys -- (atimpab)
DRV - [2001/08/17 13:19:48 | 000,174,464 | ---- | M] (ESS Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\es198x.sys -- (allegro) ESS Allegro Audio Driver (WDM)
DRV - [2001/08/17 13:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/07/16 11:17:30 | 000,076,610 | ---- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\basic2.sys -- (basic2)
DRV - [2001/07/16 11:16:58 | 000,539,917 | ---- | M] (Conexant Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\v124nt.sys -- (V124)
DRV - [2001/07/15 18:05:54 | 000,067,222 | ---- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rksample.sys -- (Rksample)
DRV - [2001/07/03 17:42:30 | 000,017,776 | ---- | M] (Conexant Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cnxtdiag.sys -- (Cnxtdiag)
DRV - [2001/06/24 17:16:36 | 000,427,215 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\k56nt.sys -- (K56)
DRV - [2001/06/24 17:16:08 | 000,124,189 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fsksnt.sys -- (Fsks)
DRV - [2001/06/24 17:15:20 | 000,215,195 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\faxnt.sys -- (SoftFax)
DRV - [2001/06/24 17:14:18 | 000,059,375 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tonesnt.sys -- (Tones)
DRV - [2001/06/24 17:13:56 | 000,308,403 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fallback.sys -- (Fallback)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..keyword.URL: "www.google.com"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/24 22:59:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/21 18:59:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010/10/18 01:35:19 | 000,000,000 | ---D | M]

[2010/12/22 23:20:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Extensions
[2010/12/22 23:20:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Extensions\home2@tomtom.com
[2011/04/07 20:22:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\extensions
[2011/04/03 17:42:52 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/04/03 15:55:36 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2011/03/21 18:59:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\LU69Q6HY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2010/11/11 17:50:21 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/10/25 13:34:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/03/18 19:58:47 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 10:00:00 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2010/01/01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 10:00:00 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/01/01 10:00:00 | 000,001,154 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2010/01/01 10:00:00 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2010/01/01 10:00:00 | 000,000,956 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2011/04/17 23:45:16 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe (Compaq)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Professional 5\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDF Professional 5\PdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005..\Run: [SoftAuto.exe] C:\Program Files\Creative\Software Update 3\SoftAuto.exe (Creative Technology Ltd)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Ajouter au fichier PDF existant - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Ajouter le contenu des liens sélectionnés à un fichier PDF existant - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Ajouter le contenu du lien à un fichier PDF existant - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Créer des fichiers PDF à partir des liens sélectionnés - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Créer fichier PDF - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Créer un fichier PDF depuis le contenu du lien - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Ouvrir avec Nuance PDF Converter 5.0 - C:\Program Files\Nuance\PDF Professional 5\cnvres_fre.dll (Nuance Communications, Inc.)
O9 - Extra Button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - File not found
O9 - Extra 'Tools' menuitem : Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - File not found
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\..Trusted Domains: ([]msn in My Computer)
O15 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\..Trusted Domains: localhost ([]http in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupda ... 7284484411 (WUWebControl Class)
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} http://fichiers.touslesdrivers.com/maco ... _6_0_1.cab ("Ma-Config.com control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.16.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\compaq.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\compaq.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/18 23:12:18 | 000,000,088 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/17 23:34:06 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/04/17 23:30:17 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/04/17 23:30:17 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/04/17 23:30:17 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/04/17 23:30:17 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/04/17 23:30:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/04/17 23:29:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/16 14:34:23 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/04/16 11:29:06 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Admin\Recent
[2011/04/04 22:32:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Flight Test 5
[2011/04/04 22:32:26 | 000,000,000 | ---D | C] -- C:\FlightTest5
[2011/04/03 17:57:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\dwhelper
[2011/03/31 21:03:12 | 000,000,000 | ---D | C] -- C:\Ad-Remover
[2011/03/31 19:48:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/03/31 19:48:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\SUPERAntiSpyware.com
[2011/03/29 22:03:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\My Documents\Téléchargements
[2011/03/28 21:33:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\TuneUp Software
[2011/03/28 21:33:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2011/03/28 17:52:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\Malwarebytes
[2011/03/28 17:52:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/28 17:52:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/28 17:52:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/28 17:52:37 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/03/28 17:52:37 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/27 21:47:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Desktop\jla
[2011/03/26 15:28:42 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/03/26 15:28:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/03/25 15:17:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/03/25 15:16:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/03/25 14:37:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/03/25 14:33:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/03/23 23:33:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2011/03/23 23:33:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\DAEMON Tools Lite
[2011/03/23 18:52:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\e-Carte Bleue LCL
[2011/03/23 18:52:01 | 000,000,000 | ---D | C] -- C:\Program Files\e-Carte Bleue LCL
[2011/03/23 14:32:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\My Documents\FAA
[2011/03/21 19:00:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Local Settings\Application Data\Mozilla
[2011/03/21 18:59:20 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011/03/20 01:21:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\FAA Written Test Prep
[2011/03/20 01:20:14 | 000,000,000 | ---D | C] -- C:\Program Files\GroundSchool

========== Files - Modified Within 30 Days ==========

[2011/04/17 23:45:16 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/17 23:45:04 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2111342016-995690780-1244716356-1005.job
[2011/04/17 23:45:00 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-18.job
[2011/04/17 23:44:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/17 23:44:47 | 1073,139,712 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/17 23:34:12 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/04/17 23:28:53 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2111342016-995690780-1244716356-1005.job
[2011/04/17 23:28:45 | 004,323,312 | R--- | M] () -- C:\Documents and Settings\Admin\Desktop\ComboFix.exe
[2011/04/16 14:10:13 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/04/16 12:41:00 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-18.job
[2011/04/16 09:31:08 | 000,224,024 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/15 23:48:44 | 000,432,924 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/15 23:48:44 | 000,067,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/15 21:49:05 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2011/04/12 15:46:12 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/04 22:32:33 | 000,001,504 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\Study with Flight Test 5.lnk
[2011/04/04 19:18:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/02 16:00:02 | 000,058,981 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\MORApdf.pdf
[2011/04/02 15:00:34 | 002,800,615 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\l_25420080920en00010238.pdf
[2011/04/02 13:56:42 | 000,000,739 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ZHPDiag.lnk
[2011/04/02 13:56:42 | 000,000,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ZHPFix.lnk
[2011/04/02 12:37:09 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/30 21:31:18 | 000,000,010 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2011/03/29 21:40:47 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/03/28 21:03:42 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/03/28 17:52:45 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/23 18:52:02 | 000,001,593 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\e-Carte Bleue LCL.lnk
[2011/03/23 14:37:53 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/03/21 19:00:08 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2011/03/21 18:59:23 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\Mozilla Firefox.lnk
[2011/03/20 01:21:00 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\GroundSchool.lnk

========== Files Created - No Company Name ==========

[2011/04/17 23:34:12 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/04/17 23:34:08 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/04/17 23:30:17 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/04/17 23:30:17 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/04/17 23:30:17 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/04/17 23:30:17 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/04/17 23:30:17 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/04/17 23:28:45 | 004,323,312 | R--- | C] () -- C:\Documents and Settings\Admin\Desktop\ComboFix.exe
[2011/04/15 21:49:05 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2011/04/04 22:32:33 | 000,001,504 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\Study with Flight Test 5.lnk
[2011/04/02 15:59:56 | 000,058,981 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\MORApdf.pdf
[2011/04/02 15:00:21 | 002,800,615 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\l_25420080920en00010238.pdf
[2011/04/01 14:29:37 | 000,000,288 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-18.job
[2011/04/01 14:29:37 | 000,000,280 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-18.job
[2011/03/30 21:31:16 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2011/03/30 21:27:12 | 000,000,739 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ZHPDiag.lnk
[2011/03/30 21:27:12 | 000,000,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ZHPFix.lnk
[2011/03/29 21:40:47 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/03/28 17:52:45 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/25 14:09:42 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/23 18:52:02 | 000,001,593 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\e-Carte Bleue LCL.lnk
[2011/03/22 17:15:21 | 000,116,632 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\permanences_d_accueil_01.pdf
[2011/03/21 19:00:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/03/21 18:59:23 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\Mozilla Firefox.lnk
[2011/03/21 18:59:23 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/03/20 01:21:00 | 000,000,670 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\GroundSchool.lnk
[2011/03/11 23:26:22 | 000,000,067 | ---- | C] () -- C:\WINDOWS\contact.ini
[2010/11/29 21:16:55 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/26 13:30:38 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2010/10/24 18:05:03 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010/10/24 18:04:58 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/10/24 18:04:58 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/10/24 18:04:57 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/10/23 13:23:40 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Admin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/21 08:38:37 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/10/21 08:22:39 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/10/18 01:20:13 | 000,004,692 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2010/10/18 01:17:39 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2010/10/18 01:04:49 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2010/10/18 01:04:22 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\Aud2Full.exe
[2010/10/17 15:44:05 | 000,004,511 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/10/17 15:44:01 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/10/17 15:43:56 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/10/17 15:42:30 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2010/10/17 15:42:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/10/17 15:11:17 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2010/10/17 15:10:37 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2010/10/17 03:01:44 | 000,000,382 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/04/01 10:58:02 | 000,005,260 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/03 23:25:48 | 000,000,062 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Systemag.ini
[2001/09/16 22:24:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2001/09/16 22:21:26 | 000,224,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2001/09/16 22:15:04 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001/09/16 22:11:00 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2001/09/16 22:10:12 | 000,432,924 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/09/16 22:10:12 | 000,067,714 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/17 13:47:42 | 000,150,784 | ---- | C] () -- C:\WINDOWS\System32\jipijpbr.dat
[2001/08/17 13:47:42 | 000,135,936 | ---- | C] () -- C:\WINDOWS\System32\qjtaokeu.dat
[2001/08/17 13:47:42 | 000,058,112 | ---- | C] () -- C:\WINDOWS\System32\dwdmyvvt.dat
[2001/08/17 13:47:42 | 000,050,432 | ---- | C] () -- C:\WINDOWS\System32\itionchj.dat
[2001/08/17 13:47:42 | 000,039,680 | ---- | C] () -- C:\WINDOWS\System32\agtfkxhc.dat
[2001/08/17 13:47:42 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\oqwcqfzz.dat
[2001/08/17 13:47:42 | 000,031,488 | ---- | C] () -- C:\WINDOWS\System32\jsxstzph.dat
[2001/08/17 13:47:42 | 000,030,464 | ---- | C] () -- C:\WINDOWS\System32\vjtcwkow.dat
[2001/08/17 13:30:26 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/17 13:30:26 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/17 13:15:40 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/07/21 14:36:50 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/07/21 14:36:06 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2000/07/15 01:00:00 | 000,030,720 | ---- | C] () -- C:\WINDOWS\regtlib.exe

========== LOP Check ==========

[2011/03/24 14:59:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\DAEMON Tools Lite
[2011/03/23 12:27:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\GroundSchool FAA
[2010/11/23 22:20:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\moovida-1
[2010/10/23 01:22:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\ScanSoft
[2010/10/17 06:09:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\TeamViewer
[2010/12/22 23:20:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\TomTom
[2011/03/16 18:31:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Transcend
[2011/03/28 21:33:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\TuneUp Software
[2010/10/24 17:32:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Uniblue
[2011/03/25 15:37:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\uTorrent
[2010/10/20 07:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Western Digital
[2010/10/23 01:22:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Zeon
[2011/03/23 23:33:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2010/10/24 17:00:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2010/10/18 01:35:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
[2010/10/24 17:17:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\inf
[2010/10/24 16:48:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ma-config.com
[2010/10/23 00:38:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance
[2011/03/11 23:25:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SOFTENTREPRISE
[2010/12/22 23:21:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom
[2011/03/28 21:34:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/10/19 08:58:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2010/10/23 00:37:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\zeon
[2010/10/27 03:55:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{26D901A1-2540-4430-81DC-0317F01BD7BE}
[2010/10/27 04:04:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{47B5977E-772D-4BBA-AAA4-4C8FF0532136}
[2010/10/27 03:55:06 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BF1E655E-0210-4F9E-BE22-94A9069BF84B}
[2010/10/22 21:13:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{F40E9D30-5DFC-4B21-BFDB-A5CDEE6440A6}

========== Purity Check ==========



< End of report >

[MoJac]

Bonjour strat333,

ça a l'air d'aller mieux ...

C'est déja ça, il y avait quand même pas mal de trucs ...

- Il y a encore des traces d'un driver bizarre lancé en mode kernel, qui semble ne plus exister, on va tenter de mettre ça au clair par la méthode douce dans un premier temps:

Nouvelle utilisation de OTL (de OldTimer), mais en nettoyage cette fois ci:

• Fais un double clic sur OTL.exe pour lancer l'outil.
  
  Ou clic droit et Exécuter en tant qu'Administrateur sous Vista/Sept
  
• Sélectionne très précisément tout ce qui est en gras avec la souris et copie le contenu dans la zone "Personnalisation" de la fenêtre OTL
  
  
  :OTL
  DRV - File not found [Kernel | Unknown | Running] -- -- (vkquwexg)
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab (Reg Error: Key error.)
  :Commands
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  
  
• Ferme toutes les fenêtres de programme ouvertes (navigateur, traitement de texte, etc...).
  Clique sur le bouton Correction:
  
  Note: Si le redémarrage est demandé, clique sur Oui/Yes
  
• Lors du redémarrage le bloc-note sera ouvert avec le contenu du fichier OTL.txt
  
• Poste son contenu

Après redémarrage de la machine:

Relance OTL et clic sur Analyse Rapide

Un rapport (assez court) sera produit.

[*]Lors du redémarrage le bloc-note sera ouvert avec le contenu du fichier OTL.txt

Sont donc attendus:

• Le rapport de correction OTL
• Le dernier rapport de contrôle OTL

Ton histoire de perte de focus persiste t'il après ça ?

A plus

[strat333]

salut
pensant que ca allait s’arrêter la , j'avais passe EMSISOFT qui a détecte 2 trojan, voici le rapport si ca peut aider
comprends pas , je fais rien d'extraordinaire avec mon ordi, et j'ai 2 trojans,
A quoi sert ESET NOD32!

Version - Emsisoft Emergency Kit 1.0
Dernière mise à jour : 17/04/2011 22:30:49

Paramètres du balayage :

Type de balayage : Scan en Détail
Objets : Mémoire, Traces, Cookies, C:\, G:\
Balayage des archives : Marche
Analyse heuristique : Arrêt
Balayage des ADS : Marche

Début du balayage : 18/04/2011 09:48:02

C:\Documents and Settings\Admin\Cookies\admin@doubleclick[1].txt Objets détectés : Trace.TrackingCookie.doubleclick!A2
C:\Documents and Settings\Admin\Cookies\admin@edge.ru4[1].txt Objets détectés : Trace.TrackingCookie.edge.ru4!A2
C:\Documents and Settings\Admin\Cookies\admin@mediaplex[2].txt Objets détectés : Trace.TrackingCookie.mediaplex!A2
C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\cookies.sqlite:1773 Objets détectés : Trace.TrackingCookie.m.webtrends.com!A2
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_zbxcgmab_.sys.zip/zbxcgmab.sys Objets détectés : Virus.Trojan.Win32.BHO.ext!IK
C:\Qoobox\Quarantine\C\WINDOWS\system32\_wllqaatc_.dll.zip/wllqaatc.dll Objets détectés : Gen.Trojan.Heur!IK

Analysé

Fichiers : 266159
Traces : 399197
Cookies : 295
Processus : 39

Objets trouvés

Fichiers : 2
Traces : 0
Cookies : 4
Processus : 0
Clés de Registre : 0

Fin du balayage : 18/04/2011 16:43:20
Temps de balayage : 6:55:18

C:\Qoobox\Quarantine\C\WINDOWS\system32\_wllqaatc_.dll.zip/wllqaatc.dll Objets Supprimés Gen.Trojan.Heur!IK
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_zbxcgmab_.sys.zip/zbxcgmab.sys Objets Supprimés Virus.Trojan.Win32.BHO.ext!IK
C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\cookies.sqlite:1773 Objets Supprimés Trace.TrackingCookie.m.webtrends.com!A2
C:\Documents and Settings\Admin\Cookies\admin@mediaplex[2].txt Objets Supprimés Trace.TrackingCookie.mediaplex!A2
C:\Documents and Settings\Admin\Cookies\admin@edge.ru4[1].txt Objets Supprimés Trace.TrackingCookie.edge.ru4!A2
C:\Documents and Settings\Admin\Cookies\admin@doubleclick[1].txt Objets Supprimés Trace.TrackingCookie.doubleclick!A2

Objets Supprimés

Fichiers : 2
Traces : 0
Cookies : 4





Je lance la manip demandee et je reviens vers toi

[MoJac]

re:

Pas de panique !

Les éléments trouvé sont ceux mis en quarantaine par ComboFix donc inoffensif en l'état.
Le reste sont des cookies traceurs des agences de pub doubleclick et cie. Pas de quoi fouetter un chat (ni changer d'antivirus )

A plus

[strat333]

Tant mieux si y pas de quoi fouetter un chat …..d’autant plus que j’en ai pas sous la main !

Voici le rapport OTL correction
ca c'est un peu moins bien passée que les dernières fois. Après la correction l'ordi est reste fige sur OTL, j'ai du éteindre l'ordi à la sauvage
voici le 1er rapport , je poste le reste dans quelques minutes


All processes killed
========== OTL ==========
Error: No service named vkquwexg was found to stop!
Service\Driver key vkquwexg not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\WINDOWS\Downloaded Program Files\swdir.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 9172 bytes
->Temporary Internet Files folder emptied: 327974 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 78961220 bytes
->Flash cache emptied: 1032 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 456 bytes

User: Owner
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 76,00 mb


[EMPTYFLASH]

User: Admin
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: Owner

Total Flash Files Cleaned = 0,00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.22.3 log created on 04182011_173326

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[strat333]

voici le rapport OTL analyse rapide
pour la perte de focus je regarde et te dis ca


OTL logfile created on: 18/04/2011 17:53:50 - Run 4
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Admin\Desktop\EXE\OTL
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

1 023,00 Mb Total Physical Memory | 621,00 Mb Available Physical Memory | 61,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111,79 Gb Total Space | 14,16 Gb Free Space | 12,66% Space Free | Partition Type: NTFS
Drive E: | 14,95 Gb Total Space | 12,44 Gb Free Space | 83,22% Space Free | Partition Type: FAT32
Drive F: | 446,77 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 297,44 Gb Total Space | 2,51 Gb Free Space | 0,85% Space Free | Partition Type: NTFS

Computer Name: DAMIEN | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/15 21:38:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\EXE\OTL\OTL.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | ---- | M] (TuneUp Software) -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | ---- | M] (TuneUp Software) -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesService32.exe
PRC - [2010/10/24 22:58:19 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/11/24 10:53:34 | 000,348,160 | ---- | M] () -- C:\Program Files\Creative\Shared Files\AVCManU.exe
PRC - [2009/11/13 13:31:14 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009/08/17 10:52:08 | 000,098,304 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
PRC - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
PRC - [2009/02/06 14:23:36 | 000,727,720 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009/02/06 14:23:12 | 002,021,400 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008/08/13 05:49:30 | 000,405,504 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Software Update 3\SoftAuto.exe
PRC - [2008/06/24 04:26:10 | 000,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe
PRC - [2008/05/21 13:42:56 | 000,064,000 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/30 12:28:58 | 000,774,144 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Professional 5\PdfPro5Hook.exe
PRC - [2008/03/30 12:28:58 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Professional 5\PDFProFiltSrv.exe
PRC - [2007/04/02 08:15:40 | 000,061,440 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe
PRC - [2002/03/07 14:49:06 | 000,171,665 | ---- | M] (Compaq) -- C:\Program Files\COMPAQ\EAB\eabservr.exe
PRC - [2002/02/26 17:08:48 | 000,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2002/02/14 12:42:50 | 000,315,392 | ---- | M] (ATI Technologies, Inc.) -- C:\WINDOWS\system32\atiptaxx.exe


========== Modules (SafeList) ==========

MOD - [2011/04/15 21:38:52 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Admin\Desktop\EXE\OTL\OTL.exe
MOD - [2010/08/23 18:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2002/02/26 17:08:28 | 000,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2010/10/27 18:23:16 | 001,483,072 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/09/12 15:30:52 | 000,251,248 | ---- | M] (CybelSoft) [On_Demand | Stopped] -- C:\Program Files\ma-config.com\maconfservice.exe -- (maconfservice)
SRV - [2009/11/13 13:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009/08/17 10:52:08 | 000,098,304 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe -- (WDSmartWareBackgroundService)
SRV - [2009/02/06 14:27:06 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009/02/06 14:23:36 | 000,727,720 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2008/05/21 13:42:56 | 000,064,000 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe -- (CTUPnPSv)
SRV - [2008/03/30 12:28:58 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files\Nuance\PDF Professional 5\PDFProFiltSrv.exe -- (PDFProFiltSrv)
SRV - [2007/04/02 08:15:40 | 000,061,440 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe -- (CTDevice_Srv)


========== Driver Services (SafeList) ==========

DRV - [2010/10/07 13:34:32 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Documents and Settings\Admin\Desktop\EXE\Tune up\TuneUpPortable\App\TuneUp\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010/08/30 12:19:54 | 000,014,336 | ---- | M] (CybelSoft) [Kernel | On_Demand | Stopped] -- C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys -- (driverhardwarev2)
DRV - [2009/02/13 12:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2009/02/06 14:24:24 | 000,093,336 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2009/02/06 14:23:18 | 000,106,208 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009/02/06 14:19:52 | 000,113,448 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2005/12/21 10:16:34 | 000,470,048 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2004/08/03 22:41:36 | 000,606,684 | ---- | M] (LT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2002/02/20 14:07:34 | 000,381,824 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2002/02/12 09:09:12 | 000,006,960 | ---- | M] (Compaq Computer Corp.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EABFILTR.SYS -- (EABFiltr)
DRV - [2002/01/28 16:43:58 | 000,005,168 | ---- | M] (Compaq Computer Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EABUSB.SYS -- (eabusb)
DRV - [2002/01/16 14:48:54 | 000,054,222 | ---- | M] (Compaq Computer Corp) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\ClntMgmt.sys -- (ClntMgmt.sys)
DRV - [2001/10/04 00:00:06 | 000,585,200 | ---- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2001/08/17 13:48:56 | 000,289,664 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\atimpab.sys -- (atimpab)
DRV - [2001/08/17 13:19:48 | 000,174,464 | ---- | M] (ESS Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\es198x.sys -- (allegro) ESS Allegro Audio Driver (WDM)
DRV - [2001/08/17 13:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/07/16 11:17:30 | 000,076,610 | ---- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\basic2.sys -- (basic2)
DRV - [2001/07/16 11:16:58 | 000,539,917 | ---- | M] (Conexant Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\v124nt.sys -- (V124)
DRV - [2001/07/15 18:05:54 | 000,067,222 | ---- | M] (Conexant Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rksample.sys -- (Rksample)
DRV - [2001/07/03 17:42:30 | 000,017,776 | ---- | M] (Conexant Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cnxtdiag.sys -- (Cnxtdiag)
DRV - [2001/06/24 17:16:36 | 000,427,215 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\k56nt.sys -- (K56)
DRV - [2001/06/24 17:16:08 | 000,124,189 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fsksnt.sys -- (Fsks)
DRV - [2001/06/24 17:15:20 | 000,215,195 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\faxnt.sys -- (SoftFax)
DRV - [2001/06/24 17:14:18 | 000,059,375 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tonesnt.sys -- (Tones)
DRV - [2001/06/24 17:13:56 | 000,308,403 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fallback.sys -- (Fallback)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
IE - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..keyword.URL: "www.google.com"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/10/24 22:59:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/21 18:59:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010/10/18 01:35:19 | 000,000,000 | ---D | M]

[2010/12/22 23:20:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Extensions
[2010/12/22 23:20:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Extensions\home2@tomtom.com
[2011/04/07 20:22:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\extensions
[2011/04/03 17:42:52 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/04/03 15:55:36 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\lu69q6hy.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2011/03/21 18:59:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\LU69Q6HY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2010/11/11 17:50:21 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/10/25 13:34:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/03/18 19:58:47 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 10:00:00 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2010/01/01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 10:00:00 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/01/01 10:00:00 | 000,001,154 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2010/01/01 10:00:00 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2010/01/01 10:00:00 | 000,000,956 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2011/04/17 23:45:16 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe (Compaq)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Professional 5\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDF Professional 5\PdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005..\Run: [SoftAuto.exe] C:\Program Files\Creative\Software Update 3\SoftAuto.exe (Creative Technology Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Ajouter au fichier PDF existant - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Ajouter le contenu des liens sélectionnés à un fichier PDF existant - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Ajouter le contenu du lien à un fichier PDF existant - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Créer des fichiers PDF à partir des liens sélectionnés - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Créer fichier PDF - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Créer un fichier PDF depuis le contenu du lien - C:\Program Files\Nuance\PDF Professional 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Ouvrir avec Nuance PDF Converter 5.0 - C:\Program Files\Nuance\PDF Professional 5\cnvres_fre.dll (Nuance Communications, Inc.)
O9 - Extra Button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - File not found
O9 - Extra 'Tools' menuitem : Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - File not found
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O15 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\..Trusted Domains: ([]msn in My Computer)
O15 - HKU\S-1-5-21-2111342016-995690780-1244716356-1005\..Trusted Domains: localhost ([]http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupda ... 7284484411 (WUWebControl Class)
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} http://fichiers.touslesdrivers.com/maco ... _6_0_1.cab ("Ma-Config.com control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.16.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\compaq.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\compaq.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/18 23:12:18 | 000,000,088 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/18 17:33:40 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/04/17 23:34:06 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/04/17 23:30:17 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/04/17 23:30:17 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/04/17 23:30:17 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/04/17 23:30:17 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/04/17 23:30:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/04/17 23:29:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/04/16 14:34:23 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/04/16 11:29:06 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Admin\Recent
[2011/04/04 22:32:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Flight Test 5
[2011/04/04 22:32:26 | 000,000,000 | ---D | C] -- C:\FlightTest5
[2011/04/03 17:57:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\dwhelper
[2011/03/31 21:03:12 | 000,000,000 | ---D | C] -- C:\Ad-Remover
[2011/03/31 19:48:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/03/31 19:48:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\SUPERAntiSpyware.com
[2011/03/29 22:03:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\My Documents\Téléchargements
[2011/03/28 21:33:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\TuneUp Software
[2011/03/28 21:33:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2011/03/28 17:52:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\Malwarebytes
[2011/03/28 17:52:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/28 17:52:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/28 17:52:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/28 17:52:37 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/03/28 17:52:37 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/27 21:47:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Desktop\jla
[2011/03/26 15:28:42 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/03/26 15:28:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/03/25 15:17:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/03/25 15:16:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/03/25 14:37:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/03/25 14:33:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/03/23 23:33:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2011/03/23 23:33:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Application Data\DAEMON Tools Lite
[2011/03/23 18:52:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\e-Carte Bleue LCL
[2011/03/23 18:52:01 | 000,000,000 | ---D | C] -- C:\Program Files\e-Carte Bleue LCL
[2011/03/23 14:32:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\My Documents\FAA
[2011/03/21 19:00:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Admin\Local Settings\Application Data\Mozilla
[2011/03/21 18:59:20 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011/03/20 01:21:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\FAA Written Test Prep
[2011/03/20 01:20:14 | 000,000,000 | ---D | C] -- C:\Program Files\GroundSchool

========== Files - Modified Within 30 Days ==========

[2011/04/18 17:43:49 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-2111342016-995690780-1244716356-1005.job
[2011/04/18 17:43:41 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-18.job
[2011/04/18 17:43:32 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/18 17:43:30 | 1073,139,712 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/17 23:45:16 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/17 23:34:12 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/04/17 23:28:53 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-2111342016-995690780-1244716356-1005.job
[2011/04/17 23:28:45 | 004,323,312 | R--- | M] () -- C:\Documents and Settings\Admin\Desktop\ComboFix.exe
[2011/04/16 14:10:13 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/04/16 12:41:00 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-18.job
[2011/04/16 09:31:08 | 000,224,024 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/15 23:48:44 | 000,432,924 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/15 23:48:44 | 000,067,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/04/15 21:49:05 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2011/04/12 15:46:12 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/04 22:32:33 | 000,001,504 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\Study with Flight Test 5.lnk
[2011/04/04 19:18:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/02 16:00:02 | 000,058,981 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\MORApdf.pdf
[2011/04/02 15:00:34 | 002,800,615 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\l_25420080920en00010238.pdf
[2011/04/02 13:56:42 | 000,000,739 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ZHPDiag.lnk
[2011/04/02 13:56:42 | 000,000,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ZHPFix.lnk
[2011/04/02 12:37:09 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/30 21:31:18 | 000,000,010 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2011/03/29 21:40:47 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/03/28 21:03:42 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/03/28 17:52:45 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/23 18:52:02 | 000,001,593 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\e-Carte Bleue LCL.lnk
[2011/03/23 14:37:53 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/03/21 19:00:08 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2011/03/21 18:59:23 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\Mozilla Firefox.lnk
[2011/03/20 01:21:00 | 000,000,670 | ---- | M] () -- C:\Documents and Settings\Admin\Desktop\GroundSchool.lnk

========== Files Created - No Company Name ==========

[2011/04/17 23:34:12 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/04/17 23:34:08 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/04/17 23:30:17 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/04/17 23:30:17 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/04/17 23:30:17 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/04/17 23:30:17 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/04/17 23:30:17 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/04/17 23:28:45 | 004,323,312 | R--- | C] () -- C:\Documents and Settings\Admin\Desktop\ComboFix.exe
[2011/04/15 21:49:05 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2011/04/04 22:32:33 | 000,001,504 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\Study with Flight Test 5.lnk
[2011/04/02 15:59:56 | 000,058,981 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\MORApdf.pdf
[2011/04/02 15:00:21 | 002,800,615 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\l_25420080920en00010238.pdf
[2011/04/01 14:29:37 | 000,000,288 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-18.job
[2011/04/01 14:29:37 | 000,000,280 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-18.job
[2011/03/30 21:31:16 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2011/03/30 21:27:12 | 000,000,739 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ZHPDiag.lnk
[2011/03/30 21:27:12 | 000,000,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ZHPFix.lnk
[2011/03/29 21:40:47 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/03/28 17:52:45 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/25 14:09:42 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/23 18:52:02 | 000,001,593 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\e-Carte Bleue LCL.lnk
[2011/03/22 17:15:21 | 000,116,632 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\permanences_d_accueil_01.pdf
[2011/03/21 19:00:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/03/21 18:59:23 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\Mozilla Firefox.lnk
[2011/03/21 18:59:23 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/03/20 01:21:00 | 000,000,670 | ---- | C] () -- C:\Documents and Settings\Admin\Desktop\GroundSchool.lnk
[2011/03/11 23:26:22 | 000,000,067 | ---- | C] () -- C:\WINDOWS\contact.ini
[2010/11/29 21:16:55 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/26 13:30:38 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2010/10/24 18:05:03 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010/10/24 18:04:58 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/10/24 18:04:58 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/10/24 18:04:57 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/10/23 13:23:40 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Admin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/21 08:38:37 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/10/21 08:22:39 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/10/18 01:20:13 | 000,004,692 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2010/10/18 01:17:39 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2010/10/18 01:04:49 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2010/10/18 01:04:22 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\Aud2Full.exe
[2010/10/17 15:44:05 | 000,004,511 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/10/17 15:44:01 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/10/17 15:43:56 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/10/17 15:42:30 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2010/10/17 15:42:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/10/17 15:11:17 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2010/10/17 15:10:37 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2010/10/17 03:01:44 | 000,000,382 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/04/01 10:58:02 | 000,005,260 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/03 23:25:48 | 000,000,062 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Systemag.ini
[2001/09/16 22:24:10 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2001/09/16 22:21:26 | 000,224,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2001/09/16 22:15:04 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001/09/16 22:11:00 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2001/09/16 22:10:12 | 000,432,924 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/09/16 22:10:12 | 000,067,714 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/17 13:47:42 | 000,150,784 | ---- | C] () -- C:\WINDOWS\System32\jipijpbr.dat
[2001/08/17 13:47:42 | 000,135,936 | ---- | C] () -- C:\WINDOWS\System32\qjtaokeu.dat
[2001/08/17 13:47:42 | 000,058,112 | ---- | C] () -- C:\WINDOWS\System32\dwdmyvvt.dat
[2001/08/17 13:47:42 | 000,050,432 | ---- | C] () -- C:\WINDOWS\System32\itionchj.dat
[2001/08/17 13:47:42 | 000,039,680 | ---- | C] () -- C:\WINDOWS\System32\agtfkxhc.dat
[2001/08/17 13:47:42 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\oqwcqfzz.dat
[2001/08/17 13:47:42 | 000,031,488 | ---- | C] () -- C:\WINDOWS\System32\jsxstzph.dat
[2001/08/17 13:47:42 | 000,030,464 | ---- | C] () -- C:\WINDOWS\System32\vjtcwkow.dat
[2001/08/17 13:30:26 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/17 13:30:26 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/17 13:15:40 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/07/21 14:36:50 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/07/21 14:36:06 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2000/07/15 01:00:00 | 000,030,720 | ---- | C] () -- C:\WINDOWS\regtlib.exe

========== LOP Check ==========

[2011/03/24 14:59:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\DAEMON Tools Lite
[2011/03/23 12:27:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\GroundSchool FAA
[2010/11/23 22:20:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\moovida-1
[2010/10/23 01:22:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\ScanSoft
[2010/10/17 06:09:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\TeamViewer
[2010/12/22 23:20:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\TomTom
[2011/03/16 18:31:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Transcend
[2011/03/28 21:33:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\TuneUp Software
[2010/10/24 17:32:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Uniblue
[2011/03/25 15:37:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\uTorrent
[2010/10/20 07:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Western Digital
[2010/10/23 01:22:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Admin\Application Data\Zeon
[2011/03/23 23:33:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2010/10/24 17:00:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
[2010/10/18 01:35:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
[2010/10/24 17:17:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\inf
[2010/10/24 16:48:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ma-config.com
[2010/10/23 00:38:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance
[2011/03/11 23:25:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SOFTENTREPRISE
[2010/12/22 23:21:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom
[2011/03/28 21:34:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/10/19 08:58:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2010/10/23 00:37:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\zeon
[2010/10/27 03:55:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{26D901A1-2540-4430-81DC-0317F01BD7BE}
[2010/10/27 04:04:07 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{47B5977E-772D-4BBA-AAA4-4C8FF0532136}
[2010/10/27 03:55:06 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{BF1E655E-0210-4F9E-BE22-94A9069BF84B}
[2010/10/22 21:13:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{F40E9D30-5DFC-4B21-BFDB-A5CDEE6440A6}

========== Purity Check ==========



< End of report >

[MoJac]

Re:

ca c'est un peu moins bien passée que les dernières fois. Après la correction l'ordi est reste fige sur OTL

- La suppression d'un driver en mode kernel au statut incertain n'est jamais une opération simple; Apparemment il n'est plus listé cependant donc OTL a quand même travaillé.

Pour ton histoire de focus j'ai trouvé ça:

http://forum.notebookreview.com/windows ... winxp.html
http://support.microsoft.com/kb/313176

Le site anglais demande de vérifier si il n'y a pas de fenêtre cachée en attente de validation (on peut la faire passer en premier plan en faisant alt+tab)

Difficile d'établir un lien avec l'action de ComboFix

- Le rapport ne montre rien.

On va continuer d'avancer:

Mises à jour de sécurité:

- Tu utilises Adobe Reader version 9.4.3. Il est impératif de faire une mise à jour vers la version Adobe X (10) qui met en oeuvre des technologies un peu plus avancées en terme de sécurité.
http://get.adobe.com/fr/reader/
- Ta version de Java n'est pas à jour. Tu peux le vérifier ICI(actuellement Version 6 Update 24)
Lors de l'installation décocher la barre d'outil Yahoo proposée
Après mise à jour
Désinstalle toutes les anciennes versions par Ajout/Suppression de programmes [b]si elles existent[/b].
Les lignes ressemblent à Java(TM) X Update Y.

- Si tu constates que tout continue d'aller on terminera la prochaine fois par la désinstallation des outils utilisés et les conseils de sécurité.

A plus

[strat333]

Bonjour
Tout a l'air d'aller pour le mieux.
J'attends tes instructions pour la dernières phase
Bonne journée

[MoJac]

Bonjour strat333,

Désinstallation des outils utilisés:

Il ne faut pas garder d'anciennes version d'outils car ceux ci sont mis à jour pratiquement journellement. En cas de besoin il est préférable de retélécharger les dernières versions.

- Suppression de Combofix

Dans le menu Démarrer :

• Sous Vista/Sept => Dans la barre Rechercher ou Exécuter > tape combofix /uninstall valide par Entrée ou OK
• Un message t'avertira de la bonne réalisation de l'opération.
• Supprime le rapport C:\Combofix.txt

- Relance OTL.exe (clic droit et exécuter en tant qu'administrateur, puis clic sur bouton "Purge outils" et suit les indications (celui ci va s'auto désinstaller).
- Relance AD-R.exe (clic droit et exécuter en tant qu'administrateur) si toujours présent sur ton bureau et choisis Désinstallation.
- Supprime SecurityCheck.exe si toujours présent sur ton bureau.
- Supprime TDSSKiller.exe si toujours présent sur ton bureau.

Par contre nous avons utilisés MalwareByte's, je te conseille de conserver cet outil et d'effectuer régulièrement, aprés mise à jour, un scan de contrôle.

- Conseils généraux relatifs à la sécurité:

• Les logiciels de sécurité (antivirus, anti-troyens ...), même les meilleurs, ne sont pas efficaces à 100% contre les menaces actuelles. Pour protéger efficacement ton PC il faut que tu connaisses les pièges tendus sur le net et que tu apprennes à les éviter. Pour cela, je t'invite à lire ce document de la Lutte Antimalwares. (Au format PDF)
  Il est très complet alors prends ton temps pour le lire et fais le circuler autour de toi.
  
• Les risques liés au P2P:Idées reçues

Sauf si tu as des questions ou encore des pb, je te propose d'en rester là.

Toute l'équipe de Micro-Astuce te souhaite bon surf en toute sécurité

[strat333]

OK, Merci pour tout
1)Les Mac sont ils "protégés " des virus et autres malwares, cela vaut il le cout d'investir dans un Mac?

2)j'utilise NOD32 et le firewall microsoft...C'est suffisant ou bien tu suggères autre chose?

3)une question en MP

Merci encore
Bonne continuation

[MoJac]

Re:

1) Les Mac ne sont pas protégés par nature (pas plus que n'importe quel OS). Ils sont moins exposés que la myriade de PC qui est la cible privilégiée des pirates qui ont un terrain de jeu beaucoup plus vaste avec ce type de machines. Donc les infections Mac sont beaucoup moins nombreuses car le "marché" est moins porteur .

- Si la préoccupation vis à vis d'un Mac est lié à sa moindre fragilité vis à vis des infections, cela ne me semble pas suffisant comme argument - compte tenu de la différence de prix. Par contre Mac est très prisé dans le monde de l'édition professionnelle le traitement d'image, vidéo. Ce n'est sans doute pas un hasard. Ceci étant je ne suis pas un professionnel de ces domaines donc mon avis est celui d'un béotien.


2) Node32 est un excellent produit. Pour Vista le firewall MS est crédible à condition de se comporter de manière responsable vis à vis de son surf. Les firewall externes ont pour la plupart tendance à fragiliser les configurations ( il suffit de regarder les logs d'outil de recherche de rootkit pour mesurer le nombre de crochetages système réalisés pas ces outils ...) et Vista est trés sensible à ce genre de bricolage.
Malwarebyte's est aussi un bon produit. Dans sa version gratuite il n'y a pas de surveillance temps réel; Le scan doit être volontaire ainsi que la mise à jour.

A propos de responsabilité je peux te suggérer quelques add on de FFox qui sont interessants car ils "sécurisent" pas mal le surf:

- WOT qui donne une appréciation sur le degré de confiance qu'on peut avoir vis à vis d'un site. Ce genre d'outil s'appuie sur une base de donnée qui est, entre autre alimentée, par les internautes; Tu as quand même le choix de passer outre ...

https://addons.mozilla.org/fr/firefox/a ... sing-tool/

Aprés avoir téléchargé le programme il suffit de l'installer et suivre les consignes.

- Adblockplus lui filtre le contenu des pages affichées en supprimant certaines publicités envahissantes. Un tuto ici:

http://www.6ma.fr/tuto/adblock+plus+blo ... irefox-303

- Il existe aussi un add on appelé no script qui bloque systématiquement Java script; Si on veut pouvoir surfer il faut autoriser pour chaque site visité les sous éléments juste nécessaires pour pouvoir naviguer sans laisser trop de traces à doubleclick et autre. C'est assez contraignant au début, mais trés efficace. A voir en second lieu car déja avec ADblock il faut parfois autoriser certaines parties de sites ...donc pas trop de nouveauté d'un seul coup !

3) Rien reçu en MP ...