Probleme avec un virus Résolu

Question

Bonjour,
Mon probleme c'est que je peux pas lancer mon antivirus ni installer et je peux même pas demmérer windows en mode sans échec, Que fais-je ? Merci

Destrio5 · Answer

Salut,

As-tu un message d'erreur ?

Rachidess · Answer

Non la fenêtre d'ainstallation et antivirus se freme automatiquement d'enviren 1 2 sec

Destrio5 · Answer

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

Rachidess · Answer

Ok

Rachidess · Answer

ça marche pas, Existe-t il une autre solution ?

Destrio5 · Answer

As-tu le rapport ?

Destrio5 · Answer

De l'analyse.

Destrio5 · Answer

Tu as quel antivirus ?

Destrio5 · Answer

Tu peux le réinstaller ?

Destrio5 · Answer

Si tu pouvais faire le scan RSIT, ce serait plus pratique.

Destrio5 · Answer

Il suffit de les poster ici.

Destrio5 · Answer

Oui.

Rachidess · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrateur at 2009-02-17 20:44:55
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (81%) free of 20 GB
Total RAM: 503 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:44:59, on 17/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winawstri.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winndltxi.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp	pcldc.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wingevmh.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\xajbb.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winypwrs.exe
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\CJ20RKQ8\RSIT[1].exe
C:\Program Files	rend micro\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Debug more] C:\DOCUME~1\ADMINI~1\APPLIC~1\TEAMOK~1\MessHtm.exe
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E9D08D56-30A0-4648-BFF9-6388EE3BE4A8}: NameServer = 212.217.0.13 212.217.1.17
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll

Destrio5 · Answer

Je vois les infections maintenant.

---> Télécharge Lop S&D sur ton Bureau.
---> Double-clique dessus pour lancer l'installation.
---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
---> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).
---> Patiente jusqu'à la fin du scan.
---> Poste le rapport généré (C:\lopR.txt).

Destrio5 · Answer

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
C:\Program Files\Circle Devlopement 
C:\Documents and Settings\Administrateur\Application Data	eamokayvga
C:\Program Files	eamokayvga   
C:\WINDOWS\system32\Cache 
C:\hyetn1i.exe 
C:\WINDOWS\system32
mdfgds1.dll  
C:\qphdin.com  
C:\WINDOWS\system32
mdfgds0.dll  
C:\WINDOWS\system32\olhrwef.exe 
C:\cv22.cmd  
D:\hyetn1i.exe 

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a666ab4c-fc7b-11dd-981f-806d6172696f}]  
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a666ab4d-fc7b-11dd-981f-806d6172696f}]  
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] 
"Debug more"=-
"cdoosoft"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\acis.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxwwry.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhuti.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvuqv.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winnbwr.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\xdysip.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wintcwv.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winetmon.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cqkka.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avqxoq.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbtjow.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winkwgyif.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfoxlk.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbvothb.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\windrbhsa.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhccpe.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxqnw.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwawkj.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pnpm.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winnatsu.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gfjf.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxkeihu.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbofwon.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kwqi.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmxkrn.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vnnr.exe"=- 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winkubnl.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iciiq.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winisusg.exe"=- 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxisrh.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbklc.exe"=-"       
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\windyak.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfqnefc.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwflxwf.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlkrge.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winqhkjb.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bkjwr.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhcxswt.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winextup.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jljkq.exe"=-      
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winteehgu.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bhujj.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winpropo.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jphm.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\lnuui.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eahwd.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhcjo.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qdvu.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\hlygbi.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jrxhm.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winllgy.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qedm.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winngdi.exe"=-      
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winrltxjr.exe"=- 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wingqfwa.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwjsad.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\stop.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wintwkn.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winubkwf.exe"=- 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winljfoly.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwvmrm.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winqeaisr.exe"=- 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eelx.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jahdmr.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvtlypf.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfnlipd.exe"=-
"C:\DOCUME~1\ADMINI~1\APPLIC~1\TEAMOK~1\MessHtm.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winawstri.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winesmf.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvtro.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winndltxi.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxlytle.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\outmvl.exe"=- 
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmumkmw.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winikivdq.exe"=-
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winntunh.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhstcli.exe"=-  
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwrbh.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iqmp.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winyjfjcp.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winouqx.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbhut.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winixkcw.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winybtwxy.exe"=-    
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wincmleo.exe"=-     
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfnxmde.exe"=-   
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winajhak.exe"=-

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Rachidess · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Program Files\Circle Devlopement moved successfully.
C:\Documents and Settings\Administrateur\Application Data	eamokayvga moved successfully.
C:\Program Files	eamokayvga moved successfully.
C:\WINDOWS\system32\Cache moved successfully.
C:\hyetn1i.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32
mdfgds1.dll
C:\WINDOWS\system32
mdfgds1.dll NOT unregistered.
C:\WINDOWS\system32
mdfgds1.dll moved successfully.
C:\qphdin.com moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32
mdfgds0.dll
C:\WINDOWS\system32
mdfgds0.dll NOT unregistered.
C:\WINDOWS\system32
mdfgds0.dll moved successfully.
C:\WINDOWS\system32\olhrwef.exe moved successfully.
C:\cv22.cmd moved successfully.
D:\hyetn1i.exe moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a666ab4c-fc7b-11dd-981f-806d6172696f}\ deleted successfully.
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a666ab4d-fc7b-11dd-981f-806d6172696f}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Debug more not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\cdoosoft not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\acis.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxwwry.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhuti.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvuqv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winnbwr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\xdysip.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wintcwv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winetmon.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cqkka.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avqxoq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbtjow.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winkwgyif.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfoxlk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbvothb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\windrbhsa.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhccpe.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxqnw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwawkj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pnpm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winnatsu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gfjf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxkeihu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbofwon.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kwqi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmxkrn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vnnr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winkubnl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iciiq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winisusg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxisrh.exe deleted successfully.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mbklc.exe"|-" /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\windyak.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfqnefc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwflxwf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlkrge.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winqhkjb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bkjwr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhcxswt.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winextup.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jljkq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winteehgu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bhujj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winpropo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jphm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\lnuui.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eahwd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhcjo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qdvu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\hlygbi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jrxhm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winllgy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qedm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winngdi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winrltxjr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wingqfwa.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwjsad.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\stop.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wintwkn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winubkwf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winljfoly.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwvmrm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winqeaisr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\eelx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jahdmr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvtlypf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfnlipd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\APPLIC~1\TEAMOK~1\MessHtm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winawstri.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winesmf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvtro.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winndltxi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxlytle.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\outmvl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmumkmw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winikivdq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winntunh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhstcli.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwrbh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iqmp.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winyjfjcp.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winouqx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbhut.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winixkcw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winybtwxy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wincmleo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfnxmde.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winajhak.exe deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxbgtni.exe scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_d64.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02182009_102559

Files moved on Reboot...
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxbgtni.exe moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\WINDOWS	emp\Perflib_Perfdata_d64.dat moved successfully.

Destrio5 · Answer

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
D:\m0vnonh.bat
D:\1utbfd.bat
D:\qphdin.com
D:\a2h2.com
D:\ur0.com
D:\pook.com
D:\w98.com
D:\hl80c6b1.com
D:\j60osk9.cmd
D:\uvsqfgwd.cmd
D:\gy.exe
D:\2aaxaiy.exe

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Rachidess · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
D:\m0vnonh.bat moved successfully.
D:\1utbfd.bat moved successfully.
D:\qphdin.com moved successfully.
D:\a2h2.com moved successfully.
D:\ur0.com moved successfully.
D:\pook.com moved successfully.
D:\w98.com moved successfully.
D:\hl80c6b1.com moved successfully.
D:\j60osk9.cmd moved successfully.
D:\uvsqfgwd.cmd moved successfully.
D:\gy.exe moved successfully.
D:\2aaxaiy.exe moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02202009_105221

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

Destrio5 · Answer

Bien.

---> Refais un scan RSIT et poste le rapport log.

Rachidess · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrateur at 2009-02-20 21:45:17
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (82%) free of 20 GB
Total RAM: 503 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:45:26, on 20/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sbymf.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Dofus\Dofus.exe
C:\Program Files\Dofus\dofus.dll
C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\ENE0RQ8L\RSIT[1].exe
C:\Program Files	rend micro\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.menara.ma/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Debug more] C:\DOCUME~1\ADMINI~1\APPLIC~1\TEAMOK~1\MessHtm.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E9D08D56-30A0-4648-BFF9-6388EE3BE4A8}: NameServer = 212.217.0.13 212.217.1.17
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll

Destrio5 · Answer

Le scan va s'effectuer en Mode sans échec : comme vous n'aurez pas accès à Internet, je vous conseille d'imprimer cette procédure. 

--> Téléchargez le scanner portable AVPTool sur votre Bureau.

--> Pour redémarrer en mode sans échec :
- Redémarrez ton PC.
- Au démarrage, tapotez sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
- Dans le menu d'options avancées, choisissez Mode sans échec.
- Choisissez votre session habituelle.

--> Lancez l'exécutable intitulé setup_7.0xxxxx en double-cliquant dessus.
--> Répondez Oui à la question Do you want to continue installation ?.
--> Cliquez sur Next pour les deux fenêtres suivantes : AVPTool s'installe sur votre Bureau dans un dossier nommé Kaspersky Lab Tool.
--> L'outil se lance tout seul : cochez toutes les cases dans l'onglet Automatic Scan.
--> Cliquez maintenant sur Scan. Le scan commence, une nouvelle fenêtre s'ouvre indiquant la progression du balayage en pourcentage. 
--> A la fin du scan, AVPTool signale les objets infectés par l'intermédiaire d'un pop-up : cochez alors Apply to all et cliquez sur Disinfect ou sur Delete selon ce que propose la fenêtre.
--> Une fois les infections traitées par l'intermédiaire des pop-ups, il se peut que des fichiers malsains n'aient pas été supprimés : ils apparaissent en rouge dans la liste : cliquez alors sur le bouton Neutralize all de la fenêtre de progression du scan : si une pop-up indique qu'il faut redémarrer, acceptez en cliquant sur OK.
--> Rendez-vous maintenant dans l'onglet Events de la fenêtre de progression du scan et décochez Show all events.
--> Cliquez enfin sur Reports puis Save to file et enregistrez le rapport sur votre Bureau sous le nom Rapport AVPTool.
--> Fermez les fenêtres d'AVPTool : un message apparaît proposant de désinstaller le logiciel : choisissez Yes. 
--> Un message d'alerte indique que le PC doit être redémarré pour finir la désinstallation. À la question Would you like to restart now, répondez Oui et laissez votre ordinateur redémarrer en Mode normal. 
--> Postez le rapport dans votre prochaine réponse.

Destrio5 · Answer

Essaie de réparer le mode sans échec avec ceci :
https://download.bleepingcomputer.com/sUBs/SafeBootKeyRepair.exe

Si ça ne fonctionne pas, fais le scan AVPTool en mode normal.

Rachidess · Answer

Je t'avais dit que je peux pas demarrer mon ordinateur en mode sans echec

Destrio5 · Answer

Tu as vu ce que j'ai marqué ?

Rachidess · Answer

Je n'arrive pas télécharger L'AVPTool "Internet Explorer ne peut pas afficher cette page Web"

Destrio5 · Answer

http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/setup_7.0.0.290_23.02.2009_13-29.exe

Destrio5 · Answer

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

Rachidess · Answer

C'est bon j'ai formaté mon disque C ,merci quand même

Destrio5 · Answer

Ok, ça marche ;)

Probleme avec un virus

29 réponses

Votre réponse

Discussions similaires

Newsletters