PC infécté!!
hassen14
Messages postés
63
Statut
Membre
-
jacques.gache Messages postés 34829 Statut Contributeur sécurité -
jacques.gache Messages postés 34829 Statut Contributeur sécurité -
Bonjour,
J'ai une infection que mon antivirus ne peut pas supprimer!
voici mon rapport Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03:08, on 17/04/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Documents and Settings\hsen\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\hsen\Bureau\u94.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\hsen.exe
C:\Documents and Settings\hsen\hsen.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\Bureau\HiJackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:9666
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
R3 - URLSearchHook: (no name) - {F4F10C1D-87C7-404A-B4B3-000000000000} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\System32\vwvoeuxb.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\logon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [hsen] C:\Documents and Settings\hsen\hsen.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\hsen\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{22BB38E2-F2B5-4B5B-9125-78BD1EBB9B73}: NameServer = 213.150.189.10 213.150.191.9
O17 - HKLM\System\CS1\Services\Tcpip\..\{22BB38E2-F2B5-4B5B-9125-78BD1EBB9B73}: NameServer = 213.150.189.10 213.150.191.9
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
J'ai une infection que mon antivirus ne peut pas supprimer!
voici mon rapport Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03:08, on 17/04/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Documents and Settings\hsen\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\hsen\Bureau\u94.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\hsen.exe
C:\Documents and Settings\hsen\hsen.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\Bureau\HiJackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.fr/spbasic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:9666
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
R3 - URLSearchHook: (no name) - {F4F10C1D-87C7-404A-B4B3-000000000000} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\System32\vwvoeuxb.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\logon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [hsen] C:\Documents and Settings\hsen\hsen.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\hsen\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{22BB38E2-F2B5-4B5B-9125-78BD1EBB9B73}: NameServer = 213.150.189.10 213.150.191.9
O17 - HKLM\System\CS1\Services\Tcpip\..\{22BB38E2-F2B5-4B5B-9125-78BD1EBB9B73}: NameServer = 213.150.189.10 213.150.191.9
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
A voir également:
- PC infécté!!
- Reinitialiser pc - Guide
- Pc lent - Guide
- Downloader for pc - Télécharger - Téléchargement & Transfert
- Forcer demarrage pc - Guide
- Double ecran pc - Guide
18 réponses
Hello,
Tu peux donner + d'informations sur cette infection ?
***************************************
● Télécharge ToolBar-S&D ( Merci à Eric_71, Angeldark, Sham_Rock et XmichouX ) :https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
● Lances l'installation du programme en exécutant le fichier téléchargé.
● Double-clique maintenant sur le raccourci de Toolbar-S&D.
● Sélectionnes la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
● Tape "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
● Un rapport sera généré, poste son contenu ici.
(!) NOTE : Si ton Bureau ne réapparait pas,
Appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.
***************************************
● Télécharge DDS:
Ici: https://download.bleepingcomputer.com/sUBs/dds.scr
Ou la: https://forospyware.com
de sUBs sur le bureau.
(!) L'outil ne nécessite pas d'installation.
Lances-le en cliquant sur l'icône dds.scr.
Cette fenêtre DOS va apparaitre : https://i75.servimg.com/u/f75/11/05/93/83/ddsdos10.jpg
● Le scan ne doit pas dépasser trois minutes.
● Un premier rapport va s'ouvrir que tu enregistreras sous DDS.txt par défaut sur le bureau.
● Il te sera demandé si tu veux faire le scan optionnel.
Accepte par Oui
● Un nouveau rapport s'ouvre que tu enregistres sous Attach.txt sur le bureau.
Tu ne le fourniras que si nécessaire.
Poste moi le rapport DDS.txt.
++
J'ai une infection que mon antivirus ne peut pas supprimer!
Tu peux donner + d'informations sur cette infection ?
***************************************
● Télécharge ToolBar-S&D ( Merci à Eric_71, Angeldark, Sham_Rock et XmichouX ) :https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2
● Lances l'installation du programme en exécutant le fichier téléchargé.
● Double-clique maintenant sur le raccourci de Toolbar-S&D.
● Sélectionnes la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
● Tape "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
● Un rapport sera généré, poste son contenu ici.
(!) NOTE : Si ton Bureau ne réapparait pas,
Appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.
***************************************
● Télécharge DDS:
Ici: https://download.bleepingcomputer.com/sUBs/dds.scr
Ou la: https://forospyware.com
de sUBs sur le bureau.
(!) L'outil ne nécessite pas d'installation.
Lances-le en cliquant sur l'icône dds.scr.
Cette fenêtre DOS va apparaitre : https://i75.servimg.com/u/f75/11/05/93/83/ddsdos10.jpg
● Le scan ne doit pas dépasser trois minutes.
● Un premier rapport va s'ouvrir que tu enregistreras sous DDS.txt par défaut sur le bureau.
● Il te sera demandé si tu veux faire le scan optionnel.
Accepte par Oui
● Un nouveau rapport s'ouvre que tu enregistres sous Attach.txt sur le bureau.
Tu ne le fourniras que si nécessaire.
Poste moi le rapport DDS.txt.
++
DDS (Ver_09-03-16.01) - NTFSx86
Run by hsen at 14:31:18,43 on 17/04/2009
Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professionnel 5.1.2600.1.1252.33.1036.18.446.100 [GMT 2:00]
============== Running Processes ===============
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Documents and Settings\hsen\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\hsen\Bureau\u94.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\hsen.exe
C:\Documents and Settings\hsen\hsen.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\Bureau\HiJackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\Bureau\dds.scr
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://search.msn.fr/spbasic.htm
mDefault_Search_URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=
mWindow Title =
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 127.0.0.1:9666
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=%s
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [ares] "c:\program files\ares\Ares.exe" -h
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [hsen] c:\documents and settings\hsen\hsen.exe /i
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [Windows DLL Loader] c:\windows\system32\vwvoeuxb.exe
mRun: [Windows Logon Application] c:\windows\system32\logon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\hsen\menudm~1\progra~1\dmarra~1\notifi~1.lnk - c:\documents and settings\hsen\application data\microsoft\notification de cadeaux msn\lsnfier.exe
StartupFolder: c:\docume~1\alluse~1\menudm~1\progra~1\dmarra~1\dslmon.lnk - c:\program files\sagem\sagem f@st 800-840\dslmon.exe
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136244205015
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
TCP: {22BB38E2-F2B5-4B5B-9125-78BD1EBB9B73} = 213.150.189.10 213.150.191.9
Notify: AtiExtEvent - Ati2evxx.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\hsen\applic~1\mozilla\firefox\profiles\19sw9jz8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - component: c:\documents and settings\hsen\application data\idm\idmmzcc2\components\idmmzcc.dll
============= SERVICES / DRIVERS ===============
R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [2006-1-2 22360]
R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [2006-1-2 45416]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2006-1-2 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2006-1-2 185089]
R3 e4usbae;USB ADSL2 LAN Adapter;c:\windows\system32\drivers\e4usbae.sys [2006-1-2 89600]
S2 acpi32;acpi32;\??\c:\windows\system32\drivers\acpi32.sys --> c:\windows\system32\drivers\acpi32.sys [?]
S2 ati64si;ati64si;\??\c:\windows\system32\drivers\ati64si.sys --> c:\windows\system32\drivers\ati64si.sys [?]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2006-1-2 69656]
S2 ksi32sk;ksi32sk;\??\c:\windows\system32\drivers\ksi32sk.sys --> c:\windows\system32\drivers\ksi32sk.sys [?]
=============== Created Last 30 ================
2009-04-17 14:27 <DIR> --d----- C:\ToolBar SD
2009-04-17 13:33 20,962 ----h--- c:\documents and settings\hsen\hsen.exe
2009-04-17 10:25 <DIR> --d----- c:\program files\Bonjour
2009-04-17 10:00 1,208 a------- c:\windows\Radio_Fr.ini
2009-04-17 09:02 <DIR> --d----- c:\program files\QuickMediaConverter
2009-04-15 18:14 <DIR> --d----- c:\program files\Orban
2009-04-15 18:10 <DIR> --d----- c:\program files\Radio Fr Solo
2009-04-15 13:30 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-15 12:20 608,448 a------- c:\windows\system32\comctl32.ocx
2009-04-15 12:20 <DIR> --d----- c:\program files\Total Video Converter
2009-04-14 20:22 <DIR> --d----- c:\program files\SpeedBit Video Accelerator
2009-04-14 20:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SpeedBit
2009-04-14 20:13 <DIR> --d----- c:\program files\DAP
2009-04-14 20:04 548,352 a------- c:\windows\system32\amp3dj.ocx
2009-04-14 20:04 <DIR> --d----- c:\program files\Usenet Radio
2009-04-14 20:02 <DIR> --d----- c:\docume~1\hsen\applic~1\GetRightToGo
2009-04-13 20:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Azureus
2009-04-13 20:13 <DIR> --d----- c:\docume~1\hsen\applic~1\Azureus
2009-04-13 20:13 <DIR> --d----- c:\program files\Vuze
2009-04-12 21:40 <DIR> --d----- c:\program files\Ares
2009-04-12 19:00 316,640 a------- c:\windows\WMSysPr9.prx
2009-04-12 19:00 <DIR> --d----- c:\windows\RegisteredPackages
2009-04-12 13:22 <DIR> --d----- c:\program files\Internet Download Manager
2009-04-12 11:52 360,960 a------- c:\windows\system32\qmgr.dll
2009-04-12 11:50 8,704 ac------ c:\windows\system32\dllcache\kbdjpn.dll
2009-04-12 11:50 8,192 ac------ c:\windows\system32\dllcache\kbdkor.dll
2009-04-12 11:50 6,144 ac------ c:\windows\system32\dllcache\kbd106.dll
2009-04-12 11:50 6,144 ac------ c:\windows\system32\dllcache\kbd101c.dll
2009-04-12 11:50 6,144 ac------ c:\windows\system32\dllcache\kbd101b.dll
2009-04-12 11:50 5,632 ac------ c:\windows\system32\dllcache\kbd103.dll
2009-04-12 11:50 8,704 a------- c:\windows\system32\kbdjpn.dll
2009-04-12 11:50 8,192 a------- c:\windows\system32\kbdkor.dll
2009-04-12 11:50 6,144 a------- c:\windows\system32\kbd106.dll
2009-04-12 11:50 6,144 a------- c:\windows\system32\kbd101c.dll
2009-04-12 11:50 6,144 a------- c:\windows\system32\kbd101b.dll
2009-04-12 11:50 5,632 a------- c:\windows\system32\kbd103.dll
2009-04-12 09:08 <DIR> --d----- c:\docume~1\hsen\applic~1\IDM
2009-04-12 09:08 <DIR> --d----- c:\program files\eMule
2009-04-11 20:30 0 a------- c:\windows\system32\atiicdxx.dat
2009-04-11 18:54 <DIR> --d----- c:\docume~1\hsen\applic~1\Malwarebytes
2009-04-11 18:54 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-11 18:54 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-11 18:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-11 18:54 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-11 18:21 <DIR> --d----- c:\program files\CCleaner
2009-04-11 17:08 272,896 a------- c:\windows\system32\kerberos.dll
2009-04-11 17:06 115,976 a------- c:\windows\system32\drivers\rdpwd.sys
2009-04-11 17:06 1,354,240 a------- c:\windows\system32\query.dll
2009-04-11 17:06 1,797,376 a------- c:\windows\system32\win32k.sys
2009-04-11 17:06 233,984 a------- c:\windows\system32\tapisrv.dll
2009-04-11 17:05 99,840 a------- c:\windows\system32\win32spl.dll
2009-04-11 17:05 51,200 a------- c:\windows\system32\spoolsv.exe
2009-04-11 17:03 200,064 a------- c:\windows\system32\drivers\rmcast.sys
2009-04-11 17:03 196,288 ac------ c:\windows\system32\dllcache\tcpip6.sys
2009-04-11 17:03 154,112 a------- c:\windows\system32\netman.dll
2009-04-11 17:03 332,928 a------- c:\windows\system32\drivers\tcpip.sys
2009-04-11 17:01 1,148,928 a------- c:\windows\system32\quartz.dll
2009-04-11 17:01 108,544 a------- c:\windows\system32\umpnpmgr.dll
2009-04-11 17:01 359,936 a------- c:\windows\system32\msdtcprx.dll
2009-04-11 17:01 151,040 a------- c:\windows\system32\msdtcuiu.dll
2009-04-11 17:01 61,440 a------- c:\windows\system32\mtxclu.dll
2009-04-11 17:00 163,328 ac------ c:\windows\system32\dllcache\rdbss.sys
2009-04-11 17:00 90,624 ac------ c:\windows\system32\dllcache\cscdll.dll
2009-04-11 17:00 407,552 a------- c:\windows\system32\drivers\mrxsmb.sys
2009-04-11 17:00 163,328 a------- c:\windows\system32\drivers\rdbss.sys
2009-04-11 17:00 90,624 a------- c:\windows\system32\cscdll.dll
2009-04-11 17:00 1,932,288 a------- c:\windows\system32\ntkrnlpa.exe
2009-04-11 17:00 1,903,616 a------- c:\windows\system32\ntoskrnl.exe
2009-04-11 17:00 562,176 a------- c:\windows\system32\user32.dll
2009-04-11 16:50 <DIR> --d----- c:\windows\system32\appmgmt
2009-04-11 16:12 56,832 ac------ c:\windows\system32\dllcache\usbaudio.sys
2009-04-11 16:12 56,832 a------- c:\windows\system32\drivers\USBAUDIO.sys
2009-04-11 16:11 28,160 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-04-11 16:11 28,160 a------- c:\windows\system32\drivers\usbccgp.sys
2009-04-11 11:28 244 a---h--- C:\sqmnoopt01.sqm
2009-04-11 11:28 232 a---h--- C:\sqmdata01.sqm
2009-04-11 11:20 <DIR> --d----- c:\documents and settings\hsen\Contacts
2009-04-11 11:20 268 a---h--- C:\sqmdata00.sqm
2009-04-11 11:20 244 a---h--- C:\sqmnoopt00.sqm
2009-04-11 11:19 <DIR> --d----- c:\program files\MSN Messenger
2009-04-11 11:07 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-11 10:46 1,006,592 a------- c:\windows\system32\esent.dll
2009-04-11 10:13 131,712 ac------ c:\windows\system32\dllcache\ks.sys
2009-04-11 10:13 57,856 ac------ c:\windows\system32\dllcache\drmk.sys
2009-04-11 10:13 44,416 ac------ c:\windows\system32\dllcache\stream.sys
2009-04-11 10:13 131,712 a------- c:\windows\system32\drivers\ks.sys
2009-04-11 10:13 57,856 a------- c:\windows\system32\drivers\drmk.sys
2009-04-11 10:13 44,416 a------- c:\windows\system32\drivers\stream.sys
2009-04-11 10:13 117,248 ac------ c:\windows\system32\dllcache\ksproxy.ax
2009-04-11 10:13 4,096 ac------ c:\windows\system32\dllcache\ksuser.dll
2009-04-11 10:13 117,248 a------- c:\windows\system32\ksproxy.ax
2009-04-11 10:13 4,096 a------- c:\windows\system32\ksuser.dll
2009-04-11 10:13 5,063,168 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-04-11 10:13 1,206,816 a------- c:\windows\RtlUpd.exe
2009-04-11 10:08 <DIR> --d----- c:\documents and settings\hsen\Shared
2009-04-11 10:07 <DIR> --d----- c:\documents and settings\hsen\Incomplete
2009-04-11 10:07 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-11 09:56 <DIR> --d----- c:\docume~1\hsen\applic~1\mp3rocket
2009-04-11 09:38 22,016 a------- c:\windows\system32\wdmaud.drv
2009-04-11 09:38 <DIR> --d----- c:\program files\Realtek
2009-04-11 09:38 540,672 a------- c:\windows\RtlExUpd.dll
2009-04-11 09:13 <DIR> --d----- c:\windows\system32\bits
2009-03-30 10:51 210,352 a------- c:\windows\system32\idmmbc.dll
==================== Find3M ====================
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\MIU0KGU4.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\XFRRXBTB.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\KMEDR131.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\B1ZN77XB.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\84FFFLF5.DAT
2009-04-11 09:35 368,076 a------- c:\windows\system32\perfh00C.dat
2009-04-11 09:35 48,856 a------- c:\windows\system32\perfc00C.dat
2009-02-24 09:36 1,109 a------- c:\windows\system32\drivers\PConfig.DCF
============= FINISH: 14:31:36,37 ===============
Run by hsen at 14:31:18,43 on 17/04/2009
Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professionnel 5.1.2600.1.1252.33.1036.18.446.100 [GMT 2:00]
============== Running Processes ===============
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Documents and Settings\hsen\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\hsen\Bureau\u94.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\hsen.exe
C:\Documents and Settings\hsen\hsen.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\Bureau\HiJackThis.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\hsen\Bureau\dds.scr
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://search.msn.fr/spbasic.htm
mDefault_Search_URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=
mWindow Title =
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 127.0.0.1:9666
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q=%s
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [ares] "c:\program files\ares\Ares.exe" -h
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [hsen] c:\documents and settings\hsen\hsen.exe /i
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [Windows DLL Loader] c:\windows\system32\vwvoeuxb.exe
mRun: [Windows Logon Application] c:\windows\system32\logon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\hsen\menudm~1\progra~1\dmarra~1\notifi~1.lnk - c:\documents and settings\hsen\application data\microsoft\notification de cadeaux msn\lsnfier.exe
StartupFolder: c:\docume~1\alluse~1\menudm~1\progra~1\dmarra~1\dslmon.lnk - c:\program files\sagem\sagem f@st 800-840\dslmon.exe
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136244205015
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
TCP: {22BB38E2-F2B5-4B5B-9125-78BD1EBB9B73} = 213.150.189.10 213.150.191.9
Notify: AtiExtEvent - Ati2evxx.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\hsen\applic~1\mozilla\firefox\profiles\19sw9jz8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q=
FF - component: c:\documents and settings\hsen\application data\idm\idmmzcc2\components\idmmzcc.dll
============= SERVICES / DRIVERS ===============
R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [2006-1-2 22360]
R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [2006-1-2 45416]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2006-1-2 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2006-1-2 185089]
R3 e4usbae;USB ADSL2 LAN Adapter;c:\windows\system32\drivers\e4usbae.sys [2006-1-2 89600]
S2 acpi32;acpi32;\??\c:\windows\system32\drivers\acpi32.sys --> c:\windows\system32\drivers\acpi32.sys [?]
S2 ati64si;ati64si;\??\c:\windows\system32\drivers\ati64si.sys --> c:\windows\system32\drivers\ati64si.sys [?]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2006-1-2 69656]
S2 ksi32sk;ksi32sk;\??\c:\windows\system32\drivers\ksi32sk.sys --> c:\windows\system32\drivers\ksi32sk.sys [?]
=============== Created Last 30 ================
2009-04-17 14:27 <DIR> --d----- C:\ToolBar SD
2009-04-17 13:33 20,962 ----h--- c:\documents and settings\hsen\hsen.exe
2009-04-17 10:25 <DIR> --d----- c:\program files\Bonjour
2009-04-17 10:00 1,208 a------- c:\windows\Radio_Fr.ini
2009-04-17 09:02 <DIR> --d----- c:\program files\QuickMediaConverter
2009-04-15 18:14 <DIR> --d----- c:\program files\Orban
2009-04-15 18:10 <DIR> --d----- c:\program files\Radio Fr Solo
2009-04-15 13:30 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-15 12:20 608,448 a------- c:\windows\system32\comctl32.ocx
2009-04-15 12:20 <DIR> --d----- c:\program files\Total Video Converter
2009-04-14 20:22 <DIR> --d----- c:\program files\SpeedBit Video Accelerator
2009-04-14 20:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SpeedBit
2009-04-14 20:13 <DIR> --d----- c:\program files\DAP
2009-04-14 20:04 548,352 a------- c:\windows\system32\amp3dj.ocx
2009-04-14 20:04 <DIR> --d----- c:\program files\Usenet Radio
2009-04-14 20:02 <DIR> --d----- c:\docume~1\hsen\applic~1\GetRightToGo
2009-04-13 20:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Azureus
2009-04-13 20:13 <DIR> --d----- c:\docume~1\hsen\applic~1\Azureus
2009-04-13 20:13 <DIR> --d----- c:\program files\Vuze
2009-04-12 21:40 <DIR> --d----- c:\program files\Ares
2009-04-12 19:00 316,640 a------- c:\windows\WMSysPr9.prx
2009-04-12 19:00 <DIR> --d----- c:\windows\RegisteredPackages
2009-04-12 13:22 <DIR> --d----- c:\program files\Internet Download Manager
2009-04-12 11:52 360,960 a------- c:\windows\system32\qmgr.dll
2009-04-12 11:50 8,704 ac------ c:\windows\system32\dllcache\kbdjpn.dll
2009-04-12 11:50 8,192 ac------ c:\windows\system32\dllcache\kbdkor.dll
2009-04-12 11:50 6,144 ac------ c:\windows\system32\dllcache\kbd106.dll
2009-04-12 11:50 6,144 ac------ c:\windows\system32\dllcache\kbd101c.dll
2009-04-12 11:50 6,144 ac------ c:\windows\system32\dllcache\kbd101b.dll
2009-04-12 11:50 5,632 ac------ c:\windows\system32\dllcache\kbd103.dll
2009-04-12 11:50 8,704 a------- c:\windows\system32\kbdjpn.dll
2009-04-12 11:50 8,192 a------- c:\windows\system32\kbdkor.dll
2009-04-12 11:50 6,144 a------- c:\windows\system32\kbd106.dll
2009-04-12 11:50 6,144 a------- c:\windows\system32\kbd101c.dll
2009-04-12 11:50 6,144 a------- c:\windows\system32\kbd101b.dll
2009-04-12 11:50 5,632 a------- c:\windows\system32\kbd103.dll
2009-04-12 09:08 <DIR> --d----- c:\docume~1\hsen\applic~1\IDM
2009-04-12 09:08 <DIR> --d----- c:\program files\eMule
2009-04-11 20:30 0 a------- c:\windows\system32\atiicdxx.dat
2009-04-11 18:54 <DIR> --d----- c:\docume~1\hsen\applic~1\Malwarebytes
2009-04-11 18:54 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-11 18:54 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-11 18:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-11 18:54 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-11 18:21 <DIR> --d----- c:\program files\CCleaner
2009-04-11 17:08 272,896 a------- c:\windows\system32\kerberos.dll
2009-04-11 17:06 115,976 a------- c:\windows\system32\drivers\rdpwd.sys
2009-04-11 17:06 1,354,240 a------- c:\windows\system32\query.dll
2009-04-11 17:06 1,797,376 a------- c:\windows\system32\win32k.sys
2009-04-11 17:06 233,984 a------- c:\windows\system32\tapisrv.dll
2009-04-11 17:05 99,840 a------- c:\windows\system32\win32spl.dll
2009-04-11 17:05 51,200 a------- c:\windows\system32\spoolsv.exe
2009-04-11 17:03 200,064 a------- c:\windows\system32\drivers\rmcast.sys
2009-04-11 17:03 196,288 ac------ c:\windows\system32\dllcache\tcpip6.sys
2009-04-11 17:03 154,112 a------- c:\windows\system32\netman.dll
2009-04-11 17:03 332,928 a------- c:\windows\system32\drivers\tcpip.sys
2009-04-11 17:01 1,148,928 a------- c:\windows\system32\quartz.dll
2009-04-11 17:01 108,544 a------- c:\windows\system32\umpnpmgr.dll
2009-04-11 17:01 359,936 a------- c:\windows\system32\msdtcprx.dll
2009-04-11 17:01 151,040 a------- c:\windows\system32\msdtcuiu.dll
2009-04-11 17:01 61,440 a------- c:\windows\system32\mtxclu.dll
2009-04-11 17:00 163,328 ac------ c:\windows\system32\dllcache\rdbss.sys
2009-04-11 17:00 90,624 ac------ c:\windows\system32\dllcache\cscdll.dll
2009-04-11 17:00 407,552 a------- c:\windows\system32\drivers\mrxsmb.sys
2009-04-11 17:00 163,328 a------- c:\windows\system32\drivers\rdbss.sys
2009-04-11 17:00 90,624 a------- c:\windows\system32\cscdll.dll
2009-04-11 17:00 1,932,288 a------- c:\windows\system32\ntkrnlpa.exe
2009-04-11 17:00 1,903,616 a------- c:\windows\system32\ntoskrnl.exe
2009-04-11 17:00 562,176 a------- c:\windows\system32\user32.dll
2009-04-11 16:50 <DIR> --d----- c:\windows\system32\appmgmt
2009-04-11 16:12 56,832 ac------ c:\windows\system32\dllcache\usbaudio.sys
2009-04-11 16:12 56,832 a------- c:\windows\system32\drivers\USBAUDIO.sys
2009-04-11 16:11 28,160 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-04-11 16:11 28,160 a------- c:\windows\system32\drivers\usbccgp.sys
2009-04-11 11:28 244 a---h--- C:\sqmnoopt01.sqm
2009-04-11 11:28 232 a---h--- C:\sqmdata01.sqm
2009-04-11 11:20 <DIR> --d----- c:\documents and settings\hsen\Contacts
2009-04-11 11:20 268 a---h--- C:\sqmdata00.sqm
2009-04-11 11:20 244 a---h--- C:\sqmnoopt00.sqm
2009-04-11 11:19 <DIR> --d----- c:\program files\MSN Messenger
2009-04-11 11:07 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-11 10:46 1,006,592 a------- c:\windows\system32\esent.dll
2009-04-11 10:13 131,712 ac------ c:\windows\system32\dllcache\ks.sys
2009-04-11 10:13 57,856 ac------ c:\windows\system32\dllcache\drmk.sys
2009-04-11 10:13 44,416 ac------ c:\windows\system32\dllcache\stream.sys
2009-04-11 10:13 131,712 a------- c:\windows\system32\drivers\ks.sys
2009-04-11 10:13 57,856 a------- c:\windows\system32\drivers\drmk.sys
2009-04-11 10:13 44,416 a------- c:\windows\system32\drivers\stream.sys
2009-04-11 10:13 117,248 ac------ c:\windows\system32\dllcache\ksproxy.ax
2009-04-11 10:13 4,096 ac------ c:\windows\system32\dllcache\ksuser.dll
2009-04-11 10:13 117,248 a------- c:\windows\system32\ksproxy.ax
2009-04-11 10:13 4,096 a------- c:\windows\system32\ksuser.dll
2009-04-11 10:13 5,063,168 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-04-11 10:13 1,206,816 a------- c:\windows\RtlUpd.exe
2009-04-11 10:08 <DIR> --d----- c:\documents and settings\hsen\Shared
2009-04-11 10:07 <DIR> --d----- c:\documents and settings\hsen\Incomplete
2009-04-11 10:07 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-11 09:56 <DIR> --d----- c:\docume~1\hsen\applic~1\mp3rocket
2009-04-11 09:38 22,016 a------- c:\windows\system32\wdmaud.drv
2009-04-11 09:38 <DIR> --d----- c:\program files\Realtek
2009-04-11 09:38 540,672 a------- c:\windows\RtlExUpd.dll
2009-04-11 09:13 <DIR> --d----- c:\windows\system32\bits
2009-03-30 10:51 210,352 a------- c:\windows\system32\idmmbc.dll
==================== Find3M ====================
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\MIU0KGU4.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\XFRRXBTB.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\KMEDR131.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\B1ZN77XB.DAT
2009-04-14 17:40 2,678 a------- c:\windows\java\packages\data\84FFFLF5.DAT
2009-04-11 09:35 368,076 a------- c:\windows\system32\perfh00C.dat
2009-04-11 09:35 48,856 a------- c:\windows\system32\perfc00C.dat
2009-02-24 09:36 1,109 a------- c:\windows\system32\drivers\PConfig.DCF
============= FINISH: 14:31:36,37 ===============
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
-----------\\ ToolBar S&D 1.2.8 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix - Award BIOS v6.00PG
USER : hsen ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:78 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:70 Go (Free:70 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 17/04/2009|14:48 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\System32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q="
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"
voila le raport de la recherche de toulbar ;
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\hsen\Mes documents\Downloads\Compressed\Top 40 singles USA April 3rd (2009)\13 Eminem Feat. 50 Cent & Dr. Dre - Crack A Bottle.mp3
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
1 - "C:\ToolBar SD\TB_1.txt" - 17/04/2009|14:29 - Option : [2]
2 - "C:\ToolBar SD\TB_2.txt" - 17/04/2009|14:48 - Option : [1]
-----------\\ Fin du rapport a 14:48:59,21
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix - Award BIOS v6.00PG
USER : hsen ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:78 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:70 Go (Free:70 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 17/04/2009|14:48 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\System32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q="
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"
voila le raport de la recherche de toulbar ;
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\hsen\Mes documents\Downloads\Compressed\Top 40 singles USA April 3rd (2009)\13 Eminem Feat. 50 Cent & Dr. Dre - Crack A Bottle.mp3
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
1 - "C:\ToolBar SD\TB_1.txt" - 17/04/2009|14:29 - Option : [2]
2 - "C:\ToolBar SD\TB_2.txt" - 17/04/2009|14:48 - Option : [1]
-----------\\ Fin du rapport a 14:48:59,21
-----------\\ ToolBar S&D 1.2.8 XP/Vista
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix - Award BIOS v6.00PG
USER : hsen ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:78 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:70 Go (Free:70 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 17/04/2009|14:54 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\System32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q="
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\hsen\Mes documents\Downloads\Compressed\Top 40 singles USA April 3rd (2009)\13 Eminem Feat. 50 Cent & Dr. Dre - Crack A Bottle.mp3
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
1 - "C:\ToolBar SD\TB_1.txt" - 17/04/2009|14:29 - Option : [2]
2 - "C:\ToolBar SD\TB_2.txt" - 17/04/2009|14:48 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 17/04/2009|14:54 - Option : [2]
-----------\\ Fin du rapport a 14:54:31,20
Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix - Award BIOS v6.00PG
USER : hsen ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:78 Go (Free:69 Go)
D:\ (Local Disk) - NTFS - Total:70 Go (Free:70 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 17/04/2009|14:54 )
-----------\\ Recherche de Fichiers / Dossiers ...
-----------\\ [..\Internet Explorer\Main]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\System32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://toolbar.ask.com/toolbarv/askRedirect?o=13116&gct=&gc=1&q="
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="https://www.msn.com/fr-fr/"
--------------------\\ Recherche d'autres infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\hsen\Mes documents\Downloads\Compressed\Top 40 singles USA April 3rd (2009)\13 Eminem Feat. 50 Cent & Dr. Dre - Crack A Bottle.mp3
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
1 - "C:\ToolBar SD\TB_1.txt" - 17/04/2009|14:29 - Option : [2]
2 - "C:\ToolBar SD\TB_2.txt" - 17/04/2009|14:48 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 17/04/2009|14:54 - Option : [2]
-----------\\ Fin du rapport a 14:54:31,20
Bon je prend la suite alors.
Normal que rien ne c'est passé Hassen, déjà j'ai demandé l'option nettoyage de ToolBArSD, résultat, tu m'as fait l'option scan !!
Fait l'option nettoyage.
Merci.
Ensuite,
● Télécharge OtmoveIt3 d'Old Timer Sur ton bureau.
● Double clique sur " OtmoveIt3.exe " pour le lancer.
● Copie/colle le texte suivant en gris dans la case de gauche " Paste Instructions for items to be moved "
● Clique sur " MoveIt! "
● Copie tout ce qui est marqué dans la case de droite " Results "
● Colle tout sur le forum.
( Rapport situé ici aussi : C:\_OTMoveIt\MovedFiles )
**************************************************
● Lance MalwareByte's Anti-Malware,
● Mets le à jour ( avec l'onglet 'Mise à jour' )
● Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
● Sélectionne Exécuter un examen RAPIDE si ce n'est pas déjà fait
● clique sur Rechercher
● Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok
● Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.
● Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection
● Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.
Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok
Tutorial : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
++
Normal que rien ne c'est passé Hassen, déjà j'ai demandé l'option nettoyage de ToolBArSD, résultat, tu m'as fait l'option scan !!
Fait l'option nettoyage.
Merci.
Ensuite,
● Télécharge OtmoveIt3 d'Old Timer Sur ton bureau.
● Double clique sur " OtmoveIt3.exe " pour le lancer.
● Copie/colle le texte suivant en gris dans la case de gauche " Paste Instructions for items to be moved "
:processes explorer.exe vwvoeuxb.exe logon.exe :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] "Windows DLL Loader"=- "Windows Logon Application"=- :files c:\windows\java\packages\data\MIU0KGU4.DAT c:\windows\java\packages\data\XFRRXBTB.DAT c:\windows\java\packages\data\KMEDR131.DAT c:\windows\java\packages\data\B1ZN77XB.DAT c:\windows\java\packages\data\84FFFLF5.DAT C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar c:\windows\system32\vwvoeuxb.exe c:\windows\system32\logon.exe :Commands [zipfiles] [emptytemp] [start explorer]
● Clique sur " MoveIt! "
● Copie tout ce qui est marqué dans la case de droite " Results "
● Colle tout sur le forum.
( Rapport situé ici aussi : C:\_OTMoveIt\MovedFiles )
**************************************************
● Lance MalwareByte's Anti-Malware,
● Mets le à jour ( avec l'onglet 'Mise à jour' )
● Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
● Sélectionne Exécuter un examen RAPIDE si ce n'est pas déjà fait
● clique sur Rechercher
● Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok
● Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.
● Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection
● Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.
Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok
Tutorial : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
++
fais ce que te demande C_XX dans le message 9 avec otmoviet et malwarebytes
Malwarebytes' Anti-Malware 1.36
Database version: 2002
Windows 5.1.2600 Service Pack 1
17/04/2009 16:06:39
mbam-log-2009-04-17 (16-06-39).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 95079
Time elapsed: 15 minute(s), 20 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 30
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN11.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN12.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN13.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN17.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN1F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN24.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN25.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN26.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN27.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN28.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN29.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN34.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN35.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN38.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN39.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN41.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN48.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN20.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
Database version: 2002
Windows 5.1.2600 Service Pack 1
17/04/2009 16:06:39
mbam-log-2009-04-17 (16-06-39).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 95079
Time elapsed: 15 minute(s), 20 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 30
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN11.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN12.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN13.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN17.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN1F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN24.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN25.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN26.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN27.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN28.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN29.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN34.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN35.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN38.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN39.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN41.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN48.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\hsen\Local Settings\Temp\BN4F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN20.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
========== PROCESSES ==========
Process explorer.exe killed successfully.
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04172009_161746
Process explorer.exe killed successfully.
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04172009_161746
ton rapport otmoviet est plus que bizare tu avais bien fais un copier coller de ce qui était donné dans la procédure
:processes
explorer.exe
vwvoeuxb.exe
logon.exe
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"Windows DLL Loader"=-
"Windows Logon Application"=-
:files
c:\windows\java\packages\data\MIU0KGU4.DAT
c:\windows\java\packages\data\XFRRXBTB.DAT
c:\windows\java\packages\data\KMEDR131.DAT
c:\windows\java\packages\data\B1ZN77XB.DAT
c:\windows\java\packages\data\84FFFLF5.DAT
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
c:\windows\system32\vwvoeuxb.exe
c:\windows\system32\logon.exe
:Commands
[zipfiles]
[emptytemp]
[start explorer]
:processes
explorer.exe
vwvoeuxb.exe
logon.exe
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"Windows DLL Loader"=-
"Windows Logon Application"=-
:files
c:\windows\java\packages\data\MIU0KGU4.DAT
c:\windows\java\packages\data\XFRRXBTB.DAT
c:\windows\java\packages\data\KMEDR131.DAT
c:\windows\java\packages\data\B1ZN77XB.DAT
c:\windows\java\packages\data\84FFFLF5.DAT
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
c:\windows\system32\vwvoeuxb.exe
c:\windows\system32\logon.exe
:Commands
[zipfiles]
[emptytemp]
[start explorer]
parce que ton rapport ne resemble pas à un rapport dans lequel il y aurait été coller ce qui à été donné donc pour être sur tu refais otmoviet et tu fais un copier coller de ce qui est en gras et tu postes le nouveau rapport , Merci
Double-clique sur OTMoveIt3.exe pour le lancer.
Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.
Copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".
:processes
explorer.exe
vwvoeuxb.exe
logon.exe
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"Windows DLL Loader"=-
"Windows Logon Application"=-
:files
c:\windows\java\packages\data\MIU0KGU4.DAT
c:\windows\java\packages\data\XFRRXBTB.DAT
c:\windows\java\packages\data\KMEDR131.DAT
c:\windows\java\packages\data\B1ZN77XB.DAT
c:\windows\java\packages\data\84FFFLF5.DAT
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
c:\windows\system32\vwvoeuxb.exe
c:\windows\system32\logon.exe
:Commands
[zipfiles]
[emptytemp]
[start explorer]
Clique sur "MoveIt!" pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur "Exit" pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .
Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
Double-clique sur OTMoveIt3.exe pour le lancer.
Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.
Copie la liste qui se trouve en gras ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".
:processes
explorer.exe
vwvoeuxb.exe
logon.exe
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"Windows DLL Loader"=-
"Windows Logon Application"=-
:files
c:\windows\java\packages\data\MIU0KGU4.DAT
c:\windows\java\packages\data\XFRRXBTB.DAT
c:\windows\java\packages\data\KMEDR131.DAT
c:\windows\java\packages\data\B1ZN77XB.DAT
c:\windows\java\packages\data\84FFFLF5.DAT
C:\DOCUME~1\hsen\Mes documents\Downloads\Programs\Internet.Download.Manager.v5.12.8.WinAll.Incl.Keygen.and.Patch-CRD.rar
c:\windows\system32\vwvoeuxb.exe
c:\windows\system32\logon.exe
:Commands
[zipfiles]
[emptytemp]
[start explorer]
Clique sur "MoveIt!" pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur "Exit" pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .
Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
voila le raport
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret < File/Folder gmer.log not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder gmer_uninstall.cmd not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder gmer.sys not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <Service not present: gmer.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder haxfix.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder haxfix.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder killbox.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder !Killbox not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder NoLop.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder NoLop.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder NoLopOLD.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder delete.bat not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTListIt2.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTListIt.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder Extras.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder _OTListIt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTMoveIt.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTMoveIt2.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles\04172009_161746 folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles\04172009_153009 folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret < > in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04182009_130310> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Service not present: catchme.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Service not present: gmer.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles\04182009_130310 folder deleted successfully.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles folder deleted successfully.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt folder deleted successfully.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04182009_130332> in the current context!
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04182009_130342
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret < File/Folder gmer.log not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder gmer_uninstall.cmd not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder gmer.sys not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <Service not present: gmer.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder haxfix.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder haxfix.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder killbox.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder !Killbox not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder NoLop.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder NoLop.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder NoLopOLD.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder delete.bat not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTListIt2.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTListIt.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder Extras.txt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder _OTListIt not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTMoveIt.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File/Folder OTMoveIt2.exe not found.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles\04172009_161746 folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles\04172009_153009 folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt folder deleted successfully.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret < > in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04182009_130310> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Service not present: catchme.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <Service not present: gmer.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles\04182009_130310 folder deleted successfully.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt\MovedFiles folder deleted successfully.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <C:\_OTMoveIt folder deleted successfully.> in the current context!> in the current context!
Error: Unable to interpret <Error: Unable to interpret <File delete failed. C:\Documents and Settings\hsen\Bureau\OTMoveIt3.exe scheduled to be deleted on reboot.> in the current context!> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04182009_130332> in the current context!
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04182009_130342
ton rapport resemble à rien de logique tu fais bien un copier coller de ce qui est en gras dans le message 18 comme demander de le faire dans le cadre de gauche de otmoviet ???
bon la passes malwarebytes
Télécharge Malwarebytes' Anti-Malware: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
. sur la page cliques sur Télécharger Malwarebyte's Anti-Malware
. enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. si le pare-feu demande l'autorisation de se connecter pour malwarebytes, acceptes
. Il va se mettre à jour une fois faite
. rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, cliques sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés)
. cliques sur Supprimer la sélection
. Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. redemarre le pc
. une fois redémarré double-cliques sur malwarebytes
. rends toi dans l'onglet rapport/log
. tu cliques dessus pour l'afficher une fois affiché
. tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous
. tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller
bon la passes malwarebytes
Télécharge Malwarebytes' Anti-Malware: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
. sur la page cliques sur Télécharger Malwarebyte's Anti-Malware
. enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. si le pare-feu demande l'autorisation de se connecter pour malwarebytes, acceptes
. Il va se mettre à jour une fois faite
. rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, cliques sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés)
. cliques sur Supprimer la sélection
. Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. redemarre le pc
. une fois redémarré double-cliques sur malwarebytes
. rends toi dans l'onglet rapport/log
. tu cliques dessus pour l'afficher une fois affiché
. tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous
. tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller
