¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.0.3 ¤¤¤¤¤¤¤¤¤¤
User : nico (Administrateurs)
Update on 05/09/2010 by g3n-h@ckm@n ::::: 08.15
Start at: 06:15:38 | 07/09/2010
Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz
Microsoft Windows 7 Édition Intégrale (6.1.7600 32-bit) #
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Disabled
C:\ -> Disque fixe local | 327,35 Go (159,5 Go free) [HDD] | NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
Boot: Normal
¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer
C:\Windows\System32\smss.exe ---- 92 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ----
C:\Windows\system32\csrss.exe ---- 2792 Ko ---- Normal ---- %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 ----
C:\Windows\system32\csrss.exe ---- 5176 Ko ---- Normal ---- %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 ----
C:\Windows\system32\wininit.exe ---- 188 Ko ---- High ---- wininit.exe ----
C:\Windows\system32\winlogon.exe ---- 1684 Ko ---- High ---- winlogon.exe ----
C:\Windows\system32\services.exe ---- 5064 Ko ---- Normal ---- C:\Windows\system32\services.exe ----
C:\Windows\system32\lsass.exe ---- 5916 Ko ---- Normal ---- C:\Windows\system32\lsass.exe ----
C:\Windows\system32\lsm.exe ---- 1456 Ko ---- Normal ---- C:\Windows\system32\lsm.exe ----
C:\Windows\system32\svchost.exe ---- 4332 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k DcomLaunch ----
C:\Windows\system32\svchost.exe ---- 4488 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k RPCSS ----
C:\Windows\System32\svchost.exe ---- 12856 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted ----
C:\Windows\System32\svchost.exe ---- 79504 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted ----
C:\Windows\system32\svchost.exe ---- 34860 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k netsvcs ----
C:\Windows\system32\svchost.exe ---- 11188 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalService ----
C:\Program Files\Avira\AntiVir Desktop\sched.exe ---- 1724 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\sched.exe" ----
C:\Windows\system32\Dwm.exe ---- 22208 Ko ---- High ---- "C:\Windows\system32\Dwm.exe" ----
C:\Windows\system32\svchost.exe ---- 8688 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork ----
C:\Windows\System32\svchost.exe ---- 45256 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k NetworkService ----
C:\Program Files\Avira\AntiVir Desktop\avguard.exe ---- 18856 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" ----
C:\Windows\system32\svchost.exe ---- 9144 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation ----
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe ---- 2716 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min ----
C:\Windows\system32\svchost.exe ---- 4384 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k imgsvc ----
C:\Windows\System32\svchost.exe ---- 40152 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k secsvcs ----
C:\Windows\system32\svchost.exe ---- 2860 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted ----
C:\Windows\System32\svchost.exe ---- 9264 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalServicePeerNet ----
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe ---- 7192 Ko ---- Normal ---- "C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe" ---- Nero AG
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE ---- 8920 Ko ---- Normal ---- "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" ---- Microsoft Corporation
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe ---- 2408 Ko ---- Normal ---- WLIDSvcM.exe 4432 ---- Microsoft Corporation
C:\Windows\System32\spoolsv.exe ---- 9948 Ko ---- Normal ---- C:\Windows\System32\spoolsv.exe ----
C:\Windows\system32\srvany.exe ---- 2144 Ko ---- Normal ---- C:\Windows\system32\srvany.exe ----
C:\Windows\KMService.exe ---- 2548 Ko ---- Normal ---- C:\Windows\KMService.exe ----
C:\Windows\system32\conhost.exe ---- 2372 Ko ---- Normal ---- \??\C:\Windows\system32\conhost.exe ----
C:\Windows\Explorer.exe ---- 72612 Ko ---- Normal ---- Explorer.exe ----
C:\Windows\system32\sppsvc.exe ---- 4752 Ko ---- Normal ---- C:\Windows\system32\sppsvc.exe ----
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 7896 Ko ---- Normal ---- "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" ---- Microsoft Corporation
C:\Windows\System32\dinotify.exe ---- 4632 Ko ---- Normal ---- "C:\Windows\System32\dinotify.exe" pnpui.dll,SimplifiedDINotification ----
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE ---- 9288 Ko ---- Normal ---- "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE" ---- Microsoft Corporation
C:\Windows\explorer.exe ---- 25824 Ko ---- Normal ---- C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding ----
C:\Windows\System32\svchost.exe ---- 3912 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k swprv ----
C:\Program Files\Mozilla Firefox\firefox.exe ---- 112252 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation
C:\Program Files\Megaupload\Mega Manager\MegaManager.exe ---- 48688 Ko ---- Normal ---- "C:\Program Files\Megaupload\Mega Manager\MegaManager.exe" /Add /URL=
http://sd-4.archive-host.com/... ----
C:\Windows\explorer.exe ---- 34720 Ko ---- Normal ---- C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding ----
C:\Program Files\Avira\AntiVir Desktop\avcenter.exe ---- 17344 Ko ---- Normal ---- "C:\Program Files\Avira\AntiVir Desktop\avcenter.exe" ----
C:\Windows\system32\AUDIODG.EXE ---- 15704 Ko ---- Normal ---- C:\Windows\system32\AUDIODG.EXE 0xaf4 ----
C:\Windows\system32\taskhost.exe ---- 11200 Ko ---- Below Normal ---- taskhost.exe $(Arg0) ----
C:\Windows\system32\cmd.exe ---- 2756 Ko ---- Normal ---- C:\Windows\system32\cmd.exe /K List'em.bat ----
C:\Windows\system32\conhost.exe ---- 4028 Ko ---- Normal ---- \??\C:\Windows\system32\conhost.exe ----
C:\Windows\system32\wbem\wmiprvse.exe ---- 7920 Ko ---- Normal ---- C:\Windows\system32\wbem\wmiprvse.exe ----
C:\Windows\system32\DllHost.exe ---- 4280 Ko ---- Normal ---- C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} ----
C:\Program Files\List_Kill'em\pv.exe ---- 4296 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ----
¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
ehTray.exe = C:\Windows\ehome\ehTray.exe
ISUSPM = "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
SUPERAntiSpyware = C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
WindowsLivePhone = "C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe" /AutoRun
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
RtHDVCpl = RtHDVCpl.exe
KMConfig = "C:\Program Files\Multimedia Keyboard & Mouse Driver\V5\StartAutorun.exe" KMConfig.exe
WindowsLivePhone = C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe /AutoRun
avgnt = "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
NPSStartup =
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
@ =
¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin = 2 (0x2)
ConsentPromptBehaviorUser = 3 (0x3)
EnableInstallerDetection = 1 (0x1)
EnableLUA = 1 (0x1)
EnableSecureUIAPaths = 1 (0x1)
EnableUIADesktopToggle = 0 (0x0)
EnableVirtualization = 1 (0x1)
PromptOnSecureDesktop = 1 (0x1)
ValidateAdminCodeSignatures = 0 (0x0)
dontdisplaylastusername = 0 (0x0)
legalnoticecaption =
scforceoption = 0 (0x0)
shutdownwithoutlogon = 1 (0x1)
undockwithoutlogon = 1 (0x1)
FilterAdministratorToken = 0 (0x0)
legalnoticetext =
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun = 0 (0x0)
NoDriveAutoRun = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage = 0 (0x0)
NoDriveAutoRun = 0 (0x0)
NoDriveTypeAutoRun = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS =
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
ReportBootOk = 1
Shell = Explorer.exe
PreCreateKnownFolders = {A520A1A4-1780-4FF6-BD18-167343C5AF16}
Userinit = C:\Windows\system32\Userinit.exe,
VMApplet = SystemPropertiesPerformance.exe /pagefile
AutoRestartShell = 1 (0x1)
Background = 0 0 0
CachedLogonsCount = 10
DebugServerCommand = no
ForceUnlockLogon = 0 (0x0)
LegalNoticeCaption =
LegalNoticeText =
PowerdownAfterShutdown = 0
ShutdownWithoutLogon = 0
WinStationsDisabled = 0
DisableCAD = 1 (0x1)
scremoveoption = 0
ShutdownFlags = 43 (0x2b)
PasswordExpiryWarning = 14 (0xe)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} =
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} = Groove GFS Stub Execution Hook
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\TriDef 3D\TriDef\TriDefMediaPlayer\TriDefMediaPlayer.exe = C:\Program Files\TriDef 3D\TriDef\TriDefMediaPlayer\TriDefMediaPlayer.exe:*:Enabled:TriDef 3D Media Player
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{8AA6CB35-67D7-45A2-B1F4-C87EC19E4522}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{23A20C3C-2ADD-4A80-AFB4-C146F8847D79}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3C3901C5-3455-3E0A-A214-0B093A5070A6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{47B3BDBB-F2AE-4B55-95C8-921C25DB3B76}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{49C187D7-91E1-459E-9759-2925384BD397}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A604D2C-E968-429B-8327-62B5CE52126D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9793EDE2-499E-4A14-8220-523691D8F91B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A59B76D1-5E3B-4893-BB7F-AF69B2570A73}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BFA2E378-31D9-4595-AFA9-CA19E610DC0F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FE600E50-2C69-46D5-ACAA-2B617006245C}]
¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{bf00e119-21a3-4fd1-b178-3b8537e75c92}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤
HKLM\SYSTEM\CCS\Services\Tcpip\..\{7A362E12-0AD3-4A47-9E38-33501CB42C6B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7A362E12-0AD3-4A47-9E38-33501CB42C6B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7A362E12-0AD3-4A47-9E38-33501CB42C6B}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page =
http://fr.msn.com/
Local Page = C:\Windows\System32\blank.htm
Default_Search_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page =
http://fr.msn.com/
Local Page = C:\Windows\system32\blank.htm
Search Page =
http://home.microsoft.com/access/allinone.asp
¤¤¤¤¤ Proxy Internet Explorer
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\Apple]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\Microsoft]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\NeroLiveEpgUpdate-PC-de-nico_nico]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\OfficeSoftwareProtectionPlatform]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\User_Feed_Synchronization-{B421EAB9-5185-4D90-80A9-2C88666196FA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\WPD]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{0CC3CCE2-EF71-4AEC-A8C3-91009731B1B0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{0E14BA34-748F-4DC6-81FD-337AB133064B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{1680D831-584F-43F5-B041-EF03D69C08D5}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{3768E576-5F96-4E74-90CE-F9DBD54D408E}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{7A02ACB2-3C55-4EE3-8EB6-7B6FE4AFC894}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{9D803F9C-C529-4A60-B4A9-DBEA603D978C}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{9F5ABC2E-3B6A-4DA8-837E-7417F2399891}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{C4939208-54D4-4813-AB28-698B8CB1FBC2}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{D5AFDE10-8306-4246-8BD2-E1C2FAA1749E}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{DDE31F42-824B-4A08-BCCA-AE751B94F1BA}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{F400CB41-BD2D-4CF6-8407-305E49518030}]
¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DllNXOptions]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IEInstal.exe]
¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection]
KnownDllList = nlhtml.dll
¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!
¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤
C:\Windows\System32\drivers\atapi.sys :
[MD5.338c86357871c167a96ab976519bf59e]
[SHA256.f28cc534523d1701b0552f5d7e18e88369c4218bdb1f69110c3e31d395884ad6]
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys :
[MD5.338c86357871c167a96ab976519bf59e]
[SHA256.f28cc534523d1701b0552f5d7e18e88369c4218bdb1f69110c3e31d395884ad6]
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys :
[MD5.338c86357871c167a96ab976519bf59e]
[SHA256.f28cc534523d1701b0552f5d7e18e88369c4218bdb1f69110c3e31d395884ad6]
¤¤¤¤¤ Reference
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 338c86357871c167a96ab976519bf59e
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤
D'fragmenteur de disque Microsoft
Copyright (c) 2007 Microsoft Corp.
Invocation de analyse sur HDD (C:)...
L'op'ration a r'ussi.
Post Defragmentation Report:
Informations sur le volumeÿ:
Taille du volume = 327,34 Go
Espace libre = 159,50 Go
Quantit' totale d'espace fragment' = 2%
Taille maximale d'espace libre = 18,39 Go
Remarqueÿ: les fragments de fichier de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.
Il n'est pas n'cessaire de d'fragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Rogues Infections ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤
Present !! : C:\install.exe
Present !! : C:\ProgramData\LauncherAccess.dt
Present !! : C:\ProgramData\LauncherAccess.dt
Present !! : C:\ProgramData\LauncherAccess.dt
Present !! : C:\ProgramData\LauncherAccess.dt
Present !! : C:\ProgramData\Trymedia
Present !! : C:\Program Files\Samsung\Samsung PC Studio 3\Update\util\UnZipTemp\OrgLoadD500.exe
Present !! : C:\Program Files\Samsung\Samsung PC Studio 3\Update\util\UnZipTemp\OrgLoadX800.exe
Present !! : C:\Program Files\Samsung\Samsung PC Studio 3\Update\util\UnZipTemp\OrgLoadZ510.exe
Present !! : C:\Windows\Fonts\GRGAREF.TTF
Present !! : C:\Windows\Installer\{E1B94435-241E-4519-B1C3-C4DD9EB352A2}
Present !! : C:\Windows\Temp\JET4162.tmp
Present !! : C:\Windows\Temp\JET44AD.tmp
Present !! : C:\Windows\Temp\JET4FA5.tmp
Present !! : C:\Windows\Temp\JET5282.tmp
Present !! : C:\Windows\Temp\JET5BF4.tmp
Present !! : C:\Windows\Temp\JET67E6.tmp
Present !! : C:\Windows\Temp\JET7A0F.tmp
Present !! : C:\Windows\Temp\JET8F53.tmp
Present !! : C:\Windows\Temp\JET9B06.tmp
Present !! : C:\Windows\Temp\JET9F1B.tmp
Present !! : C:\Windows\Temp\JETA3EC.tmp
Present !! : C:\Windows\Temp\JETA7A3.tmp
Present !! : C:\Windows\Temp\JETBFA6.tmp
Present !! : C:\Windows\Temp\JETC679.tmp
Present !! : C:\Windows\Temp\JETCC43.tmp
Present !! : C:\Windows\Temp\JETCED2.tmp
Present !! : C:\Windows\Temp\JETF46C.tmp
Present !! : C:\Users\nico\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\nico\Local Settings\Temp\B95.tmp
Present !! : C:\Users\nico\LOCAL Settings\Temp\SSUPDATE.EXE
Present !! : C:\Users\nico\LOCAL Settings\Temp\ubi40B3.tmp.exe
Present !! : C:\Users\nico\LOCAL Settings\Temp\UpdateDM.exe
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : "HKLM\Software\Trymedia Systems"
Present !! : HKCR\ImageOle.GifAnimator
Present !! : HKCR\ImageOle.GifAnimator.1
Present !! : HKCR\interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}
Present !! : HKCR\Typelib\{710993A2-4F87-41D7-B6FE-F5A20368465F}
Present !! : HKCU\software\Iminent
Present !! : HKLM\SOFTWARE\Classes\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}
Present !! : HKLM\Software\Conduit
Present !! : HKLM\Software\Freeze.com
Present !! : HKLM\software\Iminent
FEATURE_BROWSER_EMULATION | svchost :
====================================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-09-07 06:30:26
Windows 6.1.7600 FAT NTAPI
detected NTDLL code modification:
ZwEnumerateKey 0 != 116, ZwQueryKey 0 != 244, ZwOpenKey 0 != 182, ZwClose 0 != 50, ZwEnumerateValueKey 0 != 119, ZwQueryValueKey 0 != 266, ZwOpenFile 0 != 179, ZwQueryDirectoryFile 0 != 223, ZwQuerySystemInformation 0 != 261Initialization error
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x857801F8]<<
kernel: MBR read successfully
user & kernel MBR OK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval = 1 (0x1)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 6:31:03,91
