Avira Antivir : Installation impossible
Résolu
ROYA2
Messages postés
369
Statut
Membre
-
gen-hackman -
gen-hackman -
Bonjour,
Je crois que j'ai un virus sur mon pc qui empeche tout installation d'anti-virus. Je m'explique :
Avant j'utilisais Avira Antivir correctement et je n'ai jamis eu de problèmes, mais aujourd'hui dès que j'ai allumé mon ordi, au lieu qu'il me lance automatiquement Antivir au demarrage, il m'as affiché un message d'erreur de ce genre :
(avgnt.exe correspondant au nom de processus de l'application)
Alors j'ai essayé de le désinstaller puis de le réinstaller sans succès car à l'installation j'ai eu ce rapport :
L'installation n'a pas pu s'effetuer et je me retrouve maintenant avec un PC 3 fois plus lent qu'auparavant et sans anti-virus.
Merci d'avance pour vos réponses
ROYA2
Je crois que j'ai un virus sur mon pc qui empeche tout installation d'anti-virus. Je m'explique :
Avant j'utilisais Avira Antivir correctement et je n'ai jamis eu de problèmes, mais aujourd'hui dès que j'ai allumé mon ordi, au lieu qu'il me lance automatiquement Antivir au demarrage, il m'as affiché un message d'erreur de ce genre :
avgnt.exe n'est pas une application WIN32 valide
(avgnt.exe correspondant au nom de processus de l'application)
Alors j'ai essayé de le désinstaller puis de le réinstaller sans succès car à l'installation j'ai eu ce rapport :
Extraction de eula.txt Extraction de readme.txt Extraction de about.htm Extraction de basic\addr_file.html Extraction de filelist.ini Extraction de product.ini Extraction de basic\2k\avgntflt.inf Extraction de basic\xp\avgntflt.inf Extraction de basic\xp64\avgntflt.inf Extraction de basic\vista64\avgntflt.inf Extraction de basic\2k\avipbb.inf Extraction de basic\xp\avipbb.inf Extraction de basic\ssmdrv.inf Extraction de basic\avadmin.exe Extraction de basic\avcenter.exe Extraction de basic\avconfig.exe Extraction de basic\avgnt.exe Extraction de basic\avguard.exe Extraction de basic\avnotify.exe Extraction de basic\avscan.exe Extraction de basic\avupgsvc.exe Extraction de basic\avwsc.exe Extraction de basic\fact.exe Extraction de basic\guardgui.exe Extraction de basic\imp64b.exe Extraction de basic\licmgr.exe Extraction de basic\presetup.exe Extraction de basic\sched.exe Extraction de basic\setup.exe Extraction de basic\update.exe Extraction de basic\vcredist_x86.exe Extraction de basic\wsctool.exe Extraction de basic\aebb.dll Extraction de basic\aecore.dll Extraction de basic\aeemu.dll Extraction de basic\aegen.dll Extraction de basic\aehelp.dll Extraction de basic\aeheur.dll Extraction de basic\aeoffice.dll Extraction de basic\aepack.dll Extraction de basic\aerdl.dll Extraction de basic\aescn.dll Extraction de basic\aescript.dll Extraction de basic\aevdf.dll Extraction de basic\avarkt.dll Impossible de créer basic\avarkt.dll Extraction de basic\avconfig.dll Extraction de basic\avconfigrc.dll Extraction de basic\avevtlog.dll Extraction de avevtrc.dll Extraction de basic\avgio.dll Extraction de basic\avinet.dll Extraction de basic\avipc.dll Extraction de basic\avnotify.dll Extraction de basic\avpref.dll Extraction de basic\AVReg.dll Extraction de basic\avrep.dll Extraction de basic\avscan.dll Extraction de basic\avwinll.dll Extraction de basic\avwmi.dll Extraction de basic\ccev.dll Extraction de basic\ccevrc.dll Extraction de basic\ccgen.dll Extraction de basic\ccgenrc.dll Extraction de basic\ccgrdrc.dll Extraction de basic\ccguard.dll Extraction de basic\cclib.dll Extraction de basic\cclic.dll Extraction de basic\cclicrc.dll Extraction de basic\ccmainrc.dll Extraction de basic\ccmsg.dll Extraction de basic\ccprofil.dll Extraction de basic\ccquamgr.dll Extraction de basic\ccquarc.dll Extraction de basic\ccreporc.dll Extraction de basic\ccreport.dll Extraction de basic\ccscanrc.dll Extraction de basic\ccsched.dll Extraction de basic\ccscherc.dll Extraction de basic\cctpc.dll Extraction de basic\ccupdate.dll Extraction de basic\ccupdrc.dll Extraction de basic\cfglib.dll Extraction de basic\factrc.dll Extraction de basic\guardmsg.dll Extraction de basic\licmgr.dll Extraction de basic\luke.dll Extraction de basic\lukeres.dll Extraction de basic\mgrs.dll Extraction de basic\msgclient.dll Extraction de basic\netnt.dll Extraction de rchelp.dll Extraction de rcimage.dll Extraction de rctext.dll Extraction de basic\scewxmlw.dll Extraction de basic\schedr.dll Extraction de basic\setup.dll Extraction de basic\shlext.dll Extraction de basic\shlext64.dll Extraction de basic\smtplib.dll Extraction de basic\sqlite3.dll Extraction de basic\unacev2.dll Extraction de basic\update.dll Extraction de basic\updaterc.dll Extraction de updext.dll Extraction de basic\updgui.dll Extraction de basic\updguirc.dll Extraction de basic\wksstats.dll Extraction de basic\avgio.sys Extraction de basic\avgio64.sys Extraction de basic\xp\avgntdd.sys Extraction de basic\nt\avgntdd.sys Extraction de basic\2k\avgntdd.sys Extraction de basic\xp\avgntflt.sys Extraction de basic\2k\avgntflt.sys Extraction de basic\vista64\avgntflt.sys Extraction de basic\xp64\avgntflt.sys Extraction de basic\nt\avgntmgr.sys Extraction de basic\2k\avgntmgr.sys Extraction de basic\xp\avgntmgr.sys Extraction de basic\xp\avipbb.sys Extraction de basic\2k\avipbb.sys Extraction de basic\ssmdrv.sys Extraction de default.wav Extraction de produpd.avj Extraction de scanjob.avj Extraction de startupd.avj Extraction de updjob.avj Extraction de alldiscs.avp Extraction de alldrives.avp Extraction de folder.avp Extraction de mydocs.avp Extraction de process.avp Extraction de rmdiscs.avp Extraction de rootkit.avp Extraction de sysdir.avp Extraction de sysscan.avp Extraction de basic\prefix_msg.avr Extraction de basic\xp64\avgntflt.cat Extraction de basic\vista64\avgntflt.cat Extraction de avwin.chm Extraction de basic\avconfig.cpl Extraction de basic\avconfig64.cpl Extraction de basic\aeset.dat Extraction de basic\avscan.dat Extraction de build.dat Extraction de prodinfo.dat Extraction de setupprf.dat Extraction de hbedv.key Extraction de antivir.oem Extraction de weblink.url Extraction de basic\antivir0.vdf Extraction de basic\antivir1.vdf Extraction de basic\antivir2.vdf Extraction de basic\antivir3.vdf Extraction de ccplg.xml Extraction de sweb.zip Extraction de basic\2k Extraction de basic\nt Extraction de basic\vista64 Extraction de basic\xp Extraction de basic\xp64 Extraction de basic
L'installation n'a pas pu s'effetuer et je me retrouve maintenant avec un PC 3 fois plus lent qu'auparavant et sans anti-virus.
Merci d'avance pour vos réponses
ROYA2
Configuration: Packard Bell Microsoft Windows XP Edition Familial 5.1 SP2 Avast Familliale Internet Explorer 7 - Mozila Firefox 3.0.1 Windows Live Messenger 2009
16 réponses
-
--> Installe Antivir et mets-le à jour.
--> Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches.
--> Dans Antivir, choisis Outils puis Configuration.
--> Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.
--> Fais un scan complet et poste le rapport.
Tutoriel sur Antivir-
OK, le scan est en cours, mais il y a un problème, dès que j'essaie de mettre à jour l'antivirus, il me met les message d'erreur suivant :
Lors de la tentative de demarrage de la mise à jour par internet, l'erreur suivante s'est produite : Sheduler Not loaded
-
-
-
-
--> Désinstalle AntiVir.
--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.
--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)
--> Clique sur Continue à l'écran Disclaimer.
--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).
Note : les rapports sont sauvegardés dans le dossier C:\rsit.
-
-
/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.
Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix-
J'ai lancé combofix, mais à un moment (je n'ai pas fait attention au numéro de l'étape), mon pc a redémarré et dès que j'ai ouvert ma session j'ai eu un message d'erreur :
Microsoft Windows Le système a récupéré d'une erreur sérieuse Veuillez envoyer les infoformation à Microsoft ect...
J'ai fait envoyé.
Sinon, aucon Combofix.txt dans HDD (C:), par contre il y a un fichier qui a comme icone le poste de travail et comme nom Combofix et des que je double cliques dessus il m'ouvre le poste de travail.
-
-
Bonjour,
--> Télécharge FindyKill (de Chiquitine29) sur ton Bureau.
--> Lance l'installation avec les paramètres par défaut.
--> Double-clique sur le raccourci FindyKill sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci FindyKill et choisir Exécuter en tant qu'administrateur)
--> Au menu principal, choisis l'option 1 (Recherche).
--> Poste le rapport FindyKill.txt
Note : le rapport FindyKill.txt est sauvegardé à la racine du disque. -
ok, je vais le télécharger et je vous postes les résultats.
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
salut tu joues avec des cracks ?
*****************************************************
************** Option 1 (Recherche) **************
*****************************************************
Télécharge FindyKill ( de Chiquitine29) sur ton bureau :
! Déconnecte toi et ferme toutes applications en cours !
* Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut .
* Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)
* Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .
* Au menu principal choisis l'option " F " pour français et tape sur [entrée] .
* Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]
Laisse travailler l'outil et ne touche à rien ...
--> Poste le rapport qui apparait à la fin , sur le forum ...
( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
Aides en images
-
Qui a eu cette idée folle un jour d'inventer l'école. C'est ce sacré gen-hackman, sacré gen-hackman !
-
Voilà, c'était plutôt rapide....
############################## [ FindyKill V4.731 ] # User : Aurélien (Administrateurs) # 047795520178 # Update on 30/05/09 by Chiquitine29 # Start at: 15:41:22 | 01/06/2009 # Website : http://pagesperso-orange.fr/NosTools/findykill.html # Intel(R) Pentium(R) 4 CPU 3.00GHz # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3 # Internet Explorer 8.0.6001.18702 # Windows Firewall Status : Enabled # C:\ # Disque fixe local # 117,19 Go (69,81 Go free) [HDD] # NTFS # D:\ # Disque CD-ROM # E:\ # Disque fixe local # 109,69 Go (94,44 Go free) [Windows 7] # NTFS # F:\ # Disque amovible # G:\ # Disque amovible # H:\ # Disque amovible # J:\ # Disque amovible # K:\ # Disque CD-ROM ############################## [ Processus actifs ] C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Prevx\prevx.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\Program Files\Prevx\prevx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LVCOMSX.EXE C:\WINDOWS\system32\qgctvvj0e50v.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Aurélien\Application Data\drivers\winupgro.exe C:\Documents and Settings\Aurélien\Aurélien.exe C:\Documents and Settings\Aurélien\Application Data\m\flec006.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\TRENDnet\TEW-624UB_TEW-644UB\WlanCU.exe C:\WINDOWS\System32\svchost.exe C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\BNA.tmp C:\WINDOWS\TEMP\BNC.tmp C:\WINDOWS\system32\wbem\wmiprvse.exe ################## [ Processus infectieux stoppés ] "C:\Documents and Settings\Aurélien\Application Data\drivers\winupgro.exe" (2184) "C:\Documents and Settings\Aurélien\Application Data\m\flec006.exe" (2716) "C:\WINDOWS\system32\wintems.exe" (11012) ################## [ Fichiers / Dossiers infectieux ] Found ! C:\WINDOWS\system32\mdelk.exe Found ! C:\WINDOWS\system32\wintems.exe Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\downld" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\srosa2.sys" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\wfsintwq.sys" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\data.oct" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\flec006.exe" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\list.oct" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\shared" Found ! "C:\Documents and Settings\Aur‚lien\Application Data\m\srvlist.oct" ################## [ Infected Temp Files ] Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[3].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[3].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[2].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_3[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\file[1].txt Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\mxd[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_1[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_3[1].jpg Found ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\servernames[1].htm Found ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\7zO35.tmp\key_gen.exe ################## [ Registre / Clés infectieuses ] Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Local AppWizard-Generated Applications\key_gen Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Local AppWizard-Generated Applications\msnmsgr Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Local AppWizard-Generated Applications\winupgro Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\bisoft Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\DateTime4 Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\FFC Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\MuleAppData Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Ubisoft Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S Found ! HKEY_CURRENT_USER\Software\bisoft Found ! HKEY_CURRENT_USER\Software\DateTime4 Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit" Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit" Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe" Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe" Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key" Found ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key" # (!) HKLM\SYSTEM\...\Services\srosa -> Start = 0x1 # (!) HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1 ################## [ Recherche dans supports amovibles] ################## [ Registre / Mountpoints2 ] # -> Not found ! ################## [ ! Fin du rapport # FindyKill V4.731 ! ]
-
voila ce qui arrive quand on telecharge des keygens en p2p
key_gen = tu as cliqué la dessus
Il s'agit de Bagle et cette infection arrive lorsque tu télécharges des cracks ou keygens, je te conseille donc de les supprimer si tu en as encore et eviter dorénavant d'en telecharger pour eviter que cette infection ne se réïtère.
*****************************************************
************* Option 2 (Suppression) *************
*****************************************************
! Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .
* Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)
* Relance "FindyKill" : au menu principal choisis l'option " F " pour français et tape sur [entrée] .
* Au second menu choisis l'option 2 (suppression) et tape sur [entrée]
* Le pc va redémarrer automatiquement ...
--> le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !
* Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide
Aides en images ( Suppression )
ensuite :
*****************************************************
*************** Option 3 (Uninstal) ****************
*****************************************************
* Relance "FindyKill" : au menu principal choisis l'option " F " et tape sur [entrée] .
* Au second menu choisis l'option 3 et tape sur [entrée] .
* Clique sur ok quand l avertissement apparait.
-
Pendant l'analyse j'ai eu ce message d'erreur, je ne sais pas si c'est normal :
Error allocating memory
Sinon, voilà le rapport :
############################## [ FindyKill V4.731 ] # User : Aurélien (Administrateurs) # 047795520178 # Update on 30/05/09 by Chiquitine29 # Start at: 15:55:19 | 01/06/2009 # Website : http://pagesperso-orange.fr/NosTools/findykill.html # Intel(R) Pentium(R) 4 CPU 3.00GHz # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3 # Internet Explorer 8.0.6001.18702 # Windows Firewall Status : Enabled # C:\ # Disque fixe local # 117,19 Go (69,81 Go free) [HDD] # NTFS # D:\ # Disque CD-ROM # E:\ # Disque fixe local # 109,69 Go (94,44 Go free) [Windows 7] # NTFS # F:\ # Disque amovible # G:\ # Disque amovible # H:\ # Disque amovible # I:\ # Disque amovible # 1,89 Go (903,47 Mo free) [AURELIEN] # FAT # J:\ # Disque amovible # K:\ # Disque CD-ROM ############################## [ Active Processes ] C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\WINDOWS\system32\LogonUI.EXE C:\Program Files\Prevx\prevx.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Prevx\prevx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe ################## [ Infected Files \ Folders ] Deleted ! C:\WINDOWS\system32\mdelk.exe Deleted ! C:\WINDOWS\system32\wintems.exe Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\srosa2.sys" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\wfsintwq.sys" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\data.oct" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\flec006.exe" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\list.oct" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\srvlist.oct" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\downld" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\shared" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m" ################## [ Infected Temp Files ] Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\AutoRun.exe Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\7zO35.tmp\key_gen.exe Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[3].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[3].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\file[1].txt Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\mxd[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\servernames[1].htm ################## [ Registry / Infected keys ] Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S Deleted ! HKEY_CURRENT_USER\Software\bisoft Deleted ! HKEY_CURRENT_USER\Software\DateTime4 Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\FFC Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\MuleAppData Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Ubisoft Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit" Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe" Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key" ################## [ Cleaning Removable drives ] Deleted ! I:\autorun.inf ################## [ Registry / Mountpoint2 ] # -> Not found ! ################## [ States / Restarting of services ] # Services : [ Auto=2 / Request=3 / Disable=4 ] # Ndisuio -> # Type of startup =3 # EapHost -> # Type of startup =2 # Ip6Fw -> # Type of startup =2 # SharedAccess -> # Type of startup =2 # wuauserv -> # Type of startup =2 # wscsvc -> # Type of startup =2 # Safe boot mode restored ! ################## [ Searching Other Infections ] # Références de comparaison Bagle MD5 : File ... : C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe CRC32 .. : 1aeb07b8 MD5 .... : 0397d95f607289e7733d9ef221a5c6cd # -> Nothing found. ################## [ Corrupted files # Re-Installation required ] C:\APPS\RecordNow\Launch.exe C:\Program Files\Avira\basic\avadmin.exe C:\Program Files\Avira\basic\avcenter.exe C:\Program Files\Avira\basic\avconfig.exe C:\Program Files\Avira\basic\avgnt.exe C:\Program Files\Avira\basic\avguard.exe C:\Program Files\Avira\basic\avnotify.exe C:\Program Files\Avira\basic\avscan.exe C:\Program Files\Avira\basic\guardgui.exe C:\Program Files\Avira\basic\licmgr.exe C:\Program Files\Avira\basic\sched.exe C:\Program Files\Avira\basic\update.exe C:\Program Files\Avira\basic\wsctool.exe C:\Program Files\Mozilla Firefox\uninstall\helper.exe ################################### [ Cracks / Keygens / Serials ] # -> Nothing found ! ################## [ ! End of Report # FindyKill V4.731 ! ]
-
Pour voir ce qu'il en est,avoir un diagnostic précis et donc repérer les infections possibles et les neutraliser:
Télécharges et installes le logiciel de diagnostic :
ici Hijackthis
1- Cliques sur le setup pour lancer l'installe : laisses toi guider et ne modifies pas les paramètres d'installation .
A la fin de l'installe , le prg ce lance automatiquement : fermes le en cliquant sur la croix rouge .
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .
tuto pour utilisation :(merci balltrap34)
Regardes ici, c'est parfaitement expliqué en images ,
2- !! Déconnectes toi et fermes toute tes applications en cours !!
Cliques sur le raccourci du bureau pour lancer le prg :
S'il ne se lance pas clique ici
fais un scan HijackThis en cliquant sur : "Do a system scan and save a logfile"
--->copies-colles le rapport généré pour analyse
G3и-н@¢км@и™©® -
############################## [ FindyKill V4.731 ] # User : Aurélien (Administrateurs) # 047795520178 # Update on 30/05/09 by Chiquitine29 # Start at: 15:55:19 | 01/06/2009 # Website : http://pagesperso-orange.fr/NosTools/findykill.html # Intel(R) Pentium(R) 4 CPU 3.00GHz # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3 # Internet Explorer 8.0.6001.18702 # Windows Firewall Status : Enabled # C:\ # Disque fixe local # 117,19 Go (69,81 Go free) [HDD] # NTFS # D:\ # Disque CD-ROM # E:\ # Disque fixe local # 109,69 Go (94,44 Go free) [Windows 7] # NTFS # F:\ # Disque amovible # G:\ # Disque amovible # H:\ # Disque amovible # I:\ # Disque amovible # 1,89 Go (903,47 Mo free) [AURELIEN] # FAT # J:\ # Disque amovible # K:\ # Disque CD-ROM ############################## [ Active Processes ] C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\WINDOWS\system32\LogonUI.EXE C:\Program Files\Prevx\prevx.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Prevx\prevx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe ################## [ Infected Files \ Folders ] Deleted ! C:\WINDOWS\system32\mdelk.exe Deleted ! C:\WINDOWS\system32\wintems.exe Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\srosa2.sys" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\wfsintwq.sys" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\data.oct" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\flec006.exe" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\list.oct" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\srvlist.oct" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers\downld" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\drivers" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m\shared" Deleted ! "C:\Documents and Settings\Aur‚lien\Application Data\m" ################## [ Infected Temp Files ] Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\AutoRun.exe Deleted ! C:\DOCUME~1\AURLIE~1\LOCALS~1\Temp\7zO35.tmp\key_gen.exe Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64[3].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_1[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\4IGQ436S\b64_3[3].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_1[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\H46X1J2S\b64_3[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_1[2].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\file[1].txt Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\SHAHIW1L\mxd[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_1[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\b64_3[1].jpg Deleted ! C:\Documents and Settings\Aur‚lien\Local Settings\Temporary Internet Files\Content.IE5\V5OMIF32\servernames[1].htm ################## [ Registry / Infected keys ] Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S Deleted ! HKEY_CURRENT_USER\Software\bisoft Deleted ! HKEY_CURRENT_USER\Software\DateTime4 Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\key_gen Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\FFC Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\MuleAppData Deleted ! HKEY_USERS\S-1-5-21-1170982658-3214024294-1526281595-1006\Software\Ubisoft Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit" Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe" Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key" ################## [ Cleaning Removable drives ] Deleted ! I:\autorun.inf ################## [ Registry / Mountpoint2 ] # -> Not found ! ################## [ States / Restarting of services ] # Services : [ Auto=2 / Request=3 / Disable=4 ] # Ndisuio -> # Type of startup =3 # EapHost -> # Type of startup =2 # Ip6Fw -> # Type of startup =2 # SharedAccess -> # Type of startup =2 # wuauserv -> # Type of startup =2 # wscsvc -> # Type of startup =2 # Safe boot mode restored ! ################## [ Searching Other Infections ] # Références de comparaison Bagle MD5 : File ... : C:\Documents and Settings\Aur‚lien\Application Data\drivers\winupgro.exe CRC32 .. : 1aeb07b8 MD5 .... : 0397d95f607289e7733d9ef221a5c6cd # -> Nothing found. ################## [ Corrupted files # Re-Installation required ] C:\APPS\RecordNow\Launch.exe C:\Program Files\Avira\basic\avadmin.exe C:\Program Files\Avira\basic\avcenter.exe C:\Program Files\Avira\basic\avconfig.exe C:\Program Files\Avira\basic\avgnt.exe C:\Program Files\Avira\basic\avguard.exe C:\Program Files\Avira\basic\avnotify.exe C:\Program Files\Avira\basic\avscan.exe C:\Program Files\Avira\basic\guardgui.exe C:\Program Files\Avira\basic\licmgr.exe C:\Program Files\Avira\basic\sched.exe C:\Program Files\Avira\basic\update.exe C:\Program Files\Avira\basic\wsctool.exe C:\Program Files\Mozilla Firefox\uninstall\helper.exe ################################### [ Cracks / Keygens / Serials ] # -> Nothing found ! ################## [ ! End of Report # FindyKill V4.731 ! ]
-
Bonjour, le logiciel ne m'a ouvert qu'un fichier : log.txt :(
Le voici :
Logfile of random's system information tool 1.06 (written by random/random) Run by Aurélien at 2009-06-01 19:21:45 Microsoft Windows XP Édition familiale Service Pack 3 System drive C: has 73 GB (61%) free of 120 GB Total RAM: 1023 MB (33% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:21:46, on 01/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe C:\Program Files\Prevx\prevx.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\TUProgSt.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\TRENDnet\TEW-624UB_TEW-644UB\WlanCU.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Aurélien\Aurélien.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Prevx\prevx.exe C:\Program Files\Astase\PowerBatch\PowerBatch.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Aurélien\Bureau\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Aurélien.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: ShoppingAdsHelper - {2C86C605-6081-D104-96F7-F765C20B22F1} - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-1.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [rgcrvvj0e50v] C:\WINDOWS\system32\qgctvvj0e50v.exe O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Aurélien] C:\Documents and Settings\Aurélien\Aurélien.exe /i O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4924EA7F-F545-4641-ACFD-9F354E381BFD}: NameServer = 192.168.1.1 O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe O23 - Service: Google Update Service (gupdate1c987b7f1c21284) (gupdate1c987b7f1c21284) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe -- End of file - 8400 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1170982658-3214024294-1526281595-1007.job C:\WINDOWS\tasks\HDReg.job C:\WINDOWS\tasks\Maintenance en 1 clic.job C:\WINDOWS\tasks\User_Feed_Synchronization-{412F16E1-ACC7-4245-A381-0FA2600B37FF}.job C:\WINDOWS\tasks\User_Feed_Synchronization-{4F425F12-6323-403E-A117-ADED1C0857E7}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C86C605-6081-D104-96F7-F765C20B22F1}] ShoppingAdsHelper - C:\Program Files\ShoppingAdsHelper\ShoppingAdsHelper-1.dll [2009-02-15 618496] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] {32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-04-23 937416] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Alcmtr"=ALCMTR.EXE [] "LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184] "rgcrvvj0e50v"=C:\WINDOWS\system32\qgctvvj0e50v.exe [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "WIAWizardMenu"=C:\WINDOWS\system32\sti_ci.dll [2008-04-13 138240] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2008-12-02 3882312] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] "Aurélien"=C:\Documents and Settings\Aurélien\Aurélien.exe [2009-06-01 21016] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"= :\WINDOWS\syste [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "NoDispCPL"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableLUA"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoChangeAnimation"=0 "NoChangeKeyboardNavigationIndicators"=0 "NoThemesTab"=0 "NoStartMenuPinnedList"=0 "NoUserNameInStartMenu"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager" "C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile" "C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi" "C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe"="C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin" "C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox" "C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe"="C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe:*:Enabled:Zoo Tycoon 2 Executable" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" "C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player" "C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix" "E:\Program Files\eMule\emule.exe"="E:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Prevx\prevx.exe"="C:\Program Files\Prevx\prevx.exe:*:Enabled:ENABLE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e918a05-4eb6-11de-a5c1-0014d15bcbdd}] shell\AutoRun\command - interface.bat ======List of files/folders created in the last 1 months====== 2009-06-01 19:16:27 ----D---- C:\rsit 2009-06-01 16:23:42 ----D---- C:\WINDOWS\LastGood 2009-06-01 16:11:38 ----D---- C:\Program Files\Trend Micro 2009-06-01 13:24:18 ----D---- C:\Program Files\Prevx 2009-06-01 13:22:55 ----D---- C:\Documents and Settings\All Users\Application Data\PrevxCSI 2009-06-01 13:22:51 ----A---- C:\WINDOWS\wininit.ini 2009-06-01 13:10:32 ----A---- C:\WINDOWS\system32\RaCoInst.dll 2009-06-01 13:10:16 ----D---- C:\Program Files\RALINK 2009-06-01 12:49:12 ----D---- C:\NVIDIA 2009-06-01 12:14:05 ----D---- C:\Program Files\RPG Maker VX 2009-06-01 11:51:59 ----A---- C:\WINDOWS\system32\HAL.dll 2009-06-01 11:48:12 ----D---- C:\Temp 2009-06-01 11:44:03 ----D---- C:\Program Files\Game_Maker5 2009-06-01 11:43:58 ----A---- C:\WINDOWS\GPInstall.exe 2009-06-01 11:26:33 ----A---- C:\WINDOWS\system32\sgcpvvj0e50v.dll 2009-06-01 11:26:30 ----A---- C:\WINDOWS\system32\nvrsk.dll 2009-06-01 11:18:29 ----D---- C:\Program Files\Game_Maker7 2009-06-01 10:58:05 ----D---- C:\WINDOWS\apppatch 2009-05-22 17:57:05 ----RA---- C:\WINDOWS\system32\lvcoinst.ini 2009-05-22 17:57:04 ----RA---- C:\WINDOWS\system32\LVUI2RC.dll 2009-05-22 17:57:04 ----RA---- C:\WINDOWS\system32\lvcoinst.dll 2009-05-22 17:57:03 ----RA---- C:\WINDOWS\system32\LVUI2.dll 2009-05-22 17:57:03 ----RA---- C:\WINDOWS\system32\lvcodec2.dll 2009-05-22 17:53:09 ----A---- C:\WINDOWS\system32\Lvkrn12n.dll 2009-05-22 17:53:09 ----A---- C:\WINDOWS\system32\LCamCpl.dll 2009-05-22 17:52:59 ----A---- C:\WINDOWS\system32\QCUI2.dll 2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\Ltwvc12n.dll 2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltkrn12n.dll 2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltimg12n.dll 2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltfil12n.DLL 2009-05-22 17:52:58 ----A---- C:\WINDOWS\system32\ltefx12n.dll 2009-05-22 17:52:57 ----A---- C:\WINDOWS\system32\LTDIS12n.dll 2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\lftif12n.dll 2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\lffax12n.dll 2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\LFCMP12n.DLL 2009-05-22 17:52:56 ----A---- C:\WINDOWS\system32\lfbmp12n.dll 2009-05-22 17:52:52 ----A---- C:\WINDOWS\system32\LQCUI2.dll 2009-05-22 17:46:31 ----A---- C:\WINDOWS\_delis32.ini 2009-05-22 17:45:52 ----R---- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe 2009-05-22 17:43:38 ----D---- C:\Program Files\Messenger 2009-05-20 16:29:48 ----A---- C:\WINDOWS\system32\TUProgSt.exe 2009-05-20 16:29:47 ----A---- C:\WINDOWS\system32\uxtuneup.dll 2009-05-20 16:29:45 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe 2009-05-20 16:29:44 ----D---- C:\Documents and Settings\Aurélien\Application Data\TuneUp Software 2009-05-20 16:29:07 ----D---- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2009-05-20 16:29:06 ----D---- C:\Program Files\TuneUp Utilities 2009 2009-05-20 16:27:26 ----SHD---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357} 2009-05-09 10:30:54 ----A---- C:\WINDOWS\system32\SeCEdit.exe 2009-05-09 10:30:54 ----A---- C:\WINDOWS\system32\scedll.dll 2009-05-09 10:30:54 ----A---- C:\WINDOWS\system32\Rshx32_5.dll 2009-05-09 10:30:52 ----A---- C:\WINDOWS\system32\wsecedit.dll 2009-05-06 06:00:38 ----SHD---- C:\$RECYCLE.BIN 2009-05-06 05:41:47 ----RASH---- C:\BOOTSECT.BAK 2009-05-06 05:41:39 ----SHD---- C:\Boot 2009-05-05 20:56:49 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite 2009-05-05 20:56:29 ----D---- C:\Program Files\DAEMON Tools Toolbar 2009-05-05 20:56:24 ----D---- C:\Program Files\DAEMON Tools Lite 2009-05-05 20:56:16 ----D---- C:\Documents and Settings\Aurélien\Application Data\DAEMON Tools Lite 2009-05-05 19:19:42 ----A---- C:\WINDOWS\BcdLog.txt 2009-05-05 19:14:01 ----A---- C:\WINDOWS\system32\setupempdrv03.exe 2009-05-05 19:14:01 ----A---- C:\WINDOWS\system32\EuEpmGdi.dll 2009-05-05 19:14:01 ----A---- C:\WINDOWS\system32\BootMan.exe 2009-05-05 19:13:49 ----D---- C:\Program Files\EASEUS 2009-05-05 19:03:31 ----D---- C:\Documents and Settings\Aurélien\Application Data\DeepBurner 2009-05-05 19:03:18 ----D---- C:\Program Files\Astonsoft 2009-05-05 18:59:39 ----D---- C:\Program Files\winMd5Sum 2009-05-04 20:03:07 ----D---- C:\Documents and Settings\Aurélien\Application Data\YouUp 2009-05-04 20:02:26 ----D---- C:\Program Files\Ubisoft 2009-05-03 16:04:13 ----D---- C:\Program Files\i-Media 2009-05-03 16:04:13 ----A---- C:\WINDOWS\GOTO.INI 2009-05-03 16:04:08 ----D---- C:\Program Files\Goto 2009-05-03 15:36:26 ----D---- C:\Program Files\Capturino V2 2009-05-02 10:55:15 ----D---- C:\Documents and Settings\Aurélien\Application Data\tazti 2009-05-02 10:37:09 ----D---- C:\WINDOWS\Kiriasse Logiciels 2009-05-02 10:36:36 ----N---- C:\WINDOWS\Setup1.exe 2009-05-02 10:36:35 ----A---- C:\WINDOWS\ST6UNST.EXE ======List of files/folders modified in the last 1 months====== 2009-06-01 19:21:32 ----D---- C:\WINDOWS\system32\drivers 2009-06-01 19:21:32 ----D---- C:\Program Files\Avira 2009-06-01 19:15:30 ----D---- C:\Program Files\Mozilla Firefox 2009-06-01 18:11:27 ----D---- C:\WINDOWS\Temp 2009-06-01 17:13:26 ----AD---- C:\WINDOWS\system32 2009-06-01 16:23:45 ----HD---- C:\WINDOWS\inf 2009-06-01 16:23:42 ----D---- C:\WINDOWS 2009-06-01 16:22:21 ----SHD---- C:\WINDOWS\Installer 2009-06-01 16:22:21 ----D---- C:\Config.Msi 2009-06-01 16:22:18 ----D---- C:\WINDOWS\WinSxS 2009-06-01 16:22:12 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared 2009-06-01 16:11:38 ----RD---- C:\Program Files 2009-06-01 16:03:09 ----RSD---- C:\WINDOWS\assembly 2009-06-01 16:03:09 ----D---- C:\WINDOWS\Microsoft.NET 2009-06-01 16:00:05 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-06-01 15:56:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-06-01 15:55:10 ----D---- C:\WINDOWS\system32\CatRoot2 2009-06-01 15:51:20 ----A---- C:\WINDOWS\system32\EDIT.INI 2009-06-01 13:12:33 ----D---- C:\WINDOWS\system32\CatRoot 2009-06-01 13:11:11 ----D---- C:\WINDOWS\system32\ReinstallBackups 2009-06-01 13:11:03 ----RSHD---- C:\WINDOWS\system32\dllcache 2009-06-01 13:10:32 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-06-01 13:10:15 ----HD---- C:\Program Files\InstallShield Installation Information 2009-06-01 13:00:21 ----D---- C:\Program Files\ma-config.com 2009-06-01 13:00:16 ----D---- C:\Documents and Settings\All Users\Application Data\ma-config.com 2009-06-01 12:36:34 ----ASH---- C:\BOOT.INI 2009-06-01 12:36:34 ----A---- C:\WINDOWS\win.ini 2009-06-01 12:36:34 ----A---- C:\WINDOWS\system.ini 2009-06-01 12:36:13 ----D---- C:\WINDOWS\pss 2009-06-01 12:24:52 ----D---- C:\Program Files\Windows Live 2009-06-01 11:32:00 ----D---- C:\Relevé AW 2009-06-01 11:27:57 ----D---- C:\WINDOWS\Minidump 2009-06-01 11:26:30 ----A---- C:\WINDOWS\system32\user32.DLL 2009-05-22 21:14:27 ----D---- C:\Program Files\World of Warcraft 2009-05-22 18:09:55 ----SD---- C:\WINDOWS\Tasks 2009-05-22 17:52:49 ----D---- C:\Program Files\Logitech 2009-05-20 21:44:49 ----D---- C:\Program Files\Windows Live Safety Center 2009-05-20 17:34:02 ----A---- C:\WINDOWS\imsins.BAK 2009-05-20 17:18:07 ----D---- C:\Program Files\adslTV 2009-05-20 17:18:00 ----D---- C:\Documents and Settings\Aurélien\Application Data\vlc 2009-05-20 17:17:40 ----D---- C:\Program Files\eMule 2009-05-20 17:14:02 ----D---- C:\Program Files\JkDefrag 2009-05-20 16:29:48 ----D---- C:\WINDOWS\system32\config 2009-05-20 16:24:43 ----D---- C:\Program Files\Messenger Plus! Live 2009-05-18 17:59:58 ----D---- C:\Program Files\ShoppingAdsHelper 2009-05-15 21:20:56 ----A---- C:\WINDOWS\orun32.ini 2009-05-09 10:32:13 ----D---- C:\WINDOWS\Prefetch 2009-05-09 10:30:54 ----D---- C:\WINDOWS\Help 2009-05-07 09:16:29 ----A---- C:\WINDOWS\system32\mrt.exe 2009-05-05 18:44:54 ----D---- C:\Documents and Settings\Aurélien\Application Data\Download Manager 2009-05-03 16:01:13 ----D---- C:\Mes Sites Web 2009-05-03 14:46:02 ----D---- C:\Argent 2009-05-03 08:37:11 ----D---- C:\WINDOWS\system32\LogFiles 2009-05-02 10:23:22 ----D---- C:\WINDOWS\Media ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576] R1 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-06-01 21361] R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244] R2 WLNdis50;WLan NDIS 5.0 I/O Control; C:\WINDOWS\system32\DRIVERS\wlndis50.sys [2008-01-23 20480] R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2004-09-16 2257920] R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016] R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288] R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys [2008-04-13 126686] R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 QCMerced;Logitech QuickCam Communicate; C:\WINDOWS\system32\DRIVERS\LVCM.sys [2005-05-27 1317152] R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys [2008-06-10 580096] R3 RTL8023;Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver; C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys [2003-12-31 69504] R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\system32\DRIVERS\slntamr.sys [2008-04-13 404990] R3 SlWdmSup;SlWdmSup; C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys [2003-07-02 39348] R3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720] S2 amd64si;amd64si; \??\C:\WINDOWS\system32\drivers\amd64si.sys [] S2 port135sik;port135sik; \??\C:\WINDOWS\system32\drivers\port135sik.sys [] S2 systemntmi;systemntmi; \??\C:\WINDOWS\system32\drivers\systemntmi.sys [] S2 ws2_32sik;ws2_32sik; \??\C:\WINDOWS\system32\drivers\ws2_32sik.sys [] S3 as42ozlw;as42ozlw; C:\WINDOWS\system32\drivers\as42ozlw.sys [] S3 avshws;YouUp Simulated Hardware; C:\WINDOWS\system32\DRIVERS\youup.sys [2009-02-13 57344] S3 Bridge;Pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552] S3 BridgeMP;Miniport de pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552] S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024] S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys [] S3 epmntdrv;epmntdrv; \??\C:\WINDOWS\system32\epmntdrv.sys [] S3 EuGdiDrv;EuGdiDrv; \??\C:\WINDOWS\system32\EuGdiDrv.sys [] S3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-03-17 113664] S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504] S3 Mtlstrm;Mtlstrm; C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys [2008-04-13 1309184] S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248] S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880] S3 NtMtlFax;NtMtlFax; C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys [2008-04-13 180360] S3 RecAgent;recagent; \??\C:\WINDOWS\system32\DRIVERS\RecAgent.sys [] S3 RT73;Belkin USB Network Adapter; C:\WINDOWS\system32\DRIVERS\rt73.sys [2005-08-03 232192] S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136] S3 SlNtHal;SlNtHal; C:\WINDOWS\system32\DRIVERS\Slnthal.sys [2008-04-13 95424] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-05 36864] S3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [] S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424] R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 CLCapSvc;CyberLink Background Capture Service (CBCS); c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe [2005-05-11 221266] R2 CSIScanner;CSIScanner; C:\Program Files\Prevx\prevx.exe [2009-06-01 4368952] R2 CyberLink Media Library Service;CyberLink Media Library Service; C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe [2005-05-11 61440] R2 GenericHidService;Generic Service for HID Keyboard Input Collections; c:\APPS\HIDSERVICE\HIDSERVICE.exe [2005-01-07 49152] R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120] R2 RalinkRegistryWriter;Ralink Registry Writer; C:\Program Files\RALINK\Common\RalinkRegistryWriter.exe [2008-05-13 69632] R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512] R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-05-20 604416] R2 UxTuneUp;TuneUp Extension de thème; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336] R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016] S2 CLSched;CyberLink Task Scheduler (CTS); c:\APPS\Powercinema\Kernel\TV\CLSched.exe [2005-05-11 110672] S2 gupdate1c987b7f1c21284;Google Update Service (gupdate1c987b7f1c21284); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-05 133104] S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-09-18 163908] S2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2008-04-13 73796] S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632] S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664] S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168] S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2009-05-29 234864] S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-05-20 361216] S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096] S4 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808] -----------------EOF-----------------
-
Oui.
-
Voilà :
ComboFix 09-06-04.06 - Aurélien 05/06/2009 7:31.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1023.647 [GMT 2:00] Lancé depuis: c:\documents and settings\Aurélien\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\beep.sys c:\windows\system32\nvrsk.dll . ---- Exécution préalable ------- . c:\documents and settings\Aurélien\Aurélien.exe c:\windows\system32\azton.mt c:\windows\system32\drivers\acpi32.sys c:\windows\system32\drivers\beep.sys c:\windows\system32\drivers\i386si.sys c:\windows\system32\drivers\systemntmi.sys c:\windows\system32\drivers\ws2_32sik.sys c:\windows\system32\Ijl11.dll c:\windows\system32\kr_done1 c:\windows\Temp\18.exe . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ACPI32 -------\Legacy_SYSTEMNTMI -------\Legacy_WS2_32SIK -------\Service_acpi32 -------\Service_systemntmi -------\Service_ws2_32sik ((((((((((((((((((((((((((((( Fichiers créés du 2009-05-05 au 2009-06-05 )))))))))))))))))))))))))))))))))))) . 2009-06-03 10:50 . 2009-06-04 13:45 -------- d-----w- C:\CLEUSB 2009-06-03 10:22 . 2009-06-03 10:22 2855 ----a-w- c:\windows\system32\choice.PIF 2009-06-03 10:21 . 2009-06-03 10:21 -------- d--h--w- c:\windows\PIF 2009-06-02 14:24 . 2009-06-02 14:27 -------- d-----w- C:\FindyKill 2009-06-02 14:19 . 2009-06-02 14:19 -------- d-----w- c:\windows\system32\wbem\Repository 2009-06-02 14:19 . 2009-06-02 14:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2009-06-01 18:58 . 2009-06-01 18:58 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software(2) 2009-06-01 18:53 . 2009-06-02 15:11 -------- d-----w- c:\program files\Glary Utilities 2009-06-01 18:41 . 2009-06-02 14:18 -------- d-----w- c:\program files\TuneUp Utilities 2009(2) 2009-06-01 17:16 . 2009-06-01 17:16 -------- d-----w- C:\rsit 2009-06-01 14:11 . 2009-06-01 14:11 -------- d-----w- c:\program files\Trend Micro 2009-06-01 11:24 . 2009-06-02 14:20 -------- d-----w- c:\program files\Prevx 2009-06-01 11:22 . 2009-06-02 14:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI 2009-06-01 11:12 . 2009-06-01 11:12 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys 2009-06-01 11:10 . 2008-06-10 19:52 438272 ----a-w- c:\windows\system32\RaCoInst.dll 2009-06-01 11:10 . 2008-06-16 12:57 4096 ----a-w- c:\windows\system32\drivers\rt2870.bin 2009-06-01 11:10 . 2008-06-05 21:28 11783 ----a-w- c:\windows\system32\RaCoInst.dat 2009-06-01 11:10 . 2009-06-01 11:10 -------- d-----w- c:\program files\RALINK 2009-06-01 10:49 . 2009-06-01 11:08 -------- d-----w- C:\NVIDIA 2009-06-01 10:14 . 2009-06-01 10:16 -------- d-----w- c:\program files\RPG Maker VX 2009-06-01 09:48 . 2009-06-01 09:48 -------- d-----w- C:\Temp 2009-06-01 09:44 . 2009-06-01 09:46 -------- d-----w- c:\program files\Game_Maker5 2009-06-01 09:43 . 2009-06-01 09:43 796672 ----a-w- c:\windows\GPInstall.exe 2009-06-01 09:26 . 2009-06-01 09:26 118784 ----a-w- c:\windows\system32\sgcpvvj0e50v.dll 2009-06-01 09:26 . 2009-06-02 14:54 579584 ----a-w- c:\windows\system32\dllcache\user32.dll 2009-06-01 09:26 . 2009-06-01 09:26 80191 ----a-w- c:\windows\system32\qgctvvj0e50v.exe 2009-06-01 09:18 . 2009-06-01 09:38 -------- d-----w- c:\program files\Game_Maker7 2009-06-01 08:58 . 2009-06-05 05:33 -------- d-----w- c:\windows\apppatch 2009-05-22 15:57 . 2005-05-27 09:36 372736 ----a-r- c:\windows\system32\LVUI2RC.dll 2009-05-22 15:57 . 2005-05-27 09:31 22016 ----a-r- c:\windows\system32\drivers\LVUSBSta.sys 2009-05-22 15:57 . 2005-05-27 09:19 106496 ----a-r- c:\windows\system32\lvcoinst.dll 2009-05-22 15:57 . 2005-05-27 09:29 204800 ----a-r- c:\windows\system32\LVUI2.dll 2009-05-22 15:57 . 2005-05-27 09:26 204800 ----a-r- c:\windows\system32\lvcodec2.dll 2009-05-22 15:57 . 2005-05-27 09:32 1317152 ----a-r- c:\windows\system32\drivers\lvcm.sys 2009-05-22 15:57 . 2005-05-27 09:23 2180096 ----a-r- c:\windows\system32\drivers\lvsvf2.sys 2009-05-22 15:53 . 2005-06-08 13:12 462848 ----a-w- c:\windows\system32\LCamCpl.dll 2009-05-22 15:53 . 2005-06-08 12:31 215552 ----a-w- c:\windows\system32\Lvkrn12n.dll 2009-05-22 15:52 . 2005-06-08 12:41 466944 ----a-w- c:\windows\system32\QCUI2.dll 2009-05-22 15:52 . 2005-06-08 12:31 856064 ----a-w- c:\windows\system32\Ltwvc12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 406016 ----a-w- c:\windows\system32\ltkrn12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 207872 ----a-w- c:\windows\system32\ltefx12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 164864 ----a-w- c:\windows\system32\ltimg12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 131072 ----a-w- c:\windows\system32\ltfil12n.DLL 2009-05-22 15:52 . 2005-06-08 12:31 259072 ----a-w- c:\windows\system32\LTDIS12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 141312 ----a-w- c:\windows\system32\lftif12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 78336 ----a-w- c:\windows\system32\lffax12n.dll 2009-05-22 15:52 . 2005-06-08 12:31 328704 ----a-w- c:\windows\system32\LFCMP12n.DLL 2009-05-22 15:52 . 2005-06-08 12:31 30720 ----a-w- c:\windows\system32\lfbmp12n.dll 2009-05-22 15:52 . 2005-06-08 12:38 90112 ----a-w- c:\windows\system32\LQCUI2.dll 2009-05-22 15:45 . 2009-05-22 15:45 81920 ------r- c:\windows\bwUnin-6.1.4.68-8876480L.exe 2009-05-20 14:29 . 2009-05-20 14:29 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software 2009-05-20 14:29 . 2009-06-02 15:11 -------- d-----w- c:\program files\TuneUp Utilities 2009 2009-05-20 14:27 . 2009-05-20 14:27 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357} 2009-05-09 08:30 . 1998-09-30 10:26 49936 ----a-w- c:\windows\system32\SeCEdit.exe 2009-05-09 08:30 . 1998-09-30 10:24 242448 ----a-w- c:\windows\system32\scedll.dll 2009-05-09 08:30 . 1998-03-31 14:37 29968 ----a-w- c:\windows\system32\Rshx32_5.dll 2009-05-09 08:30 . 1998-10-09 12:17 384784 ----a-w- c:\windows\system32\wsecedit.dll 2009-05-06 13:23 . 2009-05-06 13:23 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-04 16:46 . 2009-02-27 14:07 -------- d-----w- c:\program files\ShoppingAdsHelper 2009-06-03 10:22 . 2002-12-22 12:36 5175 ----a-w- c:\windows\system32\choice.exe 2009-06-02 15:05 . 2009-02-05 17:33 -------- d-----w- c:\program files\Google 2009-06-02 14:54 . 2004-08-16 15:41 579584 ----a-w- c:\windows\system32\user32.dll 2009-06-02 14:29 . 2009-06-02 14:29 69 ----a-w- C:\asap.tmp 2009-06-02 14:28 . 2004-08-16 15:41 94526 ----a-w- c:\windows\system32\perfc00C.dat 2009-06-02 14:28 . 2004-08-16 15:41 536002 ----a-w- c:\windows\system32\perfh00C.dat 2009-06-01 18:57 . 2009-05-01 07:49 -------- d-----w- c:\program files\Avira 2009-06-01 11:24 . 2009-06-02 14:15 208452 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1036.dat 2009-06-01 11:10 . 2009-01-17 23:08 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-06-01 11:00 . 2009-04-29 15:50 -------- d-----w- c:\program files\ma-config.com 2009-06-01 11:00 . 2009-04-29 15:50 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com 2009-06-01 10:24 . 2009-01-18 08:48 -------- d-----w- c:\program files\Windows Live 2009-05-22 19:14 . 2009-04-19 13:40 -------- d-----w- c:\program files\World of Warcraft 2009-05-22 15:52 . 2009-02-13 17:32 -------- d-----w- c:\program files\Logitech 2009-05-20 19:44 . 2009-02-07 13:09 -------- d-----w- c:\program files\Windows Live Safety Center 2009-05-20 15:18 . 2009-02-27 14:47 -------- d-----w- c:\program files\adslTV 2009-05-20 15:17 . 2009-02-27 08:12 -------- d-----w- c:\program files\eMule 2009-05-20 15:15 . 2009-05-04 18:02 -------- d-----w- c:\program files\Ubisoft 2009-05-20 15:14 . 2009-01-18 17:47 -------- d-----w- c:\program files\JkDefrag 2009-05-20 14:24 . 2009-01-28 07:03 -------- d-----w- c:\program files\Messenger Plus! Live 2009-05-06 03:30 . 2009-05-05 18:56 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-05-05 18:56 . 2009-05-05 18:56 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite 2009-05-05 18:56 . 2009-05-05 18:56 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-05-05 17:13 . 2009-05-05 17:13 -------- d-----w- c:\program files\EASEUS 2009-05-05 17:03 . 2009-05-05 17:03 -------- d-----w- c:\program files\Astonsoft 2009-05-05 16:59 . 2009-05-05 16:59 -------- d-----w- c:\program files\winMd5Sum 2009-05-05 15:34 . 2009-05-05 15:34 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-05-03 14:04 . 2009-05-03 14:04 -------- d-----w- c:\program files\i-Media 2009-05-03 14:04 . 2009-05-03 14:04 -------- d-----w- c:\program files\Goto 2009-05-03 13:36 . 2009-05-03 13:36 -------- d-----w- c:\program files\Capturino V2 2009-05-02 08:36 . 2009-05-02 08:36 253952 ------w- c:\windows\Setup1.exe 2009-05-02 08:36 . 2009-05-02 08:36 74752 ----a-w- c:\windows\ST6UNST.EXE 2009-05-01 17:35 . 2009-05-01 17:35 -------- d-----w- c:\program files\SoundSpectrum 2009-05-01 16:56 . 2009-05-01 16:56 -------- d-----w- c:\program files\Buka 2009-05-01 08:02 . 2009-05-01 08:02 4212 ---ha-w- c:\windows\system32\zllictbl.dat 2009-05-01 08:01 . 2009-05-01 08:01 -------- d-----w- c:\program files\Zone Labs 2009-04-30 20:02 . 2009-04-30 20:02 663552 ----a-w- c:\windows\system32\nvcuvid.dll 2009-04-30 20:02 . 2009-04-30 20:02 1579630 ----a-w- c:\windows\system32\nvdata.bin 2009-04-30 20:02 . 2009-04-30 20:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll 2009-04-30 20:02 . 2008-09-17 22:55 806912 ----a-w- c:\windows\system32\nvapi.dll 2009-04-30 20:02 . 2008-09-17 22:55 1720320 ----a-w- c:\windows\system32\nvcuda.dll 2009-04-30 20:02 . 2005-08-23 19:55 457248 ----a-w- c:\windows\system32\nvudisp.exe 2009-04-30 20:02 . 1979-12-31 22:00 9994240 ----a-w- c:\windows\system32\nvoglnt.dll 2009-04-30 20:02 . 1979-12-31 22:00 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2009-04-30 20:02 . 1979-12-31 22:00 5896320 ----a-w- c:\windows\system32\nv4_disp.dll 2009-04-30 20:02 . 1979-12-31 22:00 143360 ----a-w- c:\windows\system32\nvcodins.dll 2009-04-30 20:02 . 1979-12-31 22:00 143360 ----a-w- c:\windows\system32\nvcod.dll 2009-04-30 18:54 . 2009-04-30 18:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\rkfree 2009-04-30 18:54 . 2009-04-30 18:54 -------- d-----w- c:\program files\rkfree 2009-04-30 15:09 . 2009-04-30 15:05 -------- d-----w- c:\program files\iPod 2009-04-30 15:09 . 2009-04-30 15:05 -------- d-----w- c:\program files\iTunes 2009-04-30 15:05 . 2009-04-30 13:09 -------- d-----w- c:\program files\iPod(2) 2009-04-30 15:05 . 2009-04-30 13:09 -------- d-----w- c:\program files\iTunes(2) 2009-04-30 15:05 . 2009-04-02 15:22 -------- d-----w- c:\program files\Fichiers communs\Apple 2009-04-28 17:55 . 2009-04-28 17:49 -------- d-----w- c:\program files\Orbitdownloader 2009-04-26 22:42 . 2005-08-23 19:55 457248 ----a-w- c:\windows\system32\NVUNINST.EXE 2009-04-26 17:40 . 2009-04-07 15:26 -------- d-----w- c:\program files\XWindowsDock 2009-04-26 17:08 . 2009-01-24 13:31 -------- d-----w- c:\documents and settings\Catherine\Application Data\gtk-2.0 2009-04-26 16:43 . 2009-04-26 16:43 -------- d-----w- c:\documents and settings\Catherine\Application Data\Wings3D 2009-04-26 15:08 . 2009-04-26 15:08 -------- d-----w- c:\program files\Bonjour 2009-04-26 14:52 . 2009-04-26 14:51 -------- d-----w- c:\documents and settings\Catherine\Application Data\Apple Computer 2009-04-26 14:51 . 2009-04-26 14:50 -------- d-----w- c:\program files\QuickTime 2009-04-26 12:01 . 2009-04-26 12:01 -------- d-----w- c:\documents and settings\Catherine\Application Data\Bump Technologies, Inc 2009-04-25 13:27 . 2009-04-25 13:27 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller 2009-04-24 18:22 . 2009-01-18 09:48 71616 ----a-w- c:\documents and settings\Catherine\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-24 17:35 . 2009-03-29 05:28 -------- d-----w- c:\program files\MSECache 2009-04-24 15:33 . 2009-02-14 14:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-04-23 10:44 . 2009-04-23 10:44 -------- d-----w- c:\documents and settings\Catherine\Application Data\CyberLink 2009-04-22 16:07 . 2009-04-22 11:46 -------- d-----w- c:\program files\Morgan 2009-04-22 16:02 . 2009-01-18 17:06 -------- d-----w- c:\program files\OpenOffice.org 3 2009-04-22 13:06 . 2009-02-13 09:58 -------- d-----w- c:\program files\Microsoft Picture It! PhotoPub 2009-04-20 17:22 . 2009-02-14 09:59 -------- d-----w- c:\program files\Styler 2009-04-20 17:21 . 2009-03-01 12:28 -------- d-----w- c:\program files\Safari 2009-04-20 17:21 . 2009-04-04 12:33 -------- d-----w- c:\program files\Opera 2009-04-20 17:20 . 2009-01-19 06:01 -------- d-----w- c:\program files\Nvu 2009-04-20 17:20 . 2009-03-22 09:26 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-04-20 17:18 . 2009-01-18 08:36 -------- d-----w- c:\program files\Dofus 2009-04-20 17:17 . 2009-03-22 15:20 -------- d-----w- c:\program files\AVS4YOU 2009-04-20 17:17 . 2009-03-22 15:20 -------- d-----w- c:\program files\Fichiers communs\AVSMedia 2009-04-19 13:43 . 2009-04-19 13:43 -------- d-----w- c:\program files\Fichiers communs\Blizzard Entertainment 2009-04-19 07:02 . 2009-04-18 12:41 -------- d-----w- c:\program files\EA GAMES 2009-04-18 13:02 . 2009-04-18 13:02 107888 ----a-w- c:\windows\system32\CmdLineExt.dll 2009-04-11 05:32 . 2009-04-11 05:32 -------- d-----w- c:\program files\HooTech 2009-04-10 16:27 . 2009-02-16 14:20 -------- d-----w- c:\program files\Fichiers communs\DVDVideoSoft 2009-04-10 16:18 . 2009-04-03 04:48 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-04-09 15:36 . 2009-04-09 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-02 14:29 . 2009-04-02 14:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-03-30 18:21 . 2009-03-22 13:20 1 ----a-w- c:\documents and settings\Catherine\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-03-30 08:32 . 2009-05-01 07:49 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2009-03-28 11:36 . 2009-03-28 11:36 74240 ----a-w- c:\windows\system32\taskkill.exe 2009-03-24 14:07 . 2009-05-01 07:49 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-03-19 14:32 . 2009-04-02 15:25 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-19 14:32 . 2009-03-19 14:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 12:03 . 2009-05-05 17:14 1907712 ----a-w- c:\windows\system32\BootMan.exe 2009-03-08 02:34 . 2004-08-16 15:41 914944 ----a-w- c:\windows\system32\wininet.dll 2009-03-08 02:34 . 2004-08-16 15:40 43008 ----a-w- c:\windows\system32\licmgr10.dll 2009-03-08 02:33 . 2004-08-16 15:40 18944 ----a-w- c:\windows\system32\corpol.dll 2009-03-08 02:33 . 2004-08-16 15:41 420352 ----a-w- c:\windows\system32\vbscript.dll 2009-03-08 02:32 . 2004-08-16 15:39 72704 ----a-w- c:\windows\system32\admparse.dll 2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-06-02 209153] "Connexion internet"="c:\program files\TRENDnet\TEW-624UB_TEW-644UB\WlanCU.exe" [2008-06-26 344064] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2008-04-13 138240] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-6-1 1585152] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoChangeAnimation"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime "EmailChecker"=c:\apps\EmailChecker\ech.exe "nwiz"=nwiz.exe /install "Raccourci vers la page des propriétés de High Definition Audio"=HDAudPropShortcut.exe "PCMService"="c:\apps\Powercinema\PCMService.exe" "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "SoundMan"=SOUNDMAN.EXE "ACTIVBOARD"=c:\apps\ABoard\ABoard.exe "AlcWzrd"=ALCWZRD.EXE "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot "rkfree"="c:\program files\rkfree\rkfree.exe" /b "PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC "PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 "rgcrvvj0e50v"=c:\windows\system32\qgctvvj0e50v.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Media Player\\wmplayer.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "39755:TCP"= 39755:TCP:emule1 "39765:UDP"= 39765:UDP:emule2 "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\RALINK\Common\RalinkRegistryWriter.exe [01/06/2009 13:13 69632] R2 WLNdis50;WLan NDIS 5.0 I/O Control;c:\windows\system32\drivers\WLNdis50.sys [24/01/2009 19:37 20480] R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [24/01/2009 19:36 580096] S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/05/2009 09:49 108289] S2 gupdate1c987b7f1c21284;Google Update Service (gupdate1c987b7f1c21284);c:\program files\Google\Update\GoogleUpdate.exe [05/02/2009 19:34 133104] S3 avshws;YouUp Simulated Hardware;c:\windows\system32\drivers\youup.sys [13/02/2009 11:45 57344] S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [05/05/2009 19:14 8704] S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [05/05/2009 19:14 3072] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [29/05/2009 17:13 234864] . Contenu du dossier 'Tâches planifiées' 2009-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-06-05 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2009-06-02 09:50] 2009-06-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1170982658-3214024294-1526281595-1007.job - c:\documents and settings\Catherine\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-03 16:30] 2009-06-03 c:\windows\Tasks\HDReg.job - c:\apps\HDReg\HDRegRem.exe [2005-08-23 08:14] 2009-06-05 c:\windows\Tasks\User_Feed_Synchronization-{412F16E1-ACC7-4245-A381-0FA2600B37FF}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] 2009-06-04 c:\windows\Tasks\User_Feed_Synchronization-{4F425F12-6323-403E-A117-ADED1C0857E7}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 02:31] . - - - - ORPHELINS SUPPRIMES - - - - SafeBoot-procexp90.Sys . ------- Examen supplémentaire ------- . uStart Page = hxxp://search.orbitdownloader.com uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xporter vers Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000 TCP: {4924EA7F-F545-4641-ACFD-9F354E381BFD} = 192.168.1.1 FF - ProfilePath - c:\documents and settings\Aurélien\Application Data\Mozilla\Firefox\Profiles\1zh05mm6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - component: c:\documents and settings\Aurélien\Application Data\Mozilla\Firefox\Profiles\1zh05mm6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll ---- PARAMETRES FIREFOX ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-05 07:35 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,88,8b,32,2d,d2, 84,eb,10,c8,28,51,af,b0,29,a3,98,41,ab,17,d5,2d,62,a6,b3,e2,63,26,f1,3f,c8,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,d5,2c,76,a7,47, 75,7d,54,71,3b,04,66,8b,46,0d,96,01,f3,24,76,37,aa,5e,42,6a,9c,d6,61,af,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,6e,72,b7,25,12, b7,50,4b,25,da,ec,7e,55,20,c9,26,20,d4,08,c3,a8,29,b3,ee,ff,7c,85,e0,43,d4,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,5e,52,8a,58,94, d0,5f,76,3e,1e,9e,e0,57,5a,93,61,33,09,f8,b4,13,cb,7a,5a,86,8c,21,01,be,91,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,1b,e3,16,4f,2c, fb,77,94,cd,44,cd,b9,a6,33,6c,cd,b1,c9,7a,f4,3d,ba,43,17,f5,1d,4d,73,a8,13,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ff,66,96,54,55, 6d,dc,74,b0,18,ed,a7,3f,8d,37,a4,71,80,b1,d7,9f,70,a8,c4,df,20,58,62,78,6b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,e3,6d,40,75,9c, a7,1d,7e,31,77,e1,ba,b1,f8,68,02,cc,b9,2f,b6,87,aa,76,eb,fb,a7,78,e6,12,2f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,df,4c,22,5a,44, 41,9b,aa,83,6c,56,8b,a0,85,96,ab,12,3f,74,90,40,d5,b3,c9,01,3a,48,fc,e8,04,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,2c,7d,02,96,c0, c0,47,4b,51,fa,6e,91,28,9e,14,cc,00,ac,d7,f1,4c,f1,a9,9b,f6,0f,4e,58,98,5b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,ae,83,ed,85,3d, f6,19,ea,b1,cd,45,5a,a8,c4,f8,b9,1d,84,37,b1,59,6f,8d,f4,3d,ce,ea,26,2d,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,f8,f8,4c,88,05, 7f,1a,94,e3,0e,66,d5,eb,bc,2f,6b,64,69,ec,2e,bf,a8,2d,c3,2a,b7,cc,b5,b9,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,a4,ab,d1,02,0d, 3b,fd,ab,fa,ea,66,7f,d4,3b,6b,70,4a,fb,e8,40,62,58,ec,a9,6c,43,2d,1e,aa,22,\ [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'explorer.exe'(3488) c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\eappprxy.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\apps\HIDSERVICE\HidService.exe c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\apps\Powercinema\Kernel\TV\CLSched.exe c:\windows\system32\wscntfy.exe c:\program files\Windows Live\Contacts\wlcomm.exe . ************************************************************************** . Heure de fin: 2009-06-05 7:37 - La machine a redémarré ComboFix-quarantined-files.txt 2009-06-05 05:37 Avant-CF: 75 686 596 608 octets libres Après-CF: 75 749 502 976 octets libres 416 --- E O F --- 2009-05-31 17:10
Je vais essayer de réinstaller Avira! et je vous dis si ca mrche... -
---> Télécharge SDFix (créé par AndyManchesta) sur ton Bureau.
- Double-clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
- Redémarre ton ordinateur en mode sans échec.
---> Pour redémarrer en mode sans échec :
- Redémarre ton PC.
- Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
- Dans le menu d'options avancées, choisis Mode sans échec.
- Choisis ta session.
---> Déroule la liste des instructions ci-dessous :
- Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer le script.
- Appuie sur Y pour commencer le processus de nettoyage.
- Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
- Appuie sur une touche pour redémarrer le PC.
- Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
- Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
- Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
- Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
- Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse.-
Avira Antivir fonctionne ! Merci pour toutes vos réponses ! Le scan, les mises à jours, le guard...
Je vais faire maintenant la solution proposé par Destrio5 si cela peut "desinfecter" mon pc.- Voilà :
[b]SDFix: Version 1.240 [/b] Run by Aur‚lien on 06/06/2009 at 06:13 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-06 06:19:30 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "hdf12"=hex:cd,02,7a,0b,1c,ad,e5,bf,b7,5d,8a,ce,22,9d,95,d1,60,9a,7f,7a,a2,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,65,d5,23,05,d4,9c,e5,17,e5,9a,1e,b1,23,58,1b,a3,1b,.. "hdf12"=hex:2b,5c,5e,4b,ab,e5,1f,1b,bc,78,13,c9,23,a0,9b,cb,d5,53,46,2b,95,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:aa,d8,4f,d4,0e,8a,05,c1,8f,7b,f7,8a,38,b5,32,b3,01,5b,ad,07,9f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "hdf12"=hex:cd,02,7a,0b,1c,ad,e5,bf,b7,5d,8a,ce,22,9d,95,d1,60,9a,7f,7a,a2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,65,d5,23,05,d4,9c,e5,17,e5,9a,1e,b1,23,58,1b,a3,1b,.. "hdf12"=hex:2b,5c,5e,4b,ab,e5,1f,1b,bc,78,13,c9,23,a0,9b,cb,d5,53,46,2b,95,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:aa,d8,4f,d4,0e,8a,05,c1,8f,7b,f7,8a,38,b5,32,b3,01,5b,ad,07,9f,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000000 "TracesSuccessful"=dword:00000000 "LastTraceFailure"=dword:00000000 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe:*:Enabled:Render Manager" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe:*:Enabled:umi" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"="C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe:*:Enabled:Zoo Tycoon 2 Executable" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Windows Media Player\\wmplayer.exe"="C:\\Program Files\\Windows Media Player\\wmplayer.exe:*:Enabled:Windows Media Player" "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:Partage de l'application RTC" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix" "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sat 17 Jan 2009 296 ...H. --- "C:\Boot.BAK" Wed 6 May 2009 8,192 A.SHR --- "C:\BOOTSECT.BAK" Tue 27 Jan 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Sun 26 Apr 2009 18,732 ...H. --- "C:\Documents and Settings\Aur‚lien\Application Data\Bump Technologies, Inc\BumpTop\scene.bump.bak" Sun 26 Apr 2009 17,492 A..H. --- "C:\Documents and Settings\Catherine\Application Data\Bump Technologies, Inc\BumpTop\scene.bump.bak" [b]Finished![/b]
-
-
salut pour avancer Destrio :
Télécharge TOOLBAR S&D ( de Eric_71/Team IDN ) sur ton bureau :
!! Déconnecte toi,desactive tes protections résidentes, et ferme toutes tes applications en cours le temps de la manip. !!
* Double-clique sur ToolBar SD.exe pour lancer l'outil et laisse toi guider ...
--> Tapes ( option " recherche " ) puis tape sur [Entrée].
Un rapport sera généré à la fin du processus : poste son contenu dans ta prochaine réponse
( le rapport est en outre sauvegardé ici -> C:\TB.txt )
Tutoriel
