Virus qui bloque internet et les antivirus

fredchat -  
 gen-hackman -
Bonjour,
je sollicite de l'aide suite à une infection par un virus qui ressemble à Bagle après avoir ouvert un fichier téléchargé sur le net (je suis sous windows xp).
Depuis, impossible de lancer avast, zone alarm etc, et plus de connexion internet !
J'ai essayé de télécharger des logiciels comme ccleaner, hijackthis, antivir, elibagla en les gravant sur un cd, mais rien ne se lance.
Que puis-je faire ? J'en appelle à votre précieuse aide. Merci
Configuration: Windows XP / internet explorer 8

38 réponses

  • 1
  • 2
Résumé de la discussion

Infection détectée après l'ouverture d'un fichier téléchargé sur le net sous Windows XP, provoquant le blocage d'antivirus et la perte de connexion Internet permanente sur l'ordinateur. Des solutions proposées incluent l’utilisation d’outils de nettoyage tels que Malwarebytes et le Norton Removal Tool, ainsi que la désinstallation des restes de Symantec/Norton si présents. Des conseils supplémentaires mentionnent l’analyse des rapports et l’utilisation de Malwarebytes en mode complet, avec éventuellement des outils complémentaires et le recours à des rapports en ligne pour vérifier les infections détectées. En cas de persistance, certains conseillent de redémarrer et de répéter le scan ou d’examiner les éléments d’amorçage pour éliminer les traces restantes.

Bobot (l'IA à votre service)
  1. gen-hackman
     
    salut :

    Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

    ▶ Télécharge List_Kill'em et enregistre le sur ton bureau

    ▶ Branche clés usb , disques durs externes , mp3 , mp4 , etc..

    double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

    coche la case "creer une icone sur le bureau"

    une fois terminée , clic sur "terminer" et le programme se lancera seul

    choisis la langue puis choisis l'option 1 = Mode Recherche

    ▶ laisse travailler l'outil

    à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

    un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

    ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

    1
    1. fredchat
       
      Merci beaucoup pour ta réponse, j'essaye dès ce soir.
      Par contre, pour ce qui est de désactiver l'antivirus et le pare-feu, est-ce que je dois les désinstaller ?
      J'ai avast et zone alarm, et j'ai voulu désinstaller avast avec leur logiciel de désinstallation, mais rien ne se passe quand je le lance.
      0
  2. gen-hackman
     
    lance-le en mode sans echec sinon , ces derniers ne sont pas actifs dans ce mode (les virus non plus pour la plupart)
    0
    1. fredchat
       
      bonsoir,
      je viens de rentrer chez moi, et j'ai téléchargé List_kill'em mais il y un message Trojan:Win32/wintrim.gen! sur l'ordi de ma campagne ! ce logiciel contient un virus ?
      0
  3. gen-hackman
     
    non mais sa base de données contient des noms d'infections et des codes detectés comme tels par les antivirus

    lis la premier ligne de ce que j'ai ecrit post 1

    https://forums.commentcamarche.net/forum/affich-16763022-virus-qui-bloque-internet-et-les-antivirus#1
    0
    1. fredchat
       
      Re
      J'ai téléchargé tout ce qu'il fallait mais impossible de démarrer en mode sans échec, l'ordinateur redémarre automatiquement en mode normal...
      Est-ce que je peux tout de même lancer List Kill-Em ?
      Merci
      0
  4. gen-hackman
     
    oui
    0
    1. fredchat
       
      Bonjour,
      Je reviens donner des nouvelles de mon problème, car j'ai toujours pas pu mettre en œuvre tes recommandations, car depuis hier soir, chaque fois que je démarre le pc, il reboote sans arrêt. En fait, je n'arrivais pas à démarrer en mode sans échec, j'ai alors essayer dans msconfig de cocher "bootsafe" mais depuis le pc n'arrive plus à atteindre la page du bureau...
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. clemtheboss413 Messages postés 782 Statut Membre 7
     
    salut
    remarque CCleaner a utiliser seulement dès que ton pc est propre
    0
  7. gen-hackman
     
    pourquoi tu l'as pas passé en mode normal (List_Kill'em)?

    t'es vachement dans la merde !!

    il reste plus qu'a faire tout un tas de manips pour recuperer le pc.....ca va etre un peu long mais tu perdras rien de tes données.

    fais moi savoir si tu es pret
    0
    1. fredchat
       
      Bonsoir,

      Comme tu avais dit j'ai lancé le mode sans échec... qui a échoué !
      Et depuis le PC reboot automatiquement, que l'on fasse mode normal ou mode sans échec.
      J'ai toutefois réussi à le démarrer avec un CD XPE que l'on m'a prêté.

      Je suis prêt pour les manips.
      Merci beaucoup de ton aide !
      0
  8. gen-hackman
     
    je ne t ai jamais dit d utiliser MSCONFIG pour demarrer en mode sans echec...

    bref ton pc demarre normalement ?
    0
    1. fredchat
       
      le PC démarre uniquement grace au CD XPE sinon il ne démarre pas (donc pas sur mon C: mais sur le système d'exploit du CD)
      0
  9. gen-hackman
     
    ok tu peux t'en servir avec la connection internet ?

    0
    1. fredchat
       
      non malheureusement, j'ai essayé mais ça ne fonctionne pas
      0
  10. gen-hackman
     
    ok tu peux utiliser une clé usb pour transferer des fichiers a partirde , et sur ce pc ?
    0
    1. fredchat
       
      oui, je peux !
      0
  11. gen-hackman
     
    colle le contenu du fichier C:\Boot.ini du PC malade stp
    0
    1. fredchat
       
      [boot loader]
      timeout=30
      default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
      [operating systems]
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /safeboot:minimal
      0
  12. gen-hackman
     
    [boot loader]
    timeout=30
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /safeboot:minimal

    rends-le comme ceci et redemarre le pc normalement sans le CD PE

    [boot loader]
    timeout=30
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=Microsoft Windows XP dition familiale" /NOEXECUTE=OPTIN /FASTDETECT
    0
    1. fredchat
       
      l'ordi redémarre correctement !
      0
      1. fredchat > fredchat
         
        il y a un message d'erreur qui s'affiche : cette application n'a pas pu démarrer car prremote.dll est introuvable. La réinstallation de cette application peut corriger ce problème
        0
  13. gen-hackman
     
    retente List_Kill'em tel quel en mode normal option 1

    desactive le resident de AVAST avec le clic droit dans la barre des taches sur le "a" bleu
    0
    1. fredchat
       
      je n'ai plus de "a" en barre des taches...
      J'ai lancé List_Kill'Em, ça reste sur Searching pour le moment, c'est un peu long j'ai l'impression
      0
      1. fredchat > fredchat
         
        Ca fait 5 min que c'est sur la première ligne de C:\ windows\ServicePackFiles\i386\atapi.sys
        et que ça ne bouge pas...
        Normal ou pas normal ?
        0
  14. gen-hackman
     
    c est normal comme précisé dans l'énoncé
    0
  15. gen-hackman
     
    https://forums.commentcamarche.net/forum/affich-16763022-virus-qui-bloque-internet-et-les-antivirus#25
    0
    1. fredchat
       
      Ca y est c'est terminé, je te poste le contenu de la fenêtre blanche ?
      0
    2. fredchat
       
      List'em by g3n-h@ckm@n 1.2.8.0

      User : magali (Administrateurs)
      Update on 25/02/2010 by g3n-h@ckm@n ::::: 13.00
      Start at: 21:11:15 | 26/02/2010
      Contact : https://forums.commentcamarche.net/forum/virus-securite-7

      AMD Athlon(tm) XP 2400+
      Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
      Internet Explorer 8.0.6001.18702
      Windows Firewall Status : Enabled

      A:\ -> Lecteur de disquettes 3 ½ pouces
      C:\ -> Disque fixe local | 71,76 Go (2,2 Go free) [FAC01F-4] | FAT32
      D:\ -> Disque CD-ROM
      E:\ -> Disque CD-ROM
      F:\ -> Disque fixe local | 233,76 Go (887,2 Mo free) [DEDE] | NTFS
      G:\ -> Disque amovible | 505,34 Mo (503,62 Mo free) | FAT

      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\System32\drivers\CDAC11BA.EXE
      C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
      C:\WINDOWS\system32\carpserv.exe
      C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
      C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
      C:\Program Files\List_Kill'em\List_Kill'em.scr
      C:\WINDOWS\system32\cmd.exe
      C:\Documents and Settings\magali\Local Settings\Temp\2.tmp\pv.exe

      ======================
      Keys "Run"
      ======================
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
      KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
      NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
      ISUSPM Startup REG_SZ C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
      ISUSScheduler REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
      PPMemCheck REG_SZ C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
      PestPatrol Control Center REG_SZ C:\PROGRA~1\PESTPA~1\PPControl.exe
      ccApp REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
      CARPService REG_SZ carpserv.exe
      TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      CanonSolutionMenu REG_SZ C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
      SSBkgdUpdate REG_SZ "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
      OpwareSE4 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
      Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
      MaxMenuMgr REG_SZ "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
      QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
      !AVG Anti-Spyware REG_SZ "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
      MS Dynamic Host Configuration Protocol REG_SZ MSDHCP32.exe

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

      =====================
      Other Keys
      =====================
      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      dontdisplaylastusername REG_DWORD 0 (0x0)
      legalnoticecaption REG_SZ
      legalnoticetext REG_SZ
      shutdownwithoutlogon REG_DWORD 1 (0x1)
      undockwithoutlogon REG_DWORD 1 (0x1)
      EnableLUA REG_DWORD 0 (0x0)

      ===============
      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      NoDriveTypeAutoRun REG_DWORD 145 (0x91)

      ===============
      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

      ===============
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
      AppInit_DLLS REG_SZ

      ===============
      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
      AutoRestartShell REG_DWORD 1 (0x1)
      DefaultDomainName REG_SZ MISTIGRI
      DefaultUserName REG_SZ magali
      LegalNoticeCaption REG_SZ
      LegalNoticeText REG_SZ
      PowerdownAfterShutdown REG_SZ 0
      ReportBootOk REG_SZ 1
      Shell REG_SZ Explorer.exe
      ShutdownWithoutLogon REG_SZ 0
      System REG_SZ
      Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
      VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
      SfcQuota REG_DWORD -1 (0xffffffff)
      allocatecdroms REG_SZ 0
      allocatedasd REG_SZ 0
      allocatefloppies REG_SZ 0
      cachedlogonscount REG_SZ 10
      forceunlocklogon REG_DWORD 0 (0x0)
      passwordexpirywarning REG_DWORD 14 (0xe)
      scremoveoption REG_SZ 0
      AllowMultipleTSSessions REG_DWORD 1 (0x1)
      UIHost REG_EXPAND_SZ logonui.exe
      LogonType REG_DWORD 1 (0x1)
      Background REG_SZ 0 0 0
      DebugServerCommand REG_SZ no
      SFCDisable REG_DWORD 0 (0x0)
      WinStationsDisabled REG_SZ 0
      DefaultPassword REG_SZ
      HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
      ShowLogonOptions REG_DWORD 0 (0x0)
      AltDefaultUserName REG_SZ magali
      AltDefaultDomainName REG_SZ MISTIGRI

      ===============
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Ext]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

      ===============
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
      {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
      {57B86673-276A-48B2-BAE7-C6DBB3020EB8} REG_SZ AVG Anti-Spyware 7.5

      ===============
      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
      C:\Program Files\Hercules\Hercules DualPix HD Webcam\Station2.exe REG_SZ C:\Program Files\Hercules\Hercules DualPix HD Webcam\Station2.exe:*:Enabled:Webcam Station Evolution
      C:\Program Files\Azureus\Azureus.exe REG_SZ C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus
      C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe REG_SZ C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe:*:Enabled:Nokia PC Suite
      C:\Program Files\Nokia\Nokia Lifeblog\NokiaLifeblog.exe REG_SZ C:\Program Files\Nokia\Nokia Lifeblog\NokiaLifeblog.exe:*:Enabled:Nokia Lifeblog 2.1
      C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe REG_SZ C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater
      C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe REG_SZ C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process
      C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
      C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
      C:\Program Files\Pando Networks\Pando\pando.exe REG_SZ C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:Pando Application
      C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
      C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
      C:\Program Files\Winamp Remote\bin\Orb.exe REG_SZ C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb
      C:\Program Files\Winamp Remote\bin\OrbTray.exe REG_SZ C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray
      C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe REG_SZ C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client
      C:\Program Files\SimpleCenter\Home Media Server.exe REG_SZ C:\Program Files\SimpleCenter\Home Media Server.exe:*:Enabled:Home Media Server
      C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
      C:\Program Files\Real\RealPlayer\RealPlay.exe REG_SZ C:\Program Files\Real\RealPlayer\RealPlay.exe:*:Enabled:RealPlayer
      C:\Program Files\Spotify\spotify.exe REG_SZ C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify
      C:\Program Files\Freeplayer\vlc\vlc.exe REG_SZ C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player
      C:\Program Files\VideoLAN\VLC\vlc.exe REG_SZ C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
      C:\Program Files\Freeplayer\fbx-playlist.exe REG_SZ C:\Program Files\Freeplayer\fbx-playlist.exe:*:Enabled:fbx-playlist
      C:\Program Files\SopCast\adv\SopAdver.exe REG_SZ C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver
      C:\Program Files\SopCast\SopCast.exe REG_SZ C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application
      C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe REG_SZ C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe:*:Enabled:Seagate Status Icon
      C:\Program Files\Seagate\SeagateManager\ManagerApp\stxmanager.exe REG_SZ C:\Program Files\Seagate\SeagateManager\ManagerApp\stxmanager.exe:*:Enabled:Seagate Manager

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
      C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
      C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

      ===============
      ActivX controls
      ===============
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0000000A-0000-0010-8000-00AA00389B71}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0CCA191D-13A6-4E29-B746-314DEE697D83}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1FF43AD5-2262-4C2F-81D4-26D710C3F305}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33331111-1111-1111-1111-611111193423}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33331111-1111-1111-1111-615111193427}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33564D57-0000-0010-8000-00AA00389B71}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5C051655-FCD5-4969-9182-770EA5AA5565}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E5E167B-1566-4316-B27F-0DDAB3484CF7}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8100D56A-5661-482C-BEE8-AFECE305D968}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{9F1C11AA-197B-4942-BA54-47A8489BB47F}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BA162249-F2C5-4851-8ADC-FC58CB424243}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
      HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{EDFCB7CB-942C-4822-AF14-F0B687409848}

      ===============
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{377483c2-e4b4-4ee8-b577-9aed264c8735}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4BF73126-9A34-BBBD-29CA-051570761974}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4d64f3ba-f112-4efe-a02e-96680859937c}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5b7bf89d-d196-4c32-a303-a57b8ab7f18d}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BC07EF7F-9BD2-069F-7363-FB7A54CF08F2}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BC161508-AB34-B18C-7764-0DE86970CA16}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dd772a76-bef3-44d7-8b39-502c8504c1f1}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4A7B6C7-978C-B7B4-B750-E00E2CDBCF16}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f15ee071-deb7-4cbb-951f-431c98338d8e}
      HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5776D81-AE53-4935-8E84-B0B283D8BCEF}

      ==============
      BHO :
      ======
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

      ===
      DNS
      ===

      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
      HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

      ================
      Internet Explorer :
      ================
      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
      Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
      Start Page REG_SZ https://www.google.fr/?gws_rd=ssl

      ========
      Services
      ========
      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

      Ndisuio : 0x4 ( OK = 3 )
      SharedAccess : 0x4 ( OK = 2 )
      wuauserv : 0x4 ( OK = 2 )

      =========
      Atapi.sys
      =========

      %%%% HASHDEEP-1.0
      %%%% size,md5,sha256,filename
      ## Invoked from: C:\Documents and Settings\magali\Local Settings\Temp\2.tmp
      ## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
      ##
      95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\drivers\atapi.sys
      %%%% HASHDEEP-1.0
      %%%% size,md5,sha256,filename
      ## Invoked from: C:\Documents and Settings\magali\Local Settings\Temp\2.tmp
      ## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
      ##
      86912,95b858761a00e1d4f81f79a0da019aca,5e41dae055bcb8ee8ad23d3c77d69df09c6b1e301c889aec6f02193d7dec352b,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
      %%%% HASHDEEP-1.0
      %%%% size,md5,sha256,filename
      ## Invoked from: C:\Documents and Settings\magali\Local Settings\Temp\2.tmp
      ## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
      ##
      95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\ServicePackFiles\i386\atapi.sys

      Référence :
      ==========

      Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
      Win XP_32b : a64013e98426e1877cb653685c5c0009
      Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
      Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
      Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
      Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
      Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
      Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
      Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
      Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

      =======
      Drive :
      =======

      D‚fragmenteur de disque Windows
      Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

      Rapport d'analyse
      71,76 Go total, 2,20 Go libre (3%), 42% fragment‚ (fragmentation du fichier 67%)

      Vous devriez d‚fragmenter ce volume.

      ¤¤¤¤¤¤¤¤¤¤ Files/folders :

      Present !! : C:\Documents and Settings\All Users\Application Data\.zreglib
      Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
      Present !! : C:\Program Files\Ask.com
      Present !! : C:\Program Files\setup.exe
      Present !! : C:\WINDOWS\~VS189.tmp
      Present !! : C:\WINDOWS\~VSC.tmp
      Present !! : C:\WINDOWS\~VS14.tmp
      Present !! : C:\WINDOWS\~VS15.tmp
      Present !! : C:\WINDOWS\~VS16.tmp
      Present !! : C:\WINDOWS\002406_.tmp
      Present !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
      Present !! : C:\WINDOWS\iun6002.exe
      Present !! : C:\WINDOWS\patch.exe
      Present !! : C:\WINDOWS\System32\SET*.tmp
      Present !! : C:\WINDOWS\System32\srosa2.sys
      Present !! : C:\WINDOWS\System32\wfsintwq.sys"
      Present !! : C:\WINDOWS\Temp\ICD1.tmp
      Present !! : C:\Documents and Settings\magali\Application Data\GDIPFONTCACHEV1.DAT
      Present !! : C:\Documents and Settings\magali\Application Data\GDIPFONTCACHEV1.DAT
      Present !! : C:\Documents and Settings\magali\Application Data\drivers

      ¤¤¤¤¤¤¤¤¤¤ Keys :

      Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\drvsyskit
      Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\MS Dynamic Host Configuration Protocol
      Present !! : HKU\S-1-5-21-709074730-706428418-2291417035-1005\Software\Microsoft\Windows\CurrentVersion\Run\drvsyskit
      Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
      Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
      Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
      Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
      Present !! : "HKCU\Software\Local AppWizard-Generated Applications\winupgro"
      Present !! : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
      Present !! : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
      Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
      Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
      Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
      Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
      Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
      Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
      Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
      Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
      Present !! : HKCU\software\Ask.com
      Present !! : HKCU\Software\bisoft
      Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba}
      Present !! : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
      Present !! : HKLM\software\classes\appid\GenericAskToolbar.DLL
      Present !! : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
      Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
      Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
      Present !! : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
      Present !! : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
      Present !! : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
      Present !! : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
      Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
      Present !! : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
      Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_OREANS32
      Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
      Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
      Present !! : HKLM\SYSTEM\ControlSet001\Services\oreans32
      Present !! : HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s
      Present !! : HKLM\SYSTEM\ControlSet001\Services\srosa
      Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_OREANS32
      Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
      Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
      Present !! : HKLM\SYSTEM\ControlSet002\Services\oreans32
      Present !! : HKLM\SYSTEM\ControlSet002\Services\sK9Ou0s
      Present !! : HKLM\SYSTEM\ControlSet002\Services\srosa
      Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_OREANS32
      Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
      Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
      Present !! : HKLM\SYSTEM\CurrentControlSet\Services\oreans32
      Present !! : HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security
      Present !! : HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum
      Present !! : HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s
      Present !! : HKLM\SYSTEM\CurrentControlSet\Services\srosa

      ============

      catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2010-02-26 21:44:23
      Windows 5.1.2600 Service Pack 2 FAT NTAPI

      scanning hidden processes ...

      C:\DOCUMENTS AND SETTINGS\MAGALI\APPLICATION DATA\DRIVERS\WINUPGRO.EXE [468] 0x82D2C5E8

      scanning hidden services ...

      HKLM\SYSTEM\CurrentControlSet\Services\srservice 3.0.0.00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Srvervice 3.0.0.00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRVce 3.0.0.00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\stisvcVce 3.0.0.00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\StreamDispatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\streamipspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\swenumipspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\swmidiipspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SwPrviipspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\swwdviipspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\symc810pspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\symc8xxpspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMDNSxpspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMFWSxpspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMIDSxpspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMIDSCOspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMNDISOspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMREDRVspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SYMTDIRVspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\sym_hiRVspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\sym_u3RVspatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\sysaudiospatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\SysmonLogpatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TapiSrvogpatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Tcpiprvogpatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TDPIPEvogpatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TDTCPEvogpatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TermDDvogpatcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TermServicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Themesrvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Tonessrvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TosIdervicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TrkWksrvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\TSDDDsrvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\UdfsDsrvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\UIA11srvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\ultrasrvicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Updatervicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\upnphosticetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\upperdevicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\UPSerdevicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbaudioicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbccgpoicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbehcioicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbhubioicetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbprinticetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbscanticetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbsernticetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\UsbserFiltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\USBSTORiltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usbuhciiltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\usnjsvciltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\V124svciltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\VgaSaveiltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\viaagp1iltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\ViaIde1iltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\VIAudioiltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\VolSnapiltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\vsdatantltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\vsmonantltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\VSSonantltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\VXDonantltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\W32Timetltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\W3SVCmetltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Wanarpetltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\wanatwetltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\Wdf01000ltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\WDICA000ltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\wdmaud00ltetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\WebClienttetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\winachsfttetcher00.02.2010_22-04drv

      HKLM\SYSTEM\CurrentControlSet\Services\winmgmt Workflow Foundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\Winsock Workflow Foundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WinSock2Workflow Foundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WinTrustWorkflow Foundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WMDM PMSP ServiceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WmdmPmSNP ServiceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WmimPmSNP ServiceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WmiApRplP ServiceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WmiApSrvP ServiceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WMPNetworkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\wscsvcworkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WSTCODECrkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\wuauservrkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WudfPfrvrkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WudfRdrvrkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WudfSvcvrkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\WZCSVCcvrkSvcviceFoundation 3.0.0.0

      HKLM\SYSTEM\CurrentControlSet\Services\xmlprovvrkSvcviceFoundation 3.0.0.0

      scanning hidden autostart entries ...

      scanning hidden files ...


      scan completed successfully
      hidden processes: 1
      hidden services: 89
      hidden files: 0


      Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

      device: opened successfully
      user: MBR read successfully
      called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
      kernel: MBR read successfully
      user & kernel MBR OK

      ==========
      Programs
      ==========

      Fichiers communs
      Windows NT
      wz90fr.exe
      MSN Gaming Zone
      MSN Messenger
      Windows Media Player
      Services en ligne
      WindowsUpdate
      ComPlus Applications
      Internet Explorer
      Outlook Express
      NetMeeting
      Movie Maker
      microsoft frontpage
      xerox
      Uninstall Information
      VIA Technologies, Inc
      Common Files
      Windows Journal Viewer
      InstallShield Installation Information
      ATI Technologies
      NPADEMO.exe
      directx
      Roxio
      Installation BitDefender.exe
      trueinst.exe
      xvidcore-1.1.0-beta1
      XviD
      Adobe
      CyberLink
      XnView Digital
      Elaborate Bytes
      flac112a.exe
      Real
      Nullsoft
      Viewpoint
      xp-AntiSpy_french.zip
      PestPatrol
      eMule
      MSNPatcherPlusPlus.exe
      spybotsd13.exe
      xvidcore-1.1.0-beta1.tar.gz
      VideoLAN
      WinRAR
      WinZip
      Zylom Games
      MSN Apps
      Free Audio Pack
      all2mp3.exe
      LeechFTP
      Hercules
      RealPlayer10-5GOLD_fr.exe
      INSTALL_MSN_MESSENGER_DL.EXE
      Free
      Zuma
      Nero.v6.6.0.1.Ultra.Edition
      Keyspan
      iTunes
      Microsoft Office
      iPod
      Oxilog
      Illustrate
      LitexMedia
      Nokia
      Tunatic
      setupfre.exe
      QuickTime
      Softwin
      GP5DEMO.exe
      Spybot - Search & Destroy
      Google
      Krystal Drop
      GOTO.games
      MP3 to WAV Decoder
      Yahoo!
      Mes Jeux T‚l‚charg‚s
      DIFX
      Ahead
      zone alarm pro 4.0.123.012 + fr + serial
      Zone Labs
      Winamp
      RngInterstitial.dll
      VirtualDub.exe
      DivX
      Lavalys
      Java
      Grisoft
      Xtreme Desktop
      winamp501_full.exe
      cbsetup.exe
      Installation de Xpert PDF.exe
      Installer_Aim.exe
      setupmp3towav.exe
      Win98SE_All.zip
      Guitar Pro 5
      messenger
      eMule0.47c-Installer.exe
      Alwil Software
      MSXML 4.0
      Look2Me-Destroyer.exe
      TunaticSetup.exe
      sharedaccess.reg
      eMule-NG-0[1].47c-Installer.rar
      Crazy Browser(2)
      Crazy Browser
      GoogleVideoPlayerSetup.exe
      setup_ocr.exe
      vdub.exe
      kavperspro4.5.0.94fre.exe
      you_only_live_once_ver2.gp3
      Setup_FreeConverter.exe
      ZoneAlarm_FR.exe
      vlc-0.8.1-win32.exe
      Codecs and burning tools - Codec et outil pour graver des audios
      Lavasoft
      winzip100.exe
      all4cmr301.exe
      eMule0.47a-Installer.exe
      avgas-setup-7.5.0.50.exe
      Install_Messenger.exe
      vdicmdrv.dll
      Kaspersky Lab
      everesthome220.exe
      PC Connectivity Solution
      CDex_150
      cutkiller.exe
      Microsoft ActiveSync
      Xtremsplit.exe
      Cyanide
      Spotify
      pocketdivxencoder_pocketdivxencoder_v0.3.96_francais_36289.exe
      T‚l‚chargeur de Pro Rugby Manager 2005
      Boonty
      BoontyGames
      free-wma-mp3-converter.exe
      Free WMA to MP3 Converter
      iTunesSetup.exe
      vdsvrlnk.dll
      Reference Assemblies
      MSBuild
      PandoSetup.exe
      Apple Software Update
      Bonjour
      SetupCloneDVD2917Slysoft.exe
      MediaMonkey_3.0.5.1187.exe
      MediaMonkey
      vdremote.dll
      Canon
      CanonBJ
      ScanSoft
      Panasonic
      picasaweb-current-setup.exe
      Picasa2
      VirtualDub-1.8.6.zip
      winamp5531_full_emusic-7plus_fr-fr.exe
      VirtualDub.vdi
      Winamp Remote
      Winamp Toolbar
      VirtualDub.chm
      auxsetup.exe
      aviproxy
      plugins
      Virtools Web Player 3.5
      folderlockbox_setup.exe
      My Lockbox
      Google_Earth_CZXD.exe
      SimpleCenter
      MSXML 6.0
      Windows Media Connect 2
      copying
      1221.exe
      PocketDivXEncoder_0.3.96.exe
      DivXPlayer_S60_3rd_0.sisx
      Free Video Converter
      VirtualDub.jobs
      VirtualDub1.exe
      VirtualDub
      VD_plugin_pack.exe
      FreeVideoDub.exe
      DVDVideoSoft
      uTorrent
      VDJSetup.exe
      VDJ5
      Freeplayer
      Setup_RnetFR.exe
      Micro Application
      SetupDl.exe
      spybotsd12.exe
      Ad-aware 6.0.lnk
      XviD_Install.exe
      MSDE2000
      NOS
      instmsiw.exe
      OggDS0995.exe
      djmixlitesetup130.exe
      AtomixMP3_2.3.exe
      Atory
      download-install_virtualdj_trial_v5_0.exe.exe
      setup.exe
      Radio net FR
      Setup_FreeVideoConverter.exe
      Ask.com
      BeatportSync_101_NI_Win.zip
      Beatport Sync 1.0.1 NI Setup.exe
      Native Instruments
      7-Zip
      USB MEMORY BAR
      IE8-WindowsXP-x86-FRA.exe
      Freeplayer-Win32-20070531.exe
      SopCast
      OOo_3.1.1_Win32Intel_install_wJRE_fr.exe
      openofficeorg31.msi
      openofficeorg1.cab
      instmsia.exe
      setup.ini
      licenses
      readmes
      redist
      OpenOffice.org 3
      JRE
      Combined Community Codec Pack
      Seagate
      CCleaner
      avp6
      List_Kill'em
      fdjeux

      ============
      Drive C:
      ============

      pagefile.sys
      WINDOWS
      Bootfont.bin
      ntldr
      NTDETECT.COM
      boot.ini
      Documents and Settings
      Program Files
      CONFIG.SYS
      AUTOEXEC.BAT
      IO.SYS
      MSDOS.SYS
      System Volume Information
      IPH.PH
      hiberfil.sys
      FOUND.018
      FOUND.000
      Recycled
      DVDVideoSoft
      FOUND.001
      FOUND.002
      FLASHED.DAT
      FOUND.003
      FOUND.004
      REPORTS
      SCANDISK.LOG
      Kill'em
      FOUND.010
      FOUND.011
      FOUND.012
      FOUND.013
      FOUND.014
      FOUND.015
      FOUND.016
      FOUND.017
      FOUND.019
      FOUND.020
      rapport.txt
      FOUND.021
      FOUND.022
      FOUND.023
      FOUND.024
      FOUND.025
      FOUND.026
      FOUND.027
      FOUND.028
      FOUND.029
      FOUND.030
      FOUND.031
      FOUND.032
      FOUND.033
      FOUND.034
      FOUND.035
      FOUND.036
      FOUND.037
      FOUND.038
      FOUND.039
      FOUND.040
      FOUND.041
      FOUND.042
      FOUND.043
      FOUND.044
      FOUND.045
      FOUND.046
      FOUND.047
      FOUND.048
      Check.dat
      FOUND.049
      FOUND.050
      teleir
      FOUND.051
      FOUND.052
      FOUND.053
      FOUND.054
      FOUND.055
      FOUND.056
      My Music
      FOUND.057
      FOUND.058
      FOUND.059
      FOUND.060
      FOUND.061
      FOUND.062
      FOUND.063
      FOUND.064
      FOUND.065
      FOUND.066
      FOUND.067
      FOUND.068
      FOUND.069
      FOUND.070
      FOUND.071
      FOUND.072
      FOUND.073
      FOUND.074
      FOUND.075
      FOUND.076
      FOUND.077
      FOUND.078
      FOUND.079
      FOUND.080
      FOUND.081
      FOUND.082
      FOUND.083
      FOUND.084
      FOUND.085
      FOUND.086
      FOUND.087
      FOUND.088
      FOUND.089
      FOUND.090
      FOUND.091
      FOUND.092
      FOUND.093
      FOUND.094
      FOUND.095
      FOUND.096
      FOUND.097
      FOUND.098
      FOUND.099
      FOUND.100
      FOUND.101
      FOUND.102
      FOUND.103
      FOUND.104
      FOUND.105
      FOUND.106
      FOUND.107
      FOUND.108
      FOUND.109
      FOUND.110
      FOUND.111
      FOUND.112
      FOUND.113
      FOUND.114
      FOUND.115
      FOUND.116
      FOUND.117
      Converted Music
      FOUND.118
      FOUND.119
      FOUND.120
      FOUND.121
      FOUND.122
      FOUND.123
      FOUND.124
      FOUND.125
      FOUND.126
      FOUND.127
      My Download Files
      DownloadLog.txt
      My Games
      FOUND.128
      FOUND.129
      FOUND.130
      FOUND.131
      FOUND.132
      FOUND.133
      FOUND.134
      FOUND.135
      FOUND.136
      List'em.txt
      FOUND.151
      FOUND.137
      FOUND.138
      FOUND.143
      FOUND.144
      FOUND.145
      FOUND.139
      FOUND.146
      FOUND.147
      FOUND.140
      FOUND.141
      FOUND.142
      xscan.txt
      FOUND.148
      FOUND.149
      FOUND.150
      audio
      FOUND.152
      FOUND.153
      Config.Msi
      DFR2.tmp
      DFRA.tmp

      ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

      C:\Program Files\Nero.v6.6.0.1.Ultra.Edition\NeroMix.v1.4.0.25.Incl.Keygen\CRACK\Keygen.exe
      C:\Program Files\Nero.v6.6.0.1.Ultra.Edition\CRACK\Keygen.exe




      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

      End of scan : 21:47:37,87
      0
  16. gen-hackman
     
    ok laisse tomber List_Kill'em pour l instant on y reviendra ensuite

    ▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
    mais cette fois-ci :

    ▶ choisis l'option 2 = Mode Suppression

    laisse travailler l'outil.

    en fin de scan un rapport s'ouvre

    ▶ colle le contenu dans ta reponse
    0
    1. fredchat
       
      Voici le résultat.

      Kill'em by g3n-h@ckm@n 1.2.8.0

      User : magali (Administrateurs)
      Update on 25/02/2010 by g3n-h@ckm@n ::::: 13.00
      Start at: 22:35:21 | 26/02/2010
      Contact : https://forums.commentcamarche.net/forum/virus-securite-7

      AMD Athlon(tm) XP 2400+
      Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
      Internet Explorer 8.0.6001.18702
      Windows Firewall Status : Enabled

      A:\ -> Lecteur de disquettes 3 ½ pouces
      C:\ -> Disque fixe local | 71,76 Go (2,09 Go free) [FAC01F-4] | FAT32
      D:\ -> Disque CD-ROM
      E:\ -> Disque CD-ROM
      F:\ -> Disque fixe local | 233,76 Go (887,2 Mo free) [DEDE] | NTFS
      G:\ -> Disque amovible | 505,34 Mo (503,58 Mo free) | FAT


      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\System32\drivers\CDAC11BA.EXE
      C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
      C:\WINDOWS\system32\carpserv.exe
      C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
      C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
      C:\Program Files\List_Kill'em\List_Kill'em.scr
      C:\WINDOWS\system32\cmd.exe
      C:\Documents and Settings\magali\Local Settings\Temp\7.tmp\ERUNT.EXE
      C:\Documents and Settings\magali\Local Settings\Temp\7.tmp\pv.exe

      Detections :
      ==========


      ¤¤¤¤¤¤¤¤¤¤ Files/folders :

      Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\.zreglib
      Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
      Quarantined & Deleted !! : C:\Program Files\Ask.com
      Quarantined & Deleted !! : C:\Program Files\setup.exe
      Quarantined & Deleted !! : C:\WINDOWS\~VS189.tmp
      Quarantined & Deleted !! : C:\WINDOWS\~VSC.tmp
      Quarantined & Deleted !! : C:\WINDOWS\~VS14.tmp
      Quarantined & Deleted !! : C:\WINDOWS\~VS15.tmp
      Quarantined & Deleted !! : C:\WINDOWS\~VS16.tmp
      Quarantined & Deleted !! : C:\WINDOWS\002406_.tmp
      Quarantined & Deleted !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
      Quarantined & Deleted !! : C:\WINDOWS\iun6002.exe
      Quarantined & Deleted !! : C:\WINDOWS\patch.exe

      Quarantined & Deleted !! : C:\WINDOWS\System32\SET71.tmp
      Quarantined & Deleted !! : C:\WINDOWS\system32\srosa2.sys
      Quarantined & Deleted !! : C:\WINDOWS\system32\wfsintwq.sys
      Quarantined & Deleted !! : C:\WINDOWS\Temp\ICD1.tmp
      Quarantined & Deleted !! : C:\Documents and Settings\magali\Application Data\GDIPFONTCACHEV1.DAT
      Quarantined & Deleted !! : C:\Documents and Settings\magali\Application Data\drivers

      ==============
      host file OK !
      ==============

      ========
      Registry
      ========

      Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\MS Dynamic Host Configuration Protocol
      Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
      Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
      Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
      Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
      Deleted : "HKCU\Software\Local AppWizard-Generated Applications\winupgro"
      Deleted : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
      Deleted : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
      Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
      Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
      Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
      Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
      Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
      Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
      Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
      Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
      Deleted : HKCU\software\Ask.com
      Deleted : HKCU\Software\bisoft
      Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba}
      Deleted : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
      Deleted : HKLM\software\classes\appid\GenericAskToolbar.DLL
      Deleted : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
      Deleted : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
      Deleted : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
      Deleted : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
      Deleted : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
      Deleted : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
      Deleted : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
      Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
      Deleted : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
      Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_OREANS32
      Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
      Deleted : HKLM\SYSTEM\ControlSet001\Services\oreans32
      Deleted : HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s
      Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_OREANS32
      Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
      Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
      Deleted : HKLM\SYSTEM\ControlSet002\Services\oreans32
      Deleted : HKLM\SYSTEM\ControlSet002\Services\sK9Ou0s
      ========
      Services
      =========

      Ndisuio : Start = 3
      Ip6Fw : Start = 2
      SharedAccess : Start = 2
      wuauserv : Start = 2
      wscsvc : Start = 2

      ============
      Disk Cleaned
      ============

      =================
      anti-ver blaster : OK !!
      =================

      ================
      Prefetch cleaned
      ================



      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
      0
  17. gen-hackman
     
    ▶ Télécharge FindyKill sur ton bureau :

    http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

    ! Déconnecte toi et ferme toutes applications en cours !

    ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

    ▶ Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

    ▶ Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

    ▶ Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

    ▶ Laisse travailler l'outil et ne touche à rien ...

    ▶ Poste le rapport qui apparait à la fin , sur le forum ...

    ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
    ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
    0
    1. fredchat
       
      ############################## | FindyKill V5.037 |

      # User : magali (Administrateurs) # MISTIGRI
      # Update on 18/02/2010 by El Desaparecido
      # Start at: 23:36:32 | 26/02/2010
      # Website : http://pagesperso-orange.fr/NosTools/index.html
      # Contact : FindyKill.Contact@gmail.com

      # AMD Athlon(tm) XP 2400+
      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
      # Internet Explorer 8.0.6001.18702
      # Windows Firewall Status : Enabled

      # A:\ # Lecteur de disquettes 3 ½ pouces
      # C:\ # Disque fixe local # 71,76 Go (2,04 Go free) [FAC01F-4] # FAT32
      # D:\ # Disque CD-ROM
      # E:\ # Disque CD-ROM
      # F:\ # Disque fixe local # 233,76 Go (887,2 Mo free) [DEDE] # NTFS
      # H:\ # Disque amovible # 505,34 Mo (502,26 Mo free) # FAT

      ############################## | Processus actifs |

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\System32\drivers\CDAC11BA.EXE
      C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
      C:\WINDOWS\system32\carpserv.exe
      C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
      C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
      C:\WINDOWS\system32\wscntfy.exe

      ################## | C: |

      G:\autorun.inf

      ################## | C:\WINDOWS |


      ################## | C:\WINDOWS\Prefetch |


      ################## | C:\WINDOWS\system32 |

      C:\WINDOWS\system32\wfsintwq.sys

      ################## | C:\WINDOWS\system32\drivers |


      ################## | C:\Documents and Settings\magali\Application Data |


      ################## | Temporary Internet Files |


      ################## | Registre |

      [HKLM\SYSTEM\CurrentControlSet\Services\srosa]
      [HKLM\SYSTEM\ControlSet001\Services\srosa]
      [HKLM\SYSTEM\ControlSet002\Services\srosa]
      [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
      [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
      [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
      [HKU\S-1-5-21-709074730-706428418-2291417035-1005\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
      [HKCU\Software\Local AppWizard-Generated Applications\key_gen]
      [HKU\S-1-5-21-709074730-706428418-2291417035-1005\Software\Local AppWizard-Generated Applications\key_gen]

      ################## | Etat |

      # Affichage des fichiers cachés : OK

      Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !

      # Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
      # Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
      # SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
      # wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
      # wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

      ################## | ! Fin du rapport # FindyKill V5.037 ! |
      0
      1. fredchat > fredchat
         
        Juste une petite question par rapport à FindyKill, j'ai deux disque durs, est-ce qu'il examine bien les deux ?
        0
  18. gen-hackman
     
    oui

    ########### [ Option 2 ( Suppression ) ]

    ▶ Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .

    ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

    ▶ Relance "FindyKill" (clic droit "en tant qu'administrateur" pour Vista): au menu principal choisis l'option " F " pour français et tape sur [entrée] .

    ▶ Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

    ▶ Le pc va redémarrer automatiquement ...

    ▶ le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

    ▶ Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )

    ▶ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide
    0
    1. fredchat
       
      ok, j'ai lancé l'option 2, le PC redémarre.

      En revanche, tu me dis de fermer le navigateur, alors que je n'ai pas de connexion internet ! Lorsque j'active le réseau, j'ai uniquement réseau local.
      0
  19. gen-hackman
     
    c'estb un texte tout pret copié/collé il ne correspond pas forcement a tous les cas....et toutes facons au redemarrrage , la connection se coupe quand meme ^^
    0
    1. fredchat
       
      la procédure est en cours, mais n'est qu'à 40 %, je crois que je vais laisser le pc allumé, et je posterai le rapport demain, je dois malheureusement me lever très tôt demain matin.
      Merci pour ton aide et ta patience.
      0
  20. gen-hackman
     
    pas de soucis
    0
    1. fredchat
       
      Bonjour,

      Le scan s'est interrompu à 95% avec le message : "redémarrage des services... veuillez patienter".

      Il y a une fenêtre d'erreur qui s'est ouverte en dessous : " le fichier ou le répertoire \CIMG2124.jpg est endommagé et illisible. Exécuter l'utilitaire CHKDSK" (titre de cette fenêtre Autolt v3.sniffC.exe - fichier endommagé)

      Néanmoins, une 3° fenêtre FindyKill indique que le nettoyage est effectué.

      Je ne touche à rien et attends tes instructions !!
      Merci
      0
  21. gen-hackman
     
    hello le rapport s'est ouvert ?
    0
    1. fredchat
       
      hello,

      non pas de rapport ouvert.
      Faut-il fermer le message d'erreur et la fenêtre "nettoyage effectué" ?
      0
  • 1
  • 2

Discussions similaires

FOTOSE (allemagne)
lix -
Yves -

13 réponses
ATTENTION : escroquerie à la carte bleue !!
dvrg -
dvrg -

80 réponses