Mémoire infectée et sessions ne démarrent pas
Fermé
Mel80
-
23 juil. 2009 à 14:33
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 7 août 2009 à 11:54
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 7 août 2009 à 11:54
A voir également:
- Mémoire infectée et sessions ne démarrent pas
- Mémoire vive - Guide
- Test memoire pc - Guide
- Nettoyer memoire iphone - Guide
- Mémoire virtuelle - Guide
- Mémoire virtuelle pour 16 go de ram ✓ - Forum Windows 10
121 réponses
Nouveau rapport :
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyek******************************.sys not found.
File/Folder c:\windows\system32\geyek******************************.dll not found.
File/Folder c:\windows\system32\geyek******************************.dat not found.
File/Folder c:\windows\system32\geyek******************************.tmp not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 377 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 0,00 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07282009_205255
Files moved on Reboot...
Registry entries deleted on Reboot...
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyek******************************.sys not found.
File/Folder c:\windows\system32\geyek******************************.dll not found.
File/Folder c:\windows\system32\geyek******************************.dat not found.
File/Folder c:\windows\system32\geyek******************************.tmp not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 377 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 0,00 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07282009_205255
Files moved on Reboot...
Registry entries deleted on Reboot...
Destrio5
Messages postés
85985
Date d'inscription
dimanche 11 juillet 2010
Statut
Modérateur
Dernière intervention
17 février 2023
10 295
28 juil. 2009 à 21:01
28 juil. 2009 à 21:01
Essaie celui-ci :
:processes
explorer.exe
:files
c:\windows\system32\drivers\geyek*.sys
c:\windows\system32\geyek*.dll
c:\windows\system32\geyek*.dat
c:\windows\system32\geyek*.tmp
:commands
[purity]
[emptytemp]
[reboot]
:processes
explorer.exe
:files
c:\windows\system32\drivers\geyek*.sys
c:\windows\system32\geyek*.dll
c:\windows\system32\geyek*.dat
c:\windows\system32\geyek*.tmp
:commands
[purity]
[emptytemp]
[reboot]
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
28 juil. 2009 à 22:51
28 juil. 2009 à 22:51
slt merci destrio5 de passer
peu de temps je repasse demain
un combofix un peu ancien si besoin:
http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe
peu de temps je repasse demain
un combofix un peu ancien si besoin:
http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe
Je vais faire ComboFix (aujourd'hui, le téléchargement de la dernière version à réussi ) . Et voilà le rapport de OTM demandé par Destrio5 :
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyek*.sys not found.
File/Folder c:\windows\system32\geyek*.dll not found.
File/Folder c:\windows\system32\geyek*.dat not found.
File/Folder c:\windows\system32\geyek*.tmp not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 377 bytes
RecycleBin emptied: 3063651 bytes
Total Files Cleaned = 2,92 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07292009_115748
Files moved on Reboot...
Registry entries deleted on Reboot...
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyek*.sys not found.
File/Folder c:\windows\system32\geyek*.dll not found.
File/Folder c:\windows\system32\geyek*.dat not found.
File/Folder c:\windows\system32\geyek*.tmp not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 377 bytes
RecycleBin emptied: 3063651 bytes
Total Files Cleaned = 2,92 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07292009_115748
Files moved on Reboot...
Registry entries deleted on Reboot...
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
29 juil. 2009 à 12:20
29 juil. 2009 à 12:20
ok fais combofix!
J'ai fait ComboFix. Par contre, encore une fois, l'ordinateur a du redémarrer pour faire le scan et de ce fait, AntiVir s'est automatiquement réactivé ..
ComboFix 09-07-28.04 - Rouvillain 29/07/2009 12:16.11.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.3327.2694 [GMT 2:00]
Running from: c:\users\Rouvillain\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: AntiVir Desktop *disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-29 10:23 . 2009-07-29 10:23 -------- d-----w- c:\users\Elodie\AppData\Local\temp
2009-07-29 03:39 . 2009-07-29 03:39 -------- d-sh--w- C:\found.002
2009-07-28 18:43 . 2009-07-28 18:43 -------- dc----w- C:\_OTM
2009-07-28 11:47 . 2009-07-28 11:47 199316666 -c--a-w- C:\Sauv.reg
2009-07-28 02:48 . 2009-07-28 02:48 -------- d-sh--w- C:\found.001
2009-07-27 23:34 . 2009-07-27 23:34 -------- d-sh--w- C:\found.000
2009-07-27 12:00 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-27 12:00 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-27 12:00 . 2009-07-27 12:00 -------- d-----w- c:\program files\Avira
2009-07-27 12:00 . 2009-07-27 12:00 -------- d-----w- c:\progra~2\Avira
2009-07-26 18:34 . 2009-07-26 18:34 -------- d-----w- c:\progra~2\NortonInstaller
2009-07-25 10:12 . 2009-07-25 10:12 -------- d-----w- c:\progra~2\Kaspersky Lab Setup Files
2009-07-23 20:56 . 2009-07-23 20:56 -------- d-----w- c:\progra~2\Simply Super Software
2009-07-23 14:45 . 2009-07-28 11:47 -------- d-----w- c:\program files\trend micro
2009-07-23 12:55 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 12:55 . 2009-07-24 17:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-23 12:55 . 2009-07-23 12:55 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-23 12:55 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-23 12:54 . 2009-07-23 12:54 3775176 ----a-w- c:\users\Public\mbam-setup.exe
2009-07-20 17:16 . 2009-07-24 11:27 -------- d-----w- c:\program files\a-squared Anti-Malware
2009-07-20 17:06 . 2009-07-20 17:16 59412480 ----a-w- c:\users\Public\a2AntiMalwareSetup.exe
2009-07-20 17:02 . 2009-07-20 17:05 23975176 ----a-w- c:\users\Public\sdsetup.exe
2009-07-20 14:07 . 2009-07-20 14:18 -------- d-----w- c:\users\Public\backups
2009-07-20 13:36 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-07-20 13:36 . 2009-07-20 13:36 -------- d-----w- c:\program files\Panda Security
2009-07-19 19:25 . 2009-07-25 14:58 -------- d-----w- c:\program files\CCleaner
2009-07-19 18:07 . 2009-06-22 14:58 13312 ----a-w- c:\windows\system32\drivers\snetcfg.exe
2009-07-19 18:07 . 2009-07-23 13:45 -------- d-----w- c:\program files\Common Files\Uninstall
2009-07-19 17:04 . 2009-07-19 17:06 -------- d-----w- c:\users\Public\Photos anniv' Pauline
2009-07-17 11:13 . 2009-07-17 12:00 -------- d-----w- c:\users\Public\Musique
2009-07-17 11:09 . 2009-07-21 20:55 -------- d-----w- c:\users\Public\Jeux DS
2009-07-17 10:01 . 2009-05-21 08:56 -------- d-----w- c:\users\Public\eng
2009-07-17 10:01 . 2009-07-17 10:01 6955522 ----a-w- c:\users\Public\DSone_SDHC_V3.0_sp8_eng.zip
2009-07-15 10:15 . 2009-06-15 15:29 156160 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 10:15 . 2009-06-15 15:23 24064 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 10:15 . 2009-06-15 15:22 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 10:15 . 2009-06-15 15:21 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 10:15 . 2009-06-15 15:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2009-07-15 10:15 . 2009-06-15 13:03 289792 ----a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 09:51 . 2009-04-29 15:15 -------- d-----w- c:\progra~2\Google Updater
2009-07-26 18:37 . 2007-05-06 19:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-25 19:04 . 2007-05-06 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-24 10:40 . 2009-03-14 20:51 -------- d-----w- c:\program files\Zylom Games
2009-07-21 16:59 . 2009-03-01 16:38 -------- d-----w- c:\program files\VSO
2009-07-19 20:21 . 2008-11-02 12:54 -------- d-----w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2
2009-07-16 10:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-28 11:23 . 2008-05-24 15:45 -------- d-----w- c:\users\Elodie\AppData\Roaming\LimeWire
2009-06-13 09:56 . 2007-05-06 19:18 -------- d-----w- c:\progra~2\Microsoft Help
2009-06-13 09:55 . 2007-05-06 19:20 -------- d-----w- c:\program files\Microsoft Works
2009-06-07 21:52 . 2009-06-07 21:52 -------- d-----w- c:\progra~2\Grey Alien Games
2009-06-07 15:35 . 2009-05-23 16:41 -------- d-----w- c:\progra~2\HipSoft
2009-06-07 13:08 . 2009-04-18 16:05 -------- d-----w- c:\program files\bfgclient
2009-05-30 17:52 . 2009-05-30 17:52 -------- d-----w- c:\progra~2\Gogii
2009-05-30 15:12 . 2009-04-29 15:15 -------- d-----w- c:\program files\Google
2009-05-09 13:40 . 2008-11-02 12:55 1 ----a-w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-04-30 12:52 . 2009-06-14 14:08 292352 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-30 12:44 . 2009-06-14 14:08 1244672 ----a-w- c:\windows\system32\mcmde.dll
2009-04-30 12:42 . 2009-06-14 14:08 428032 ----a-w- c:\windows\system32\EncDec.dll
2008-05-31 21:41 . 2008-05-31 21:41 774144 ----a-w- c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-23 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-06-25 1578736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-01-24 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"PlayMovie"="c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe" [2007-07-13 178280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-31 185896]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-03 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-07-06 4669440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
c:\users\Elodie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-6 528384]
PCM Media Sharing.lnk - c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-5-6 200812]
ScanPanel.lnk - c:\program files\ScanPanel\ScnPanel.exe [2008-7-25 1732608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\K:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3949DEB9-8DD8-42E4-A506-7B9F4A231291}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A033DC2D-F311-40C6-91FC-22337523B865}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F726BF72-BF4E-4B4F-B9FE-4CDF4E903131}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{51674872-C1F2-4F6E-9B9C-A757F38BE2C6}"= c:\program files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow DVD workprocess
"{00717E99-5B5E-4D82-B899-5B920CE145A9}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{F90A806B-AED4-4244-AC78-EA10F3E4F0E6}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{2EACCE03-44AD-4451-AFA5-833B35CC35B9}"= c:\program files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{39E7738E-3D11-43B9-835D-D16D2F3B2B0D}"= c:\program files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{59B339AA-E6E9-43D5-A0ED-DAC81D658E12}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{B70C9DFF-8065-445C-8092-F386899335A3}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{9F52794C-B028-4208-88E2-1D78370B9A3B}"= c:\program files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{DCB45B20-FA20-4095-9016-E7F74A52FD4B}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PlayMovie.exe:Acer PlayMovie
"{A374BCC4-D6BE-418F-8E7C-B6C07284B3E6}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe:Acer PlayMovie Resident Program
"{F0F76D77-4063-4396-AF0F-C9DBEA96F77D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A9AD6B6D-BF59-4C65-9C6F-635ADFB19461}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{781C8B61-197B-47FE-A4DF-51B52DC8FA6E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B885E36F-6409-420C-AB3F-78A3510481E1}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8891F40A-06A6-45B5-B57D-1C6BC4D9321E}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{98C04AAB-2961-4C33-AB7C-18A1ED042E88}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4360709E-DF39-4239-9378-AC9804D93FCF}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{5871D7C5-6183-491C-8D34-6F210FCE59F0}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{AE7BDAFE-BA85-4D42-84D5-12F4A95BFA5C}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{E106A2D7-4784-48D6-9A13-49CBE30C9BE8}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{43BAD9D9-E0B3-4DF9-88CD-577F58C607D1}"= UDP:27760:BitComet 27760 TCP
"{07226393-181B-4F03-8D02-71235858B79B}"= TCP:27760:BitComet 27760 UDP
"TCP Query User{5137E0B5-766B-4993-A075-6DEEA24AC510}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{949AECEC-8445-47B2-8E52-A49FEE8D5455}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{A7684022-ABF6-44DE-A9D8-2839615A1505}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{64C253C9-5181-4546-B4B8-FFB4F498D7BC}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{2DE48908-7FFB-451D-B24F-FC697421E0AA}"= UDP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
"{6B9F09F5-638A-48AF-96E4-FCEFDC4CBC3D}"= TCP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [20/07/2009 15:36 28544]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Live\Acer PlayMovie\000.fcl [04/05/2008 12:55 39408]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [06/05/2007 21:33 266343]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [27/07/2009 14:00 108289]
R2 SampleScanner;USB-Flachbettscanner;c:\windows\System32\drivers\ArtecGT.sys [25/07/2008 16:23 18120]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe" /TEMPSTART:""c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE" --> c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe [?]
S2 gupdate1c9c8de20341bb7;Service Google Update (gupdate1c9c8de20341bb7);c:\program files\Google\Update\GoogleUpdate.exe [29/04/2009 17:21 133104]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [21/08/2008 16:16 457856]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [23/05/2008 19:33 28224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://fr.fr.acer.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mWindow Title =
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 12:23
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
Completion time: 2009-07-29 12:25
ComboFix-quarantined-files.txt 2009-07-29 10:25
Pre-Run: 39 710 367 744 octets libres
Post-Run: 39 723 188 224 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
199 --- E O F --- 2009-07-26 20:53
ComboFix 09-07-28.04 - Rouvillain 29/07/2009 12:16.11.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.3327.2694 [GMT 2:00]
Running from: c:\users\Rouvillain\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: AntiVir Desktop *disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-29 10:23 . 2009-07-29 10:23 -------- d-----w- c:\users\Elodie\AppData\Local\temp
2009-07-29 03:39 . 2009-07-29 03:39 -------- d-sh--w- C:\found.002
2009-07-28 18:43 . 2009-07-28 18:43 -------- dc----w- C:\_OTM
2009-07-28 11:47 . 2009-07-28 11:47 199316666 -c--a-w- C:\Sauv.reg
2009-07-28 02:48 . 2009-07-28 02:48 -------- d-sh--w- C:\found.001
2009-07-27 23:34 . 2009-07-27 23:34 -------- d-sh--w- C:\found.000
2009-07-27 12:00 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-07-27 12:00 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-27 12:00 . 2009-07-27 12:00 -------- d-----w- c:\program files\Avira
2009-07-27 12:00 . 2009-07-27 12:00 -------- d-----w- c:\progra~2\Avira
2009-07-26 18:34 . 2009-07-26 18:34 -------- d-----w- c:\progra~2\NortonInstaller
2009-07-25 10:12 . 2009-07-25 10:12 -------- d-----w- c:\progra~2\Kaspersky Lab Setup Files
2009-07-23 20:56 . 2009-07-23 20:56 -------- d-----w- c:\progra~2\Simply Super Software
2009-07-23 14:45 . 2009-07-28 11:47 -------- d-----w- c:\program files\trend micro
2009-07-23 12:55 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 12:55 . 2009-07-24 17:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-23 12:55 . 2009-07-23 12:55 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-23 12:55 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-23 12:54 . 2009-07-23 12:54 3775176 ----a-w- c:\users\Public\mbam-setup.exe
2009-07-20 17:16 . 2009-07-24 11:27 -------- d-----w- c:\program files\a-squared Anti-Malware
2009-07-20 17:06 . 2009-07-20 17:16 59412480 ----a-w- c:\users\Public\a2AntiMalwareSetup.exe
2009-07-20 17:02 . 2009-07-20 17:05 23975176 ----a-w- c:\users\Public\sdsetup.exe
2009-07-20 14:07 . 2009-07-20 14:18 -------- d-----w- c:\users\Public\backups
2009-07-20 13:36 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-07-20 13:36 . 2009-07-20 13:36 -------- d-----w- c:\program files\Panda Security
2009-07-19 19:25 . 2009-07-25 14:58 -------- d-----w- c:\program files\CCleaner
2009-07-19 18:07 . 2009-06-22 14:58 13312 ----a-w- c:\windows\system32\drivers\snetcfg.exe
2009-07-19 18:07 . 2009-07-23 13:45 -------- d-----w- c:\program files\Common Files\Uninstall
2009-07-19 17:04 . 2009-07-19 17:06 -------- d-----w- c:\users\Public\Photos anniv' Pauline
2009-07-17 11:13 . 2009-07-17 12:00 -------- d-----w- c:\users\Public\Musique
2009-07-17 11:09 . 2009-07-21 20:55 -------- d-----w- c:\users\Public\Jeux DS
2009-07-17 10:01 . 2009-05-21 08:56 -------- d-----w- c:\users\Public\eng
2009-07-17 10:01 . 2009-07-17 10:01 6955522 ----a-w- c:\users\Public\DSone_SDHC_V3.0_sp8_eng.zip
2009-07-15 10:15 . 2009-06-15 15:29 156160 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 10:15 . 2009-06-15 15:23 24064 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 10:15 . 2009-06-15 15:22 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 10:15 . 2009-06-15 15:21 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 10:15 . 2009-06-15 15:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2009-07-15 10:15 . 2009-06-15 13:03 289792 ----a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 09:51 . 2009-04-29 15:15 -------- d-----w- c:\progra~2\Google Updater
2009-07-26 18:37 . 2007-05-06 19:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-25 19:04 . 2007-05-06 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-24 10:40 . 2009-03-14 20:51 -------- d-----w- c:\program files\Zylom Games
2009-07-21 16:59 . 2009-03-01 16:38 -------- d-----w- c:\program files\VSO
2009-07-19 20:21 . 2008-11-02 12:54 -------- d-----w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2
2009-07-16 10:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-28 11:23 . 2008-05-24 15:45 -------- d-----w- c:\users\Elodie\AppData\Roaming\LimeWire
2009-06-13 09:56 . 2007-05-06 19:18 -------- d-----w- c:\progra~2\Microsoft Help
2009-06-13 09:55 . 2007-05-06 19:20 -------- d-----w- c:\program files\Microsoft Works
2009-06-07 21:52 . 2009-06-07 21:52 -------- d-----w- c:\progra~2\Grey Alien Games
2009-06-07 15:35 . 2009-05-23 16:41 -------- d-----w- c:\progra~2\HipSoft
2009-06-07 13:08 . 2009-04-18 16:05 -------- d-----w- c:\program files\bfgclient
2009-05-30 17:52 . 2009-05-30 17:52 -------- d-----w- c:\progra~2\Gogii
2009-05-30 15:12 . 2009-04-29 15:15 -------- d-----w- c:\program files\Google
2009-05-09 13:40 . 2008-11-02 12:55 1 ----a-w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2009-04-30 12:52 . 2009-06-14 14:08 292352 ----a-w- c:\windows\system32\psisdecd.dll
2009-04-30 12:44 . 2009-06-14 14:08 1244672 ----a-w- c:\windows\system32\mcmde.dll
2009-04-30 12:42 . 2009-06-14 14:08 428032 ----a-w- c:\windows\system32\EncDec.dll
2008-05-31 21:41 . 2008-05-31 21:41 774144 ----a-w- c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-23 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-06-25 1578736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-01-24 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"PlayMovie"="c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe" [2007-07-13 178280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-31 185896]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-03 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-07-06 4669440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
c:\users\Elodie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-6 528384]
PCM Media Sharing.lnk - c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-5-6 200812]
ScanPanel.lnk - c:\program files\ScanPanel\ScnPanel.exe [2008-7-25 1732608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\K:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3949DEB9-8DD8-42E4-A506-7B9F4A231291}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A033DC2D-F311-40C6-91FC-22337523B865}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F726BF72-BF4E-4B4F-B9FE-4CDF4E903131}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{51674872-C1F2-4F6E-9B9C-A757F38BE2C6}"= c:\program files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow DVD workprocess
"{00717E99-5B5E-4D82-B899-5B920CE145A9}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{F90A806B-AED4-4244-AC78-EA10F3E4F0E6}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{2EACCE03-44AD-4451-AFA5-833B35CC35B9}"= c:\program files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{39E7738E-3D11-43B9-835D-D16D2F3B2B0D}"= c:\program files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{59B339AA-E6E9-43D5-A0ED-DAC81D658E12}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{B70C9DFF-8065-445C-8092-F386899335A3}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{9F52794C-B028-4208-88E2-1D78370B9A3B}"= c:\program files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{DCB45B20-FA20-4095-9016-E7F74A52FD4B}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PlayMovie.exe:Acer PlayMovie
"{A374BCC4-D6BE-418F-8E7C-B6C07284B3E6}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe:Acer PlayMovie Resident Program
"{F0F76D77-4063-4396-AF0F-C9DBEA96F77D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A9AD6B6D-BF59-4C65-9C6F-635ADFB19461}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{781C8B61-197B-47FE-A4DF-51B52DC8FA6E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B885E36F-6409-420C-AB3F-78A3510481E1}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8891F40A-06A6-45B5-B57D-1C6BC4D9321E}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{98C04AAB-2961-4C33-AB7C-18A1ED042E88}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4360709E-DF39-4239-9378-AC9804D93FCF}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{5871D7C5-6183-491C-8D34-6F210FCE59F0}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{AE7BDAFE-BA85-4D42-84D5-12F4A95BFA5C}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{E106A2D7-4784-48D6-9A13-49CBE30C9BE8}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{43BAD9D9-E0B3-4DF9-88CD-577F58C607D1}"= UDP:27760:BitComet 27760 TCP
"{07226393-181B-4F03-8D02-71235858B79B}"= TCP:27760:BitComet 27760 UDP
"TCP Query User{5137E0B5-766B-4993-A075-6DEEA24AC510}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{949AECEC-8445-47B2-8E52-A49FEE8D5455}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{A7684022-ABF6-44DE-A9D8-2839615A1505}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{64C253C9-5181-4546-B4B8-FFB4F498D7BC}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{2DE48908-7FFB-451D-B24F-FC697421E0AA}"= UDP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
"{6B9F09F5-638A-48AF-96E4-FCEFDC4CBC3D}"= TCP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [20/07/2009 15:36 28544]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Live\Acer PlayMovie\000.fcl [04/05/2008 12:55 39408]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [06/05/2007 21:33 266343]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [27/07/2009 14:00 108289]
R2 SampleScanner;USB-Flachbettscanner;c:\windows\System32\drivers\ArtecGT.sys [25/07/2008 16:23 18120]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe" /TEMPSTART:""c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE" --> c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe [?]
S2 gupdate1c9c8de20341bb7;Service Google Update (gupdate1c9c8de20341bb7);c:\program files\Google\Update\GoogleUpdate.exe [29/04/2009 17:21 133104]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [21/08/2008 16:16 457856]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [23/05/2008 19:33 28224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://fr.fr.acer.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mWindow Title =
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 12:23
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
Completion time: 2009-07-29 12:25
ComboFix-quarantined-files.txt 2009-07-29 10:25
Pre-Run: 39 710 367 744 octets libres
Post-Run: 39 723 188 224 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
199 --- E O F --- 2009-07-26 20:53
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
29 juil. 2009 à 12:35
29 juil. 2009 à 12:35
- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut.
lance ccleaner et nettoie le registre et les fichiers temporaires
_________________
encore des soucis???
lance ccleaner et nettoie le registre et les fichiers temporaires
_________________
encore des soucis???
Rien qui me parait anormal à part toujorus ces 2 messages au démarrage :
http://i708.photobucket.com/albums/ww83/Meltiterieuse/MessagesdeAntiVirGuard.jpg
http://i708.photobucket.com/albums/ww83/Meltiterieuse/MessagesdeAntiVirGuard.jpg
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
29 juil. 2009 à 15:06
29 juil. 2009 à 15:06
ok
Télécharge OTM
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTM.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.
:processes
explorer.exe
:Services
geyekrvgndgdlq
geyekrswdoetla
:files
c:\windows\system32\drivers\geyekrvgndgdlq.dll
c:\windows\system32\geyekrvgndgdlq.dll
c:\windows\system32\geyekrswdoetla.dll
c:\windows\system32\drivers\geyekrswdoetla.dll
:commands
[purity]
[emptytemp]
[start explorer]
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
puis redemarre le pc et dis si antivir trouve encore ces fichiers et si oui ignore les et refais otm
Télécharge OTM
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTM.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.
:processes
explorer.exe
:Services
geyekrvgndgdlq
geyekrswdoetla
:files
c:\windows\system32\drivers\geyekrvgndgdlq.dll
c:\windows\system32\geyekrvgndgdlq.dll
c:\windows\system32\geyekrswdoetla.dll
c:\windows\system32\drivers\geyekrswdoetla.dll
:commands
[purity]
[emptytemp]
[start explorer]
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
puis redemarre le pc et dis si antivir trouve encore ces fichiers et si oui ignore les et refais otm
Voilà le rapport du 1er OTM :
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrswdoetla not found.
Service\Driver geyekrswdoetla not found.
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrswdoetla.dll not found.
File/Folder c:\windows\system32\drivers\geyekrswdoetla.dll not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 25688 bytes
RecycleBin emptied: 407552 bytes
Total Files Cleaned = 0,41 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07292009_195333
Files moved on Reboot...
Registry entries deleted on Reboot...
Comme les messages d'AntiVir ont encore été donné, je recommence OTM..
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrswdoetla not found.
Service\Driver geyekrswdoetla not found.
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrswdoetla.dll not found.
File/Folder c:\windows\system32\drivers\geyekrswdoetla.dll not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 25688 bytes
RecycleBin emptied: 407552 bytes
Total Files Cleaned = 0,41 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07292009_195333
Files moved on Reboot...
Registry entries deleted on Reboot...
Comme les messages d'AntiVir ont encore été donné, je recommence OTM..
OTM ne trouve toujours pas ces fichiers et AntiVir détecte toujours les logiciels malveillants.
Pourtant Malwarebytes me dit toujours qu'il n'y a plus rien.. Et les scan d'AntiVir ne trouve plus rien apparemment, un peu bizarre, non?
Pourtant Malwarebytes me dit toujours qu'il n'y a plus rien.. Et les scan d'AntiVir ne trouve plus rien apparemment, un peu bizarre, non?
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
29 juil. 2009 à 20:29
29 juil. 2009 à 20:29
si antivir trouve encore ces fichiers et si oui ignore les et refais otm
Je l'ai fait mais malgrè le fait d'ignorer, au redémarrage suivant AntiVir me les a encore détecté.
Et aussi, autre chose, J'ai un message qui s'affiche en bas à droite pour me dire que des fichiers sont endommagé et qu'il faut que je vérifie avec CHKSDK. Mais quand je le fais, ils me disent que pour vérifier certains endroits, ils doivent le faire au prochain démarrage de l'ordinateur car le système doit être arrêté mais quand je rallume, rien ne se passe et la vérification n'a pas été faite ..
Et aussi, autre chose, J'ai un message qui s'affiche en bas à droite pour me dire que des fichiers sont endommagé et qu'il faut que je vérifie avec CHKSDK. Mais quand je le fais, ils me disent que pour vérifier certains endroits, ils doivent le faire au prochain démarrage de l'ordinateur car le système doit être arrêté mais quand je rallume, rien ne se passe et la vérification n'a pas été faite ..
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
29 juil. 2009 à 21:32
29 juil. 2009 à 21:32
demarre en mode sans echec et fais OTM
et colle le rapport
_______________
répare windows comme ceci:
https://www.commentcamarche.net/informatique/windows/25-verifier-et-reparer-des-fichiers-systeme-avec-windows-10/
et colle le rapport
_______________
répare windows comme ceci:
https://www.commentcamarche.net/informatique/windows/25-verifier-et-reparer-des-fichiers-systeme-avec-windows-10/
Toujours ce résultat en mode sans échec :
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrswdoetla not found.
Service\Driver geyekrswdoetla not found.
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrswdoetla.dll not found.
File/Folder c:\windows\system32\drivers\geyekrswdoetla.dll not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 25900 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 0,02 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07292009_222733
Files moved on Reboot...
Registry entries deleted on Reboot...
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrvgndgdlq not found.
Service\Driver geyekrswdoetla not found.
Service\Driver geyekrswdoetla not found.
========== FILES ==========
File/Folder c:\windows\system32\drivers\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrvgndgdlq.dll not found.
File/Folder c:\windows\system32\geyekrswdoetla.dll not found.
File/Folder c:\windows\system32\drivers\geyekrswdoetla.dll not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 25900 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 0,02 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07292009_222733
Files moved on Reboot...
Registry entries deleted on Reboot...
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
29 juil. 2009 à 22:37
29 juil. 2009 à 22:37
ok
tentons ceci
vire antivir complètement
puis
Pour fusionner:
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
c:\windows\system32\geyekrvgndgdlq.dll
c:\windows\system32\geyekrswdoetla.dll
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
__________________________
puis reinstalle antivir et dis si cela persiste
tentons ceci
vire antivir complètement
puis
Pour fusionner:
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
_______________
telecharge combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !
_________________
Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)
Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :
File::
c:\windows\system32\geyekrvgndgdlq.dll
c:\windows\system32\geyekrswdoetla.dll
Enregistre ce fichier sous le nom CFscript
Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe
Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.
Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
__________________________
puis reinstalle antivir et dis si cela persiste
Alors, voilà le rapport de ComboFix :
ComboFix 09-07-28.04 - Rouvillain 29/07/2009 22:58.12.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.3327.2765 [GMT 2:00]
Running from: c:\users\Rouvillain\Desktop\ComboFix.exe
Command switches used :: c:\users\Rouvillain\Desktop\CFscript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
FILE ::
"c:\windows\system32\geyekrswdoetla.dll"
"c:\windows\system32\geyekrvgndgdlq.dll"
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-30 05:07 . 2009-07-30 05:07 -------- d-sh--w- C:\found.003
2009-07-29 21:07 . 2009-07-29 21:07 -------- d-----w- c:\users\Elodie\AppData\Local\temp
2009-07-29 03:39 . 2009-07-29 03:39 -------- d-sh--w- C:\found.002
2009-07-28 18:43 . 2009-07-28 18:43 -------- dc----w- C:\_OTM
2009-07-28 11:47 . 2009-07-28 11:47 199316666 -c--a-w- C:\Sauv.reg
2009-07-28 02:48 . 2009-07-28 02:48 -------- d-sh--w- C:\found.001
2009-07-27 23:34 . 2009-07-27 23:34 -------- d-sh--w- C:\found.000
2009-07-27 12:00 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-26 18:34 . 2009-07-26 18:34 -------- d-----w- c:\progra~2\NortonInstaller
2009-07-25 10:12 . 2009-07-25 10:12 -------- d-----w- c:\progra~2\Kaspersky Lab Setup Files
2009-07-23 20:56 . 2009-07-23 20:56 -------- d-----w- c:\progra~2\Simply Super Software
2009-07-23 14:45 . 2009-07-28 11:47 -------- d-----w- c:\program files\trend micro
2009-07-23 12:55 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 12:55 . 2009-07-24 17:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-23 12:55 . 2009-07-23 12:55 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-23 12:55 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-23 12:54 . 2009-07-23 12:54 3775176 ----a-w- c:\users\Public\mbam-setup.exe
2009-07-20 17:16 . 2009-07-24 11:27 -------- d-----w- c:\program files\a-squared Anti-Malware
2009-07-20 17:06 . 2009-07-20 17:16 59412480 ----a-w- c:\users\Public\a2AntiMalwareSetup.exe
2009-07-20 17:02 . 2009-07-20 17:05 23975176 ----a-w- c:\users\Public\sdsetup.exe
2009-07-20 14:07 . 2009-07-20 14:18 -------- d-----w- c:\users\Public\backups
2009-07-20 13:36 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-07-20 13:36 . 2009-07-20 13:36 -------- d-----w- c:\program files\Panda Security
2009-07-19 19:25 . 2009-07-25 14:58 -------- d-----w- c:\program files\CCleaner
2009-07-19 18:07 . 2009-06-22 14:58 13312 ----a-w- c:\windows\system32\drivers\snetcfg.exe
2009-07-19 18:07 . 2009-07-23 13:45 -------- d-----w- c:\program files\Common Files\Uninstall
2009-07-19 17:04 . 2009-07-19 17:06 -------- d-----w- c:\users\Public\Photos anniv' Pauline
2009-07-17 11:13 . 2009-07-17 12:00 -------- d-----w- c:\users\Public\Musique
2009-07-17 11:09 . 2009-07-21 20:55 -------- d-----w- c:\users\Public\Jeux DS
2009-07-17 10:01 . 2009-05-21 08:56 -------- d-----w- c:\users\Public\eng
2009-07-17 10:01 . 2009-07-17 10:01 6955522 ----a-w- c:\users\Public\DSone_SDHC_V3.0_sp8_eng.zip
2009-07-15 10:15 . 2009-06-15 15:29 156160 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 10:15 . 2009-06-15 15:23 24064 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 10:15 . 2009-06-15 15:22 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 10:15 . 2009-06-15 15:21 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 10:15 . 2009-06-15 15:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2009-07-15 10:15 . 2009-06-15 13:03 289792 ----a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 09:51 . 2009-04-29 15:15 -------- d-----w- c:\progra~2\Google Updater
2009-07-26 18:37 . 2007-05-06 19:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-25 19:04 . 2007-05-06 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-24 10:40 . 2009-03-14 20:51 -------- d-----w- c:\program files\Zylom Games
2009-07-21 16:59 . 2009-03-01 16:38 -------- d-----w- c:\program files\VSO
2009-07-19 20:21 . 2008-11-02 12:54 -------- d-----w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2
2009-07-16 10:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-28 11:23 . 2008-05-24 15:45 -------- d-----w- c:\users\Elodie\AppData\Roaming\LimeWire
2009-06-13 09:56 . 2007-05-06 19:18 -------- d-----w- c:\progra~2\Microsoft Help
2009-06-13 09:55 . 2007-05-06 19:20 -------- d-----w- c:\program files\Microsoft Works
2009-06-07 21:52 . 2009-06-07 21:52 -------- d-----w- c:\progra~2\Grey Alien Games
2009-06-07 15:35 . 2009-05-23 16:41 -------- d-----w- c:\progra~2\HipSoft
2009-06-07 13:08 . 2009-04-18 16:05 -------- d-----w- c:\program files\bfgclient
2009-05-09 13:40 . 2008-11-02 12:55 1 ----a-w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2008-05-31 21:41 . 2008-05-31 21:41 774144 ----a-w- c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-07-29_10.23.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-06 19:10 . 2009-07-29 20:57 29490 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-07-29 20:57 50958 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-04 10:51 . 2009-07-29 20:55 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-04 10:51 . 2009-07-29 10:00 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-04 10:51 . 2009-07-29 10:00 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-04 10:51 . 2009-07-29 20:55 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-04 10:51 . 2009-07-29 10:00 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-04 10:51 . 2009-07-29 20:55 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-24 14:07 . 2009-07-27 11:48 3184 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-05-24 14:07 . 2009-07-29 18:56 3184 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2009-07-28 11:54 . 2009-07-29 20:44 3474 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2283137450-1778682601-968884257-1000_UserData.bin
+ 2009-07-29 20:55 . 2009-07-29 20:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-07-29 10:15 . 2009-07-29 10:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-07-29 10:15 . 2009-07-29 10:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-29 20:55 . 2009-07-29 20:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-23 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-06-25 1578736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-01-24 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"PlayMovie"="c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe" [2007-07-13 178280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-31 185896]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-03 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-07-06 4669440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
c:\users\Elodie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-6 528384]
PCM Media Sharing.lnk - c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-5-6 200812]
ScanPanel.lnk - c:\program files\ScanPanel\ScnPanel.exe [2008-7-25 1732608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk /p \??\K:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3949DEB9-8DD8-42E4-A506-7B9F4A231291}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A033DC2D-F311-40C6-91FC-22337523B865}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F726BF72-BF4E-4B4F-B9FE-4CDF4E903131}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{51674872-C1F2-4F6E-9B9C-A757F38BE2C6}"= c:\program files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow DVD workprocess
"{00717E99-5B5E-4D82-B899-5B920CE145A9}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{F90A806B-AED4-4244-AC78-EA10F3E4F0E6}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{2EACCE03-44AD-4451-AFA5-833B35CC35B9}"= c:\program files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{39E7738E-3D11-43B9-835D-D16D2F3B2B0D}"= c:\program files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{59B339AA-E6E9-43D5-A0ED-DAC81D658E12}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{B70C9DFF-8065-445C-8092-F386899335A3}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{9F52794C-B028-4208-88E2-1D78370B9A3B}"= c:\program files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{DCB45B20-FA20-4095-9016-E7F74A52FD4B}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PlayMovie.exe:Acer PlayMovie
"{A374BCC4-D6BE-418F-8E7C-B6C07284B3E6}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe:Acer PlayMovie Resident Program
"{F0F76D77-4063-4396-AF0F-C9DBEA96F77D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A9AD6B6D-BF59-4C65-9C6F-635ADFB19461}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{781C8B61-197B-47FE-A4DF-51B52DC8FA6E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B885E36F-6409-420C-AB3F-78A3510481E1}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8891F40A-06A6-45B5-B57D-1C6BC4D9321E}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{98C04AAB-2961-4C33-AB7C-18A1ED042E88}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4360709E-DF39-4239-9378-AC9804D93FCF}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{5871D7C5-6183-491C-8D34-6F210FCE59F0}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{AE7BDAFE-BA85-4D42-84D5-12F4A95BFA5C}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{E106A2D7-4784-48D6-9A13-49CBE30C9BE8}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{43BAD9D9-E0B3-4DF9-88CD-577F58C607D1}"= UDP:27760:BitComet 27760 TCP
"{07226393-181B-4F03-8D02-71235858B79B}"= TCP:27760:BitComet 27760 UDP
"TCP Query User{5137E0B5-766B-4993-A075-6DEEA24AC510}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{949AECEC-8445-47B2-8E52-A49FEE8D5455}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{A7684022-ABF6-44DE-A9D8-2839615A1505}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{64C253C9-5181-4546-B4B8-FFB4F498D7BC}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{2DE48908-7FFB-451D-B24F-FC697421E0AA}"= UDP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
"{6B9F09F5-638A-48AF-96E4-FCEFDC4CBC3D}"= TCP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [20/07/2009 15:36 28544]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Live\Acer PlayMovie\000.fcl [04/05/2008 12:55 39408]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [06/05/2007 21:33 266343]
R2 SampleScanner;USB-Flachbettscanner;c:\windows\System32\drivers\ArtecGT.sys [25/07/2008 16:23 18120]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe" /TEMPSTART:""c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE" --> c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe [?]
S2 gupdate1c9c8de20341bb7;Service Google Update (gupdate1c9c8de20341bb7);c:\program files\Google\Update\GoogleUpdate.exe [29/04/2009 17:21 133104]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [21/08/2008 16:16 457856]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [23/05/2008 19:33 28224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://fr.fr.acer.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mWindow Title =
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 23:07
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
Completion time: 2009-07-29 23:12
ComboFix-quarantined-files.txt 2009-07-29 21:12
ComboFix2.txt 2009-07-29 10:25
Pre-Run: 39 813 427 200 octets libres
Post-Run: 39 798 878 208 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
210 --- E O F --- 2009-07-26 20:53
Par contre, je n'ai pas eu le temps de réinstaller AntiVir et demain je ne suis pas là. Donc je le ferai en rentrant, vers 19h ..
A demain !
ComboFix 09-07-28.04 - Rouvillain 29/07/2009 22:58.12.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.3327.2765 [GMT 2:00]
Running from: c:\users\Rouvillain\Desktop\ComboFix.exe
Command switches used :: c:\users\Rouvillain\Desktop\CFscript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
FILE ::
"c:\windows\system32\geyekrswdoetla.dll"
"c:\windows\system32\geyekrvgndgdlq.dll"
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-30 05:07 . 2009-07-30 05:07 -------- d-sh--w- C:\found.003
2009-07-29 21:07 . 2009-07-29 21:07 -------- d-----w- c:\users\Elodie\AppData\Local\temp
2009-07-29 03:39 . 2009-07-29 03:39 -------- d-sh--w- C:\found.002
2009-07-28 18:43 . 2009-07-28 18:43 -------- dc----w- C:\_OTM
2009-07-28 11:47 . 2009-07-28 11:47 199316666 -c--a-w- C:\Sauv.reg
2009-07-28 02:48 . 2009-07-28 02:48 -------- d-sh--w- C:\found.001
2009-07-27 23:34 . 2009-07-27 23:34 -------- d-sh--w- C:\found.000
2009-07-27 12:00 . 2009-03-24 14:07 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-26 18:34 . 2009-07-26 18:34 -------- d-----w- c:\progra~2\NortonInstaller
2009-07-25 10:12 . 2009-07-25 10:12 -------- d-----w- c:\progra~2\Kaspersky Lab Setup Files
2009-07-23 20:56 . 2009-07-23 20:56 -------- d-----w- c:\progra~2\Simply Super Software
2009-07-23 14:45 . 2009-07-28 11:47 -------- d-----w- c:\program files\trend micro
2009-07-23 12:55 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-23 12:55 . 2009-07-24 17:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-23 12:55 . 2009-07-23 12:55 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-23 12:55 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-23 12:54 . 2009-07-23 12:54 3775176 ----a-w- c:\users\Public\mbam-setup.exe
2009-07-20 17:16 . 2009-07-24 11:27 -------- d-----w- c:\program files\a-squared Anti-Malware
2009-07-20 17:06 . 2009-07-20 17:16 59412480 ----a-w- c:\users\Public\a2AntiMalwareSetup.exe
2009-07-20 17:02 . 2009-07-20 17:05 23975176 ----a-w- c:\users\Public\sdsetup.exe
2009-07-20 14:07 . 2009-07-20 14:18 -------- d-----w- c:\users\Public\backups
2009-07-20 13:36 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-07-20 13:36 . 2009-07-20 13:36 -------- d-----w- c:\program files\Panda Security
2009-07-19 19:25 . 2009-07-25 14:58 -------- d-----w- c:\program files\CCleaner
2009-07-19 18:07 . 2009-06-22 14:58 13312 ----a-w- c:\windows\system32\drivers\snetcfg.exe
2009-07-19 18:07 . 2009-07-23 13:45 -------- d-----w- c:\program files\Common Files\Uninstall
2009-07-19 17:04 . 2009-07-19 17:06 -------- d-----w- c:\users\Public\Photos anniv' Pauline
2009-07-17 11:13 . 2009-07-17 12:00 -------- d-----w- c:\users\Public\Musique
2009-07-17 11:09 . 2009-07-21 20:55 -------- d-----w- c:\users\Public\Jeux DS
2009-07-17 10:01 . 2009-05-21 08:56 -------- d-----w- c:\users\Public\eng
2009-07-17 10:01 . 2009-07-17 10:01 6955522 ----a-w- c:\users\Public\DSone_SDHC_V3.0_sp8_eng.zip
2009-07-15 10:15 . 2009-06-15 15:29 156160 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 10:15 . 2009-06-15 15:23 24064 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 10:15 . 2009-06-15 15:22 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 10:15 . 2009-06-15 15:21 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 10:15 . 2009-06-15 15:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2009-07-15 10:15 . 2009-06-15 13:03 289792 ----a-w- c:\windows\system32\atmfd.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 09:51 . 2009-04-29 15:15 -------- d-----w- c:\progra~2\Google Updater
2009-07-26 18:37 . 2007-05-06 19:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-25 19:04 . 2007-05-06 19:23 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-24 10:40 . 2009-03-14 20:51 -------- d-----w- c:\program files\Zylom Games
2009-07-21 16:59 . 2009-03-01 16:38 -------- d-----w- c:\program files\VSO
2009-07-19 20:21 . 2008-11-02 12:54 -------- d-----w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2
2009-07-16 10:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-28 11:23 . 2008-05-24 15:45 -------- d-----w- c:\users\Elodie\AppData\Roaming\LimeWire
2009-06-13 09:56 . 2007-05-06 19:18 -------- d-----w- c:\progra~2\Microsoft Help
2009-06-13 09:55 . 2007-05-06 19:20 -------- d-----w- c:\program files\Microsoft Works
2009-06-07 21:52 . 2009-06-07 21:52 -------- d-----w- c:\progra~2\Grey Alien Games
2009-06-07 15:35 . 2009-05-23 16:41 -------- d-----w- c:\progra~2\HipSoft
2009-06-07 13:08 . 2009-04-18 16:05 -------- d-----w- c:\program files\bfgclient
2009-05-09 13:40 . 2008-11-02 12:55 1 ----a-w- c:\users\Elodie\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2008-05-31 21:41 . 2008-05-31 21:41 774144 ----a-w- c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-07-29_10.23.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-06 19:10 . 2009-07-29 20:57 29490 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-07-29 20:57 50958 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-05-04 10:51 . 2009-07-29 20:55 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-04 10:51 . 2009-07-29 10:00 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-05-04 10:51 . 2009-07-29 10:00 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-04 10:51 . 2009-07-29 20:55 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-04 10:51 . 2009-07-29 10:00 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-05-04 10:51 . 2009-07-29 20:55 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-05-24 14:07 . 2009-07-27 11:48 3184 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-05-24 14:07 . 2009-07-29 18:56 3184 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2009-07-28 11:54 . 2009-07-29 20:44 3474 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2283137450-1778682601-968884257-1000_UserData.bin
+ 2009-07-29 20:55 . 2009-07-29 20:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-07-29 10:15 . 2009-07-29 10:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-07-29 10:15 . 2009-07-29 10:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-29 20:55 . 2009-07-29 20:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-23 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-06-25 1578736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-01-24 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"PlayMovie"="c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe" [2007-07-13 178280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"SystrayORAHSS"="c:\program files\OrangeHSS\Systray\SystrayApp.exe" [2006-12-12 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-31 185896]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-03 64000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-07-06 4669440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
c:\users\Elodie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-5-6 528384]
PCM Media Sharing.lnk - c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-5-6 200812]
ScanPanel.lnk - c:\program files\ScanPanel\ScnPanel.exe [2008-7-25 1732608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk /p \??\K:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3949DEB9-8DD8-42E4-A506-7B9F4A231291}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A033DC2D-F311-40C6-91FC-22337523B865}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F726BF72-BF4E-4B4F-B9FE-4CDF4E903131}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{51674872-C1F2-4F6E-9B9C-A757F38BE2C6}"= c:\program files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow DVD workprocess
"{00717E99-5B5E-4D82-B899-5B920CE145A9}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{F90A806B-AED4-4244-AC78-EA10F3E4F0E6}"= c:\program files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{2EACCE03-44AD-4451-AFA5-833B35CC35B9}"= c:\program files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{39E7738E-3D11-43B9-835D-D16D2F3B2B0D}"= c:\program files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{59B339AA-E6E9-43D5-A0ED-DAC81D658E12}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{B70C9DFF-8065-445C-8092-F386899335A3}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{9F52794C-B028-4208-88E2-1D78370B9A3B}"= c:\program files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{DCB45B20-FA20-4095-9016-E7F74A52FD4B}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PlayMovie.exe:Acer PlayMovie
"{A374BCC4-D6BE-418F-8E7C-B6C07284B3E6}"= c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe:Acer PlayMovie Resident Program
"{F0F76D77-4063-4396-AF0F-C9DBEA96F77D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A9AD6B6D-BF59-4C65-9C6F-635ADFB19461}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{781C8B61-197B-47FE-A4DF-51B52DC8FA6E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{B885E36F-6409-420C-AB3F-78A3510481E1}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8891F40A-06A6-45B5-B57D-1C6BC4D9321E}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{98C04AAB-2961-4C33-AB7C-18A1ED042E88}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4360709E-DF39-4239-9378-AC9804D93FCF}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{5871D7C5-6183-491C-8D34-6F210FCE59F0}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{AE7BDAFE-BA85-4D42-84D5-12F4A95BFA5C}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{E106A2D7-4784-48D6-9A13-49CBE30C9BE8}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{43BAD9D9-E0B3-4DF9-88CD-577F58C607D1}"= UDP:27760:BitComet 27760 TCP
"{07226393-181B-4F03-8D02-71235858B79B}"= TCP:27760:BitComet 27760 UDP
"TCP Query User{5137E0B5-766B-4993-A075-6DEEA24AC510}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{949AECEC-8445-47B2-8E52-A49FEE8D5455}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{A7684022-ABF6-44DE-A9D8-2839615A1505}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{64C253C9-5181-4546-B4B8-FFB4F498D7BC}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"{2DE48908-7FFB-451D-B24F-FC697421E0AA}"= UDP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
"{6B9F09F5-638A-48AF-96E4-FCEFDC4CBC3D}"= TCP:c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp\SymNRT.exe:Norton Removal Tool
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [20/07/2009 15:36 28544]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Live\Acer PlayMovie\000.fcl [04/05/2008 12:55 39408]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [06/05/2007 21:33 266343]
R2 SampleScanner;USB-Flachbettscanner;c:\windows\System32\drivers\ArtecGT.sys [25/07/2008 16:23 18120]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe" /TEMPSTART:""c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE" --> c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe [?]
S2 gupdate1c9c8de20341bb7;Service Google Update (gupdate1c9c8de20341bb7);c:\program files\Google\Update\GoogleUpdate.exe [29/04/2009 17:21 133104]
S3 PAC7302;PAC7302 VGA USB Camera;c:\windows\System32\drivers\PAC7302.SYS [21/08/2008 16:16 457856]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [23/05/2008 19:33 28224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://fr.fr.acer.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mWindow Title =
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-29 23:07
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
Completion time: 2009-07-29 23:12
ComboFix-quarantined-files.txt 2009-07-29 21:12
ComboFix2.txt 2009-07-29 10:25
Pre-Run: 39 813 427 200 octets libres
Post-Run: 39 798 878 208 octets libres
Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
210 --- E O F --- 2009-07-26 20:53
Par contre, je n'ai pas eu le temps de réinstaller AntiVir et demain je ne suis pas là. Donc je le ferai en rentrant, vers 19h ..
A demain !
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
30 juil. 2009 à 09:34
30 juil. 2009 à 09:34
avant de remettre antivir fais ceci:
AntiVirUpgradeService
Télécharge OTM
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTM.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.
(attention bien mettre :files)
:Services
AntiVirUpgradeService
:processes
explorer.exe
:files
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe
C:\found.003
C:\found.001
C:\found.000
c:\progra~2\NortonInstaller
c:\progra~2\Kaspersky Lab Setup Files
c:\program files\Panda Security
c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp
:reg
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2DE48908-7FFB-451D-B24F-FC697421E0AA}"=-
"{6B9F09F5-638A-48AF-96E4-FCEFDC4CBC3D}"=-
:commands
[purity]
[emptytemp]
[start explorer]
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
_________________________
passe un coup de ccleaner
__________________________
lance tool cleaner pour tout virer
https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/
__________________________
remets antivir et colle un rapport pour voir si encore des infections
AntiVirUpgradeService
Télécharge OTM
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTM.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTM :Paste instruction for items to be moved.
(attention bien mettre :files)
:Services
AntiVirUpgradeService
:processes
explorer.exe
:files
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe
c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe
C:\found.003
C:\found.001
C:\found.000
c:\progra~2\NortonInstaller
c:\progra~2\Kaspersky Lab Setup Files
c:\program files\Panda Security
c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp
:reg
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2DE48908-7FFB-451D-B24F-FC697421E0AA}"=-
"{6B9F09F5-638A-48AF-96E4-FCEFDC4CBC3D}"=-
:commands
[purity]
[emptytemp]
[start explorer]
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTM\MovedFiles.
il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
_________________________
passe un coup de ccleaner
__________________________
lance tool cleaner pour tout virer
https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/
__________________________
remets antivir et colle un rapport pour voir si encore des infections
Et hop, voilà le rapport de OTM :
All processes killed
========== SERVICES/DRIVERS ==========
Service\Driver AntiVirUpgradeService deleted successfully.
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3 not found.
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe not found.
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe not found.
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe not found.
C:\found.003\dir0001.chk moved successfully.
C:\found.003\dir0000.chk moved successfully.
C:\found.003 moved successfully.
C:\found.001 moved successfully.
C:\found.000\dir0000.chk moved successfully.
C:\found.000 moved successfully.
c:\progra~2\NortonInstaller\Settings moved successfully.
c:\progra~2\NortonInstaller\Logs\07-26-2009-20h34m24s moved successfully.
c:\progra~2\NortonInstaller\Logs moved successfully.
c:\progra~2\NortonInstaller moved successfully.
c:\progra~2\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.459\French\doc moved successfully.
c:\progra~2\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.459\French moved successfully.
c:\progra~2\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.459 moved successfully.
c:\progra~2\Kaspersky Lab Setup Files moved successfully.
c:\program files\Panda Security\ActiveScan 2.0 moved successfully.
c:\program files\Panda Security moved successfully.
File/Folder c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 377 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 0,00 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07302009_192653
Files moved on Reboot...
Registry entries deleted on Reboot...
All processes killed
========== SERVICES/DRIVERS ==========
Service\Driver AntiVirUpgradeService deleted successfully.
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3 not found.
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe not found.
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\setup.exe not found.
File/Folder c:\users\ROUVIL~1\AppData\Local\Temp\AVSETUP_4a6d93d3\basic\avupgsvc.exe not found.
C:\found.003\dir0001.chk moved successfully.
C:\found.003\dir0000.chk moved successfully.
C:\found.003 moved successfully.
C:\found.001 moved successfully.
C:\found.000\dir0000.chk moved successfully.
C:\found.000 moved successfully.
c:\progra~2\NortonInstaller\Settings moved successfully.
c:\progra~2\NortonInstaller\Logs\07-26-2009-20h34m24s moved successfully.
c:\progra~2\NortonInstaller\Logs moved successfully.
c:\progra~2\NortonInstaller moved successfully.
c:\progra~2\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.459\French\doc moved successfully.
c:\progra~2\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.459\French moved successfully.
c:\progra~2\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2010 9.0.0.459 moved successfully.
c:\progra~2\Kaspersky Lab Setup Files moved successfully.
c:\program files\Panda Security\ActiveScan 2.0 moved successfully.
c:\program files\Panda Security moved successfully.
File/Folder c:\users\Rouvillain\AppData\Local\Temp\7zS3CFF.tmp not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules not found.
Registry key HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
->Temp folder emptied: 0 bytes
User: Default
User: Default User
User: Elodie
User: Mélanie
User: Public
User: Rouvillain
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 377 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 0,00 mb
OTM by OldTimer - Version 3.0.0.5 log created on 07302009_192653
Files moved on Reboot...
Registry entries deleted on Reboot...
