Rapport findy kill

Bonjour,

############################## | FindyKill V5.031 |

# User : hugo (Administrateurs) # HUGO-7E88110B8D
# Update on 03/02/2010 by El Desaparecido
# Start at: 09:59:00 | 03/02/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) M processor 1.73GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Pack Sécurité SFR 9.12 9.12 [ Enabled | Updated ]
# FW : Pack Sécurité SFR 9.12[ Enabled ]9.12

# C:\ # Disque fixe local # 74,52 Go (31,56 Go free) # NTFS
# D:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |

################## | C:\WINDOWS |

C:\WINDOWS\ban_list.txt
C:\WINDOWS\mdelk.exe
C:\WINDOWS\wintems.exe

################## | C:\WINDOWS\Prefetch |

C:\WINDOWS\Prefetch\303482359.EXE-02E0247F.pf
C:\WINDOWS\Prefetch\303496812.EXE-3765305C.pf
C:\WINDOWS\Prefetch\318429015.EXE-1AEB229E.pf
C:\WINDOWS\Prefetch\318433593.EXE-04A2E251.pf
C:\WINDOWS\Prefetch\318449015.EXE-19FE4B6C.pf
C:\WINDOWS\Prefetch\318452656.EXE-330309A7.pf
C:\WINDOWS\Prefetch\333301437.EXE-0B6D78BD.pf
C:\WINDOWS\Prefetch\333328531.EXE-2F7B2570.pf
C:\WINDOWS\Prefetch\333351156.EXE-0D47A9D1.pf
C:\WINDOWS\Prefetch\348349828.EXE-00AED276.pf
C:\WINDOWS\Prefetch\348360328.EXE-36DA40A6.pf
C:\WINDOWS\Prefetch\348364078.EXE-0032842E.pf
C:\WINDOWS\Prefetch\363199953.EXE-0711F5B2.pf
C:\WINDOWS\Prefetch\363215140.EXE-19B445A6.pf
C:\WINDOWS\Prefetch\363295312.EXE-37571A06.pf
C:\WINDOWS\Prefetch\378741015.EXE-2CEA7B1B.pf
C:\WINDOWS\Prefetch\378761343.EXE-02197505.pf
C:\WINDOWS\Prefetch\378765265.EXE-3280EAFB.pf
C:\WINDOWS\Prefetch\394013671.EXE-26445854.pf
C:\WINDOWS\Prefetch\394034406.EXE-10A8DFE2.pf
C:\WINDOWS\Prefetch\394038953.EXE-365F791D.pf
C:\WINDOWS\Prefetch\408941812.EXE-05FD4CEF.pf
C:\WINDOWS\Prefetch\408965390.EXE-0ECC6F8B.pf
C:\WINDOWS\Prefetch\408971500.EXE-2D54197D.pf
C:\WINDOWS\Prefetch\424009359.EXE-296C1B85.pf
C:\WINDOWS\Prefetch\424025171.EXE-3B1563BE.pf
C:\WINDOWS\Prefetch\424030593.EXE-0A4BBF40.pf
C:\WINDOWS\Prefetch\438872171.EXE-196EE9B7.pf
C:\WINDOWS\Prefetch\438883140.EXE-0A972490.pf
C:\WINDOWS\Prefetch\438907203.EXE-16D8D813.pf
C:\WINDOWS\Prefetch\453762500.EXE-2251A6BF.pf
C:\WINDOWS\Prefetch\453767609.EXE-067D68C9.pf
C:\WINDOWS\Prefetch\453776218.EXE-3A180784.pf
C:\WINDOWS\Prefetch\468708531.EXE-1349E224.pf
C:\WINDOWS\Prefetch\468737453.EXE-171FFF99.pf
C:\WINDOWS\Prefetch\468771500.EXE-078BAAD9.pf
C:\WINDOWS\Prefetch\483666796.EXE-109933F1.pf
C:\WINDOWS\Prefetch\483686468.EXE-1C910DCB.pf
C:\WINDOWS\Prefetch\498564656.EXE-07044A1F.pf
C:\WINDOWS\Prefetch\498569531.EXE-121C0903.pf
C:\WINDOWS\Prefetch\498586390.EXE-230BCD46.pf
C:\WINDOWS\Prefetch\498609718.EXE-105C205D.pf
C:\WINDOWS\Prefetch\513739187.EXE-293A42D4.pf
C:\WINDOWS\Prefetch\513748812.EXE-29FFF831.pf
C:\WINDOWS\Prefetch\513762234.EXE-2774A28B.pf
C:\WINDOWS\Prefetch\FLEC006.EXE-2C81FC7D.pf
C:\WINDOWS\Prefetch\MDELK.EXE-087EF2B4.pf
C:\WINDOWS\Prefetch\MDELK.EXE-1D176F91.pf
C:\WINDOWS\Prefetch\WINTEMS.EXE-127B61D4.pf
C:\WINDOWS\Prefetch\WINTEMS.EXE-2A563F9B.pf

################## | C:\WINDOWS\system32 |

C:\WINDOWS\system32\ban_list.txt
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\system32\srosa2.sys
C:\WINDOWS\system32\wfsintwq.sys
C:\WINDOWS\system32\wintems.exe

################## | C:\WINDOWS\system32\drivers |

################## | C:\Documents and Settings\hugo\Application Data |

C:\Documents and Settings\hugo\Application Data\drivers
C:\Documents and Settings\hugo\Application Data\drivers\downld
C:\Documents and Settings\hugo\Application Data\drivers\winupgro.exe
C:\Documents and Settings\hugo\Application Data\m
C:\Documents and Settings\hugo\Application Data\m\data.oct
C:\Documents and Settings\hugo\Application Data\m\flec006.exe
C:\Documents and Settings\hugo\Application Data\m\list.oct
C:\Documents and Settings\hugo\Application Data\m\srvlist.oct
C:\Documents and Settings\hugo\Application Data\m\shared

################## | Zip File ... |

C:\PROGRA~1\WINDOW~2\npdrmv2.zip
-> Contain crack\crack.exe |Size : 813568 |With Bagle CRC32 : B57AC074

C:\PROGRA~1\WINDOW~2\npds.zip
-> Contain patch\keygen.exe |Size : 813568 |With Bagle CRC32 : B57AC074

################## | Temporary Internet Files |

################## | Registre |

[HKLM\SYSTEM\CurrentControlSet\Services\srosa]
[HKLM\SYSTEM\ControlSet001\Services\srosa]
[HKLM\SYSTEM\ControlSet002\Services\srosa]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
[HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA]
[HKCU\Software\bisoft]
[HKCU\Software\DateTime4]
[HKCU\Software\MuleAppData]
[HKCU\Software\WS33]
[HKCU\Software\WS35]
[HKCU\Software\WS4001]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\bisoft]
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\DateTime4]
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\MuleAppData]
[HKCU\Software\Local AppWizard-Generated Applications\winupgro]
[HKU\S-1-5-21-776561741-527237240-1417001333-1003\Software\Local AppWizard-Generated Applications\winupgro]

################## | Etat |

# Affichage des fichiers cachés : OK

Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !

# (!) Ndisuio -> Start = 4 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) Ip6Fw -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.031 ! |