Virus mal autorun
Fermé
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
-
6 mars 2010 à 16:58
dédétraqué Messages postés 4384 Date d'inscription vendredi 5 septembre 2008 Statut Contributeur sécurité Dernière intervention 4 février 2013 - 17 mars 2010 à 23:03
dédétraqué Messages postés 4384 Date d'inscription vendredi 5 septembre 2008 Statut Contributeur sécurité Dernière intervention 4 février 2013 - 17 mars 2010 à 23:03
A voir également:
- Virus mal autorun
- Svchost.exe virus - Guide
- Autorun - Télécharger - Divers Utilitaires
- Usb Autorun - Télécharger - Divers Utilitaires
- Autoruns - Télécharger - Optimisation
- Youtu.be virus - Guide
82 réponses
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
9 mars 2010 à 20:39
9 mars 2010 à 20:39
Salut dédétraqué, voici le rapport de la recherche :
List'em by g3n-h@ckm@n 1.3.2.0
User : Fire and Ice (Administrateurs)
Update on 09/03/2010 by g3n-h@ckm@n ::::: 05.30
Start at: 20:25:24 | 09/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.26 [ (!) Disabled | (!) Outdated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 115,03 Go (28,76 Go free) [Marcy] | NTFS
D:\ -> Disque fixe local | 74,52 Go (70,2 Go free) [Jeux] | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe
======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
SPC610NC_Monitor REG_SZ C:\WINDOWS\Philips\SPC610NC\Monitor.exe
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
AutorunRemover.exe REG_SZ C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 0 (0x0)
===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
NoDriveAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 0 (0x0)
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 255 (0xff)
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ MARCY
DefaultUserName REG_SZ Fire and Ice
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Fire and Ice
AltDefaultDomainName REG_SZ MARCY
ChangePasswordUseKerberos REG_DWORD 1 (0x1)
===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\WINDOWS\system32\dwwin.exe REG_SZ C:\WINDOWS\system32\dwwin.exe:*:Enabled:ipsec
C:\WINDOWS\system32\drwtsn32.exe REG_SZ C:\WINDOWS\system32\drwtsn32.exe:*:Enabled:ipsec
C:\WINDOWS\system32\wscntfy.exe REG_SZ C:\WINDOWS\system32\wscntfy.exe:*:Enabled:ipsec
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe REG_SZ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe:*:Enabled:ipsec
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe REG_SZ C:\Program Files\Analog Devices\SoundMAX\Smax4.exe:*:Enabled:ipsec
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:ipsec
C:\Program Files\Java\jre6\bin\java.exe REG_SZ C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:ipsec
C:\Program Files\Java\jre6\bin\jusched.exe REG_SZ C:\Program Files\Java\jre6\bin\jusched.exe:*:Enabled:ipsec
C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE REG_SZ C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE:*:Enabled:ipsec
C:\WINDOWS\system32\wuauclt.exe REG_SZ C:\WINDOWS\system32\wuauclt.exe:*:Enabled:ipsec
C:\Program Files\OpenOffice.org 3\program\soffice.exe REG_SZ C:\Program Files\OpenOffice.org 3\program\soffice.exe:*:Enabled:ipsec
C:\Program Files\Micro Application\LauncherMA.exe REG_SZ C:\Program Files\Micro Application\LauncherMA.exe:*:Enabled:ipsec
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe REG_SZ C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe:*:Enabled:ipsec
C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe REG_SZ C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe:*:Enabled:ipsec
C:\Program Files\Linksys\WUSB54GC\WUSB54GC.exe REG_SZ C:\Program Files\Linksys\WUSB54GC\WUSB54GC.exe:*:Enabled:ipsec
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr REG_SZ C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr:*:Enabled:Userinit
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
C:\Program Files\InstallShield Installation Information\{9D89EE43-B471-40EC-9550-6BD77C7BE3F4}\setup.exe REG_SZ C:\Program Files\InstallShield Installation Information\{9D89EE43-B471-40EC-9550-6BD77C7BE3F4}\setup.exe:*:Enabled:ipsec
C:\Program Files\Mozilla Firefox\firefox.exe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe:*:Enabled:ipsec
C:\WINDOWS\explorer.exe REG_SZ C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe:*:Enabled:ipsec
C:\WINDOWS\Philips\SPC610NC\Monitor.exe REG_SZ C:\WINDOWS\Philips\SPC610NC\Monitor.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe:*:Enabled:ipsec
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{DFB17AA8-042A-429D-987C-26CE244A4189}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
===
DNS
===
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1119766A-56E0-4099-80DE-06D1F307CCD0}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1119766A-56E0-4099-80DE-06D1F307CCD0}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1119766A-56E0-4099-80DE-06D1F307CCD0}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x2 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
=========
Atapi.sys
=========
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
##
86912,95b858761a00e1d4f81f79a0da019aca,5e41dae055bcb8ee8ad23d3c77d69df09c6b1e301c889aec6f02193d7dec352b,C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
Référence :
==========
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
=======
Drive :
=======
D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.
Rapport d'analyse
115 Go total, 28,77 Go libre (25%), 5% fragment‚ (fragmentation du fichier 11%)
Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Present !! : C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
¤¤¤¤¤¤¤¤¤¤ Keys :
============
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-09 20:38:33
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 20:38:47,00
List'em by g3n-h@ckm@n 1.3.2.0
User : Fire and Ice (Administrateurs)
Update on 09/03/2010 by g3n-h@ckm@n ::::: 05.30
Start at: 20:25:24 | 09/03/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.26 [ (!) Disabled | (!) Outdated ]
A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 115,03 Go (28,76 Go free) [Marcy] | NTFS
D:\ -> Disque fixe local | 74,52 Go (70,2 Go free) [Jeux] | NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
Boot: Normal
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\List_Kill'em\FxEx.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe
======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
SoundMAXPnP REG_SZ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
SPC610NC_Monitor REG_SZ C:\WINDOWS\Philips\SPC610NC\Monitor.exe
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
AutorunRemover.exe REG_SZ C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
avgnt REG_SZ "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 0 (0x0)
===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
NoDriveAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 0 (0x0)
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 0 (0x0)
NoDriveAutoRun REG_DWORD 255 (0xff)
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ MARCY
DefaultUserName REG_SZ Fire and Ice
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Fire and Ice
AltDefaultDomainName REG_SZ MARCY
ChangePasswordUseKerberos REG_DWORD 1 (0x1)
===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\WINDOWS\system32\dwwin.exe REG_SZ C:\WINDOWS\system32\dwwin.exe:*:Enabled:ipsec
C:\WINDOWS\system32\drwtsn32.exe REG_SZ C:\WINDOWS\system32\drwtsn32.exe:*:Enabled:ipsec
C:\WINDOWS\system32\wscntfy.exe REG_SZ C:\WINDOWS\system32\wscntfy.exe:*:Enabled:ipsec
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe REG_SZ C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe:*:Enabled:ipsec
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe REG_SZ C:\Program Files\Analog Devices\SoundMAX\Smax4.exe:*:Enabled:ipsec
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:ipsec
C:\Program Files\Java\jre6\bin\java.exe REG_SZ C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:ipsec
C:\Program Files\Java\jre6\bin\jusched.exe REG_SZ C:\Program Files\Java\jre6\bin\jusched.exe:*:Enabled:ipsec
C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE REG_SZ C:\Program Files\Microsoft Office\Office\1036\OLFSNT40.EXE:*:Enabled:ipsec
C:\WINDOWS\system32\wuauclt.exe REG_SZ C:\WINDOWS\system32\wuauclt.exe:*:Enabled:ipsec
C:\Program Files\OpenOffice.org 3\program\soffice.exe REG_SZ C:\Program Files\OpenOffice.org 3\program\soffice.exe:*:Enabled:ipsec
C:\Program Files\Micro Application\LauncherMA.exe REG_SZ C:\Program Files\Micro Application\LauncherMA.exe:*:Enabled:ipsec
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe REG_SZ C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe:*:Enabled:ipsec
C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe REG_SZ C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe:*:Enabled:ipsec
C:\Program Files\Linksys\WUSB54GC\WUSB54GC.exe REG_SZ C:\Program Files\Linksys\WUSB54GC\WUSB54GC.exe:*:Enabled:ipsec
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr REG_SZ C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr:*:Enabled:Userinit
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\eMule\emule.exe REG_SZ C:\Program Files\eMule\emule.exe:*:Enabled:eMule
C:\Program Files\InstallShield Installation Information\{9D89EE43-B471-40EC-9550-6BD77C7BE3F4}\setup.exe REG_SZ C:\Program Files\InstallShield Installation Information\{9D89EE43-B471-40EC-9550-6BD77C7BE3F4}\setup.exe:*:Enabled:ipsec
C:\Program Files\Mozilla Firefox\firefox.exe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe:*:Enabled:ipsec
C:\WINDOWS\explorer.exe REG_SZ C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe:*:Enabled:ipsec
C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe REG_SZ C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe:*:Enabled:ipsec
C:\WINDOWS\Philips\SPC610NC\Monitor.exe REG_SZ C:\WINDOWS\Philips\SPC610NC\Monitor.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe:*:Enabled:ipsec
C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe REG_SZ C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe:*:Enabled:ipsec
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{6414512B-B978-451D-A0D8-FCFDF33E833C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{DFB17AA8-042A-429D-987C-26CE244A4189}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
===
DNS
===
HKLM\SYSTEM\CCS\Services\Tcpip\..\{1119766A-56E0-4099-80DE-06D1F307CCD0}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1119766A-56E0-4099-80DE-06D1F307CCD0}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1119766A-56E0-4099-80DE-06D1F307CCD0}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
Ndisuio : 0x3 ( OK = 3 )
EapHost : 0x2 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
=========
Atapi.sys
=========
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
##
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ERDNT\cache\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ERDNT\cache\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
##
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Program Files\List_Kill'em
## C:\> hashdeep.exe C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
##
86912,95b858761a00e1d4f81f79a0da019aca,5e41dae055bcb8ee8ad23d3c77d69df09c6b1e301c889aec6f02193d7dec352b,C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
Référence :
==========
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
=======
Drive :
=======
D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.
Rapport d'analyse
115 Go total, 28,77 Go libre (25%), 5% fragment‚ (fragmentation du fichier 11%)
Il ne vous est pas n‚cessaire de d‚fragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Present !! : C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
¤¤¤¤¤¤¤¤¤¤ Keys :
============
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-09 20:38:33
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 20:38:47,00
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
11 mars 2010 à 00:24
11 mars 2010 à 00:24
Salut Nirvana666Cherry
Double clique sur le raccourci d'HijackThis sur ton Bureau, clique sur Do a scan system only coche la case devant la(les) ligne(s) suivante(s) si présente(s)
Si pas de raccourci sur le bureau, il ce trouve ici :
C:\Program Files\trend micro\Fire and Ice.exe
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
- Ferme les fenêtres en cours sauf HijackThis, clique sur Fix checked
- Quitte HijackThis
-----
Télécharge OTM (de Old_Timer) sur le bureau :
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
Double-clique sur OTM.exe sur le bureau
- Copie le texte qui se trouve en gras ci-dessous et colle le dans le cadre de gauche de OTM nommé Paste Instructions for Items to be Moved
:services
asc3360pr
catchme
:reg
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe"=-
:files
C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr
C:\WINDOWS\system32\OLDFF.tmp
C:\WINDOWS\system32\OLDFB.tmp
:commands
[purity]
[emptytemp]
- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTM
Ton PC va redémarrer pour finir la suppression, si il ne le fais pas lui-même, redémarre le.
Poste le rapport de OTMoveIt qui se trouve dans C:\_OTM\MovedFiles.
Refais un scan avec RSIT et poste le contenu du rapport log.txt à la fin de l’analyse
Le rapport est dans le dossier ici C:\rsit
@++ :)
Double clique sur le raccourci d'HijackThis sur ton Bureau, clique sur Do a scan system only coche la case devant la(les) ligne(s) suivante(s) si présente(s)
Si pas de raccourci sur le bureau, il ce trouve ici :
C:\Program Files\trend micro\Fire and Ice.exe
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (file missing)
- Ferme les fenêtres en cours sauf HijackThis, clique sur Fix checked
- Quitte HijackThis
-----
Télécharge OTM (de Old_Timer) sur le bureau :
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
Double-clique sur OTM.exe sur le bureau
- Copie le texte qui se trouve en gras ci-dessous et colle le dans le cadre de gauche de OTM nommé Paste Instructions for Items to be Moved
:services
asc3360pr
catchme
:reg
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe"=-
"C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe"=-
"C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe"=-
:files
C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr
C:\WINDOWS\system32\OLDFF.tmp
C:\WINDOWS\system32\OLDFB.tmp
:commands
[purity]
[emptytemp]
- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTM
Ton PC va redémarrer pour finir la suppression, si il ne le fais pas lui-même, redémarre le.
Poste le rapport de OTMoveIt qui se trouve dans C:\_OTM\MovedFiles.
Refais un scan avec RSIT et poste le contenu du rapport log.txt à la fin de l’analyse
Le rapport est dans le dossier ici C:\rsit
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
11 mars 2010 à 18:21
11 mars 2010 à 18:21
Coucou dédétraqué, sa vas tu ne perd pas espoir avec mon PC. ^^
Voici le rapport OTMoveIt :
All processes killed
========== SERVICES/DRIVERS ==========
Service asc3360pr stopped successfully!
Service asc3360pr deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe deleted successfully.
========== FILES ==========
LoadLibrary failed for C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL moved successfully.
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr moved successfully.
C:\WINDOWS\system32\OLDFF.tmp moved successfully.
C:\WINDOWS\system32\OLDFB.tmp moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Diiamant
->Temp folder emptied: 646575 bytes
->Temporary Internet Files folder emptied: 1208278 bytes
->Java cache emptied: 12118723 bytes
->FireFox cache emptied: 88195496 bytes
->Flash cache emptied: 6448 bytes
User: Fire and Ice
->Temp folder emptied: 68279707 bytes
->Temporary Internet Files folder emptied: 18309409 bytes
->Java cache emptied: 28577971 bytes
->FireFox cache emptied: 77866294 bytes
->Flash cache emptied: 8313 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5216949 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 287,00 mb
OTM by OldTimer - Version 3.1.10.0 log created on 03112010_181410
Files moved on Reboot...
Registry entries deleted on Reboot...
Voici le rapport OTMoveIt :
All processes killed
========== SERVICES/DRIVERS ==========
Service asc3360pr stopped successfully!
Service asc3360pr deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe deleted successfully.
========== FILES ==========
LoadLibrary failed for C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL moved successfully.
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr moved successfully.
C:\WINDOWS\system32\OLDFF.tmp moved successfully.
C:\WINDOWS\system32\OLDFB.tmp moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Diiamant
->Temp folder emptied: 646575 bytes
->Temporary Internet Files folder emptied: 1208278 bytes
->Java cache emptied: 12118723 bytes
->FireFox cache emptied: 88195496 bytes
->Flash cache emptied: 6448 bytes
User: Fire and Ice
->Temp folder emptied: 68279707 bytes
->Temporary Internet Files folder emptied: 18309409 bytes
->Java cache emptied: 28577971 bytes
->FireFox cache emptied: 77866294 bytes
->Flash cache emptied: 8313 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5216949 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 287,00 mb
OTM by OldTimer - Version 3.1.10.0 log created on 03112010_181410
Files moved on Reboot...
Registry entries deleted on Reboot...
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
11 mars 2010 à 18:23
11 mars 2010 à 18:23
Et voila le rapport de RSIT :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Fire and Ice at 2010-03-11 18:22:56
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 28 GB (24%) free of 118 GB
Total RAM: 2559 MB (83% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:00, on 11/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Fire and Ice\Bureau\RSIT.exe
C:\Program Files\trend micro\Fire and Ice.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lanceur.lnk = C:\Program Files\Micro Application\LauncherMA.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Launch WhiteSmoke.lnk = C:\Program Files\WhiteSmoke\WSEnrichment.exe
O4 - Global Startup: Wireless Network Monitor.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: WUSB54GC - Unknown owner - C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
Logfile of random's system information tool 1.06 (written by random/random)
Run by Fire and Ice at 2010-03-11 18:22:56
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 28 GB (24%) free of 118 GB
Total RAM: 2559 MB (83% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:00, on 11/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Fire and Ice\Bureau\RSIT.exe
C:\Program Files\trend micro\Fire and Ice.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lanceur.lnk = C:\Program Files\Micro Application\LauncherMA.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Launch WhiteSmoke.lnk = C:\Program Files\WhiteSmoke\WSEnrichment.exe
O4 - Global Startup: Wireless Network Monitor.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: WUSB54GC - Unknown owner - C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
12 mars 2010 à 00:06
12 mars 2010 à 00:06
Salut Nirvana666Cherry
On va vérifier si rien de caché :
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :
https://www.eset.com/int/home/online-scanner/
(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt
@++ :)
On va vérifier si rien de caché :
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :
https://www.eset.com/int/home/online-scanner/
(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
12 mars 2010 à 22:48
12 mars 2010 à 22:48
Salut dédétraqué,
J'ai fais le scan d'après ce que j'ai vu j'ai des virus assez important, voici le rapport :
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=92bce6d930fd6c4d84b303117d33bac9
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-03-12 09:44:10
# local_time=2010-03-12 10:44:10 (+0100, Paris, Madrid)
# country="France"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 94685 94685 0 0
# compatibility_mode=1797 16774122 100 96 355292 64479571 0 0
# compatibility_mode=8192 67108863 100 0 3942 3942 0 0
# scanned=67074
# found=18
# cleaned=10
# scan_time=10990
C:\Documents and Settings\Fire and Ice\Mes documents\eMule Downloads\Incoming\(2009) Guitar Pro 5 .zip Win32/Agent.QKL trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Avira\AntiVir Desktop\avadmin.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avupgsvc.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\fact.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\licmgr.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\setup.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\update.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\wsctool.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP112\A0065424.exe Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068840.rbf Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068841.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068842.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068843.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\C\WINDOWS\msnmgr.exe.UsbFix Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\H\autorun.inf.UsbFix INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\J\autorun.inf.UsbFix INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTM\MovedFiles\03112010_181410\C_Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
J'ai fais le scan d'après ce que j'ai vu j'ai des virus assez important, voici le rapport :
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=92bce6d930fd6c4d84b303117d33bac9
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-03-12 09:44:10
# local_time=2010-03-12 10:44:10 (+0100, Paris, Madrid)
# country="France"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 94685 94685 0 0
# compatibility_mode=1797 16774122 100 96 355292 64479571 0 0
# compatibility_mode=8192 67108863 100 0 3942 3942 0 0
# scanned=67074
# found=18
# cleaned=10
# scan_time=10990
C:\Documents and Settings\Fire and Ice\Mes documents\eMule Downloads\Incoming\(2009) Guitar Pro 5 .zip Win32/Agent.QKL trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Avira\AntiVir Desktop\avadmin.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avupgsvc.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\fact.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\licmgr.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\setup.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\update.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\wsctool.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP112\A0065424.exe Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068840.rbf Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068841.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068842.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068843.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\C\WINDOWS\msnmgr.exe.UsbFix Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\H\autorun.inf.UsbFix INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\J\autorun.inf.UsbFix INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTM\MovedFiles\03112010_181410\C_Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
12 mars 2010 à 23:29
12 mars 2010 à 23:29
Salut Nirvana666Cherry
Télécharge Dr.Web CureIt! sur le Bureau :
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
- Double clique sur l'icône de drweb-cureit.exe sur le bureau et clique sur Commencer le scan.
- Si des infections sont trouvées après ce scan rapide, clique sur le bouton Oui pour Tout.
- Après ce scan rapide, sélectionnez Analyse complète et clique sur la flèche verte à droite.
- Le scan du PC va débuter, le scan peut-être très très long.
- Si une infection sont trouvée, clique sur le bouton Oui pour Tout.
- A la fin du scan, si des infections sont trouvées, clique sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, clique sur Quarantaine.
- Au menu principal de l'outil, en haut à gauche, clique sur le menu Fichier et choisissez Enregistrer le rapport.
- Sauvegarde le rapport sur votre Bureau. Ce dernier se nommera DrWeb.csv.
- Ferme Dr.Web CureIt!
- Redémarre ton PC (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.
- Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.
@++ :)
Télécharge Dr.Web CureIt! sur le Bureau :
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
- Double clique sur l'icône de drweb-cureit.exe sur le bureau et clique sur Commencer le scan.
- Si des infections sont trouvées après ce scan rapide, clique sur le bouton Oui pour Tout.
- Après ce scan rapide, sélectionnez Analyse complète et clique sur la flèche verte à droite.
- Le scan du PC va débuter, le scan peut-être très très long.
- Si une infection sont trouvée, clique sur le bouton Oui pour Tout.
- A la fin du scan, si des infections sont trouvées, clique sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, clique sur Quarantaine.
- Au menu principal de l'outil, en haut à gauche, clique sur le menu Fichier et choisissez Enregistrer le rapport.
- Sauvegarde le rapport sur votre Bureau. Ce dernier se nommera DrWeb.csv.
- Ferme Dr.Web CureIt!
- Redémarre ton PC (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.
- Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
14 mars 2010 à 01:32
14 mars 2010 à 01:32
Salut dédétraqué,
Je crois que le dossier est trop lourd. Où je peux te l'envoyer ?
Et je voulais encore te remercier de ta patience et de toute l'aide que tu m'apportes.
Je crois que le dossier est trop lourd. Où je peux te l'envoyer ?
Et je voulais encore te remercier de ta patience et de toute l'aide que tu m'apportes.
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
14 mars 2010 à 01:56
14 mars 2010 à 01:56
Salut Nirvana666Cherry
Envoie ici :
https://www.filedropper.com/
http://ww38.toofiles.com/fr/
@++ :)
Envoie ici :
https://www.filedropper.com/
http://ww38.toofiles.com/fr/
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
14 mars 2010 à 02:00
14 mars 2010 à 02:00
Le fichier est trop lourd je crois pour le site.
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
14 mars 2010 à 02:14
14 mars 2010 à 02:14
Salut Nirvana666Cherry
Combien fais le fichier??
@++ :)
Combien fais le fichier??
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
14 mars 2010 à 02:15
14 mars 2010 à 02:15
Non attend j'ai rien dit...
J'ai réussi à le mettre sur le premier site que tu m'as donner. Désolé. ^^
J'ai réussi à le mettre sur le premier site que tu m'as donner. Désolé. ^^
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
14 mars 2010 à 02:20
14 mars 2010 à 02:20
Je fait quoi après avoir mis le lien sur le site ?
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
14 mars 2010 à 02:33
14 mars 2010 à 02:33
Salut Nirvana666Cherry
Voir avec :
http://ww38.toofiles.com/fr/
Clique sur Document dans le haut
@++ :)
Voir avec :
http://ww38.toofiles.com/fr/
Clique sur Document dans le haut
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
14 mars 2010 à 09:29
14 mars 2010 à 09:29
Salut dédétraqué,
Voila j'ai réussi à le mettre.
Voici le lien : http://ww38.toofiles.com/fr/oip/documents/pdf/drweb.html
Voila j'ai réussi à le mettre.
Voici le lien : http://ww38.toofiles.com/fr/oip/documents/pdf/drweb.html
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
14 mars 2010 à 19:02
14 mars 2010 à 19:02
Salut Nirvana666Cherry
Désinstalle Antivir avec cet outil:
http://dlpro.antivir.com/package/removaltool/win32/en/removaltool-win32-en.exe
Passe cet outil pour le registre :
http://dlpro.antivir.com/down/windows/registrycleaner_en.zip
Fais de nouveau un scan en ligne ici :
https://www.eset.com/int/home/online-scanner/
@++ :)
Désinstalle Antivir avec cet outil:
http://dlpro.antivir.com/package/removaltool/win32/en/removaltool-win32-en.exe
Passe cet outil pour le registre :
http://dlpro.antivir.com/down/windows/registrycleaner_en.zip
Fais de nouveau un scan en ligne ici :
https://www.eset.com/int/home/online-scanner/
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
15 mars 2010 à 18:44
15 mars 2010 à 18:44
Salut dédétraqué,
Le premier lien que tu m'as donné n'a pas désinstaller Avira. Il a juste fait un scan. Je fais quand même le registre ?
Le premier lien que tu m'as donné n'a pas désinstaller Avira. Il a juste fait un scan. Je fais quand même le registre ?
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
15 mars 2010 à 23:53
15 mars 2010 à 23:53
Salut Nirvana666Cherry
C'est mal expliqué sur leur site, faire un clic droit sur l'icône d'AntiVir dans la barre des tâches (en bas à droite), clique sur "Activer Antivir Guard" afin de le désactiver puis désinstalle le programme à partir de l'outil Ajout/suppression de programmes qui se trouve dans le Panneau de configuration.
Passe l'outil pour le registre de nouveau et faire le scan en ligne
@++ :)
C'est mal expliqué sur leur site, faire un clic droit sur l'icône d'AntiVir dans la barre des tâches (en bas à droite), clique sur "Activer Antivir Guard" afin de le désactiver puis désinstalle le programme à partir de l'outil Ajout/suppression de programmes qui se trouve dans le Panneau de configuration.
Passe l'outil pour le registre de nouveau et faire le scan en ligne
@++ :)
Nirvana666Cherry
Messages postés
45
Date d'inscription
samedi 6 mars 2010
Statut
Membre
Dernière intervention
17 mars 2010
16 mars 2010 à 08:17
16 mars 2010 à 08:17
Salut dédétraqué,
Il n'est pas dans ma barre des taches en bas à droite, juste sur mon bureau et quand je clique droit dessus je n'est pas de "activer Avira" ou quelque chose de ce genre. Et lorsque je vais dans panneau de config pour le désinstaller il me met un message d'erreur : "Echec de l'initialisation des modules de produit.
Dois-je quand même faire le registre ou pas ?
Il n'est pas dans ma barre des taches en bas à droite, juste sur mon bureau et quand je clique droit dessus je n'est pas de "activer Avira" ou quelque chose de ce genre. Et lorsque je vais dans panneau de config pour le désinstaller il me met un message d'erreur : "Echec de l'initialisation des modules de produit.
Dois-je quand même faire le registre ou pas ?
dédétraqué
Messages postés
4384
Date d'inscription
vendredi 5 septembre 2008
Statut
Contributeur sécurité
Dernière intervention
4 février 2013
286
17 mars 2010 à 02:07
17 mars 2010 à 02:07
Salut Nirvana666Cherry
Refais un scan avec RSIT et poste le contenu du rapport log.txt à la fin de l’analyse
Le rapport est dans le dossier ici C:\rsit
@++ :)
Refais un scan avec RSIT et poste le contenu du rapport log.txt à la fin de l’analyse
Le rapport est dans le dossier ici C:\rsit
@++ :)
