Voila les deux rapport
Numéro 1
Gmer :
GMER 1.0.15.15507 -
http://www.gmer.net
Rootkit scan 2010-11-07 10:44:06
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 ST9160827AS 3.AAA
Running: v9nhdw7e.exe; Driver: C:\Users\Anthony\AppData\Local\Temp\ugryrkow.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8D80B360, 0x35B0A2, 0xE8000020]
.text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0x9D7C0300, 0x22020, 0xE8000020]
.text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0x9D7E9300, 0x1B7E, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4204] USER32.dll!TrackPopupMenu 76CA14F3 5 Bytes JMP 65955CF5 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[5404] ntdll.dll!LdrLoadDll 77089390 5 Bytes JMP 011413F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\system32\services.exe[636] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 001B0002
IAT C:\Windows\system32\services.exe[636] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 001B0000
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF dynamique/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF dynamique/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
---- EOF - GMER 1.0.15 ----
Le numéro 2 Listem
¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.1.1 ¤¤¤¤¤¤¤¤¤¤
User : Anthony (Administrateurs)
Update on 05/11/2010 by g3n-h@ckm@n ::::: 11.00
Start at: 12:36:54 | 06/11/2010
AMD Turion(tm) 64 X2 Mobile Technology TL-60
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18975
Windows Firewall Status : Enabled
C:\ -> Disque fixe local | 137,05 Go (69,03 Go free) [HDD] | NTFS
D:\ -> Disque CD-ROM
¤¤¤¤¤ Sessions ¤¤¤¤¤
C:\Users\Anthony
C:\Users\Public
C:\Users\Default
Boot: Normal
¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer
C:\Windows\System32\smss.exe ---- 1412 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ----
C:\Windows\system32\csrss.exe ---- 10612 Ko ---- Normal ---- C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ----
C:\Windows\system32\csrss.exe ---- 13332 Ko ---- Normal ---- C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ----
C:\Windows\system32\wininit.exe ---- 10336 Ko ---- High ---- wininit.exe ----
C:\Windows\system32\services.exe ---- 15360 Ko ---- Normal ---- C:\Windows\system32\services.exe ----
C:\Windows\system32\lsass.exe ---- 2300 Ko ---- Normal ---- C:\Windows\system32\lsass.exe ----
C:\Windows\system32\winlogon.exe ---- 13076 Ko ---- High ---- winlogon.exe ----
C:\Windows\system32\lsm.exe ---- 10324 Ko ---- Normal ---- C:\Windows\system32\lsm.exe ----
C:\Windows\system32\svchost.exe ---- 30924 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k DcomLaunch ----
C:\Windows\system32\svchost.exe ---- 29408 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k rpcss ----
C:\Windows\System32\svchost.exe ---- 57184 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k secsvcs ----
C:\Windows\System32\svchost.exe ---- 30276 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted ----
C:\Windows\System32\svchost.exe ---- 127760 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted ----
C:\Windows\system32\svchost.exe ---- 112104 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k netsvcs ----
C:\Windows\system32\svchost.exe ---- 13244 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k GPSvcGroup ----
C:\Windows\system32\SLsvc.exe ---- 17712 Ko ---- Normal ---- C:\Windows\system32\SLsvc.exe ----
C:\Windows\system32\svchost.exe ---- 39772 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalService ----
C:\Windows\system32\svchost.exe ---- 46884 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkService ----
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe ---- 8304 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" ---- ALWIL Software
C:\Program Files\Alwil Software\Avast4\ashServ.exe ---- 26576 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashServ.exe" ---- ALWIL Software
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ---- 82340 Ko ---- Normal ---- "C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe" ---- Lavasoft AB
C:\Windows\system32\Dwm.exe ---- 57164 Ko ---- High ---- "C:\Windows\system32\Dwm.exe" ----
C:\Windows\Explorer.EXE ---- 113796 Ko ---- Normal ---- C:\Windows\Explorer.EXE ----
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ---- 27208 Ko ---- Normal ---- "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ---- Synaptics Incorporated
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe ---- 27880 Ko ---- Normal ---- "C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe" ----
C:\Windows\System32\spoolsv.exe ---- 42000 Ko ---- Normal ---- C:\Windows\System32\spoolsv.exe ----
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe ---- 7212 Ko ---- Normal ---- "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup ---- Google Inc
C:\Windows\system32\taskeng.exe ---- 44344 Ko ---- Normal ---- taskeng.exe {FF52ADD5-1F18-457F-B630-6D75619FCCE3} ----
C:\Windows\system32\svchost.exe ---- 24728 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork ----
C:\Windows\System32\rundll32.exe ---- 30092 Ko ---- Normal ---- rundll32 NVSVC.DLL,nvsvcInitialize ----
C:\Program Files\OrangeHSS\Systray\SystrayApp.exe ---- 29912 Ko ---- Normal ---- "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe" ----
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ---- 24196 Ko ---- Normal ---- "C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe" ---- Adobe Systems Incorporated
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ---- 13836 Ko ---- Normal ---- "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" ---- Apple Inc.
C:\Program Files\Bonjour\mDNSResponder.exe ---- 25736 Ko ---- Normal ---- "C:\Program Files\Bonjour\mDNSResponder.exe" ---- Apple Inc.
C:\Program Files\Alwil Software\Avast4\ashDisp.exe ---- 33652 Ko ---- Normal ---- "C:\Program Files\Alwil Software\Avast4\ashDisp.exe" ---- ALWIL Software
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe ---- 12312 Ko ---- Normal ---- "C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe" ----
C:\Windows\system32\svchost.exe ---- 17512 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted ----
C:\Windows\system32\svchost.exe ---- 31800 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k imgsvc ----
C:\Windows\System32\svchost.exe ---- 5136 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k WerSvcGroup ----
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE ---- 34488 Ko ---- Normal ---- "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" ---- Microsoft Corporation
C:\Windows\system32\SearchIndexer.exe ---- 48268 Ko ---- Normal ---- C:\Windows\system32\SearchIndexer.exe /Embedding ----
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe ---- 20952 Ko ---- Normal ---- WLIDSvcM.exe 2380 ---- Microsoft Corporation
C:\Program Files\OrangeHSS\Launcher\Launcher.exe ---- 55228 Ko ---- Normal ---- "C:\Program Files\OrangeHSS\Launcher\Launcher.exe" -appid connectivityapp ---- FRANCE TELECOM
C:\Program Files\Common Files\Java\Java Update\jusched.exe ---- 27448 Ko ---- Normal ---- "C:\Program Files\Common Files\Java\Java Update\jusched.exe" ---- Sun Microsystems, Inc.
C:\Program Files\iTunes\iTunesHelper.exe ---- 70704 Ko ---- Normal ---- "C:\Program Files\iTunes\iTunesHelper.exe" ---- Apple Inc.
C:\Program Files\Windows Sidebar\sidebar.exe ---- 69336 Ko ---- Normal ---- "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun ----
C:\Program Files\Orange\MailNotifier\MailNotifier.exe ---- 50716 Ko ---- Normal ---- "C:\Program Files\Orange\MailNotifier\MailNotifier.exe" ----
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe ---- 16404 Ko ---- Normal ---- "C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe" -Embedding ----
C:\Users\Anthony\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe ---- 27108 Ko ---- Normal ---- "C:\Users\Anthony\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe" ----
C:\Users\Anthony\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe ---- 27528 Ko ---- Normal ---- "C:\Users\Anthony\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe" ----
C:\Windows\system32\wbem\wmiprvse.exe ---- 19188 Ko ---- Normal ---- C:\Windows\system32\wbem\wmiprvse.exe ----
C:\Windows\system32\wbem\unsecapp.exe ---- 12852 Ko ---- Normal ---- C:\Windows\system32\wbem\unsecapp.exe -Embedding ----
C:\Program Files\iPod\bin\iPodService.exe ---- 15356 Ko ---- Normal ---- "C:\Program Files\iPod\bin\iPodService.exe" ---- Apple Inc.
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe ---- 55008 Ko ---- Normal ---- "C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe" -Embedding ----
C:\Windows\system32\svchost.exe ---- 11980 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation ----
C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe ---- 36668 Ko ---- Normal ---- "C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe" ----
C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe ---- 51652 Ko ---- Normal ---- "C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe" ----
C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe ---- 26136 Ko ---- Normal ---- OraConfigRecover.exe Orange_ADM ----
C:\Windows\system32\taskeng.exe ---- 34044 Ko ---- Below Normal ---- taskeng.exe {4E2FB4D5-C645-420A-91EB-F17171D3A5F8} ----
C:\Windows\system32\svchost.exe ---- 20296 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k WindowsMobile ----
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe ---- 30332 Ko ---- Normal ---- "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe" ---- Lavasoft AB
C:\Program Files\Mozilla Firefox\firefox.exe ---- 241116 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation
C:\Program Files\Mozilla Firefox\plugin-container.exe ---- 72500 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=5900.abbab40.2140025431 "C:\Windows\system32\Macromed\Flash\NPSWF32.dll" 5900 plugin \.\pipe\gecko-crash-server-pipe.5900 ---- Mozilla Corporation
C:\Windows\system32\conime.exe ---- 10792 Ko ---- Normal ---- C:\Windows\system32\conime.exe ----
C:\Windows\system32\svchost.exe ---- 32352 Ko ---- Below Normal ---- C:\Windows\system32\svchost.exe -k SDRSVC ----
C:\Windows\system32\SearchProtocolHost.exe ---- 32768 Ko ---- Idle ---- "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" ----
C:\Windows\system32\SearchFilterHost.exe ---- 29140 Ko ---- Idle ---- "C:\Windows\system32\SearchFilterHost.exe" 0 620 624 632 65536 628 ----
C:\Windows\system32\cmd.exe ---- 2428 Ko ---- Normal ---- C:\Windows\system32\cmd.exe /K List'em.bat ----
C:\Windows\system32\DllHost.exe ---- 4144 Ko ---- Normal ---- C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} ----
C:\Windows\system32\wbem\wmiprvse.exe ---- 8632 Ko ---- Normal ---- C:\Windows\system32\wbem\wmiprvse.exe ----
C:\Program Files\List_Kill'em\pv.exe ---- 5680 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ----
¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Sidebar = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
msnmsgr = "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
MailNotifier = C:\Program Files\Orange\MailNotifier\MailNotifier.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NvSvc = RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
NvCplDaemon = RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
NvMediaCenter = RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
CardReaderMonitor = C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
Google Desktop Search = "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
toolbar_eula_launcher = C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
SystrayORAHSS = "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
AppleSyncNotifier = C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
ORAHSSSessionManager = "C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe"
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
QuickTime Task = "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveAutoRun = 3 (0x3)
NoDriveTypeAutoRun = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage = 0 (0x0)
NoDriveAutoRun = 3 (0x3)
NoDriveTypeAutoRun = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS =
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell = Explorer.exe
Userinit = C:\Windows\system32\Userinit.exe,
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe = C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
C:\Nexon\Combat Arms\CombatArms.exe = C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
C:\Nexon\Combat Arms\Engine.exe = C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{2357B3CF-7F8D-4451-8D81-FD6097610AEE}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5D6F45B3-9043-443D-A792-115447494D24}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{DAF7E6E6-D53A-439A-B28D-12271406B8A9}]
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3C3901C5-3455-3E0A-A214-0B093A5070A6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤
HKLM\SYSTEM\CCS\Services\Tcpip\..\{18B76C9E-5432-4BC7-BCA6-2E64738E7F75}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{18B76C9E-5432-4BC7-BCA6-2E64738E7F75}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{18B76C9E-5432-4BC7-BCA6-2E64738E7F75}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page =
http://fr.msn.com/
Local Page = C:\Windows\System32\blank.htm
Default_Search_URL =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page =
http://fr.msn.com/
Local Page = C:\Windows\system32\blank.htm
¤¤¤¤¤ Proxy Internet Explorer
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!
¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤
[MD5.1f05b78ab91c9075565a9d8a4b880bc4] - C:\Windows\System32\drivers\atapi.sys
[MD5.1f05b78ab91c9075565a9d8a4b880bc4] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[MD5.4f4fcb8b6ea06784fb6d475b7ec7300f] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[MD5.2d9c903dc76a66813d350a562de40ed9] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[MD5.2d9c903dc76a66813d350a562de40ed9] - C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[MD5.1f05b78ab91c9075565a9d8a4b880bc4] - C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
¤¤¤¤¤ Reference
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 338c86357871c167a96ab976519bf59e
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
¤¤¤¤¤¤¤¤¤¤ Explorer ¤¤¤¤¤¤¤¤¤¤
[MD5.d07d4c3038f3578ffce1c0237f2a1253] - C:\Windows\explorer.exe
[MD5.37440d09deae0b672a04dccf7abf06be] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[MD5.e7156b0b74762d9de0e66bdcde06e5fb] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[MD5.ffa764631cb70a30065c12ef8e174f9f] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
[MD5.4f554999d7d5f05daaebba7b5ba1089d] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[MD5.50ba5850147410cde89c523ad3bc606e] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[MD5.d07d4c3038f3578ffce1c0237f2a1253] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
¤¤¤¤¤¤¤¤¤¤ Winlogon ¤¤¤¤¤¤¤¤¤¤
[MD5.898e7c06a350d4a1a64a9ea264d55452] - C:\Windows\System32\winlogon.exe
[MD5.c2610b6bdbefc053bbdab4f1b965cb24] - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
[MD5.898e7c06a350d4a1a64a9ea264d55452] - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤
D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.
Rapport d'analyse pour le volume C: HDD
Taille du volume = 137 Go
Espace libre = 69.04 Go
tendue d'espace libre la plus grande = 31.89 Go
Pourcentage de fragmentation des fichiers = 0 %
Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.
Il n'est pas n'cessaire de d'fragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ First Scan ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤
[HKEY_CURRENT_USER\software\Ad-Remover]
[HKEY_CURRENT_USER\software\Adobe]
[HKEY_CURRENT_USER\software\Ahead]
[HKEY_CURRENT_USER\software\AhnLab]
[HKEY_CURRENT_USER\software\ALWIL Software]
[HKEY_CURRENT_USER\software\AppDataLow]
[HKEY_CURRENT_USER\software\Apple Computer, Inc.]
[HKEY_CURRENT_USER\software\Apple Inc.]
[HKEY_CURRENT_USER\software\Astonsoft]
[HKEY_CURRENT_USER\software\Audacity]
[HKEY_CURRENT_USER\software\Blizzard Entertainment]
[HKEY_CURRENT_USER\software\Bugsplat]
[HKEY_CURRENT_USER\software\Callia]
[HKEY_CURRENT_USER\software\Camfrog]
[HKEY_CURRENT_USER\software\Carbonite]
[HKEY_CURRENT_USER\software\Casino]
[HKEY_CURRENT_USER\software\ClassesB]
[HKEY_CURRENT_USER\software\Clients]
[HKEY_CURRENT_USER\software\EA Sports]
[HKEY_CURRENT_USER\software\Eidos]
[HKEY_CURRENT_USER\software\eMule]
[HKEY_CURRENT_USER\software\GlarySoft]
[HKEY_CURRENT_USER\software\Google]
[HKEY_CURRENT_USER\software\IM Providers]
[HKEY_CURRENT_USER\software\Image-Line]
[HKEY_CURRENT_USER\software\INCAInternet]
[HKEY_CURRENT_USER\software\JavaSoft]
[HKEY_CURRENT_USER\software\Jeskola]
[HKEY_CURRENT_USER\software\Leadertech]
[HKEY_CURRENT_USER\software\Macromedia]
[HKEY_CURRENT_USER\software\Macrovision]
[HKEY_CURRENT_USER\software\Magix]
[HKEY_CURRENT_USER\software\MainConcept]
[HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware]
[HKEY_CURRENT_USER\software\Marseillesoft]
[HKEY_CURRENT_USER\software\MGS]
[HKEY_CURRENT_USER\software\Microgaming]
[HKEY_CURRENT_USER\software\Microsoft]
[HKEY_CURRENT_USER\software\Mozilla]
[HKEY_CURRENT_USER\software\MozillaPlugins]
[HKEY_CURRENT_USER\software\Native Instruments]
[HKEY_CURRENT_USER\software\Nero]
[HKEY_CURRENT_USER\software\Netscape]
[HKEY_CURRENT_USER\software\Nokia]
[HKEY_CURRENT_USER\software\Nseries]
[HKEY_CURRENT_USER\software\NVIDIA Corporation]
[HKEY_CURRENT_USER\software\ODBC]
[HKEY_CURRENT_USER\software\Orange]
[HKEY_CURRENT_USER\software\Packard Bell]
[HKEY_CURRENT_USER\software\Pando Networks]
[HKEY_CURRENT_USER\software\Patchou]
[HKEY_CURRENT_USER\software\PhotoFiltre]
[HKEY_CURRENT_USER\software\Piriform]
[HKEY_CURRENT_USER\software\Policies]
[HKEY_CURRENT_USER\software\Research In Motion]
[HKEY_CURRENT_USER\software\SCS Software]
[HKEY_CURRENT_USER\software\SecuROM]
[HKEY_CURRENT_USER\software\SoftVoice]
[HKEY_CURRENT_USER\software\Solid State Networks]
[HKEY_CURRENT_USER\software\Stdin2]
[HKEY_CURRENT_USER\software\Synaptics]
[HKEY_CURRENT_USER\software\Totem]
[HKEY_CURRENT_USER\software\Trolltech]
[HKEY_CURRENT_USER\software\TVANTS]
[HKEY_CURRENT_USER\software\Unity]
[HKEY_CURRENT_USER\software\Usbfix]
[HKEY_CURRENT_USER\software\ValuSoft]
[HKEY_CURRENT_USER\software\VB and VBA Program Settings]
[HKEY_CURRENT_USER\software\VirtualDJ]
[HKEY_CURRENT_USER\software\WinRAR]
[HKEY_CURRENT_USER\software\WinRAR SFX]
[HKEY_CURRENT_USER\software\Yahoo]
[HKEY_CURRENT_USER\software\YahooPartnerToolbar]
[HKEY_CURRENT_USER\software\Classes]
[flash = application/x-shockwave-flash]
[HKEY_LOCAL_MACHINE\software\Adobe]
[HKEY_LOCAL_MACHINE\software\Ahead]
[HKEY_LOCAL_MACHINE\software\ALWIL Software]
[HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.]
[HKEY_LOCAL_MACHINE\software\Apple Inc.]
[HKEY_LOCAL_MACHINE\software\AviSynth]
[HKEY_LOCAL_MACHINE\software\BrowserChoice]
[HKEY_LOCAL_MACHINE\software\CCleaner]
[HKEY_LOCAL_MACHINE\software\Classes]
[HKEY_LOCAL_MACHINE\software\Clients]
[HKEY_LOCAL_MACHINE\software\Conexant]
[HKEY_LOCAL_MACHINE\software\Conexant Systems Inc ]
[HKEY_LOCAL_MACHINE\software\Daniusoft]
[HKEY_LOCAL_MACHINE\software\Digital River]
[HKEY_LOCAL_MACHINE\software\Download!]
[HKEY_LOCAL_MACHINE\software\EasyBits]
[HKEY_LOCAL_MACHINE\software\FRANCE TELECOM]
[HKEY_LOCAL_MACHINE\software\FullCircle]
[HKEY_LOCAL_MACHINE\software\GEAR Software]
[HKEY_LOCAL_MACHINE\software\GlarySoft]
[HKEY_LOCAL_MACHINE\software\Google]
[HKEY_LOCAL_MACHINE\software\Image-Line]
[HKEY_LOCAL_MACHINE\software\InstalledOptions]
[HKEY_LOCAL_MACHINE\software\InstallShield]
[HKEY_LOCAL_MACHINE\software\Intel]
[HKEY_LOCAL_MACHINE\software\JavaSoft]
[HKEY_LOCAL_MACHINE\software\JreMetrics]
[HKEY_LOCAL_MACHINE\software\Lavasoft]
[HKEY_LOCAL_MACHINE\software\Logitech]
[HKEY_LOCAL_MACHINE\software\Macromedia]
[HKEY_LOCAL_MACHINE\software\MAGIX]
[HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware]
[HKEY_LOCAL_MACHINE\software\Microsoft]
[HKEY_LOCAL_MACHINE\software\MiKit4]
[HKEY_LOCAL_MACHINE\software\MimarSinan]
[HKEY_LOCAL_MACHINE\software\Mozilla]
[HKEY_LOCAL_MACHINE\software\mozilla.org]
[HKEY_LOCAL_MACHINE\software\MozillaPlugins]
[HKEY_LOCAL_MACHINE\software\Native Instruments]
[HKEY_LOCAL_MACHINE\software\Nero]
[HKEY_LOCAL_MACHINE\software\NexonUS]
[HKEY_LOCAL_MACHINE\software\Nokia]
[HKEY_LOCAL_MACHINE\software\NSeries]
[HKEY_LOCAL_MACHINE\software\NVIDIA Corporation]
[HKEY_LOCAL_MACHINE\software\ODBC]
[HKEY_LOCAL_MACHINE\software\OMSI]
[HKEY_LOCAL_MACHINE\software\OpenAL]
[HKEY_LOCAL_MACHINE\software\Orange]
[HKEY_LOCAL_MACHINE\software\Outsim]
[HKEY_LOCAL_MACHINE\software\PACKARD BELL]
[HKEY_LOCAL_MACHINE\software\Pando Networks]
[HKEY_LOCAL_MACHINE\software\Patchou]
[HKEY_LOCAL_MACHINE\software\PB_EBAY]
[HKEY_LOCAL_MACHINE\software\PB_FIRSTCHOICE]
[HKEY_LOCAL_MACHINE\software\PB_KODAK]
[HKEY_LOCAL_MACHINE\software\PB_METABOLI]
[HKEY_LOCAL_MACHINE\software\PC Connectivity Solution]
[HKEY_LOCAL_MACHINE\software\PCSuite]
[HKEY_LOCAL_MACHINE\software\Policies]
[HKEY_LOCAL_MACHINE\software\Realtek USB 2.0 Card Reader]
[HKEY_LOCAL_MACHINE\software\RedKawa]
[HKEY_LOCAL_MACHINE\software\RegisteredApplications]
[HKEY_LOCAL_MACHINE\software\Research In Motion]
[HKEY_LOCAL_MACHINE\software\Skype]
[HKEY_LOCAL_MACHINE\software\Sonic]
[HKEY_LOCAL_MACHINE\software\SPsoft]
[HKEY_LOCAL_MACHINE\software\Symantec]
[HKEY_LOCAL_MACHINE\software\Synaptics]
[HKEY_LOCAL_MACHINE\software\Thomson]
[HKEY_LOCAL_MACHINE\software\Trolltech]
[HKEY_LOCAL_MACHINE\software\TwonkyMedia]
[HKEY_LOCAL_MACHINE\software\VideoLAN]
[HKEY_LOCAL_MACHINE\software\VirtualDJ]
[HKEY_LOCAL_MACHINE\software\Volatile]
[HKEY_LOCAL_MACHINE\software\VST]
[HKEY_LOCAL_MACHINE\software\WinRAR]
[HKEY_LOCAL_MACHINE\software\WOW6432Node]
[HKEY_LOCAL_MACHINE\software\Yahoo]
[HKEY_LOCAL_MACHINE\software\ZSMC]
¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤
Present !! : C:\install.exe
Present !! : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Present !! : C:\Users\Anthony\AppData\Local\d3d9caps.dat
Present !! : C:\Users\Anthony\AppData\Local\GDIPFONTCACHEV1.DAT
Present !! : C:\Users\Anthony\LOCAL Settings\Temp\NEventMessages.dll
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar"
Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
FEATURE_BROWSER_EMULATION | svchost :
====================================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-11-06 12:52:57
Windows 6.0.6002 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,
http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
kernel: MBR read successfully
user & kernel MBR OK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval = 1 (0x1)
UacDisableNotify = 0 (0x0)
InternetSettingsDisableNotify = 0 (0x0)
AutoUpdateDisableNotify = 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 12:53:09,61
Maintenant a toi de jouer :)
