Anti virus avast
Résolu/Fermé
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
-
19 janv. 2009 à 17:53
sandra5901 Messages postés 91 Date d'inscription jeudi 20 novembre 2008 Statut Membre Dernière intervention 22 janvier 2009 - 22 janv. 2009 à 18:45
sandra5901 Messages postés 91 Date d'inscription jeudi 20 novembre 2008 Statut Membre Dernière intervention 22 janvier 2009 - 22 janv. 2009 à 18:45
A voir également:
- Anti virus avast
- Anti slash ✓ - Forum Clavier
- Avast clear - Télécharger - Antivirus & Antimalwares
- Antislash sur AZERTY ✓ - Forum Clavier
- L'ordinateur de mustapha a été infecté par un virus répertorié récemment. son anti-virus ne l'a pas détecté. qu'a-t-il pu se passer ? - Forum Virus
- Youtu.be virus - Accueil - Guide virus
101 réponses
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
20 janv. 2009 à 16:14
20 janv. 2009 à 16:14
ya plus personne pour m'aider svp!!
fullscreen
Messages postés
934
Date d'inscription
vendredi 11 mai 2007
Statut
Membre
Dernière intervention
8 novembre 2012
79
20 janv. 2009 à 16:17
20 janv. 2009 à 16:17
essaies de faire :
démarrer - éxécuter , tapes msconfig
cliques sur ok
coches le mode de démarrage diagnostique
redémarres l'ordi
essaies de désinstaller les antivirus
démarrer - éxécuter , tapes msconfig
cliques sur ok
coches le mode de démarrage diagnostique
redémarres l'ordi
essaies de désinstaller les antivirus
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
20 janv. 2009 à 18:43
20 janv. 2009 à 18:43
bon de toute les solutions il y en na aucune qui fonctionne comment sa se fait??? ya pas un moyen en ligne de nettoyer et de supprimer les fichier superflu??
Utilisateur anonyme
20 janv. 2009 à 18:46
20 janv. 2009 à 18:46
Re,
@Sandra,
Télécharge toolscleaner sur ton Bureau :
toolscleaner
* Double-clique sur ToolsCleaner2.exe et laisse le travailler
* Clique sur Recherche et laisse le scan se terminer.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter, pour que le rapport puisse se créer.
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FindyKill de Chiquitine29
▶ Fais un clique droit sur le lien et choisis ( "enregistrer la cible sous ...." )( , destination le bureau .
▶ ( Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .
▶ Laisse toi guider pour l'installer.
▶ Double clic sur " FindyKill." pour lancer l'outil .
▶ Choisis La langue:F pour français
▶ Choisis l'option 1 . Puis laisses travailler ...
▶ Une fois terminé, postes le rapport FindyKill.txt qui est généré ...
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
Les-risques-securitaires-du-peer-to-peer
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
@Sandra,
Télécharge toolscleaner sur ton Bureau :
toolscleaner
* Double-clique sur ToolsCleaner2.exe et laisse le travailler
* Clique sur Recherche et laisse le scan se terminer.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter, pour que le rapport puisse se créer.
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FindyKill de Chiquitine29
▶ Fais un clique droit sur le lien et choisis ( "enregistrer la cible sous ...." )( , destination le bureau .
▶ ( Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .
▶ Laisse toi guider pour l'installer.
▶ Double clic sur " FindyKill." pour lancer l'outil .
▶ Choisis La langue:F pour français
▶ Choisis l'option 1 . Puis laisses travailler ...
▶ Une fois terminé, postes le rapport FindyKill.txt qui est généré ...
( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )
Les-risques-securitaires-du-peer-to-peer
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
VOILA LE RAPPORT FINDYKILL :
###################### [ FindyKill V4.714 ]
# User : dider - SY4PUND51D
# Emplacement : C:\Program Files\FindyKill
# Outils Mis a jours le 19/01/09 par Chiquitine29
# Recherche effectuée à 19:07:12 le 2009-01-20
# Windows XP - Internet Explorer 7.0.5730.11
# [ FindyKill V4.714 - Scan ] ##############
\\\\\\\\\\\\\\\\\\\\ [ Processus actifs ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\dider\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Documents and Settings\dider\Application Data\drivers\winupgro.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\dider\Application Data\m\flec006.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
\\\\\\\\\\\\\\\\\\ [ Processus infectieux stoppés ] ///////////////////
"C:\Documents and Settings\dider\Application Data\drivers\winupgro.exe" (1896)
"C:\WINDOWS\system32\wintems.exe" (3568)
"C:\Documents and Settings\dider\Application Data\m\flec006.exe" (200)
\\\\\\\\\\\\\\\\\\ [ Fichiers/Dossiers infectieux ] ///////////////////
################## [ C:\ ]
Found ! [2009-01-19 16:07] - "C:\Avenger"
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Found ! - C:\WINDOWS\prefetch\103187.EXE-1CDD0A12.pf
Found ! - C:\WINDOWS\prefetch\159156.EXE-1FE84EE2.pf
Found ! - C:\WINDOWS\prefetch\161296.EXE-0BDD70E7.pf
Found ! - C:\WINDOWS\prefetch\201515.EXE-1EC7B83D.pf
Found ! - C:\WINDOWS\prefetch\224000.EXE-1FE61503.pf
Found ! - C:\WINDOWS\prefetch\244828.EXE-329D0826.pf
Found ! - C:\WINDOWS\prefetch\262359.EXE-27B39697.pf
Found ! - C:\WINDOWS\prefetch\283546.EXE-3A0DCE47.pf
Found ! - C:\WINDOWS\prefetch\73562.EXE-10620AEE.pf
Found ! - C:\WINDOWS\prefetch\94109.EXE-22BA53ED.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-00C8A688.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
################## [ C:\WINDOWS\system32 ]
Found ! [2009-01-20 18:32] - C:\WINDOWS\system32\mdelk.exe
Found ! [2009-01-20 18:32] - C:\WINDOWS\system32\wintems.exe
Found ! [2009-01-20 18:33] - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ C:\Documents and Settings\dider\Application Data ]
Found ! [2009-01-20 18:35] - "C:\Documents and Settings\dider\Application Data\m\flec006.exe"
Found ! [2009-01-20 18:36] - "C:\Documents and Settings\dider\Application Data\m\list.oct"
Found ! [2009-01-20 18:36] - "C:\Documents and Settings\dider\Application Data\m\data.oct"
Found ! [2009-01-20 18:36] - "C:\Documents and Settings\dider\Application Data\m\srvlist.oct"
Found ! [2009-01-20 18:37] - "C:\Documents and Settings\dider\Application Data\m\shared"
Found ! [2009-01-19 16:11] - "C:\Documents and Settings\dider\Application Data\m"
Found ! [2008-12-20 18:40] - "C:\Documents and Settings\dider\Application Data\drivers"
Found ! [2009-01-20 18:32] - "C:\Documents and Settings\dider\Application Data\drivers\srosa.sys"
Found ! [2009-01-20 18:32] - "C:\Documents and Settings\dider\Application Data\drivers\srosa2.sys"
Found ! [2005-05-02 05:10] - "C:\Documents and Settings\dider\Application Data\drivers\winupgro.exe"
Found ! [2009-01-20 18:38] - "C:\Documents and Settings\dider\Application Data\drivers\downld"
################## [ C:\DOCUME~1\dider\LOCALS~1\Temp ]
\\\\\\\\\\\\\\\\\\ [ Registre / Startup ] ///////////////////
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe
swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
msnmsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
SoftwareHelper=C:\Documents and Settings\dider\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
VTTimer=VTTimer.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
SCANINICIO="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
PinnacleDriverCheck=C:\WINDOWS\system32\PSDrvCheck.exe
HP Software Update="C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
HP Component Manager="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Google Desktop Search="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
EoEngine="C:\Program Files\EoRezo\EoEngine.exe"
DXDllRegExe=dxdllreg.exe
CamserviceDeluxe2=C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe /startup
AudioDeck=C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
APVXDWIN="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
AGRSMMSG=AGRSMMSG.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
[HKEY_CURRENT_USER\software\local appwizard-generated applications\DestComp]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\DocUnins]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\hprbui]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\run]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
\\\\\\\\\\\\\\\\\\ [ Registre / Clés infectieuses ] ///////////////////
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | drvsyskit
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | german.exe
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | mule_st_key
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
\\\\\\\\\\\\\\\\\\ [ Etat / Services ] ///////////////////
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
/!\ Mode sans echec non fonctionnel !!
# Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - # Type de démarrage = 4
EapHost - # Type de démarrage = 3
/!\ Ip6Fw - # Type de démarrage = 4
/!\ SharedAccess - # Type de démarrage = 4
/!\ wuauserv - # Type de démarrage = 4
/!\ wscsvc - # Type de démarrage = 4
\\\\\\\\\\\\\\\\\\ [ Recherche dans supports amovibles] ///////////////////
# Informations :
C: - Lecteur fixe
# presence des fichiers :
\\\\\\\\\\\\\\\\\\ [ Registre / Mountpoint2 ] ///////////////////
-> Not found !
################## [ ! Fin du rapport # FindyKill V4.714 ! ]
###################### [ FindyKill V4.714 ]
# User : dider - SY4PUND51D
# Emplacement : C:\Program Files\FindyKill
# Outils Mis a jours le 19/01/09 par Chiquitine29
# Recherche effectuée à 19:07:12 le 2009-01-20
# Windows XP - Internet Explorer 7.0.5730.11
# [ FindyKill V4.714 - Scan ] ##############
\\\\\\\\\\\\\\\\\\\\ [ Processus actifs ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\dider\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\EoRezo\EoEngine.exe
C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Documents and Settings\dider\Application Data\drivers\winupgro.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\wintems.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\dider\Application Data\m\flec006.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
\\\\\\\\\\\\\\\\\\ [ Processus infectieux stoppés ] ///////////////////
"C:\Documents and Settings\dider\Application Data\drivers\winupgro.exe" (1896)
"C:\WINDOWS\system32\wintems.exe" (3568)
"C:\Documents and Settings\dider\Application Data\m\flec006.exe" (200)
\\\\\\\\\\\\\\\\\\ [ Fichiers/Dossiers infectieux ] ///////////////////
################## [ C:\ ]
Found ! [2009-01-19 16:07] - "C:\Avenger"
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Found ! - C:\WINDOWS\prefetch\103187.EXE-1CDD0A12.pf
Found ! - C:\WINDOWS\prefetch\159156.EXE-1FE84EE2.pf
Found ! - C:\WINDOWS\prefetch\161296.EXE-0BDD70E7.pf
Found ! - C:\WINDOWS\prefetch\201515.EXE-1EC7B83D.pf
Found ! - C:\WINDOWS\prefetch\224000.EXE-1FE61503.pf
Found ! - C:\WINDOWS\prefetch\244828.EXE-329D0826.pf
Found ! - C:\WINDOWS\prefetch\262359.EXE-27B39697.pf
Found ! - C:\WINDOWS\prefetch\283546.EXE-3A0DCE47.pf
Found ! - C:\WINDOWS\prefetch\73562.EXE-10620AEE.pf
Found ! - C:\WINDOWS\prefetch\94109.EXE-22BA53ED.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-00C8A688.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
################## [ C:\WINDOWS\system32 ]
Found ! [2009-01-20 18:32] - C:\WINDOWS\system32\mdelk.exe
Found ! [2009-01-20 18:32] - C:\WINDOWS\system32\wintems.exe
Found ! [2009-01-20 18:33] - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ C:\Documents and Settings\dider\Application Data ]
Found ! [2009-01-20 18:35] - "C:\Documents and Settings\dider\Application Data\m\flec006.exe"
Found ! [2009-01-20 18:36] - "C:\Documents and Settings\dider\Application Data\m\list.oct"
Found ! [2009-01-20 18:36] - "C:\Documents and Settings\dider\Application Data\m\data.oct"
Found ! [2009-01-20 18:36] - "C:\Documents and Settings\dider\Application Data\m\srvlist.oct"
Found ! [2009-01-20 18:37] - "C:\Documents and Settings\dider\Application Data\m\shared"
Found ! [2009-01-19 16:11] - "C:\Documents and Settings\dider\Application Data\m"
Found ! [2008-12-20 18:40] - "C:\Documents and Settings\dider\Application Data\drivers"
Found ! [2009-01-20 18:32] - "C:\Documents and Settings\dider\Application Data\drivers\srosa.sys"
Found ! [2009-01-20 18:32] - "C:\Documents and Settings\dider\Application Data\drivers\srosa2.sys"
Found ! [2005-05-02 05:10] - "C:\Documents and Settings\dider\Application Data\drivers\winupgro.exe"
Found ! [2009-01-20 18:38] - "C:\Documents and Settings\dider\Application Data\drivers\downld"
################## [ C:\DOCUME~1\dider\LOCALS~1\Temp ]
\\\\\\\\\\\\\\\\\\ [ Registre / Startup ] ///////////////////
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
WMPNSCFG=C:\Program Files\Windows Media Player\WMPNSCFG.exe
swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
msnmsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
SoftwareHelper=C:\Documents and Settings\dider\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
VTTimer=VTTimer.exe
SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
SCANINICIO="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
PinnacleDriverCheck=C:\WINDOWS\system32\PSDrvCheck.exe
HP Software Update="C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
HP Component Manager="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Google Desktop Search="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
EoEngine="C:\Program Files\EoRezo\EoEngine.exe"
DXDllRegExe=dxdllreg.exe
CamserviceDeluxe2=C:\Program Files\Hercules\Deluxe Optical Glass\Camservice.exe /startup
AudioDeck=C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
APVXDWIN="C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
AGRSMMSG=AGRSMMSG.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
[HKEY_CURRENT_USER\software\local appwizard-generated applications\DestComp]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\DocUnins]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\hprbui]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\MsnMsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\run]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
\\\\\\\\\\\\\\\\\\ [ Registre / Clés infectieuses ] ///////////////////
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\MsnMsgr
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | drvsyskit
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | german.exe
Found ! - [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] | mule_st_key
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
\\\\\\\\\\\\\\\\\\ [ Etat / Services ] ///////////////////
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
/!\ Mode sans echec non fonctionnel !!
# Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
/!\ Mode sans echec non fonctionnel !!
# Services : [ Auto=2 / Demande=3 / Désactivé=4 ]
/!\ Ndisuio - # Type de démarrage = 4
EapHost - # Type de démarrage = 3
/!\ Ip6Fw - # Type de démarrage = 4
/!\ SharedAccess - # Type de démarrage = 4
/!\ wuauserv - # Type de démarrage = 4
/!\ wscsvc - # Type de démarrage = 4
\\\\\\\\\\\\\\\\\\ [ Recherche dans supports amovibles] ///////////////////
# Informations :
C: - Lecteur fixe
# presence des fichiers :
\\\\\\\\\\\\\\\\\\ [ Registre / Mountpoint2 ] ///////////////////
-> Not found !
################## [ ! Fin du rapport # FindyKill V4.714 ! ]
Utilisateur anonyme
20 janv. 2009 à 19:14
20 janv. 2009 à 19:14
Re,
Findykill de chiquitine29 option 2:
▶ Branche tes disques amovibles à ton PC ( (clefs USB, disque dur externe, etc...) sans les ouvrir
▶ Double-clique sur le raccourci FindyKill sur ton bureau
▶ Au menu principal, choisisl'option 2 (Suppression)
/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\
▶ Ensuite, poste le rapport FindyKill.txt
Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
Findykill de chiquitine29 option 2:
▶ Branche tes disques amovibles à ton PC ( (clefs USB, disque dur externe, etc...) sans les ouvrir
▶ Double-clique sur le raccourci FindyKill sur ton bureau
▶ Au menu principal, choisisl'option 2 (Suppression)
/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\
▶ Ensuite, poste le rapport FindyKill.txt
Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]
-->- Recherche:
C:\avenger: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\avenger: ERREUR DE SUPPRESSION !!
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\FindyKill: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis: supprimé !
Corbeille vidée!
Fichiers temporaires nettoyés !
-->- Recherche:
C:\avenger: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
---------------------------------
-->- Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\avenger: ERREUR DE SUPPRESSION !!
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\FindyKill: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis: supprimé !
Corbeille vidée!
Fichiers temporaires nettoyés !
bon j'ai fait comme vous avez dit et quand je fait option 2 mon pc s'éteint et se rallume mais rien se produit j'ai repeter l'operation 2fois et il n'y a pas de rapport sur le lecteur C !
nan mais sa fonctionne pas du tout de plus mon pc rame encor plus je trouve il y a pas une autre solution que cela!! il y a pas de logiciel qui nettoie ou balaye tout les fichier en trop??
Utilisateur anonyme
20 janv. 2009 à 21:34
20 janv. 2009 à 21:34
Re,
Supprime déjà ton ou tes cracks.
Refait un coup de ccleaner et fait combofix comme donner précèdement.
Supprime déjà ton ou tes cracks.
Refait un coup de ccleaner et fait combofix comme donner précèdement.
Utilisateur anonyme
20 janv. 2009 à 21:39
20 janv. 2009 à 21:39
Re,
Si sa ne fonctionne toujours pas fait ce qui suit:
---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :
:files
c:\documents and settings\dider\application data\drivers\winupgro.exe
c:\windows\system32\wintems.exe
c:\documents and settings\dider\application data\m\flec006.exe
c:\windows\system32\mdelk.exe
:commands
[purity]
[emptytemp]
[reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
Si sa ne fonctionne toujours pas fait ce qui suit:
---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe
---> Double-clique sur OTMoveIt3.exe afin de le lancer.
---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :
:files
c:\documents and settings\dider\application data\drivers\winupgro.exe
c:\windows\system32\wintems.exe
c:\documents and settings\dider\application data\m\flec006.exe
c:\windows\system32\mdelk.exe
:commands
[purity]
[emptytemp]
[reboot]
---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.
---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
20 janv. 2009 à 21:57
20 janv. 2009 à 21:57
========= FILES ==========
c:\documents and settings\dider\application data\drivers\winupgro.exe moved successfully.
File move failed. c:\windows\system32\wintems.exe scheduled to be moved on reboot.
File move failed. c:\documents and settings\dider\application data\m\flec006.exe scheduled to be moved on reboot.
File move failed. c:\windows\system32\mdelk.exe scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\dider\LOCALS~1\Temp\is-0MN6P.tmp\spybotsd160[1].tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\dider\LOCALS~1\Temp\~DF4E29.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01202009_214548
Files moved on Reboot...
File move failed. c:\windows\system32\wintems.exe scheduled to be moved on reboot.
File move failed. c:\documents and settings\dider\application data\m\flec006.exe scheduled to be moved on reboot.
File move failed. c:\windows\system32\mdelk.exe scheduled to be moved on reboot.
File C:\DOCUME~1\dider\LOCALS~1\Temp\is-0MN6P.tmp\spybotsd160[1].tmp not found!
C:\DOCUME~1\dider\LOCALS~1\Temp\~DF4E29.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
c:\documents and settings\dider\application data\drivers\winupgro.exe moved successfully.
File move failed. c:\windows\system32\wintems.exe scheduled to be moved on reboot.
File move failed. c:\documents and settings\dider\application data\m\flec006.exe scheduled to be moved on reboot.
File move failed. c:\windows\system32\mdelk.exe scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\dider\LOCALS~1\Temp\is-0MN6P.tmp\spybotsd160[1].tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\dider\LOCALS~1\Temp\~DF4E29.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01202009_214548
Files moved on Reboot...
File move failed. c:\windows\system32\wintems.exe scheduled to be moved on reboot.
File move failed. c:\documents and settings\dider\application data\m\flec006.exe scheduled to be moved on reboot.
File move failed. c:\windows\system32\mdelk.exe scheduled to be moved on reboot.
File C:\DOCUME~1\dider\LOCALS~1\Temp\is-0MN6P.tmp\spybotsd160[1].tmp not found!
C:\DOCUME~1\dider\LOCALS~1\Temp\~DF4E29.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
Utilisateur anonyme
20 janv. 2009 à 22:04
20 janv. 2009 à 22:04
Re,
Redémarre ton pc et recommence l'option 2 de findykill.
merci
Redémarre ton pc et recommence l'option 2 de findykill.
merci
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
20 janv. 2009 à 23:29
20 janv. 2009 à 23:29
###################### [ FindyKill V4.714 ]
# User : dider - SY4PUND51D
# Executed from : C:\Program Files\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 22:17:12 the 2009-01-20
# Windows XP - Internet Explorer 7.0.5730.11
# [ FindyKill V4.714 - Deleting ] ###############
\\\\\\\\\\\\\\\\\\ [ Active Processes ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\userinit.exe
\\\\\\\\\\\\\\\\\\ [ Infected Files / Folders ] ///////////////////
################## [ C:\ ]
Deleted ! - "C:\Avenger\m\shared"
Deleted ! - "C:\Avenger\m"
Deleted ! - C:\Avenger\flec006.exe
Deleted ! - C:\Avenger\wintems.exe
Deleted ! - "C:\Avenger"
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Deleted ! - C:\WINDOWS\prefetch\103187.EXE-1CDD0A12.pf
Deleted ! - C:\WINDOWS\prefetch\159156.EXE-1FE84EE2.pf
Deleted ! - C:\WINDOWS\prefetch\161296.EXE-0BDD70E7.pf
Deleted ! - C:\WINDOWS\prefetch\201515.EXE-1EC7B83D.pf
Deleted ! - C:\WINDOWS\prefetch\224000.EXE-1FE61503.pf
Deleted ! - C:\WINDOWS\prefetch\244828.EXE-329D0826.pf
Deleted ! - C:\WINDOWS\prefetch\262359.EXE-27B39697.pf
Deleted ! - C:\WINDOWS\prefetch\283546.EXE-3A0DCE47.pf
Deleted ! - C:\WINDOWS\prefetch\73562.EXE-10620AEE.pf
Deleted ! - C:\WINDOWS\prefetch\94109.EXE-22BA53ED.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-00C8A688.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
################## [ C:\WINDOWS\system32 ]
Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ C:\Documents and Settings\dider\Application Data ]
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\flec006.exe"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\list.oct"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\data.oct"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\srvlist.oct"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers\srosa.sys"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers\srosa2.sys"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers"
################## [ C:\DOCUME~1\dider\LOCALS~1\Temp ]
################## [ C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5 ]
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64[3].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\servernames[2].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\3U000SZF\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\3U000SZF\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64[5].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64[6].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_2[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_3[5].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_3[6].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[3].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\mxd[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\E1LAJFDP\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\E1LAJFDP\mxd[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\mxd[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\b64[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\b64_1[5].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\b64_2[7].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\mxd[3].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\b64[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\PWLHDAWW\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\PWLHDAWW\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\PWLHDAWW\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64[7].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64[8].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64_1[7].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64_1[8].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64_2[7].jpg
\\\\\\\\\\\\\\\\\\ [ Registry / Infected keys ] ///////////////////
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\FFC
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\MuleAppData
\\\\\\\\\\\\\\\\\\ [ States / Restarting of services ] ///////////////////
# Safe boot mode restored !
# Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - # Type of startup = 3
EapHost - # Type of startup = 2
Ip6Fw - # Type of startup = 2
SharedAccess - # Type of startup = 2
wuauserv - # Type of startup = 2
wscsvc - # Type of startup = 2
\\\\\\\\\\\\\\\\\\ [ Cleaning Removable drives ] ///////////////////
# Informations :
C: - Lecteur fixe
# deleting files :
\\\\\\\\\\\\\\\\\\ [ Registry / Mountpoint2 ] ///////////////////
-> Not found !
\\\\\\\\\\\\\\\\\\ [ Searching Other Infections ] ///////////////////
Références de comparaison Bagle MD5 :
2144df1c C:\_OTMoveIt\MovedFiles\01202009_214548\documents and settings\dider\application data\drivers\winupgro.exe
143b9bf5cd2efc3cfc30d01c9924ca29 C:\_OTMoveIt\MovedFiles\01202009_214548\documents and settings\dider\application data\drivers\winupgro.exe
Suspect ! - 143b9bf5cd2efc3cfc30d01c9924ca29 C:\Program Files\eMule\Incoming\Media Player Codec Pack 3.2.0\run.exe
Suspect ! - 143b9bf5cd2efc3cfc30d01c9924ca29 C:\_OTMoveIt\MovedFiles\01202009_214548\documents and settings\dider\application data\drivers\winupgro.exe
\\\\\\\\\\\\\\\\\\ [ Searching Cracks / Keygen ] ///////////////////
C:\Documents and Settings\dider\Mes documents\Ma musique\CAP'TAIN\cap'tain 2007\06 Nutcracka.wma
################## [ ! End of report # FindyKill V4.714 ! ]
# User : dider - SY4PUND51D
# Executed from : C:\Program Files\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 22:17:12 the 2009-01-20
# Windows XP - Internet Explorer 7.0.5730.11
# [ FindyKill V4.714 - Deleting ] ###############
\\\\\\\\\\\\\\\\\\ [ Active Processes ] ///////////////////
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\userinit.exe
\\\\\\\\\\\\\\\\\\ [ Infected Files / Folders ] ///////////////////
################## [ C:\ ]
Deleted ! - "C:\Avenger\m\shared"
Deleted ! - "C:\Avenger\m"
Deleted ! - C:\Avenger\flec006.exe
Deleted ! - C:\Avenger\wintems.exe
Deleted ! - "C:\Avenger"
################## [ C:\WINDOWS ]
################## [ C:\WINDOWS\Prefetch ]
Deleted ! - C:\WINDOWS\prefetch\103187.EXE-1CDD0A12.pf
Deleted ! - C:\WINDOWS\prefetch\159156.EXE-1FE84EE2.pf
Deleted ! - C:\WINDOWS\prefetch\161296.EXE-0BDD70E7.pf
Deleted ! - C:\WINDOWS\prefetch\201515.EXE-1EC7B83D.pf
Deleted ! - C:\WINDOWS\prefetch\224000.EXE-1FE61503.pf
Deleted ! - C:\WINDOWS\prefetch\244828.EXE-329D0826.pf
Deleted ! - C:\WINDOWS\prefetch\262359.EXE-27B39697.pf
Deleted ! - C:\WINDOWS\prefetch\283546.EXE-3A0DCE47.pf
Deleted ! - C:\WINDOWS\prefetch\73562.EXE-10620AEE.pf
Deleted ! - C:\WINDOWS\prefetch\94109.EXE-22BA53ED.pf
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-00C8A688.pf
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
################## [ C:\WINDOWS\system32 ]
Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe
Deleted ! - C:\WINDOWS\system32\ban_list.txt
################## [ C:\WINDOWS\system32\drivers ]
################## [ C:\Documents and Settings\dider\Application Data ]
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\flec006.exe"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\list.oct"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\data.oct"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\srvlist.oct"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\dider\Application Data\m"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers\srosa.sys"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers\srosa2.sys"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers\downld"
Deleted ! - "C:\Documents and Settings\dider\Application Data\drivers"
################## [ C:\DOCUME~1\dider\LOCALS~1\Temp ]
################## [ C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5 ]
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64[3].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\13D5DT5J\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\18NCVOTS\servernames[2].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\3U000SZF\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\3U000SZF\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64[5].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64[6].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_2[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_3[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_3[5].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\6G5GI7TE\b64_3[6].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[3].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\B16Q9113\mxd[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\E1LAJFDP\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\E1LAJFDP\mxd[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\G8N9EEZO\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\b64_3[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\HR0LUYU2\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\b64_1[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\mxd[2].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\KOVG4TBU\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\b64[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\b64_1[5].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\b64_2[7].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\MJR53W7A\mxd[3].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\b64[4].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\file[1].txt
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\NT8X4D37\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\PWLHDAWW\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\PWLHDAWW\mxd[1].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\PWLHDAWW\servernames[1].htm
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64[7].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64[8].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64_1[7].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64_1[8].jpg
Deleted ! - C:\Documents and Settings\dider\Local Settings\Temporary Internet Files\Content.IE5\USIN23D1\b64_2[7].jpg
\\\\\\\\\\\\\\\\\\ [ Registry / Infected keys ] ///////////////////
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\MsnMsgr
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\FFC
Deleted ! - HKEY_USERS\S-1-5-21-2846713853-1512459178-3149687112-1006\Software\MuleAppData
\\\\\\\\\\\\\\\\\\ [ States / Restarting of services ] ///////////////////
# Safe boot mode restored !
# Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - # Type of startup = 3
EapHost - # Type of startup = 2
Ip6Fw - # Type of startup = 2
SharedAccess - # Type of startup = 2
wuauserv - # Type of startup = 2
wscsvc - # Type of startup = 2
\\\\\\\\\\\\\\\\\\ [ Cleaning Removable drives ] ///////////////////
# Informations :
C: - Lecteur fixe
# deleting files :
\\\\\\\\\\\\\\\\\\ [ Registry / Mountpoint2 ] ///////////////////
-> Not found !
\\\\\\\\\\\\\\\\\\ [ Searching Other Infections ] ///////////////////
Références de comparaison Bagle MD5 :
2144df1c C:\_OTMoveIt\MovedFiles\01202009_214548\documents and settings\dider\application data\drivers\winupgro.exe
143b9bf5cd2efc3cfc30d01c9924ca29 C:\_OTMoveIt\MovedFiles\01202009_214548\documents and settings\dider\application data\drivers\winupgro.exe
Suspect ! - 143b9bf5cd2efc3cfc30d01c9924ca29 C:\Program Files\eMule\Incoming\Media Player Codec Pack 3.2.0\run.exe
Suspect ! - 143b9bf5cd2efc3cfc30d01c9924ca29 C:\_OTMoveIt\MovedFiles\01202009_214548\documents and settings\dider\application data\drivers\winupgro.exe
\\\\\\\\\\\\\\\\\\ [ Searching Cracks / Keygen ] ///////////////////
C:\Documents and Settings\dider\Mes documents\Ma musique\CAP'TAIN\cap'tain 2007\06 Nutcracka.wma
################## [ ! End of report # FindyKill V4.714 ! ]
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
20 janv. 2009 à 23:30
20 janv. 2009 à 23:30
voila le rapport j'espere que c'est bien ca !
Utilisateur anonyme
20 janv. 2009 à 23:31
20 janv. 2009 à 23:31
Re,
très bien on y arrive.
Je te conseil de supprimer sa=>C:\Documents and Settings\dider\Mes documents\Ma musique\CAP'TAIN\cap'tain 2007\06 Nutcracka.wma
Maintenant fait ce qui suit STP.
▶ Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte
▶ Mets le à jour
▶ Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
▶ Sélectionne Exécuter un examen RAPIDE si ce n'est pas déjà fait
▶ clique sur Rechercher
▶ Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok
▶ Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.
▶ Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection
▶ Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.
Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
Tutoriel pour MalwareByte's
très bien on y arrive.
Je te conseil de supprimer sa=>C:\Documents and Settings\dider\Mes documents\Ma musique\CAP'TAIN\cap'tain 2007\06 Nutcracka.wma
Maintenant fait ce qui suit STP.
▶ Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte
▶ Mets le à jour
▶ Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
▶ Sélectionne Exécuter un examen RAPIDE si ce n'est pas déjà fait
▶ clique sur Rechercher
▶ Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok
▶ Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.
▶ Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection
▶ Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.
Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok
Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.
Tutoriel pour MalwareByte's
sandra5901
Messages postés
91
Date d'inscription
jeudi 20 novembre 2008
Statut
Membre
Dernière intervention
22 janvier 2009
21 janv. 2009 à 00:22
21 janv. 2009 à 00:22
Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1673
Windows 5.1.2600 Service Pack 3
2009-01-21 00:16:16
mbam-log-2009-01-21 (00-16-16).txt
Type de recherche: Examen rapide
Eléments examinés: 52936
Temps écoulé: 3 minute(s), 57 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
Version de la base de données: 1673
Windows 5.1.2600 Service Pack 3
2009-01-21 00:16:16
mbam-log-2009-01-21 (00-16-16).txt
Type de recherche: Examen rapide
Eléments examinés: 52936
Temps écoulé: 3 minute(s), 57 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
