Virus qui bloque internet et les antivirus

fredchat -  
Bonjour,
je sollicite de l'aide suite à une infection par un virus qui ressemble à Bagle après avoir ouvert un fichier téléchargé sur le net (je suis sous windows xp).
Depuis, impossible de lancer avast, zone alarm etc, et plus de connexion internet !
J'ai essayé de télécharger des logiciels comme ccleaner, hijackthis, antivir, elibagla en les gravant sur un cd, mais rien ne se lance.
Que puis-je faire ? J'en appelle à votre précieuse aide. Merci
Configuration: Windows XP / internet explorer 8

38 réponses

Résumé de la discussion

Infection détectée après l'ouverture d'un fichier téléchargé sur le net sous Windows XP, provoquant le blocage d'antivirus et la perte de connexion Internet permanente sur l'ordinateur. Des solutions proposées incluent l’utilisation d’outils de nettoyage tels que Malwarebytes et le Norton Removal Tool, ainsi que la désinstallation des restes de Symantec/Norton si présents. Des conseils supplémentaires mentionnent l’analyse des rapports et l’utilisation de Malwarebytes en mode complet, avec éventuellement des outils complémentaires et le recours à des rapports en ligne pour vérifier les infections détectées. En cas de persistance, certains conseillent de redémarrer et de répéter le scan ou d’examiner les éléments d’amorçage pour éliminer les traces restantes.

Bobot (l’IA à votre service)
  1. gen-hackman
    salut :

    Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection)

    ▶ Télécharge List_Kill'em et enregistre le sur ton bureau

    ▶ Branche clés usb , disques durs externes , mp3 , mp4 , etc..

    double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

    coche la case "creer une icone sur le bureau"

    une fois terminée , clic sur "terminer" et le programme se lancera seul

    choisis la langue puis choisis l'option 1 = Mode Recherche

    ▶ laisse travailler l'outil

    à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

    un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

    ▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

    1
    1. fredchat
      Merci beaucoup pour ta réponse, j'essaye dès ce soir.
      Par contre, pour ce qui est de désactiver l'antivirus et le pare-feu, est-ce que je dois les désinstaller ?
      J'ai avast et zone alarm, et j'ai voulu désinstaller avast avec leur logiciel de désinstallation, mais rien ne se passe quand je le lance.
      0
  2. gen-hackman
    lance-le en mode sans echec sinon , ces derniers ne sont pas actifs dans ce mode (les virus non plus pour la plupart)
    0
    1. fredchat
      bonsoir,
      je viens de rentrer chez moi, et j'ai téléchargé List_kill'em mais il y un message Trojan:Win32/wintrim.gen! sur l'ordi de ma campagne ! ce logiciel contient un virus ?
      0
  3. gen-hackman
    non mais sa base de données contient des noms d'infections et des codes detectés comme tels par les antivirus

    lis la premier ligne de ce que j'ai ecrit post 1

    https://forums.commentcamarche.net/forum/affich-16763022-virus-qui-bloque-internet-et-les-antivirus#1
    0
    1. fredchat
      Re
      J'ai téléchargé tout ce qu'il fallait mais impossible de démarrer en mode sans échec, l'ordinateur redémarre automatiquement en mode normal...
      Est-ce que je peux tout de même lancer List Kill-Em ?
      Merci
      0
  4. gen-hackman
    oui
    0
    1. fredchat
      Bonjour,
      Je reviens donner des nouvelles de mon problème, car j'ai toujours pas pu mettre en œuvre tes recommandations, car depuis hier soir, chaque fois que je démarre le pc, il reboote sans arrêt. En fait, je n'arrivais pas à démarrer en mode sans échec, j'ai alors essayer dans msconfig de cocher "bootsafe" mais depuis le pc n'arrive plus à atteindre la page du bureau...
      0
  6. clemtheboss413
    salut
    remarque CCleaner a utiliser seulement dès que ton pc est propre
    0
    1. gen-hackman
      pourquoi tu l'as pas passé en mode normal (List_Kill'em)?

      t'es vachement dans la merde !!

      il reste plus qu'a faire tout un tas de manips pour recuperer le pc.....ca va etre un peu long mais tu perdras rien de tes données.

      fais moi savoir si tu es pret
      0
      1. fredchat
        Bonsoir,

        Comme tu avais dit j'ai lancé le mode sans échec... qui a échoué !
        Et depuis le PC reboot automatiquement, que l'on fasse mode normal ou mode sans échec.
        J'ai toutefois réussi à le démarrer avec un CD XPE que l'on m'a prêté.

        Je suis prêt pour les manips.
        Merci beaucoup de ton aide !
        0
    2. gen-hackman
      je ne t ai jamais dit d utiliser MSCONFIG pour demarrer en mode sans echec...

      bref ton pc demarre normalement ?
      0
      1. fredchat
        le PC démarre uniquement grace au CD XPE sinon il ne démarre pas (donc pas sur mon C: mais sur le système d'exploit du CD)
        0
    3. gen-hackman
      ok tu peux t'en servir avec la connection internet ?

      0
      1. fredchat
        non malheureusement, j'ai essayé mais ça ne fonctionne pas
        0
    4. gen-hackman
      ok tu peux utiliser une clé usb pour transferer des fichiers a partirde , et sur ce pc ?
      0
      1. fredchat
        oui, je peux !
        0
    5. gen-hackman
      colle le contenu du fichier C:\Boot.ini du PC malade stp
      0
      1. fredchat
        [boot loader]
        timeout=30
        default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
        [operating systems]
        multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /safeboot:minimal
        0
    6. gen-hackman
      [boot loader]
      timeout=30
      default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
      [operating systems]
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /safeboot:minimal

      rends-le comme ceci et redemarre le pc normalement sans le CD PE

      [boot loader]
      timeout=30
      default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
      [operating systems]
      multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=Microsoft Windows XP dition familiale" /NOEXECUTE=OPTIN /FASTDETECT
      0
      1. fredchat
        l'ordi redémarre correctement !
        0
      2. fredchat
        @fredchatil y a un message d'erreur qui s'affiche : cette application n'a pas pu démarrer car prremote.dll est introuvable. La réinstallation de cette application peut corriger ce problème
        0
    7. gen-hackman
      retente List_Kill'em tel quel en mode normal option 1

      desactive le resident de AVAST avec le clic droit dans la barre des taches sur le "a" bleu
      0
      1. fredchat
        je n'ai plus de "a" en barre des taches...
        J'ai lancé List_Kill'Em, ça reste sur Searching pour le moment, c'est un peu long j'ai l'impression
        0
      2. fredchat
        @fredchatCa fait 5 min que c'est sur la première ligne de C:\ windows\ServicePackFiles\i386\atapi.sys
        et que ça ne bouge pas...
        Normal ou pas normal ?
        0
    8. gen-hackman
      c est normal comme précisé dans l'énoncé
      0
      1. gen-hackman
        https://forums.commentcamarche.net/forum/affich-16763022-virus-qui-bloque-internet-et-les-antivirus#25
        0
        1. fredchat
          Ca y est c'est terminé, je te poste le contenu de la fenêtre blanche ?
          0
        2. fredchat
          List'em by g3n-h@ckm@n 1.2.8.0

          User : magali (Administrateurs)
          Update on 25/02/2010 by g3n-h@ckm@n ::::: 13.00
          Start at: 21:11:15 | 26/02/2010
          Contact : https://forums.commentcamarche.net/forum/virus-securite-7

          AMD Athlon(tm) XP 2400+
          Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
          Internet Explorer 8.0.6001.18702
          Windows Firewall Status : Enabled

          A:\ -> Lecteur de disquettes 3 ½ pouces
          C:\ -> Disque fixe local | 71,76 Go (2,2 Go free) [FAC01F-4] | FAT32
          D:\ -> Disque CD-ROM
          E:\ -> Disque CD-ROM
          F:\ -> Disque fixe local | 233,76 Go (887,2 Mo free) [DEDE] | NTFS
          G:\ -> Disque amovible | 505,34 Mo (503,62 Mo free) | FAT

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\System32\MsPMSPSv.exe
          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
          C:\WINDOWS\system32\carpserv.exe
          C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
          C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
          C:\Program Files\List_Kill'em\List_Kill'em.scr
          C:\WINDOWS\system32\cmd.exe
          C:\Documents and Settings\magali\Local Settings\Temp\2.tmp\pv.exe

          ======================
          Keys "Run"
          ======================
          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          ATIPTA REG_SZ C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
          KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
          NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
          ISUSPM Startup REG_SZ C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
          ISUSScheduler REG_SZ "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
          PPMemCheck REG_SZ C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
          PestPatrol Control Center REG_SZ C:\PROGRA~1\PESTPA~1\PPControl.exe
          ccApp REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
          CARPService REG_SZ carpserv.exe
          TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          CanonSolutionMenu REG_SZ C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
          SSBkgdUpdate REG_SZ "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
          OpwareSE4 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
          Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
          MaxMenuMgr REG_SZ "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
          QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
          !AVG Anti-Spyware REG_SZ "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
          MS Dynamic Host Configuration Protocol REG_SZ MSDHCP32.exe

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

          =====================
          Other Keys
          =====================
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
          dontdisplaylastusername REG_DWORD 0 (0x0)
          legalnoticecaption REG_SZ
          legalnoticetext REG_SZ
          shutdownwithoutlogon REG_DWORD 1 (0x1)
          undockwithoutlogon REG_DWORD 1 (0x1)
          EnableLUA REG_DWORD 0 (0x0)

          ===============
          [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
          NoDriveTypeAutoRun REG_DWORD 145 (0x91)

          ===============
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

          ===============
          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
          AppInit_DLLS REG_SZ

          ===============
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
          AutoRestartShell REG_DWORD 1 (0x1)
          DefaultDomainName REG_SZ MISTIGRI
          DefaultUserName REG_SZ magali
          LegalNoticeCaption REG_SZ
          LegalNoticeText REG_SZ
          PowerdownAfterShutdown REG_SZ 0
          ReportBootOk REG_SZ 1
          Shell REG_SZ Explorer.exe
          ShutdownWithoutLogon REG_SZ 0
          System REG_SZ
          Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
          VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
          SfcQuota REG_DWORD -1 (0xffffffff)
          allocatecdroms REG_SZ 0
          allocatedasd REG_SZ 0
          allocatefloppies REG_SZ 0
          cachedlogonscount REG_SZ 10
          forceunlocklogon REG_DWORD 0 (0x0)
          passwordexpirywarning REG_DWORD 14 (0xe)
          scremoveoption REG_SZ 0
          AllowMultipleTSSessions REG_DWORD 1 (0x1)
          UIHost REG_EXPAND_SZ logonui.exe
          LogonType REG_DWORD 1 (0x1)
          Background REG_SZ 0 0 0
          DebugServerCommand REG_SZ no
          SFCDisable REG_DWORD 0 (0x0)
          WinStationsDisabled REG_SZ 0
          DefaultPassword REG_SZ
          HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
          ShowLogonOptions REG_DWORD 0 (0x0)
          AltDefaultUserName REG_SZ magali
          AltDefaultDomainName REG_SZ MISTIGRI

          ===============
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Ext]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

          ===============
          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
          {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
          {57B86673-276A-48B2-BAE7-C6DBB3020EB8} REG_SZ AVG Anti-Spyware 7.5

          ===============
          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
          %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
          C:\Program Files\Hercules\Hercules DualPix HD Webcam\Station2.exe REG_SZ C:\Program Files\Hercules\Hercules DualPix HD Webcam\Station2.exe:*:Enabled:Webcam Station Evolution
          C:\Program Files\Azureus\Azureus.exe REG_SZ C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus
          C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe REG_SZ C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe:*:Enabled:Nokia PC Suite
          C:\Program Files\Nokia\Nokia Lifeblog\NokiaLifeblog.exe REG_SZ C:\Program Files\Nokia\Nokia Lifeblog\NokiaLifeblog.exe:*:Enabled:Nokia Lifeblog 2.1
          C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe REG_SZ C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater
          C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe REG_SZ C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process
          C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
          C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
          C:\Program Files\Pando Networks\Pando\pando.exe REG_SZ C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:Pando Application
          C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
          C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
          C:\Program Files\Winamp Remote\bin\Orb.exe REG_SZ C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb
          C:\Program Files\Winamp Remote\bin\OrbTray.exe REG_SZ C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray
          C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe REG_SZ C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client
          C:\Program Files\SimpleCenter\Home Media Server.exe REG_SZ C:\Program Files\SimpleCenter\Home Media Server.exe:*:Enabled:Home Media Server
          C:\Program Files\uTorrent\uTorrent.exe REG_SZ C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
          C:\Program Files\Real\RealPlayer\RealPlay.exe REG_SZ C:\Program Files\Real\RealPlayer\RealPlay.exe:*:Enabled:RealPlayer
          C:\Program Files\Spotify\spotify.exe REG_SZ C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify
          C:\Program Files\Freeplayer\vlc\vlc.exe REG_SZ C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player
          C:\Program Files\VideoLAN\VLC\vlc.exe REG_SZ C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player
          C:\Program Files\Freeplayer\fbx-playlist.exe REG_SZ C:\Program Files\Freeplayer\fbx-playlist.exe:*:Enabled:fbx-playlist
          C:\Program Files\SopCast\adv\SopAdver.exe REG_SZ C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver
          C:\Program Files\SopCast\SopCast.exe REG_SZ C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application
          C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe REG_SZ C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe:*:Enabled:Seagate Status Icon
          C:\Program Files\Seagate\SeagateManager\ManagerApp\stxmanager.exe REG_SZ C:\Program Files\Seagate\SeagateManager\ManagerApp\stxmanager.exe:*:Enabled:Seagate Manager

          [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
          %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
          C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
          C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

          ===============
          ActivX controls
          ===============
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\DirectAnimation Java Classes
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0000000A-0000-0010-8000-00AA00389B71}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{0CCA191D-13A6-4E29-B746-314DEE697D83}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1FF43AD5-2262-4C2F-81D4-26D710C3F305}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33331111-1111-1111-1111-611111193423}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33331111-1111-1111-1111-615111193427}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33564D57-0000-0010-8000-00AA00389B71}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{5C051655-FCD5-4969-9182-770EA5AA5565}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6E5E167B-1566-4316-B27F-0DDAB3484CF7}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8100D56A-5661-482C-BEE8-AFECE305D968}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{9F1C11AA-197B-4942-BA54-47A8489BB47F}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{BA162249-F2C5-4851-8ADC-FC58CB424243}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}
          HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{EDFCB7CB-942C-4822-AF14-F0B687409848}

          ===============
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{377483c2-e4b4-4ee8-b577-9aed264c8735}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4BF73126-9A34-BBBD-29CA-051570761974}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4d64f3ba-f112-4efe-a02e-96680859937c}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5b7bf89d-d196-4c32-a303-a57b8ab7f18d}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BC07EF7F-9BD2-069F-7363-FB7A54CF08F2}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BC161508-AB34-B18C-7764-0DE86970CA16}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{dd772a76-bef3-44d7-8b39-502c8504c1f1}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4A7B6C7-978C-B7B4-B750-E00E2CDBCF16}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f15ee071-deb7-4cbb-951f-431c98338d8e}
          HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5776D81-AE53-4935-8E84-B0B283D8BCEF}

          ==============
          BHO :
          ======
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

          ===
          DNS
          ===

          HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
          HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
          HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

          ================
          Internet Explorer :
          ================
          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          Start Page REG_SZ https://www.google.fr/?gws_rd=ssl

          ========
          Services
          ========
          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

          Ndisuio : 0x4 ( OK = 3 )
          SharedAccess : 0x4 ( OK = 2 )
          wuauserv : 0x4 ( OK = 2 )

          =========
          Atapi.sys
          =========

          %%%% HASHDEEP-1.0
          %%%% size,md5,sha256,filename
          ## Invoked from: C:\Documents and Settings\magali\Local Settings\Temp\2.tmp
          ## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
          ##
          95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\system32\drivers\atapi.sys
          %%%% HASHDEEP-1.0
          %%%% size,md5,sha256,filename
          ## Invoked from: C:\Documents and Settings\magali\Local Settings\Temp\2.tmp
          ## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
          ##
          86912,95b858761a00e1d4f81f79a0da019aca,5e41dae055bcb8ee8ad23d3c77d69df09c6b1e301c889aec6f02193d7dec352b,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
          %%%% HASHDEEP-1.0
          %%%% size,md5,sha256,filename
          ## Invoked from: C:\Documents and Settings\magali\Local Settings\Temp\2.tmp
          ## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
          ##
          95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\ServicePackFiles\i386\atapi.sys

          Référence :
          ==========

          Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
          Win XP_32b : a64013e98426e1877cb653685c5c0009
          Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
          Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
          Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
          Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
          Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
          Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
          Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
          Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

          =======
          Drive :
          =======

          D‚fragmenteur de disque Windows
          Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

          Rapport d'analyse
          71,76 Go total, 2,20 Go libre (3%), 42% fragment‚ (fragmentation du fichier 67%)

          Vous devriez d‚fragmenter ce volume.

          ¤¤¤¤¤¤¤¤¤¤ Files/folders :

          Present !! : C:\Documents and Settings\All Users\Application Data\.zreglib
          Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
          Present !! : C:\Program Files\Ask.com
          Present !! : C:\Program Files\setup.exe
          Present !! : C:\WINDOWS\~VS189.tmp
          Present !! : C:\WINDOWS\~VSC.tmp
          Present !! : C:\WINDOWS\~VS14.tmp
          Present !! : C:\WINDOWS\~VS15.tmp
          Present !! : C:\WINDOWS\~VS16.tmp
          Present !! : C:\WINDOWS\002406_.tmp
          Present !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
          Present !! : C:\WINDOWS\iun6002.exe
          Present !! : C:\WINDOWS\patch.exe
          Present !! : C:\WINDOWS\System32\SET*.tmp
          Present !! : C:\WINDOWS\System32\srosa2.sys
          Present !! : C:\WINDOWS\System32\wfsintwq.sys"
          Present !! : C:\WINDOWS\Temp\ICD1.tmp
          Present !! : C:\Documents and Settings\magali\Application Data\GDIPFONTCACHEV1.DAT
          Present !! : C:\Documents and Settings\magali\Application Data\GDIPFONTCACHEV1.DAT
          Present !! : C:\Documents and Settings\magali\Application Data\drivers

          ¤¤¤¤¤¤¤¤¤¤ Keys :

          Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\drvsyskit
          Present !! : HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\MS Dynamic Host Configuration Protocol
          Present !! : HKU\S-1-5-21-709074730-706428418-2291417035-1005\Software\Microsoft\Windows\CurrentVersion\Run\drvsyskit
          Present !! : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
          Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
          Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
          Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
          Present !! : "HKCU\Software\Local AppWizard-Generated Applications\winupgro"
          Present !! : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
          Present !! : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
          Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
          Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
          Present !! : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
          Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
          Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
          Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
          Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
          Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
          Present !! : HKCU\software\Ask.com
          Present !! : HKCU\Software\bisoft
          Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba}
          Present !! : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
          Present !! : HKLM\software\classes\appid\GenericAskToolbar.DLL
          Present !! : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
          Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
          Present !! : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
          Present !! : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
          Present !! : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
          Present !! : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
          Present !! : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
          Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
          Present !! : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
          Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_OREANS32
          Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
          Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
          Present !! : HKLM\SYSTEM\ControlSet001\Services\oreans32
          Present !! : HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s
          Present !! : HKLM\SYSTEM\ControlSet001\Services\srosa
          Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_OREANS32
          Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
          Present !! : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
          Present !! : HKLM\SYSTEM\ControlSet002\Services\oreans32
          Present !! : HKLM\SYSTEM\ControlSet002\Services\sK9Ou0s
          Present !! : HKLM\SYSTEM\ControlSet002\Services\srosa
          Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_OREANS32
          Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
          Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
          Present !! : HKLM\SYSTEM\CurrentControlSet\Services\oreans32
          Present !! : HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Security
          Present !! : HKLM\SYSTEM\CurrentControlSet\Services\oreans32\Enum
          Present !! : HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s
          Present !! : HKLM\SYSTEM\CurrentControlSet\Services\srosa

          ============

          catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2010-02-26 21:44:23
          Windows 5.1.2600 Service Pack 2 FAT NTAPI

          scanning hidden processes ...

          C:\DOCUMENTS AND SETTINGS\MAGALI\APPLICATION DATA\DRIVERS\WINUPGRO.EXE [468] 0x82D2C5E8

          scanning hidden services ...

          HKLM\SYSTEM\CurrentControlSet\Services\srservice 3.0.0.00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Srvervice 3.0.0.00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRVce 3.0.0.00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\stisvcVce 3.0.0.00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\StreamDispatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\streamipspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\swenumipspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\swmidiipspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SwPrviipspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\swwdviipspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\symc810pspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\symc8xxpspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMDNSxpspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMFWSxpspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMIDSxpspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMIDSCOspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMNDISOspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMREDRVspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SYMTDIRVspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\sym_hiRVspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\sym_u3RVspatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\sysaudiospatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\SysmonLogpatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TapiSrvogpatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Tcpiprvogpatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TDPIPEvogpatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TDTCPEvogpatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TermDDvogpatcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TermServicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Themesrvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Tonessrvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TosIdervicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TrkWksrvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\TSDDDsrvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\UdfsDsrvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\UIA11srvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\ultrasrvicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Updatervicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\upnphosticetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\upperdevicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\UPSerdevicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbaudioicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbccgpoicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbehcioicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbhubioicetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbprinticetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbscanticetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbsernticetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\UsbserFiltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\USBSTORiltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usbuhciiltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\usnjsvciltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\V124svciltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\VgaSaveiltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\viaagp1iltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\ViaIde1iltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\VIAudioiltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\VolSnapiltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\vsdatantltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\vsmonantltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\VSSonantltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\VXDonantltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\W32Timetltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\W3SVCmetltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Wanarpetltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\wanatwetltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\Wdf01000ltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\WDICA000ltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\wdmaud00ltetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\WebClienttetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\winachsfttetcher00.02.2010_22-04drv

          HKLM\SYSTEM\CurrentControlSet\Services\winmgmt Workflow Foundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\Winsock Workflow Foundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WinSock2Workflow Foundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WinTrustWorkflow Foundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WMDM PMSP ServiceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WmdmPmSNP ServiceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WmimPmSNP ServiceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WmiApRplP ServiceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WmiApSrvP ServiceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WMPNetworkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\wscsvcworkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WSTCODECrkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\wuauservrkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WudfPfrvrkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WudfRdrvrkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WudfSvcvrkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\WZCSVCcvrkSvcviceFoundation 3.0.0.0

          HKLM\SYSTEM\CurrentControlSet\Services\xmlprovvrkSvcviceFoundation 3.0.0.0

          scanning hidden autostart entries ...

          scanning hidden files ...

          scan completed successfully
          hidden processes: 1
          hidden services: 89
          hidden files: 0

          Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

          device: opened successfully
          user: MBR read successfully
          called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
          kernel: MBR read successfully
          user & kernel MBR OK

          ==========
          Programs
          ==========

          Fichiers communs
          Windows NT
          wz90fr.exe
          MSN Gaming Zone
          MSN Messenger
          Windows Media Player
          Services en ligne
          WindowsUpdate
          ComPlus Applications
          Internet Explorer
          Outlook Express
          NetMeeting
          Movie Maker
          microsoft frontpage
          xerox
          Uninstall Information
          VIA Technologies, Inc
          Common Files
          Windows Journal Viewer
          InstallShield Installation Information
          ATI Technologies
          NPADEMO.exe
          directx
          Roxio
          Installation BitDefender.exe
          trueinst.exe
          xvidcore-1.1.0-beta1
          XviD
          Adobe
          CyberLink
          XnView Digital
          Elaborate Bytes
          flac112a.exe
          Real
          Nullsoft
          Viewpoint
          xp-AntiSpy_french.zip
          PestPatrol
          eMule
          MSNPatcherPlusPlus.exe
          spybotsd13.exe
          xvidcore-1.1.0-beta1.tar.gz
          VideoLAN
          WinRAR
          WinZip
          Zylom Games
          MSN Apps
          Free Audio Pack
          all2mp3.exe
          LeechFTP
          Hercules
          RealPlayer10-5GOLD_fr.exe
          INSTALL_MSN_MESSENGER_DL.EXE
          Free
          Zuma
          Nero.v6.6.0.1.Ultra.Edition
          Keyspan
          iTunes
          Microsoft Office
          iPod
          Oxilog
          Illustrate
          LitexMedia
          Nokia
          Tunatic
          setupfre.exe
          QuickTime
          Softwin
          GP5DEMO.exe
          Spybot - Search & Destroy
          Google
          Krystal Drop
          GOTO.games
          MP3 to WAV Decoder
          Yahoo!
          Mes Jeux T‚l‚charg‚s
          DIFX
          Ahead
          zone alarm pro 4.0.123.012 + fr + serial
          Zone Labs
          Winamp
          RngInterstitial.dll
          VirtualDub.exe
          DivX
          Lavalys
          Java
          Grisoft
          Xtreme Desktop
          winamp501_full.exe
          cbsetup.exe
          Installation de Xpert PDF.exe
          Installer_Aim.exe
          setupmp3towav.exe
          Win98SE_All.zip
          Guitar Pro 5
          messenger
          eMule0.47c-Installer.exe
          Alwil Software
          MSXML 4.0
          Look2Me-Destroyer.exe
          TunaticSetup.exe
          sharedaccess.reg
          eMule-NG-0[1].47c-Installer.rar
          Crazy Browser(2)
          Crazy Browser
          GoogleVideoPlayerSetup.exe
          setup_ocr.exe
          vdub.exe
          kavperspro4.5.0.94fre.exe
          you_only_live_once_ver2.gp3
          Setup_FreeConverter.exe
          ZoneAlarm_FR.exe
          vlc-0.8.1-win32.exe
          Codecs and burning tools - Codec et outil pour graver des audios
          Lavasoft
          winzip100.exe
          all4cmr301.exe
          eMule0.47a-Installer.exe
          avgas-setup-7.5.0.50.exe
          Install_Messenger.exe
          vdicmdrv.dll
          Kaspersky Lab
          everesthome220.exe
          PC Connectivity Solution
          CDex_150
          cutkiller.exe
          Microsoft ActiveSync
          Xtremsplit.exe
          Cyanide
          Spotify
          pocketdivxencoder_pocketdivxencoder_v0.3.96_francais_36289.exe
          T‚l‚chargeur de Pro Rugby Manager 2005
          Boonty
          BoontyGames
          free-wma-mp3-converter.exe
          Free WMA to MP3 Converter
          iTunesSetup.exe
          vdsvrlnk.dll
          Reference Assemblies
          MSBuild
          PandoSetup.exe
          Apple Software Update
          Bonjour
          SetupCloneDVD2917Slysoft.exe
          MediaMonkey_3.0.5.1187.exe
          MediaMonkey
          vdremote.dll
          Canon
          CanonBJ
          ScanSoft
          Panasonic
          picasaweb-current-setup.exe
          Picasa2
          VirtualDub-1.8.6.zip
          winamp5531_full_emusic-7plus_fr-fr.exe
          VirtualDub.vdi
          Winamp Remote
          Winamp Toolbar
          VirtualDub.chm
          auxsetup.exe
          aviproxy
          plugins
          Virtools Web Player 3.5
          folderlockbox_setup.exe
          My Lockbox
          Google_Earth_CZXD.exe
          SimpleCenter
          MSXML 6.0
          Windows Media Connect 2
          copying
          1221.exe
          PocketDivXEncoder_0.3.96.exe
          DivXPlayer_S60_3rd_0.sisx
          Free Video Converter
          VirtualDub.jobs
          VirtualDub1.exe
          VirtualDub
          VD_plugin_pack.exe
          FreeVideoDub.exe
          DVDVideoSoft
          uTorrent
          VDJSetup.exe
          VDJ5
          Freeplayer
          Setup_RnetFR.exe
          Micro Application
          SetupDl.exe
          spybotsd12.exe
          Ad-aware 6.0.lnk
          XviD_Install.exe
          MSDE2000
          NOS
          instmsiw.exe
          OggDS0995.exe
          djmixlitesetup130.exe
          AtomixMP3_2.3.exe
          Atory
          download-install_virtualdj_trial_v5_0.exe.exe
          setup.exe
          Radio net FR
          Setup_FreeVideoConverter.exe
          Ask.com
          BeatportSync_101_NI_Win.zip
          Beatport Sync 1.0.1 NI Setup.exe
          Native Instruments
          7-Zip
          USB MEMORY BAR
          IE8-WindowsXP-x86-FRA.exe
          Freeplayer-Win32-20070531.exe
          SopCast
          OOo_3.1.1_Win32Intel_install_wJRE_fr.exe
          openofficeorg31.msi
          openofficeorg1.cab
          instmsia.exe
          setup.ini
          licenses
          readmes
          redist
          OpenOffice.org 3
          JRE
          Combined Community Codec Pack
          Seagate
          CCleaner
          avp6
          List_Kill'em
          fdjeux

          ============
          Drive C:
          ============

          pagefile.sys
          WINDOWS
          Bootfont.bin
          ntldr
          NTDETECT.COM
          boot.ini
          Documents and Settings
          Program Files
          CONFIG.SYS
          AUTOEXEC.BAT
          IO.SYS
          MSDOS.SYS
          System Volume Information
          IPH.PH
          hiberfil.sys
          FOUND.018
          FOUND.000
          Recycled
          DVDVideoSoft
          FOUND.001
          FOUND.002
          FLASHED.DAT
          FOUND.003
          FOUND.004
          REPORTS
          SCANDISK.LOG
          Kill'em
          FOUND.010
          FOUND.011
          FOUND.012
          FOUND.013
          FOUND.014
          FOUND.015
          FOUND.016
          FOUND.017
          FOUND.019
          FOUND.020
          rapport.txt
          FOUND.021
          FOUND.022
          FOUND.023
          FOUND.024
          FOUND.025
          FOUND.026
          FOUND.027
          FOUND.028
          FOUND.029
          FOUND.030
          FOUND.031
          FOUND.032
          FOUND.033
          FOUND.034
          FOUND.035
          FOUND.036
          FOUND.037
          FOUND.038
          FOUND.039
          FOUND.040
          FOUND.041
          FOUND.042
          FOUND.043
          FOUND.044
          FOUND.045
          FOUND.046
          FOUND.047
          FOUND.048
          Check.dat
          FOUND.049
          FOUND.050
          teleir
          FOUND.051
          FOUND.052
          FOUND.053
          FOUND.054
          FOUND.055
          FOUND.056
          My Music
          FOUND.057
          FOUND.058
          FOUND.059
          FOUND.060
          FOUND.061
          FOUND.062
          FOUND.063
          FOUND.064
          FOUND.065
          FOUND.066
          FOUND.067
          FOUND.068
          FOUND.069
          FOUND.070
          FOUND.071
          FOUND.072
          FOUND.073
          FOUND.074
          FOUND.075
          FOUND.076
          FOUND.077
          FOUND.078
          FOUND.079
          FOUND.080
          FOUND.081
          FOUND.082
          FOUND.083
          FOUND.084
          FOUND.085
          FOUND.086
          FOUND.087
          FOUND.088
          FOUND.089
          FOUND.090
          FOUND.091
          FOUND.092
          FOUND.093
          FOUND.094
          FOUND.095
          FOUND.096
          FOUND.097
          FOUND.098
          FOUND.099
          FOUND.100
          FOUND.101
          FOUND.102
          FOUND.103
          FOUND.104
          FOUND.105
          FOUND.106
          FOUND.107
          FOUND.108
          FOUND.109
          FOUND.110
          FOUND.111
          FOUND.112
          FOUND.113
          FOUND.114
          FOUND.115
          FOUND.116
          FOUND.117
          Converted Music
          FOUND.118
          FOUND.119
          FOUND.120
          FOUND.121
          FOUND.122
          FOUND.123
          FOUND.124
          FOUND.125
          FOUND.126
          FOUND.127
          My Download Files
          DownloadLog.txt
          My Games
          FOUND.128
          FOUND.129
          FOUND.130
          FOUND.131
          FOUND.132
          FOUND.133
          FOUND.134
          FOUND.135
          FOUND.136
          List'em.txt
          FOUND.151
          FOUND.137
          FOUND.138
          FOUND.143
          FOUND.144
          FOUND.145
          FOUND.139
          FOUND.146
          FOUND.147
          FOUND.140
          FOUND.141
          FOUND.142
          xscan.txt
          FOUND.148
          FOUND.149
          FOUND.150
          audio
          FOUND.152
          FOUND.153
          Config.Msi
          DFR2.tmp
          DFRA.tmp

          ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials

          C:\Program Files\Nero.v6.6.0.1.Ultra.Edition\NeroMix.v1.4.0.25.Incl.Keygen\CRACK\Keygen.exe
          C:\Program Files\Nero.v6.6.0.1.Ultra.Edition\CRACK\Keygen.exe

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

          End of scan : 21:47:37,87
          0
      2. gen-hackman
        ok laisse tomber List_Kill'em pour l instant on y reviendra ensuite

        ▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
        mais cette fois-ci :

        ▶ choisis l'option 2 = Mode Suppression

        laisse travailler l'outil.

        en fin de scan un rapport s'ouvre

        ▶ colle le contenu dans ta reponse
        0
        1. fredchat
          Voici le résultat.

          Kill'em by g3n-h@ckm@n 1.2.8.0

          User : magali (Administrateurs)
          Update on 25/02/2010 by g3n-h@ckm@n ::::: 13.00
          Start at: 22:35:21 | 26/02/2010
          Contact : https://forums.commentcamarche.net/forum/virus-securite-7

          AMD Athlon(tm) XP 2400+
          Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
          Internet Explorer 8.0.6001.18702
          Windows Firewall Status : Enabled

          A:\ -> Lecteur de disquettes 3 ½ pouces
          C:\ -> Disque fixe local | 71,76 Go (2,09 Go free) [FAC01F-4] | FAT32
          D:\ -> Disque CD-ROM
          E:\ -> Disque CD-ROM
          F:\ -> Disque fixe local | 233,76 Go (887,2 Mo free) [DEDE] | NTFS
          G:\ -> Disque amovible | 505,34 Mo (503,58 Mo free) | FAT

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\System32\MsPMSPSv.exe
          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
          C:\WINDOWS\system32\carpserv.exe
          C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
          C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
          C:\Program Files\List_Kill'em\List_Kill'em.scr
          C:\WINDOWS\system32\cmd.exe
          C:\Documents and Settings\magali\Local Settings\Temp\7.tmp\ERUNT.EXE
          C:\Documents and Settings\magali\Local Settings\Temp\7.tmp\pv.exe

          Detections :
          ==========

          ¤¤¤¤¤¤¤¤¤¤ Files/folders :

          Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\.zreglib
          Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
          Quarantined & Deleted !! : C:\Program Files\Ask.com
          Quarantined & Deleted !! : C:\Program Files\setup.exe
          Quarantined & Deleted !! : C:\WINDOWS\~VS189.tmp
          Quarantined & Deleted !! : C:\WINDOWS\~VSC.tmp
          Quarantined & Deleted !! : C:\WINDOWS\~VS14.tmp
          Quarantined & Deleted !! : C:\WINDOWS\~VS15.tmp
          Quarantined & Deleted !! : C:\WINDOWS\~VS16.tmp
          Quarantined & Deleted !! : C:\WINDOWS\002406_.tmp
          Quarantined & Deleted !! : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
          Quarantined & Deleted !! : C:\WINDOWS\iun6002.exe
          Quarantined & Deleted !! : C:\WINDOWS\patch.exe

          Quarantined & Deleted !! : C:\WINDOWS\System32\SET71.tmp
          Quarantined & Deleted !! : C:\WINDOWS\system32\srosa2.sys
          Quarantined & Deleted !! : C:\WINDOWS\system32\wfsintwq.sys
          Quarantined & Deleted !! : C:\WINDOWS\Temp\ICD1.tmp
          Quarantined & Deleted !! : C:\Documents and Settings\magali\Application Data\GDIPFONTCACHEV1.DAT
          Quarantined & Deleted !! : C:\Documents and Settings\magali\Application Data\drivers

          ==============
          host file OK !
          ==============

          ========
          Registry
          ========

          Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\MS Dynamic Host Configuration Protocol
          Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440}
          Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
          Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
          Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
          Deleted : "HKCU\Software\Local AppWizard-Generated Applications\winupgro"
          Deleted : "HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
          Deleted : "HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}"
          Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
          Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
          Deleted : "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}"
          Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
          Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
          Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
          Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
          Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
          Deleted : HKCU\software\Ask.com
          Deleted : HKCU\Software\bisoft
          Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7d5dd829-6c90-42c5-b54c-2afa82f988ba}
          Deleted : HKLM\software\classes\appid\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
          Deleted : HKLM\software\classes\appid\GenericAskToolbar.DLL
          Deleted : HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
          Deleted : HKLM\software\classes\GenericAskToolbar.ToolbarWnd
          Deleted : HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
          Deleted : HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
          Deleted : HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
          Deleted : HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
          Deleted : HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
          Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
          Deleted : HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
          Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_OREANS32
          Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
          Deleted : HKLM\SYSTEM\ControlSet001\Services\oreans32
          Deleted : HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s
          Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\Legacy_OREANS32
          Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
          Deleted : HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
          Deleted : HKLM\SYSTEM\ControlSet002\Services\oreans32
          Deleted : HKLM\SYSTEM\ControlSet002\Services\sK9Ou0s
          ========
          Services
          =========

          Ndisuio : Start = 3
          Ip6Fw : Start = 2
          SharedAccess : Start = 2
          wuauserv : Start = 2
          wscsvc : Start = 2

          ============
          Disk Cleaned
          ============

          =================
          anti-ver blaster : OK !!
          =================

          ================
          Prefetch cleaned
          ================

          ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
          0
      3. gen-hackman
        ▶ Télécharge FindyKill sur ton bureau :

        http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe

        ! Déconnecte toi et ferme toutes applications en cours !

        ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

        ▶ Double-clique (clic droit "en tant qu'administrateur" pour Vista)sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .

        ▶ Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

        ▶ Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

        ▶ Laisse travailler l'outil et ne touche à rien ...

        ▶ Poste le rapport qui apparait à la fin , sur le forum ...

        ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )
        ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
        0
        1. fredchat
          ############################## | FindyKill V5.037 |

          # User : magali (Administrateurs) # MISTIGRI
          # Update on 18/02/2010 by El Desaparecido
          # Start at: 23:36:32 | 26/02/2010
          # Website : http://pagesperso-orange.fr/NosTools/index.html
          # Contact : FindyKill.Contact@gmail.com

          # AMD Athlon(tm) XP 2400+
          # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
          # Internet Explorer 8.0.6001.18702
          # Windows Firewall Status : Enabled

          # A:\ # Lecteur de disquettes 3 ½ pouces
          # C:\ # Disque fixe local # 71,76 Go (2,04 Go free) [FAC01F-4] # FAT32
          # D:\ # Disque CD-ROM
          # E:\ # Disque CD-ROM
          # F:\ # Disque fixe local # 233,76 Go (887,2 Mo free) [DEDE] # NTFS
          # H:\ # Disque amovible # 505,34 Mo (502,26 Mo free) # FAT

          ############################## | Processus actifs |

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\System32\drivers\CDAC11BA.EXE
          C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
          C:\Program Files\Java\jre6\bin\jqs.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\System32\MsPMSPSv.exe
          C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
          C:\WINDOWS\system32\carpserv.exe
          C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
          C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
          C:\WINDOWS\system32\wscntfy.exe

          ################## | C: |

          G:\autorun.inf

          ################## | C:\WINDOWS |

          ################## | C:\WINDOWS\Prefetch |

          ################## | C:\WINDOWS\system32 |

          C:\WINDOWS\system32\wfsintwq.sys

          ################## | C:\WINDOWS\system32\drivers |

          ################## | C:\Documents and Settings\magali\Application Data |

          ################## | Temporary Internet Files |

          ################## | Registre |

          [HKLM\SYSTEM\CurrentControlSet\Services\srosa]
          [HKLM\SYSTEM\ControlSet001\Services\srosa]
          [HKLM\SYSTEM\ControlSet002\Services\srosa]
          [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
          [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
          [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
          [HKU\S-1-5-21-709074730-706428418-2291417035-1005\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
          [HKCU\Software\Local AppWizard-Generated Applications\key_gen]
          [HKU\S-1-5-21-709074730-706428418-2291417035-1005\Software\Local AppWizard-Generated Applications\key_gen]

          ################## | Etat |

          # Affichage des fichiers cachés : OK

          Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !

          # Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
          # Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
          # SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
          # wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
          # wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

          ################## | ! Fin du rapport # FindyKill V5.037 ! |
          0
        2. fredchat
          @fredchatJuste une petite question par rapport à FindyKill, j'ai deux disque durs, est-ce qu'il examine bien les deux ?
          0
      4. gen-hackman
        oui

        ########### [ Option 2 ( Suppression ) ]

        ▶ Déconnecte toi et ferme toutes application en cours ( navigateur compris ) .

        ▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

        ▶ Relance "FindyKill" (clic droit "en tant qu'administrateur" pour Vista): au menu principal choisis l'option " F " pour français et tape sur [entrée] .

        ▶ Au second menu choisis l'option 2 (suppression) et tape sur [entrée]

        ▶ Le pc va redémarrer automatiquement ...

        ▶ le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

        ▶ Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt )

        ▶ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide
        0
        1. fredchat
          ok, j'ai lancé l'option 2, le PC redémarre.

          En revanche, tu me dis de fermer le navigateur, alors que je n'ai pas de connexion internet ! Lorsque j'active le réseau, j'ai uniquement réseau local.
          0
      5. gen-hackman
        c'estb un texte tout pret copié/collé il ne correspond pas forcement a tous les cas....et toutes facons au redemarrrage , la connection se coupe quand meme ^^
        0
        1. fredchat
          la procédure est en cours, mais n'est qu'à 40 %, je crois que je vais laisser le pc allumé, et je posterai le rapport demain, je dois malheureusement me lever très tôt demain matin.
          Merci pour ton aide et ta patience.
          0
      6. gen-hackman
        pas de soucis
        0
        1. fredchat
          Bonjour,

          Le scan s'est interrompu à 95% avec le message : "redémarrage des services... veuillez patienter".

          Il y a une fenêtre d'erreur qui s'est ouverte en dessous : " le fichier ou le répertoire \CIMG2124.jpg est endommagé et illisible. Exécuter l'utilitaire CHKDSK" (titre de cette fenêtre Autolt v3.sniffC.exe - fichier endommagé)

          Néanmoins, une 3° fenêtre FindyKill indique que le nettoyage est effectué.

          Je ne touche à rien et attends tes instructions !!
          Merci
          0
      7. gen-hackman
        hello le rapport s'est ouvert ?
        0
        1. fredchat
          hello,

          non pas de rapport ouvert.
          Faut-il fermer le message d'erreur et la fenêtre "nettoyage effectué" ?
          0
      • 1
      • 2

      Discussions similaires

      FOTOSE (allemagne)
      lix

      13 réponses
      ATTENTION : escroquerie à la carte bleue !!
      dvrg

      80 réponses