4 virus trouvés Au secour

Résolu
alvince -  
Bonjour,

Plus possible
- d'ouvrir C:\
- de voir fichiers cachés
- de lancer avast et spybot (win32 non valide)
- UC tourne en continue

j'ai lancé KASPERSKY ON-LINE SCANNER REPORT

4 virus trouvés
Trojan.Win32.Monderb.ackd
Backdoor.Win32.IRCBot.th
Trojan.Win32.Monder.ajla
Trojan-Downloader.Win32.Bagle.akq

c'est grave docteur

Au secours

Merci
Configuration: Windows XP
Internet Explorer 7.0

44 réponses

Résumé de la discussion

Des infections multiples ont été détectées sur un PC Windows XP après un passage avec Kaspersky Online Scanner, révélant des trojans et backdoors tels que Trojan.Win32.Monderb.ackd et Backdoor.Win32.IRCBot.th. Plusieurs outils et pistes ont été évoqués, notamment FindyKill et HijackThis, afin d'identifier processus suspects, fichiers infectés et entrées de registre compromises, ainsi que des services critiques potentiellement touchés. Des conseils ont été donnés pour déconnecter les sources de données externes, lancer FindyKill en mode suppression et attendre le message indiquant le nettoyage, puis publier le rapport FindyKill.txt. Le dernier rapport FindyKill montre la suppression des fichiers infectés et du contenu dans C:, Windows et le dossier Prefetch, marquant une progression et nécessitant un nouveau contrôle.

Bobot (l’IA à votre service)
  1. alvince Auteur
    nouveau rapport

    Thu Jan 08 13:26:04 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Acción Directa):

    Thu Jan 08 13:26:35 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Exploración):
    Explorando "C:\"

    Nº Total de Directorios: 8506
    Nº Total de Ficheros: 68580
    Nº de Ficheros Analizados: 14628
    Nº de Ficheros Infectados: 0
    Nº de Ficheros Limpiados: 0

    Thu Jan 08 13:35:10 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Acción Directa):

    Thu Jan 08 13:35:16 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Exploración):
    Explorando "C:\"

    Nº Total de Directorios: 8505
    Nº Total de Ficheros: 68580
    Nº de Ficheros Analizados: 14628
    Nº de Ficheros Infectados: 0
    Nº de Ficheros Limpiados: 0

    Thu Jan 08 13:41:14 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Exploración):
    Explorando "D:\"

    Nº Total de Directorios: 2506
    Nº Total de Ficheros: 72118
    Nº de Ficheros Analizados: 531
    Nº de Ficheros Infectados: 0
    Nº de Ficheros Limpiados: 0

    Thu Jan 08 13:42:25 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Exploración):
    Explorando "N:\"

    Nº Total de Directorios: 1048
    Nº Total de Ficheros: 26170
    Nº de Ficheros Analizados: 3
    Nº de Ficheros Infectados: 0
    Nº de Ficheros Limpiados: 0

    Thu Jan 08 13:42:59 2009
    EliBagle v12.07 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 30 de Diciembre del 2008)
    ----------------------------------------------
    Lista de Acciones (por Exploración):
    Explorando "C:\"

    Nº Total de Directorios: 8505
    Nº Total de Ficheros: 68580
    Nº de Ficheros Analizados: 14628
    Nº de Ficheros Infectados: 0
    Nº de Ficheros Limpiados: 0
    1
    1. geoffrey5 Contributeur sécurité
      Bonjour,

      Ton PC est infecté par Bagle, ce qui explique le disfonctionnement des logiciels de protection.

      Fais ceci stp :

      ▶ Telecharge FindyKill sur ton bureau :

      ▶ Lance l installation avec les parametres par default

      ▶ Double clic sur le raccourci FindyKill sur ton bureau

      ▶ Au menu principal,choisi l option 1 (Recherche)

      ▶ Post le rapport FindyKill.txt

      * Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
      0
      1. alvince Auteur
        merci

        Ci joint rapport demandé

        ----------------- FindyKill V4.711 ------------------

        * User : AlexVince
        * Emplacement : C:\Program Files\FindyKill
        * Outils Mis a jours le 05/01/09 par Chiquitine29
        * Recherche effectuée à 12:14:41 le 08/01/2009
        * Windows XP - Internet Explorer 7.0.5730.13

        ((((((((((((((((( *** Recherche *** ))))))))))))))))))

        --------------- [ Processus actifs ] ----------------

        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\SOUNDMAN.EXE
        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\Microsoft ActiveSync\wcescomm.exe
        C:\Program Files\DAEMON Tools Lite\daemon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\OrangeHSS\Launcher\Launcher.exe
        C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\winupgro.exe
        C:\PROGRA~1\MI3AA1~1\rapimgr.exe
        C:\Program Files\FinePixViewer\QuickDCF.exe
        C:\Program Files\WinZip\WZQKPICK.EXE
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\2\AlertModule.exe
        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
        C:\Program Files\OrangeHSS\systray\systrayapp.exe
        C:\Program Files\Skype\Plugin Manager\skypePM.exe
        C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
        C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
        C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\system32\PnkBstrA.exe
        C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
        C:\PROGRA~1\UpsPilot\Winpower.exe
        C:\Program Files\UpsPilot\jre\bin\javaw.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\system32\wbem\wmiprvse.exe
        C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\1\FTCOMModule.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Outlook Express\msimn.exe

        --------------- [ Processus infectieux stoppés ] ----------------

        "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\winupgro.exe" (584)

        --------------- [ Fichiers/Dossiers infectieux ] ----------------

        »»»» Presence des fichiers dans C:

        Found ! [11/11/2008 00:09] - C:\fsc.tmp

        »»»» Presence des fichiers dans C:\WINDOWS

        »»»» Presence des fichiers dans C:\WINDOWS\Prefetch

        Found ! - C:\WINDOWS\prefetch\15080890.EXE-0F59BBC4.pf
        Found ! - C:\WINDOWS\prefetch\15351968.EXE-31763EB6.pf
        Found ! - C:\WINDOWS\prefetch\15405796.EXE-0A7C8156.pf
        Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
        Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
        Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-101AF362.pf

        »»»» Presence des fichiers dans C:\WINDOWS\system32

        Found ! [08/01/2009 11:49] - C:\WINDOWS\system32\mdelk.exe
        Found ! [08/01/2009 11:49] - C:\WINDOWS\system32\wintems.exe
        Found ! [08/01/2009 11:50] - C:\WINDOWS\system32\ban_list.txt

        »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

        Found ! [12/06/2008 20:21] - "C:\WINDOWS\system32\drivers\downld"

        Found ! [08/01/2009 07:43] - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\flec006.exe"
        Found ! [08/01/2009 07:44] - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\list.oct"
        Found ! [08/01/2009 07:44] - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\data.oct"
        Found ! [08/01/2009 07:44] - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\srvlist.oct"
        Found ! [08/01/2009 07:45] - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared"
        Found ! [07/01/2009 23:12] - "C:\Documents and Settings\AlexVince&Paul\Application Data\m"
        Found ! [07/01/2009 21:48] - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers"
        Found ! [08/01/2009 07:41] - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\srosa.sys"
        Found ! [08/01/2009 07:41] - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\srosa2.sys"
        Found ! [22/09/2006 05:02] - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\winupgro.exe"
        Found ! [08/01/2009 11:59] - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\downld"

        »»»» Presence des fichiers dans C:\DOCUME~1\ALEXVI~1\LOCALS~1\Temp

        Found ! [08/01/2009 07:47] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\0ILXP3FV\b64_1[1].jpg
        Found ! [08/01/2009 11:55] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\0ILXP3FV\b64_5[1].jpg
        Found ! [08/01/2009 11:50] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\0ILXP3FV\file[1].txt
        Found ! [08/01/2009 07:43] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\59LADMJZ\b64[1].jpg
        Found ! [08/01/2009 11:49] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\59LADMJZ\b64_3[1].jpg
        Found ! [08/01/2009 07:43] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\829TMNFH\b64_1[1].jpg
        Found ! [08/01/2009 11:54] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\829TMNFH\b64_1[2].jpg
        Found ! [08/01/2009 07:44] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\829TMNFH\servernames[1].htm
        Found ! [08/01/2009 07:42] - C:\Documents and Settings\AlexVince&Paul\Local Settings\Temporary Internet Files\Content.IE5\X0CU9UTN\b64_3[1].jpg

        --------------- [ Registre / Startup ] ----------------

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
        CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
        SuperCopier2.exe=C:\Program Files\SuperCopier2\SuperCopier2.exe
        Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
        H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
        DAEMON Tools Lite="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
        swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
        FreeRAM XP="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
        AROReminder=C:\Program Files\Advanced Registry Optimizer\aro.exe -rem

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
        ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
        REGSHAVE=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
        SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
        TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        amd_dc_opt=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
        ORAHSSSessionManager=C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
        StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
        SoundMan=SOUNDMAN.EXE
        QuickTime Task="C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
        iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
        5cf86796=rundll32.exe "C:\WINDOWS\system32\tmkdyibl.dll",b
        HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
        <NO NAME>=
        HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
        Installed=1
        <NO NAME>=
        HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
        NoChange=1
        Installed=1
        <NO NAME>=
        HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
        Installed=1
        <NO NAME>=

        [HKEY_CURRENT_USER\software\local appwizard-generated applications\75675678894534654655324324234234324235635344353465465445345345643645645]
        [HKEY_CURRENT_USER\software\local appwizard-generated applications\install_patch]
        [HKEY_CURRENT_USER\software\local appwizard-generated applications\key_generator]
        [HKEY_CURRENT_USER\software\local appwizard-generated applications\run]
        [HKEY_CURRENT_USER\software\local appwizard-generated applications\SuperCopier2]
        [HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

        --------------- [ Registre / Clés infectieuses ] ----------------

        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\Local AppWizard-Generated Applications\install_patch
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\Local AppWizard-Generated Applications\key_generator
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\Local AppWizard-Generated Applications\winupgro
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\bisoft
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\DateTime4
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\FFC
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\FirtR
        Found ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\MuleAppData
        Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
        Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_generator
        Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
        Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
        Found ! - HKEY_CURRENT_USER\Software\bisoft
        Found ! - HKEY_CURRENT_USER\Software\DateTime4
        Found ! - HKEY_CURRENT_USER\Software\FirtR

        /!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
        /!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

        --------------- [ Etat / Services ] ----------------

        Clé manquante : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden

        /!\ Affichage des fichiers cachés non fonctionnel !!

        Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

        /!\ Mode sans echec non fonctionnel !!

        Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

        /!\ Mode sans echec non fonctionnel !!

        Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

        /!\ Mode sans echec non fonctionnel !!

        +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

        /!\ Ndisuio - Type de démarrage = 4

        EapHost - Type de démarrage = 3

        /!\ Ip6Fw - Type de démarrage = 4

        /!\ SharedAccess - Type de démarrage = 4

        /!\ wuauserv - Type de démarrage = 4

        /!\ wscsvc - Type de démarrage = 4

        --------------- [ Recherche dans supports amovibles] ----------------

        +- Informations :

        C: - Lecteur fixe

        D: - Lecteur fixe

        E: - Lecteur de CD-ROM

        +- Contenu de l'autorun : E:\autorun.inf

        [autorun]
        open = setup.exe
        icon = Livebox.ico

        +- presence des fichiers :

        Found ! [11/11/2008 00:09][d--------] - C:\fsc.tmp
        Found ! [30/01/2008 13:33][-r-------] - E:\autorun.inf

        --------------- [ Registre / Mountpoint2 ] ----------------

        -> Not found !

        ------------------- ! Fin du rapport ! --------------------
        0
    3. geoffrey5 Contributeur sécurité
      il ne doit pas changer d antivirus maintenant !!

      Son PC est infecté par Bagle... Ce qui fait que si il réinstalle un autre antivirus, il sera aussi infecté..

      Il faudra réinstaller un antivirus en fin de désinfection...

      Je m en occupe aymeric.moulin
      0
      2. geoffrey5 Contributeur sécurité
        Ok... Beaucoup d infections à ce que je vois.

        ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

        ▶ Double clic sur le raccourci FindyKill sur ton bureau

        ▶ Au menu principal,choisi l option 2 (Suppression)

        /!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage effectué"

        /!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal !

        ▶ ensuite post le rapport FindyKill.txt

        * Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
        * Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides
        0
        1. aymeric.moulin
          re
          di-moi geoffrey 5, j'ai fait quelques recherches sur ce fameux virus et j'y ai trouvé quelques outils de désinsfection comme celui-ci http://www.commentcamarche.net/faq/sujet 2731 virus kit de desinfection pour eradiquer w32 beagle mm bagle . Pourquoi pas essayer de désinsfecter avec ça?

          Aymeric
          0
          1. geoffrey5 Contributeur sécurité
            Il y a d'autres outils aussi bon que ceux là ;-)
            0
            1. alvince Auteur
              je ne peux plus poster
              0
          2. alvince Auteur
            voila le nouveau rapport

            ----------------- FindyKill V4.711 ------------------

            * User : AlexVince
            * executed from : C:\Program Files\FindyKill
            * Update on 05/01/09 par Chiquitine29
            * Start at 12:32:01 the 08/01/2009
            * Windows XP - Internet Explorer 7.0.5730.13

            ((((((((((((((( *** deleting *** ))))))))))))))))))

            --------------- [ Active Processes ] ----------------

            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\csrss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\logonui.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\WINDOWS\system32\userinit.exe
            C:\WINDOWS\system32\WgaTray.exe

            --------------- [ Infected files / folders ] ----------------

            »»»» Supression files in C:

            Deleted ! - C:\fsc.tmp

            »»»» Supression files in C:\WINDOWS

            »»»» Supression files in C:\WINDOWS\Prefetch

            Deleted ! - C:\WINDOWS\prefetch\15080890.EXE-0F59BBC4.pf
            Deleted ! - C:\WINDOWS\prefetch\15351968.EXE-31763EB6.pf
            Deleted ! - C:\WINDOWS\prefetch\15405796.EXE-0A7C8156.pf
            Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
            Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
            Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-101AF362.pf

            »»»» Supression files in C:\WINDOWS\system32

            Deleted ! - C:\WINDOWS\system32\mdelk.exe
            Deleted ! - C:\WINDOWS\system32\wintems.exe
            Deleted ! - C:\WINDOWS\system32\ban_list.txt

            »»»» Supression files in C:\WINDOWS\system32\drivers

            Deleted ! - "C:\WINDOWS\system32\drivers\downld"

            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\flec006.exe"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\list.oct"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\data.oct"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\srvlist.oct"
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\(CRACKED).Mcafee.Virus.Scan.Pro.8.02.2004.by.blizzardtwice.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\100 Bikini Babes Screen Saver 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\1015 saturday 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\1st Audio Splitter Extractor 1.25.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\3D Stairway to Turkey Heaven 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\3DS Import for SolidWorks 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\A White Christmas 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Abander MP3 Image Extractor 1.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Active Bulletin Screen Saver 1.10.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\AdManager 1.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Agree Free Rip DVD to 3GP iPod Zune iPhone MP4 Ripper 4.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Aloaha Fairy 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Area61 VideoBrowser 5.0.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Astronomy Picture of the Day Opera Widget 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\AudioJPEG Studio 1.0.1.24.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Automation ActiveX Components 1.000.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\avast__Professional_Edition_4.7.892.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\AVG_AntiVirus_Professional_v7.1.371a669_Multilanguage.+.keygen.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\AVS Audio Tools 4.4.1.227.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Backup Utility 1.0.0.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Bell & Ross BR 01-92 Yellow 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Bill Serial Port Monitor 3.0T.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Brisbane Traffic Cams 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Brown Bear Screensaver 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Cartes du Ciel 2.76.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Copenhagen Traffic Cams 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\CrystalDiffract 1.0.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Dariolius Column Splitter 2.7.506.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Deep Space 3D Screensaver 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Depleted Uranium The Killer that Keeps on Killing 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Desktop Sales Manager 6.7.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Digital Dream Studio 2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Digital Secure Disk 1.5.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Disk Throughput Tester 1.2.9.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\DivX Web Player 1.4.2 Beta 2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Dropcloth 0.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\DVD to AVI AC3 Ripper 1.0.0.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\EA.Mobile.Tiger.Woods.07.352x416.v4.3.90.S60v3.J2ME.Retail-BiNPDA.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Easy Collection 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Easy HR Date Calculator 1.09.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Easy-Pro Midi to Audio Converter 1.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\easyStockDater 1.5.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\ECOMAC 0.100.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\EiffelStudio 6.1.7.1477.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Elektronika Live 2.12.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Excel Save Xlt As Xls Software 7.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\EZScan 1.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Firefox PasswordMaker 1.5.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Flash DVD Ripper 0.92.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\FoxTab 1.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Fresnel Reflection Plugin 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Goldbach 3.1c.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Great Artist Renoir 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Guyana Screen Saver 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Halloween Clock screensaver 2.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Hide Window 1.40.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Honda CB Screensaver 1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\HTML CaseChanger 1.0.23.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Internet Access Scheduler 2.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Jans Act 10.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Joboshare DVD to Zune Converter 2.3.9.1129.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\JR Screen Ruler 1.5.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\JRelaxTimer 1.0.001.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\JWC CD Player 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Kernel Undelete 4.02.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\KingConvert For Epson P-3000 4.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Lite Edit 2.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\liteRecorder 1.7.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Locator Map of the New York City Districts 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\MCAFEE.SPAMKILLER.6.0.Fr.Crack.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Microsoft Application Request Routing for IIS 7 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Miraplacid Text Driver Terminal Edition 5.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Morovia PDF417 Barcode Fontware 3.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Mozilla Addons toolbar for Firefox 1.0.1.30.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\MPEG4 Bitrate Calculator 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\New Zealand UV Index 1.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Norton.AntiVirus.2007.14.0.0.1+crack-multilenguaje-byzven.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Note Taker 2.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\NT340 1.0 Build 3188.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\O&O DiskStat Professional Edition 1.0.2687.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\OpenEditor 0.98 Beta Build 3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\PetLinx 2.5.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Pick n' Text 2002.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Picture Resizer Pro 2007 2.6.6.5.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Power Equipment 1.03.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Prevx1.Pc.Security.Crack.Updated-Fixed.07-2006.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Public WEB PST for Outlook 1.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\PuTTY Tray 0.60 r2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\R-Type v1.0 (Elite Systems) Multi-5 240x320 Nokia n73 n95 Byjj.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Reasonable Antiphishing 2.1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Regular Expression Checker 1.32.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Regular Expression Component Library for VC6 3.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Reminders 1.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\RSS Writer 1.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\rss2mail 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Saga CD Ripper 1.04.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Seafood2 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Shaggy Bears Screensaver 2.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\SHARM 2.6.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Shell Extension Pack 4.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Site Sentry 2000 1.4.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\SmartInspect Professional 3.1.0.8000.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Snow Country Demo Screensaver 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Sony ACID Pro 7.0a Build 536.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Sony PSP Video Converter 6.0.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\SoundClick Bot.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Source Code Organizer 1.o6.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\StillMotion PE 2 2.0 Build 3908.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\SuperPro Software 5.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Symantec_Mobile_Security_4.0.41_Aggiornamento.10_08_06_ByAngelo_.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Ted 2.52.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\TExcelDSNCreator 1.002.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\ThrottleWatch 2.02.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Toadnode 3.1.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Tomtom Gps Crack Let All Gps Recievers Work For Tomtom Mobile.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Tracker Leader Enterprise 2.1.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Tray Launcher v1.51.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Universal Msn Polygamy 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Universal Plug-and-Play Tester 2.08 Build 53.5.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Usagecircle 2 Cores Gadget 0.5.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\VeryPDF Mini EMF Printer 2.01.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\VisioForge Video Edit ActiveX Version 3.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Voice Call 4.2.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Windows Std Serial Comm Lib for Xbase++ 4.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\Wolves Screen Savers 6 1.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\X-Copy Media Center 3.0.0.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\XCPlan 1.3.zip
            Deleted ! - C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared\XMouse360 0.2 Beta.zip
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\m\shared"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\m"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\srosa.sys"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\srosa2.sys"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\winupgro.exe"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\downld"
            Deleted ! - "C:\Documents and Settings\AlexVince&Paul\Application Data\drivers"

            »»»» Supression files in C:\DOCUME~1\ALEXVI~1\LOCALS~1\Temp

            --------------- [ Registry / Infected keys ] ----------------

            Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
            Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
            Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
            Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
            Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
            Deleted ! - HKEY_CURRENT_USER\Software\bisoft
            Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
            Deleted ! - HKEY_CURRENT_USER\Software\FirtR
            Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdelk.exe
            Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintems.exe
            Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\flec006.exe
            Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hldrrr.exe
            Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winfilse.exe
            Deleted ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupgro.exe
            Deleted ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\Local AppWizard-Generated Applications\install_patch
            Deleted ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\Local AppWizard-Generated Applications\key_generator
            Deleted ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\Local AppWizard-Generated Applications\winupgro
            Deleted ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\FFC
            Deleted ! - HKEY_USERS\S-1-5-21-1409082233-1547161642-725345543-1003\Software\MuleAppData

            --------------- [ States / Restarting of services ] ----------------

            +- Safe boot mode restored !

            +- Showing of hidden files has been repaired !

            +- Services : [ Auto=2 / Request=3 / Disable=4 ]

            Ndisuio - Type of startup = 3

            EapHost - Type of startup = 2

            Ip6Fw - Type of startup = 2

            SharedAccess - Type of startup = 2

            wuauserv - Type of startup = 2

            wscsvc - Type of startup = 2

            --------------- [ Cleaning removable drives ] ----------------

            +- Informations :

            C: - Lecteur fixe

            D: - Lecteur fixe

            E: - Lecteur de CD-ROM

            N: - Lecteur fixe

            +- deleting files :

            Not deleted !! - E:\autorun.inf

            --------------- [ Registry / Mountpoint2 ] ----------------

            -> Not found !

            --------------- [ Searching Other Infections ] ----------------

            Références de comparaison Bagle MD5 :

            113ac36b77630a2f67dd6cb7844406a4 C:\WINDOWS\system32\mdelk.exe
            113ac36b77630a2f67dd6cb7844406a4 C:\WINDOWS\system32\wintems.exe
            d532a42b8f3f3787529bfe86d6cf5f02 C:\Documents and Settings\AlexVince&Paul\Application Data\drivers\winupgro.exe

            Suspect ! - d532a42b8f3f3787529bfe86d6cf5f02 C:\Program Files\SuperCopier2\SuperCopier2.exe

            --------------- [ Searching Cracks / Keygen ] ----------------

            ---------------- ! End of report ! ------------------
            0
            1. geoffrey5 Contributeur sécurité
              Oui je sais il y a un problème pour le moment, les messages avec des rapports ne s affichent plus, tu n es pas le seul dans ce cas là ;-)
              0
              1. alvince Auteur
                rapport posté avant ta dernière réponse

                voir au dessus
                0
                1. geoffrey5 Contributeur sécurité
                  très bien... Maintenant fais ceci stp :

                  ▶ Rends toi sur ce site :
                  http://www.zonavirus.com/datos/descargas/95/elibagla.asp
                  ▶ tout en bas de cette page tu trouveras un outil
                  à télécharger,clique sur "escargar Elibagla" (le numéro de version change au fur et à mesure des mises à jour)
                  ▶ installe ce fichier sur le Bureau.
                  ▶ ensuite double-clic sur Elibagla.exe
                  ▶ laisse la case "eliminar ficheros automaticamente" coché
                  ▶ clique sur"explorar"
                  ▶ laisse-le travailler

                  ▶ Redémarre en mode sans échec,

                  *Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
                  Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
                  Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
                  (Si F8 ne marche pas utilise la touche F5).

                  ▶ relance 2 fois elibagla

                  ▶ redémarre en mode normal

                  ▶ poste le rapport final qui sera dans c:\infosat.txt
                  0
                  1. alvince Auteur
                    Ci dessus dernier rapport

                    Merci
                    0
                2. geoffrey5 Contributeur sécurité
                  ok maintenant :

                  ▶ Telecharge UsbFix sur ton bureau

                  ▶ Lance l installation avec les parametres par default

                  ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

                  ▶ Double clic sur le raccourci UsbFix sur ton bureau

                  ▶ Le pc va redémarer

                  ▶ Clique sur l'option 1 Nettoyage

                  ▶ Apres redémarrage post le rapport UsbFix.txt

                  * Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

                  * Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" ,
                  "Nouvelle tâche" , tapes explorer.exe et valides
                  0
                  2. alvince Auteur
                    De retour

                    rapport demandé => merci

                    -------------- UsbFix V2.413.9 ---------------

                    * User : AlexVince
                    * Outils mis a jours le 05/01/2009 par Chiquitine29 et Chimay8
                    * Recherche effectuée à 20:52:42 le 08/01/2009
                    * Windows Xp - Internet Explorer 7.0.5730.13

                    --------------- [ Processus actifs ] ----------------

                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\csrss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\logonui.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\system32\userinit.exe
                    C:\WINDOWS\system32\WgaTray.exe
                    C:\WINDOWS\Explorer.EXE

                    --------------- [ Informations lecteurs ] ----------------

                    C: - Lecteur fixe

                    D: - Lecteur fixe

                    E: - Lecteur de CD-ROM

                    N: - Lecteur fixe

                    +- Contenu de l'autorun : E:\autorun.inf

                    [autorun]
                    open = setup.exe
                    icon = Livebox.ico

                    --------------- [ Lecteur C ] ----------------

                    C: - Lecteur fixe

                    +- Listing des fichiers présents :

                    [15/11/2007 01:13][--a------] C:\AUTOEXEC.BAT
                    [15/11/2007 01:13][--a------] C:\muxmp4.bat
                    [05/08/2004 15:00][-rahs----] C:\NTDETECT.COM
                    [15/01/2008 11:19][--a------] C:\md5.exe
                    [23/11/2008 23:40][-r-hs----] C:\boot.ini
                    [08/01/2009 12:40][--a------] C:\FindyKill.txt
                    [08/01/2009 12:40][--a------] C:\InfoSat.txt
                    [08/01/2009 12:40][--a------] C:\mkv.txt
                    [08/01/2009 12:40][--a------] C:\mpeg.txt
                    [08/01/2009 12:40][--a------] C:\rfc1321.txt
                    [08/01/2009 12:40][--a------] C:\UsbFix.txt
                    [15/11/2007 01:13][--a------] C:\CONFIG.SYS
                    [15/11/2007 01:13][--a------] C:\IO.SYS
                    [15/11/2007 01:13][--a------] C:\MSDOS.SYS
                    [15/11/2007 01:13][--a------] C:\pagefile.sys

                    --------------- [ Lecteur D ] ----------------

                    D: - Lecteur fixe

                    +- Listing des fichiers présents :

                    --------------- [ Lecteur E ] ----------------

                    E: - Lecteur de CD-ROM

                    +- Listing des fichiers présents :

                    [23/01/2008 21:25][-r-------] E:\livebox.exe
                    [23/01/2008 21:25][-r-------] E:\Setup.exe
                    [30/01/2008 13:33][-r-------] E:\setup.ini
                    [30/01/2008 13:33][-r-------] E:\Autorun.inf

                    --------------- [ Lecteur N ] ----------------

                    N: - Lecteur fixe

                    +- Listing des fichiers présents :

                    --------------- [ Registre / Startup ] ----------------

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

                    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                    "Search Page"="https://www.google.com/?gws_rd=ssl"
                    "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
                    CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
                    SuperCopier2.exe=C:\Program Files\SuperCopier2\SuperCopier2.exe
                    Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                    H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                    DAEMON Tools Lite="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                    swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
                    FreeRAM XP="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
                    AROReminder=C:\Program Files\Advanced Registry Optimizer\aro.exe -rem

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
                    ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                    REGSHAVE=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
                    SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                    TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                    avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    amd_dc_opt=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
                    ORAHSSSessionManager=C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
                    StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
                    SoundMan=SOUNDMAN.EXE
                    QuickTime Task="C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
                    iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
                    5cf86796=rundll32.exe "C:\WINDOWS\system32\tmkdyibl.dll",b
                    KernelFaultCheck=%systemroot%\system32\dumprep 0 -k
                    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
                    <NO NAME>=
                    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
                    Installed=1
                    <NO NAME>=
                    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
                    NoChange=1
                    Installed=1
                    <NO NAME>=
                    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
                    Installed=1
                    <NO NAME>=

                    --------------- [ Registre / Mountpoint2 ] ----------------

                    Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2ffe6816-9305-11dc-b304-806d6172696f}\Shell\AutoRun\command

                    --------------- [ Nettoyage des disques ] ----------------

                    Echec de la supression !! - [30/01/2008 13:33] E:\autorun.inf
                    Echec de la supression !! - [31/05/2007 14:02] E:\Setup.exe
                    Echec de la supression !! - [30/01/2008 13:33] E:\autorun.inf
                    Echec de la supression !! - [30/01/2008 13:33] E:\autorun.inf
                    Supprimé ! - [23/11/2008 17:13][--ahs----] N:\THUMBS.DB

                    --------------- [ Resumé ] ----------------

                    -> /!\ Le resultat doit etre interprété par un spécialiste /!\

                    [15/11/2007 01:13][--a------] C:\AUTOEXEC.BAT
                    [15/11/2007 01:13][--a------] C:\muxmp4.bat
                    [05/08/2004 15:00][-rahs----] C:\NTDETECT.COM
                    [15/01/2008 11:19][--a------] C:\md5.exe
                    [23/11/2008 23:40][-r-hs----] C:\boot.ini
                    [23/01/2008 21:25][-r-------] E:\livebox.exe
                    [23/01/2008 21:25][-r-------] E:\Setup.exe
                    [30/01/2008 13:33][-r-------] E:\setup.ini
                    [30/01/2008 13:33][-r-------] E:\Autorun.inf

                    --------------- [ Vaccination ] ----------------

                    C:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
                    D:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
                    Echec de la supression !! - [30/01/2008 13:33] E:\autorun.inf
                    Echec de la supression !! - [30/01/2008 13:33] E:\autorun.inf
                    N:\autorun.inf -> Dossier autorun.inf crée par UsbFix !

                    --------------- ! Fin du rapport ! ----------------
                    0
                    3. geoffrey5 Contributeur sécurité
                      Re,

                      ▶ Télécharge hijackthis

                      ▶ Tout est expliqué sur mon site web pour l'installer et l'utiliser correctement.

                      ▶ Poste le rapport obtenu dans le bloc note dans ta prochaine réponse.

                      Comment copier/coller le rapport :

                      ▶ Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".

                      ▶ ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport.
                      0
                      1. alvince Auteur
                        C:\ non accessible pour renommer

                        Plante ou m'éjecte
                        0
                        1. alvince Auteur
                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 23:40:41, on 08/01/2009
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16762)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                          C:\WINDOWS\SOUNDMAN.EXE
                          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                          C:\Program Files\iTunes\iTunesHelper.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Skype\Phone\Skype.exe
                          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                          C:\Program Files\DAEMON Tools Lite\daemon.exe
                          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\Program Files\OrangeHSS\Launcher\Launcher.exe
                          C:\Program Files\FinePixViewer\QuickDCF.exe
                          C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                          C:\Program Files\WinZip\WZQKPICK.EXE
                          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\2\AlertModule.exe
                          C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                          C:\WINDOWS\system32\PnkBstrA.exe
                          C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\PROGRA~1\UpsPilot\Winpower.exe
                          C:\Program Files\UpsPilot\jre\bin\javaw.exe
                          C:\Program Files\OrangeHSS\systray\systrayapp.exe
                          C:\Program Files\iPod\bin\iPodService.exe
                          C:\Program Files\Skype\Plugin Manager\skypePM.exe
                          C:\WINDOWS\system32\wscntfy.exe
                          C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
                          C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
                          C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
                          C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
                          C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\1\FTCOMModule.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          C:\WINDOWS\system32\imapi.exe
                          C:\WINDOWS\explorer.exe
                          C:\WINDOWS\system32\rundll32.exe
                          C:\Program Files\Trend Micro\HijackThis\Htj.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
                          O2 - BHO: (no name) - {00D29711-A271-4D99-8FAC-286D45C5E961} - C:\WINDOWS\system32\yayXRHwV.dll
                          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                          O2 - BHO: {94d37406-b235-3c0a-fdf4-07332d28df04} - {40fd82d2-3370-4fdf-a0c3-532b60473d49} - C:\WINDOWS\system32\cedoqb.dll
                          O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\ddcYoNef.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
                          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                          O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                          O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                          O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
                          O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
                          O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
                          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
                          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                          O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                          O4 - HKLM\..\Run: [5cf86796] rundll32.exe "C:\WINDOWS\system32\bopvtjcp.dll",b
                          O4 - HKLM\..\RunServices: [Winpower] C:\Program Files\UpsPilot\Winpower.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
                          O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                          O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
                          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                          O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
                          O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O4 - Global Startup: Exif Launcher.lnk = ?
                          O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                          O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                          O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                          O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                          O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
                          O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
                          O15 - Trusted Zone: http://*.mappy.com
                          O15 - Trusted Zone: http://*.orange.fr
                          O15 - Trusted Zone: http://rw.search.ke.voila.fr
                          O15 - Trusted Zone: http://orange.weborama.fr
                          O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
                          O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                          O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe
                          O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                          O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                          O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
                          O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://webmail.gbh.fr/dwa7W.cab
                          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                          O20 - AppInit_DLLs: cedoqb.dll
                          O20 - Winlogon Notify: ddcYoNef - C:\WINDOWS\SYSTEM32\ddcYoNef.dll
                          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                          O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                          O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
                          O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                          O23 - Service: Winpower - ZeroG Software - C:\PROGRA~1\UpsPilot\Winpower.exe
                          O23 - Service: Winpowermanager - ZeroG Software - C:\PROGRA~1\UpsPilot\manager.exe
                          O23 - Service: Winpowermonitor - ZeroG Software - C:\PROGRA~1\UpsPilot\monitor.exe
                          O23 - Service: WinpowerRMI - ZeroG Software - C:\PROGRA~1\UpsPilot\wpRMI.exe
                          0
                          • 1
                          • 2
                          • 3

                          Discussions similaires

                          Numéro incomplet et suspect selon moi (+33 1 06 4)
                          Llo222

                          5 réponses
                          Softonic,est-ce un virus ?
                          techmel1

                          6 réponses
                          Chrome://newtab
                          Nova

                          14 réponses
                          Désinstaller Softonic
                          Diguimette

                          5 réponses
                          4GO équivaut à combien en GB ?
                          xolena

                          4 réponses