Voici un copier/coller du rapport:
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan | g3n-h@ckm@n | Saachaa | 3.1003 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
~ ¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤ - Start 21:14:54
~ Update on 03/10/2013 | 13.10 by g3n-h@ckm@n
~ Evolution :
http://security-helpzone.com/gen-hackma ... og/2013-2/
~ Pre_Script Infos :
http://security-helpzone.com/gen-hackma ... re_script/
~ Pre_scan Feedbacks :
http://security-helpzone.com/gen-hackma ... ours-bugs/
~ [GAGEOT (Administrator)] - [GAGEOT-PC]
~ SID = S-1-5-21-3833397537-1658621944-3901429324-1001
~ System : Windows 7 Home Premium (64 bits) HomePremium Service Pack 1
~ ProcessorNameString : Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz
~ Identifier : Intel64 Family 6 Model 42 Stepping 7
~ Memory RAM = Total (MB) : 4176 | Free (MB) : 2972
~ Pagefile = Total (MB) : 8350 | Free (MB) : 7114
~ Virtual = Total (MB) : 4194 | Free (MB) : 4019
¤¤¤¤¤¤¤¤¤¤ | Boot's scripts
C:\Windows\Setup\Scripts\MonitorAuto_x64.exe
C:\Windows\Setup\Scripts\MOD01SET5O000N0002.enc
C:\Windows\Setup\Scripts\useralaunch.cmd
C:\Windows\Setup\Scripts\OOBE.CMD
C:\Windows\Setup\Scripts\SetupComplete.cmd
¤¤¤¤¤¤¤¤¤¤ | Drives
c:\ - [Fixed] | [Acer] | Total : 945610 Mo | Free : 840710 Mo - NTFS
d:\ - [Fixed] | [DATA] | Total : 945630 Mo | Free : 945510 Mo - NTFS
¤¤¤¤¤¤¤¤¤¤ | Windows Updates
No windows updates detected !!!
¤¤¤¤¤¤¤¤¤¤ | services
WU: Windows Update Service [Auto(2)] = Running
¤¤¤¤¤¤¤¤¤¤ | Sessions
~ C:\Windows\system32\config\systemprofile
~ C:\Windows\ServiceProfiles\LocalService
~ C:\Windows\ServiceProfiles\NetworkService
~ C:\Users\GAGEOT
New restorepoint created
Standby deleted !
¤¤¤¤¤¤¤¤¤¤ | stopped Processes
988 | C:\Windows\system32\atiesrxx.exe (.AMD - AMD External Events Service Module.) - (6.14.11.1088) - C:\Windows\system32\atiesrxx.exe
1128 | C:\Windows\system32\atieclxx.exe (.AMD - AMD External Events Client Module.) - (6.14.11.1088) - atieclxx
1176 | C:\Windows\SYSTEM32\WISPTIS.EXE (.Microsoft Corporation - Composant de saisie tactile ou avec stylet Microsoft.) - (6.1.7601.17514) - /QuitInfo:00000000000002E0;00000000000002E4; /AddRef;
1348 | C:\Windows\System32\spoolsv.exe (.Microsoft Corporation - Application sous-système spouleur.) - (6.1.7601.17777) - C:\Windows\System32\spoolsv.exe
1540 | C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (.ArcSoft Inc. - ArcSoft Connect Service.) - (1.1.0.47) - "C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe"
1732 | C:\Windows\SYSTEM32\WISPTIS.EXE (.Microsoft Corporation - Composant de saisie tactile ou avec stylet Microsoft.) - (6.1.7601.17514) - /QuitInfo:00000000000002D0;0000000000000240; /AddRef;
1744 | C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (.Microsoft Corporation - Tablet PC Input Panel Accessory.) - (6.1.7600.16385) - /QuitInfo:00000000000001AC;00000000000001D4;
1804 | C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe (.Microsoft Corporation - Tablet PC Input Panel Helper.) - (6.1.7600.16385) - /loadhooks /Parent:00000000000006D0
1888 | C:\Windows\system32\taskhost.exe (.Microsoft Corporation - Processus hôte pour Tâches Windows.) - (6.1.7601.17514) - "taskhost.exe"
1992 | C:\Windows\Explorer.EXE (.Microsoft Corporation - Explorateur Windows.) - (6.1.7601.17567) - C:\Windows\Explorer.EXE
2032 | C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (.Symantec Corporation - Norton Online Backup Service.) - (2.1.17869.0) - "C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE
2180 | C:\Windows\system32\Pen_Tablet.exe (.Wacom Technology, Corp. - Tablet Service for consumer driver.) - (5.1.0.4) - C:\Windows\system32\Pen_Tablet.exe
2208 | C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (.TomTom - Windows Service for TomTom HOME.) - (2.9.5.3093) - "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe"
2336 | C:\Windows\system32\WTablet\Pen_TabletUser.exe (.Wacom Technology, Corp. - Tablet user module for consumer driver.) - (5.1.0.4) - WTablet\Pen_TabletUser.exe
2364 | C:\Windows\system32\Pen_Tablet.exe (.Wacom Technology, Corp. - Tablet Service for consumer driver.) - (5.1.0.4) - Pen_Tablet.exe au
2540 | C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) - (1.0.0.608) - "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
2604 | C:\Program Files\Microsoft IntelliType Pro\itype.exe (.Microsoft Corporation - IType.exe.) - (8.20.469.0) - "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
2736 | C:\Program Files\Microsoft IntelliPoint\ipoint.exe (.Microsoft Corporation - IPoint.exe.) - (8.20.468.0) - "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
2760 | C:\OEM\USBDECTION\USBS3S4Detection.exe (. - USB S3S4 Detection.) - (1.0.0.1) - C:\OEM\USBDECTION\USBS3S4Detection.exe
2784 | C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (.Microsoft Corp. - Microsoft® Windows Live ID Service.) - (7.250.4232.0) - "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
2976 | C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (.Microsoft Corp. - Microsoft® Windows Live ID Service Monitor.) - (7.250.4232.0) - WLIDSvcM.exe 2784
2076 | C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (.TomTom - System Tray application for TomTom HOME.) - (2.9.5.3093) - "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
2348 | C:\Program Files (x86)\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe (.Orbiscom Ltd. All rights reserved. - ECBL Client.) - (2.2.7.0) - "C:\Program Files (x86)\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe" " /dontopenmycards"
2292 | C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (.Egis Technology Inc. - SuiteTray.) - (4.0.14.11) - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
2400 | C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (.Egis Technology Inc. - PMM Update Application.) - (1.1.36.0) - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
1640 | C:\Windows\system32\taskeng.exe (.Microsoft Corporation - Moteur du Planificateur de tâches.) - (6.1.7601.17514) - taskeng.exe {72EF5AB9-D306-4513-8DF1-9330594F2D13}
2532 | C:\Windows\system32\WUDFHost.exe (.Microsoft Corporation - Windows Driver Foundation - Processus hôte de l’infrastructure de pilotes en mode utilisateur.) - (6.1.7601.17514) - "C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-469902bf-3146-40fc-ad40-8c1d07a1b8fd -SystemEventPortName:HostProcess-2e6839fb-cd72-4894-96f8-2f6d4a7e7102 -IoCancelEventPortName:HostProcess-d197f07d-f190-47cc-a42d-559bcfd84f35 -NonStateChangingEventPortName:HostProcess-dba25643-3185-45ac-97f1-ac79b5e6dff5 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:6aab3c9f-20dd-4b26-bd0d-9d6acdc6e7ad
3096 | C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (.Intel Corporation - IAStorIcon.) - (10.1.0.1008) - "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
3108 | C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (.CyberLink Corp. - clear.fi Movie Resident Program.) - (9.0.7713.0) - "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe"
3144 | C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe (. - Hotkey Utility.) - (2.5.3014.0) - "C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe"
3152 | C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (.InstallShield Software Corporation - InstallShield Update Service Scheduler.) - (3.0.100.1161) - "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
3160 | C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (.Hewlett-Packard - hpwuSchd Application.) - (80.1.1.0) - "C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe"
3236 | C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (.ArcSoft Inc. - ArcSoft Connect Daemon.) - (1.1.0.49) - "C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe"
3276 | C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) - (1.7.4.0) - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
3324 | C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (.ArcSoft Inc. - ArcSoft Connect Notifier.) - (1.1.0.48) - ArcCon.ac 66090 0
3368 | C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe (.CyberLink Corp. - clear.fi Resident Program.) - (4.0.7229.0) - "C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe"
3536 | C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) - (2.0.7.1) - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
3672 | C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe (.CyberLink - DMREngine.) - (1.1.0.3904) - "C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe"
4028 | C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (.Egis Technology Inc. - EgisUpdate Release Application.) - (1.1.36.0) - "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe"
3768 | C:\Program Files\Windows Media Player\wmpnetwk.exe (.Microsoft Corporation - Service Partage réseau du Lecteur Windows Media.) - (12.0.7601.17514) - "C:\Program Files\Windows Media Player\wmpnetwk.exe"
4912 | C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) - (2.0.0.0) - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
5004 | C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (.ATI Technologies Inc. - Catalyst Control Center: Host application.) - (3.5.0.0) - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
4888 | C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (.Microsoft Corporation - PresentationFontCache.exe.) - (3.0.6920.5011) - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
3272 | C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (.Intel Corporation - IAStorDataSvc.) - (10.1.0.1008) - "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
4244 | C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (.Intel Corporation - Local Manageability Service.) - (7.0.2.1164) - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
4072 | C:\Program Files (x86)\Nero\Update\NASvc.exe (.Nero AG - NeroUpdate.) - (1.0.18.0) - "C:\Program Files (x86)\Nero\Update\NASvc.exe"
2392 | C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (.Intel Corporation - User Notification Service.) - (7.0.2.1164) - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
4172 | C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe (.Microsoft Corporation - Serveur de personnalisation d’entrée.) - (6.1.7600.16385) - "C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
4280 | C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (.Sun Microsystems, Inc. - Java(TM) Update Checker.) - (2.0.7.1) - "C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto -critical
6652 | C:\Users\GAGEOT\Desktop\RogueKiller.exe (. - .) - (8.7.1.0) - "C:\Users\GAGEOT\Desktop\RogueKiller.exe"
4664 | C:\Program Files (x86)\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (9.0.8112.16450) - "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
6420 | C:\Program Files (x86)\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (9.0.8112.16450) - "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:4664 CREDAT:145409
3952 | C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (.Google Inc. - Google Toolbar Broker.) - (7.5.4209.2358) - "C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe"
6736 | C:\Program Files (x86)\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (9.0.8112.16450) - "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:4664 CREDAT:79876
¤¤¤¤¤¤¤¤¤¤ | Running processes
Boot : Normal
¤¤¤¤¤¤¤¤¤¤ | Winlogon User : OK !
¤¤¤¤¤¤¤¤¤¤ | Winlogon Machine
Repaired : [HKLM | Winlogon]|[userinit] : userinit.exe, - C:\Windows\SysWOW64\userinit.exe,
Repaired : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]|[userinit] : C:\Windows\SysWOW64\userinit.exe, - C:\Windows\System32\userinit.exe,
¤¤¤¤¤¤¤¤¤¤ | Associations
Repaired : [HKCR\Folder\shell\open\command] : %SystemRoot%\Explorer.exe - C:\Windows\Explorer.exe
¤
Repaired : [HKLM\Software\Clients\StartMenuInternet\Firefox.exe\shell\open\command] : C:\Program Files (x86)\Mozilla Firefox\firefox.exe - "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Repaired : [HKLM\Software\Clients\StartMenuInternet\IExplore.exe\shell\open\command] : C:\Program Files (x86)\Internet Explorer\iexplore.exe - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
¤¤¤¤¤¤¤¤¤¤ | Registry
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{9343812e-1c37-4a49-a12e-4b2d810d956b}] : 1 - 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}] : 1 - 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{20D04FE0-3AEA-1069-A2D8-08002B30309D}] : 1 - 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{208D2C60-3AEA-1069-A2D7-08002B30309D}] : 1 - 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{871C5380-42A0-1069-A2EA-08002B30309D}] : 1 - 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}] : 1 - 0
Repaired : [HKLM\software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]|[{59031a47-3f72-44a7-89c5-5595fe6b30ee}] : 1 - 0
Repaired : [HKU\S-1-5-21-3833397537-1658621944-3901429324-1001\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]| : 2 - 0
Repaired : [HKU\S-1-5-21-3833397537-1658621944-3901429324-1001\software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel]|[AllItemsIconView] : 0 - 1
¤¤¤¤¤¤¤¤¤¤ | Taskmgr and Registry Access
¤¤¤¤¤¤¤¤¤¤ | SafeBoot | Control | Repair
Safeboot Keys are O.K
Alternate shell is OK !
¤
Safeboot Minimal Subkeys : O.K !
¤
Safeboot Network Subkeys : O.K !
¤¤¤¤¤¤¤¤¤¤ | IFEO
¤¤¤¤¤¤¤¤¤¤ | Mountpoints2
¤¤¤¤¤¤¤¤¤¤ | Windows
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]|[Shell] : SYS:Microsoft\Windows NT\CurrentVersion\Winlogon
Winsrv : OK !
Repaired : [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[AppInit_DLLS] : c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll -
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[LoadAppInit_DLLs] : 1
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]|[AppInit_DLLS] :
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]|[LoadAppInit_DLLs] : 1
¤¤¤¤¤¤¤¤¤¤ | Security Center
¤¤¤¤¤¤¤¤¤¤ | Services Corrections
Service : BFE : Restored
Service : BITS : Restored
Service : MPSSVC : Restored
Service : WSCSVC : Restored
Service : IPHLPSVC : Restored
Service : WINDEFEND : Restored
Service : SHAREDACCESS : Restored
Repaired : [HKLM | Services\Compbatt] : 3 - 0
Repaired : [HKLM | Services\luafv] : 4 - 2
Repaired : [HKLM | Services\agp440] : 3 - 2
Repaired : [HKLM | Services\Browser] : 2 - 3
Repaired : [HKLM | Services\Bits] : 3 - 2
Repaired : [HKLM | Services\EapHost] : 3 - 2
Repaired : [HKLM | Services\Wlansvc] : 3 - 2
Repaired : [HKLM | Services\windefend] : 3 - 2
Repaired : [HKLM | Services\WerSvc] : 4 - 2
¤¤¤¤¤¤¤¤¤¤ | Internet Explorer
Repaired : [HKU\S-1-5-21-3833397537-1658621944-3901429324-1001\Software\Microsoft\Internet Explorer\Main]|[Start Page] :
http://www.orange.fr/portail -
http://www.google.com/
Repaired : [HKU\S-1-5-21-3833397537-1658621944-3901429324-1001\Software\Microsoft\Internet Explorer\Main]|[Local Page] : C:\Windows\system32\blank.htm - C:\Windows\SysWOW64\blank.htm
Repaired : [HKU\S-1-5-21-3833397537-1658621944-3901429324-1001\Software\Microsoft\Internet Explorer\Main]|[Search Page] :
http://go.microsoft.com/fwlink/?LinkId=54896 -
http://www.microsoft.com/isapi/redir.dl ... r=iesearch
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Main]|[Start Page] :
http://acer.msn.com -
http://go.microsoft.com/fwlink/?LinkId=69157
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Main]|[Default_Page_URL] :
http://acer.msn.com -
http://go.microsoft.com/fwlink/?LinkId=69157
¤
Repaired : [HKU\S-1-5-21-3833397537-1658621944-3901429324-1001\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[WarnonZoneCrossing] : 0 - 1
¤¤¤¤¤¤¤¤¤¤ | Hosts
C:\Windows\System32\Drivers\etc\hosts : Cleaned
¤¤¤¤¤¤¤¤¤¤ | reparsepoint
FLTL_BYBunO