Detection Trojan TR/Crypt.XPACK.Gen et plus
Fermé
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
-
31 juil. 2009 à 00:39
Utilisateur anonyme - 17 août 2009 à 18:00
Utilisateur anonyme - 17 août 2009 à 18:00
A voir également:
- Detection Trojan TR/Crypt.XPACK.Gen et plus
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Tr mail - Forum Messagerie
- Tr/crypt.xpack.gen ✓ - Forum Virus / Sécurité
- Detection materiel pc - Guide
- Google tr - Télécharger - Traduction
75 réponses
Mon 08/10/2009 ---- 16:19:15.12
----------------------------------
§§§§§§ [Mindjet] §§§§§§
----------------------------------
[X] Registre
-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete
********************
[Registre]
********************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\MindManager 7\\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\"="1"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="mindjet"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604]
"000"="mindjet"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe"="PrnInstaller"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe"="Uninstaller"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Collections]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Collections\My Projects]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Folders]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver]
"JobsPath"="C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\pdfSaver\\Jobs"
*******************
[Fichier]
*******************
*********************
[Même date]
*********************
Aucun fichier créé à la même date détecté
Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------
----------------------------------
§§§§§§ [Mindjet] §§§§§§
----------------------------------
[X] Registre
-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete
********************
[Registre]
********************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\MindManager 7\\"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\"="1"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="mindjet"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604]
"000"="mindjet"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe"="PrnInstaller"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe"="Uninstaller"
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Collections]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Collections\My Projects]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\MindManager\7\MyMaps\Folders]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver]
"JobsPath"="C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\pdfSaver\\Jobs"
*******************
[Fichier]
*******************
*********************
[Même date]
*********************
Aucun fichier créé à la même date détecté
Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------
▶ Double clic sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\MindManager 7\\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\"=-
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"=""
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604]
"000"=""
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe"=-
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe"=-
[-HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver]
"JobsPath"=""
:commands
[emptytemp]
[start explorer]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\MindManager 7\\"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\Mindjet\\"=-
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"=""
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604]
"000"=""
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe"=-
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe"=-
[-HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet]
[HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver]
"JobsPath"=""
:commands
[emptytemp]
[start explorer]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\\Program Files\\Mindjet\\MindManager 7\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\\Program Files\\Mindjet\\ not found.
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603\\"000"|"" /E!
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604\\"000"|"" /E!
Registry value HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe not found.
Registry value HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe not found.
Registry key HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\ deleted successfully.
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver\\"JobsPath"|"" /E!
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Administrator.NC-M2105
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 3232284 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: EndUser
->Temp folder emptied: 59324739 bytes
->Temporary Internet Files folder emptied: 9231648 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 60856226 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 482153 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 49152 bytes
RecycleBin emptied: 1144168 bytes
Total Files Cleaned = 130.21 mb
OTL by OldTimer - Version 3.0.10.5 log created on 08102009_183109
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
Process firefox.exe killed successfully!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\\Program Files\\Mindjet\\MindManager 7\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\\Program Files\\Mindjet\\ not found.
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5603\\"000"|"" /E!
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Search Assistant\ACMru\5604\\"000"|"" /E!
Registry value HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\PrnInstaller.exe not found.
Registry value HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\\C:\\Program Files\\Mindjet\\MindManager 7\\PDF-XChange\\unins000.exe not found.
Registry key HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Mindjet\ deleted successfully.
Unable to set value : HKEY_USERS\S-1-5-21-789336058-162531612-725345543-1004\Software\Tracker Software\PDF-XChange 3.0\Drivers\pdfSaver\\"JobsPath"|"" /E!
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Administrator.NC-M2105
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 3232284 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: EndUser
->Temp folder emptied: 59324739 bytes
->Temporary Internet Files folder emptied: 9231648 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 60856226 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 482153 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 49152 bytes
RecycleBin emptied: 1144168 bytes
Total Files Cleaned = 130.21 mb
OTL by OldTimer - Version 3.0.10.5 log created on 08102009_183109
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
14 août 2009 à 21:02
14 août 2009 à 21:02
Bonjour gen-hackman,
Vundo (ou le noms que vous voulez) n est pas mort!!! Les alertes d'Avira on recomence'! Et depuis la derniere operation mon pc est devenu super lent, ca prend une heure pour faire ce qui lui prend normalment 1 minutes!! Si bien que j ai renonce' a l'utiliser pour le moment, enfin, j suis qd meme entrain de faire le scan avec Malwarebite, j'en suis a la 30eme minute et la fenetre du programme est tjrs pas apparue encore.... J'ai peur pour mon pc...
Vundo (ou le noms que vous voulez) n est pas mort!!! Les alertes d'Avira on recomence'! Et depuis la derniere operation mon pc est devenu super lent, ca prend une heure pour faire ce qui lui prend normalment 1 minutes!! Si bien que j ai renonce' a l'utiliser pour le moment, enfin, j suis qd meme entrain de faire le scan avec Malwarebite, j'en suis a la 30eme minute et la fenetre du programme est tjrs pas apparue encore.... J'ai peur pour mon pc...
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
16 août 2009 à 03:49
16 août 2009 à 03:49
7hrs de scan! Bon j vais essayer d etre plus rapide maintenant l'ordi va mieux...
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2626
Windows 5.1.2600 Service Pack 2
8/15/2009 9:34:50 PM
mbam-log-2009-08-15 (21-34-38).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 142856
Temps écoulé: 7 hour(s), 16 minute(s), 51 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2626
Windows 5.1.2600 Service Pack 2
8/15/2009 9:34:50 PM
mbam-log-2009-08-15 (21-34-38).txt
Type de recherche: Examen complet (C:\|)
Eléments examinés: 142856
Temps écoulé: 7 hour(s), 16 minute(s), 51 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
télécharge ceci , fais un scan avec en desactivant le guard d'antivir et ton parefeu (si présent)
et poste le contenu du rapport qui va s'ouvrir à la fin
http://sd-1.archive-host.com/membres/up/829108531491024/Listem.exe
et poste le contenu du rapport qui va s'ouvrir à la fin
http://sd-1.archive-host.com/membres/up/829108531491024/Listem.exe
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
17 août 2009 à 00:22
17 août 2009 à 00:22
Voici :
List'em by g3n-h@ckm@n 1.0.2.0
update on 16.08.2009 ::::: 16.00
Microsoft Windows XP [Version 5.1.2600]
Sun 08/16/2009 18:20:53.28
Infections possibles :
=================
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
¤¤¤¤¤¤¤¤¤¤ Windows\Prefetch :
C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf
C:\WINDOWS\Prefetch\APPLEMOBILEDEVICEHELPER.EXE-2864A39D.pf
C:\WINDOWS\Prefetch\ASPNET_REGIIS.EXE-009D6E80.pf
C:\WINDOWS\Prefetch\AVCENTER.EXE-1A970FA0.pf
C:\WINDOWS\Prefetch\AVWSC.EXE-0283F9DD.pf
C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf
C:\WINDOWS\Prefetch\DISTNOTED.EXE-036B52B9.pf
C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf
C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf
C:\WINDOWS\Prefetch\GUARDGUI.EXE-00ECD849.pf
C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf
C:\WINDOWS\Prefetch\HOTFIXINSTALLER.EXE-065AB2A1.pf
C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf
C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf
C:\WINDOWS\Prefetch\ITUNES.EXE-1A268432.pf
C:\WINDOWS\Prefetch\JQSNOTIFY.EXE-24AE4A36.pf
C:\WINDOWS\Prefetch\Layout.ini
C:\WINDOWS\Prefetch\LISTEM.EXE-2C0EFD91.pf
C:\WINDOWS\Prefetch\LODCTR.EXE-1009C3B4.pf
C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf
C:\WINDOWS\Prefetch\MBAM.EXE-0BEE0439.pf
C:\WINDOWS\Prefetch\MODE.COM-31685BAE.pf
C:\WINDOWS\Prefetch\MOFCOMP.EXE-01718E95.pf
C:\WINDOWS\Prefetch\MSCORSVW.EXE-1BF30400.pf
C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
C:\WINDOWS\Prefetch\MSNMSGR.EXE-030AB647.pf
C:\WINDOWS\Prefetch\NDP35SP1-KB963707-X86.EXE-0A1DC737.pf
C:\WINDOWS\Prefetch\NGEN.EXE-38021CCC.pf
C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
C:\WINDOWS\Prefetch\REG.EXE-0D2A95F7.pf
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf
C:\WINDOWS\Prefetch\REGSVCS.EXE-11A17120.pf
C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
C:\WINDOWS\Prefetch\REGTLIBV12.EXE-0E2FA54B.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf
C:\WINDOWS\Prefetch\SKYPE.EXE-30AE1A60.pf
C:\WINDOWS\Prefetch\SKYPEPM.EXE-2BC7DD5C.pf
C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf
C:\WINDOWS\Prefetch\SPUPDSVC.EXE-21B36524.pf
C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-04FFAD65.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-32ED1DE4.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-37F3C0F9.pf
C:\WINDOWS\Prefetch\WLCOMM.EXE-04AE9009.pf
C:\WINDOWS\Prefetch\WMIADAP.EXE-2DF425B2.pf
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf
C:\WINDOWS\Prefetch\WSCNTFY.EXE-1B24F5EB.pf
C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf
--------EOF------------
List'em by g3n-h@ckm@n 1.0.2.0
update on 16.08.2009 ::::: 16.00
Microsoft Windows XP [Version 5.1.2600]
Sun 08/16/2009 18:20:53.28
Infections possibles :
=================
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :
¤¤¤¤¤¤¤¤¤¤ Windows\Prefetch :
C:\WINDOWS\Prefetch\ALG.EXE-0F138680.pf
C:\WINDOWS\Prefetch\APPLEMOBILEDEVICEHELPER.EXE-2864A39D.pf
C:\WINDOWS\Prefetch\ASPNET_REGIIS.EXE-009D6E80.pf
C:\WINDOWS\Prefetch\AVCENTER.EXE-1A970FA0.pf
C:\WINDOWS\Prefetch\AVWSC.EXE-0283F9DD.pf
C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf
C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf
C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf
C:\WINDOWS\Prefetch\DISTNOTED.EXE-036B52B9.pf
C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf
C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf
C:\WINDOWS\Prefetch\GUARDGUI.EXE-00ECD849.pf
C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf
C:\WINDOWS\Prefetch\HOTFIXINSTALLER.EXE-065AB2A1.pf
C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf
C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf
C:\WINDOWS\Prefetch\ITUNES.EXE-1A268432.pf
C:\WINDOWS\Prefetch\JQSNOTIFY.EXE-24AE4A36.pf
C:\WINDOWS\Prefetch\Layout.ini
C:\WINDOWS\Prefetch\LISTEM.EXE-2C0EFD91.pf
C:\WINDOWS\Prefetch\LODCTR.EXE-1009C3B4.pf
C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf
C:\WINDOWS\Prefetch\MBAM.EXE-0BEE0439.pf
C:\WINDOWS\Prefetch\MODE.COM-31685BAE.pf
C:\WINDOWS\Prefetch\MOFCOMP.EXE-01718E95.pf
C:\WINDOWS\Prefetch\MSCORSVW.EXE-1BF30400.pf
C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
C:\WINDOWS\Prefetch\MSNMSGR.EXE-030AB647.pf
C:\WINDOWS\Prefetch\NDP35SP1-KB963707-X86.EXE-0A1DC737.pf
C:\WINDOWS\Prefetch\NGEN.EXE-38021CCC.pf
C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf
C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
C:\WINDOWS\Prefetch\REG.EXE-0D2A95F7.pf
C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf
C:\WINDOWS\Prefetch\REGSVCS.EXE-11A17120.pf
C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf
C:\WINDOWS\Prefetch\REGTLIBV12.EXE-0E2FA54B.pf
C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf
C:\WINDOWS\Prefetch\SKYPE.EXE-30AE1A60.pf
C:\WINDOWS\Prefetch\SKYPEPM.EXE-2BC7DD5C.pf
C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf
C:\WINDOWS\Prefetch\SPUPDSVC.EXE-21B36524.pf
C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-04FFAD65.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-32ED1DE4.pf
C:\WINDOWS\Prefetch\UPDATE.EXE-37F3C0F9.pf
C:\WINDOWS\Prefetch\WLCOMM.EXE-04AE9009.pf
C:\WINDOWS\Prefetch\WMIADAP.EXE-2DF425B2.pf
C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf
C:\WINDOWS\Prefetch\WSCNTFY.EXE-1B24F5EB.pf
C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf
--------EOF------------
▶ Double clic sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:files
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
:commands
[emptytemp]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous Customs Scans/Fixes :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:files
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
:commands
[emptytemp]
[reboot]
▶ Clique sur RunFix pour lancer la suppression.
▶ Poste le rapport.
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
17 août 2009 à 00:55
17 août 2009 à 00:55
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== FILES ==========
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Administrator.NC-M2105
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: EndUser
->Temp folder emptied: 3006757 bytes
->Temporary Internet Files folder emptied: 40184740 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 42522446 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 16395915 bytes
RecycleBin emptied: 6649 bytes
Total Files Cleaned = 97.48 mb
OTL by OldTimer - Version 3.0.10.5 log created on 08162009_184322
Files\Folders moved on Reboot...
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
Registry entries deleted on Reboot...
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== FILES ==========
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Administrator.NC-M2105
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: EndUser
->Temp folder emptied: 3006757 bytes
->Temporary Internet Files folder emptied: 40184740 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 42522446 bytes
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 16395915 bytes
RecycleBin emptied: 6649 bytes
Total Files Cleaned = 97.48 mb
OTL by OldTimer - Version 3.0.10.5 log created on 08162009_184322
Files\Folders moved on Reboot...
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
Registry entries deleted on Reboot...
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
17 août 2009 à 01:37
17 août 2009 à 01:37
ah bon? C tres rassurant lol. Je vire C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
et C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
et C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
jeannotlapin31
Messages postés
13
Date d'inscription
vendredi 31 juillet 2009
Statut
Membre
Dernière intervention
17 août 2009
17 août 2009 à 02:01
17 août 2009 à 02:01
ca marche pas...