A voir également:
- Problème de faux antivirus
- Comodo antivirus - Télécharger - Sécurité
- Panda antivirus - Télécharger - Antivirus & Antimalwares
- Desactiver antivirus windows 10 - Guide
- Bitdefender antivirus gratuit - Télécharger - Antivirus & Antimalwares
- Antivirus norton gratuit - Télécharger - Antivirus & Antimalwares
29 réponses
Utilisateur anonyme
3 mai 2010 à 03:38
3 mai 2010 à 03:38
Télécharge rkill :
▶ https://download.bleepingcomputer.com/grinler/rkill.exe
▶ https://download.bleepingcomputer.com/grinler/rkill.com
▶ https://download.bleepingcomputer.com/grinler/rkill.scr
▶ http://download.bleepingcomputer.com/grinler/rkill.pif
▶ Enregistre-le sur ton Bureau
▶ Double-clique sur l'icone rkill ( pour Vista/Seven clic-droit Exécuter en tant qu'Administrateur)
Un bref écran noir t'indiquera que le tool s'est correctement exécuter, s'il ne lance pas,
change de lien de téléchargement.
une fois qu'il aura terminé
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)
▶ Télécharge List_Kill'em et enregistre le sur ton bureau
double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation
Laisse coché :
♦ Executer Shortcut
♦ Executer List_Kill'em
une fois terminée , clic sur "terminer" et le programme se lancera seul
choisis l'option Search
▶ laisse travailler l'outil
à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.
▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
▶ https://download.bleepingcomputer.com/grinler/rkill.exe
▶ https://download.bleepingcomputer.com/grinler/rkill.com
▶ https://download.bleepingcomputer.com/grinler/rkill.scr
▶ http://download.bleepingcomputer.com/grinler/rkill.pif
▶ Enregistre-le sur ton Bureau
▶ Double-clique sur l'icone rkill ( pour Vista/Seven clic-droit Exécuter en tant qu'Administrateur)
Un bref écran noir t'indiquera que le tool s'est correctement exécuter, s'il ne lance pas,
change de lien de téléchargement.
une fois qu'il aura terminé
DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)
▶ Télécharge List_Kill'em et enregistre le sur ton bureau
double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation
Laisse coché :
♦ Executer Shortcut
♦ Executer List_Kill'em
une fois terminée , clic sur "terminer" et le programme se lancera seul
choisis l'option Search
▶ laisse travailler l'outil
à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.
▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"
Utilisateur anonyme
Modifié par gen-hackman le 3/05/2010 à 02:56
Modifié par gen-hackman le 3/05/2010 à 02:56
bonsoir regarde si tu peux executer ceci :
http://sd-1.archive-host.com/membres/up/829108531491024/Mes_Tools/FxEx.bat
tu double cliques et ca te cree une clé de registre sur ton bureau
tu double-cliques dessus et acceptes
?G3?-?@¢??@?(TM)©®?
http://sd-1.archive-host.com/membres/up/829108531491024/Mes_Tools/FxEx.bat
tu double cliques et ca te cree une clé de registre sur ton bureau
tu double-cliques dessus et acceptes
?G3?-?@¢??@?(TM)©®?
Utilisateur anonyme
3 mai 2010 à 04:18
3 mai 2010 à 04:18
ok :)
List'em by g3n-h@ckm@n 1.7.2.6
User : Audette Maheux (Administrateurs)
Update on 02/05/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 22:08:08 | 2010-05-02
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]
C:\ -> Disque fixe local | 182,49 Go (132,23 Go free) | NTFS
D:\ -> Disque fixe local | 3,82 Go (1,05 Go free) [RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
Boot: Safeboot
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe
======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
EA Core REG_SZ "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe
iukjpgrk REG_SZ C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf\jevrynktssd.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
SunKistEM REG_SZ C:\Program Files\Digital Media Reader\shwiconem.exe
<NO NAME> REG_SZ
NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
Raccourci vers la page des propriétés de High Definition Audio REG_SZ HDAudPropShortcut.exe
Mixersel REG_SZ C:\Program Files\Realtek\InstallShield\mixersel.exe
SoundMan REG_SZ SOUNDMAN.EXE
AlcWzrd REG_SZ ALCWZRD.EXE
Alcmtr REG_SZ ALCMTR.EXE
HP Software Update REG_SZ "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
fssui REG_SZ "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
lxdxmon.exe REG_SZ "C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe"
lxdxamon REG_SZ "C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe"
AppleSyncNotifier REG_SZ C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
iukjpgrk REG_SZ C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf\jevrynktssd.exe
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ CHAMBRECATHERIN
DefaultUserName REG_SZ Audette Maheux
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
DefaultPassword REG_SZ
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Audette Maheux
AltDefaultDomainName REG_SZ CHAMBRECATHERIN
===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe:*:Enabled:Lexmark Device Monitor
C:\Program Files\Lexmark 3600-4600 Series\frun.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\frun.exe:*:Enabled:Lexmark Productivity Studio
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe:*:Enabled:Printer Device Monitor
C:\WINDOWS\system32\lxdxcfg.exe REG_SZ C:\WINDOWS\system32\lxdxcfg.exe:*:Enabled:Printer Communication System
C:\WINDOWS\system32\lxdxcoms.exe REG_SZ C:\WINDOWS\system32\lxdxcoms.exe:*:Enabled:Lexmark Communications System
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe:*:Enabled:Printer Status Window Interface
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe:*:Enabled:Lexmark Connect Time Executable
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe:*:Enabled:Job Status Window Interface
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxwbgw.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxwbgw.exe:*:Enabled:Lexmark Web Gateway
C:\Program Files\Electronic Arts\EADM\Core.exe REG_SZ C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\Lexmark 3600-4600 Series\lxdxlscn.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\lxdxlscn.exe:*:Enabled:
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8}]
===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{93711D60-F5E1-6DC1-4475-9C5D1AB0117E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BAE4BA30-8CAB-5379-4BA7-9E276024DB66}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}]
==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
===
DNS
===
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A9028C01-3A04-4C7E-9627-9ACD290B530A}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A9028C01-3A04-4C7E-9627-9ACD290B530A}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A9028C01-3A04-4C7E-9627-9ACD290B530A}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_EXPAND_SZ %SystemRoot%\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://alexx-ee.skyblog.com/
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ https://www.google.com/?gws_rd=ssl
========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
Ndisuio : 0x3 ( OK = 3 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
========
Safemode
========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!
=========
Atapi.sys
=========
C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]
C:\WINDOWS\system32\dllcache\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
Référence :
==========
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e
=======
Drive :
=======
D'fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.
Rapport d'analyse
182 Go total, 132 Go libre (72%), 16% fragment' (fragmentation du fichier 33%)
Vous devriez d'fragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\sqmdata13.sqm
Present !! : C:\sqmdata14.sqm
Present !! : C:\sqmdata15.sqm
Present !! : C:\sqmdata16.sqm
Present !! : C:\sqmdata17.sqm
Present !! : C:\sqmdata18.sqm
Present !! : C:\sqmdata19.sqm
Present !! : C:\sqmnoopt13.sqm
Present !! : C:\sqmnoopt14.sqm
Present !! : C:\sqmnoopt15.sqm
Present !! : C:\sqmnoopt16.sqm
Present !! : C:\sqmnoopt17.sqm
Present !! : C:\sqmnoopt18.sqm
Present !! : C:\sqmnoopt19.sqm
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\SET*.tmp
Present !! : C:\WINDOWS\Temp\scs1.tmp
Present !! : C:\WINDOWS\Temp\scs2.tmp
Present !! : C:\WINDOWS\Temp\scs3.tmp
Present !! : C:\WINDOWS\Temp\scs4.tmp
Present !! : C:\WINDOWS\Temp\scs5.tmp
Present !! : C:\WINDOWS\Temp\scs7.tmp
Present !! : C:\WINDOWS\Temp\SEP6.tmp
Present !! : C:\WINDOWS\Temp\SEPC.tmp
Present !! : C:\WINDOWS\Temp\SEPE3.tmp
Present !! : C:\WINDOWS\TEMP\scs1.tmp
Present !! : C:\WINDOWS\TEMP\scs2.tmp
Present !! : C:\WINDOWS\TEMP\scs3.tmp
Present !! : C:\WINDOWS\TEMP\scs4.tmp
Present !! : C:\WINDOWS\TEMP\scs5.tmp
Present !! : C:\WINDOWS\TEMP\scs7.tmp
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\dw.log
Present !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\d_4.png
Present !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\VP6.reg
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRun.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\converter.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD4.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD5.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD6.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD7.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD8.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD9.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EADA.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\eauninstall.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\First15.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FirstUse.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzmsi01.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzscr01.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Install_WLMessenger.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\jre-6u3-windows-i586-p-iftw_2cd32978.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\MsgPlusUninstall.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\QlIU.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\stopinv.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\The Sims 2_uninst.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\uBGG.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6Install.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AVRES_OPTRF_LiveUpdate.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hposcr04.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpqscr01.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\isconfig.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\symcprop.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\SymSCLiveUpdate.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\aswV5Hlp.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRunGUI.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-awt-win32-3346.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-win32-3346.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\UninstallEADM.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6VFW.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSShoppingMall_01.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSStreet8.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSWay8_complete.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_Melanie.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Schnuddl_Beard_Rap.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp151.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp16F.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A3.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A4.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A5.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A6.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E1.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E2.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp20E.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp459.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp4E.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpC2.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpCE.tmp
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCU\SOFTWARE\avsoft
Present !! : HKCU\Software\avsuite
Present !! : HKLM\SOFTWARE\avsoft
Present !! : HKLM\SOFTWARE\avsuite
============
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-02 22:23:49
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 22:23:50,89
User : Audette Maheux (Administrateurs)
Update on 02/05/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 22:08:08 | 2010-05-02
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]
C:\ -> Disque fixe local | 182,49 Go (132,23 Go free) | NTFS
D:\ -> Disque fixe local | 3,82 Go (1,05 Go free) [RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
Boot: Safeboot
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\List_Kill'em\List_Kill'em.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\pv.exe
======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
EA Core REG_SZ "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe
iukjpgrk REG_SZ C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf\jevrynktssd.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
SunKistEM REG_SZ C:\Program Files\Digital Media Reader\shwiconem.exe
<NO NAME> REG_SZ
NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
Raccourci vers la page des propriétés de High Definition Audio REG_SZ HDAudPropShortcut.exe
Mixersel REG_SZ C:\Program Files\Realtek\InstallShield\mixersel.exe
SoundMan REG_SZ SOUNDMAN.EXE
AlcWzrd REG_SZ ALCWZRD.EXE
Alcmtr REG_SZ ALCMTR.EXE
HP Software Update REG_SZ "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
NvMediaCenter REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
KernelFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -k
fssui REG_SZ "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
lxdxmon.exe REG_SZ "C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe"
lxdxamon REG_SZ "C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe"
AppleSyncNotifier REG_SZ C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
iukjpgrk REG_SZ C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf\jevrynktssd.exe
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveTypeAutoRun REG_DWORD 145 (0x91)
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
HonorAutoRunSetting REG_DWORD 1 (0x1)
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
AutoRestartShell REG_DWORD 1 (0x1)
DefaultDomainName REG_SZ CHAMBRECATHERIN
DefaultUserName REG_SZ Audette Maheux
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
ShutdownWithoutLogon REG_SZ 0
System REG_SZ
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
SfcQuota REG_DWORD -1 (0xffffffff)
allocatecdroms REG_SZ 0
allocatedasd REG_SZ 0
allocatefloppies REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0 (0x0)
passwordexpirywarning REG_DWORD 14 (0xe)
scremoveoption REG_SZ 0
AllowMultipleTSSessions REG_DWORD 1 (0x1)
UIHost REG_EXPAND_SZ logonui.exe
LogonType REG_DWORD 1 (0x1)
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
SFCDisable REG_DWORD 0 (0x0)
WinStationsDisabled REG_SZ 0
DefaultPassword REG_SZ
HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
ShowLogonOptions REG_DWORD 0 (0x0)
AltDefaultUserName REG_SZ Audette Maheux
AltDefaultDomainName REG_SZ CHAMBRECATHERIN
===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ
===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe:*:Enabled:Lexmark Device Monitor
C:\Program Files\Lexmark 3600-4600 Series\frun.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\frun.exe:*:Enabled:Lexmark Productivity Studio
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe:*:Enabled:Printer Device Monitor
C:\WINDOWS\system32\lxdxcfg.exe REG_SZ C:\WINDOWS\system32\lxdxcfg.exe:*:Enabled:Printer Communication System
C:\WINDOWS\system32\lxdxcoms.exe REG_SZ C:\WINDOWS\system32\lxdxcoms.exe:*:Enabled:Lexmark Communications System
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe:*:Enabled:Printer Status Window Interface
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe:*:Enabled:Lexmark Connect Time Executable
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe:*:Enabled:Job Status Window Interface
C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxwbgw.exe REG_SZ C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxwbgw.exe:*:Enabled:Lexmark Web Gateway
C:\Program Files\Electronic Arts\EADM\Core.exe REG_SZ C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
C:\Program Files\Lexmark 3600-4600 Series\lxdxlscn.exe REG_SZ C:\Program Files\Lexmark 3600-4600 Series\lxdxlscn.exe:*:Enabled:
C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
%windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe REG_SZ C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live FolderShare
===============
ActivX controls
===============
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{C3F79A2B-B9B4-4A66-B012-3EE46475B072}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8}]
===============
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{233C1507-6A77-46A4-9443-F871F945D258}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{93711D60-F5E1-6DC1-4475-9C5D1AB0117E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BAE4BA30-8CAB-5379-4BA7-9E276024DB66}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}]
==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
===
DNS
===
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A9028C01-3A04-4C7E-9627-9ACD290B530A}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A9028C01-3A04-4C7E-9627-9ACD290B530A}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A9028C01-3A04-4C7E-9627-9ACD290B530A}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_EXPAND_SZ %SystemRoot%\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://alexx-ee.skyblog.com/
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ https://www.google.com/?gws_rd=ssl
========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
Ndisuio : 0x3 ( OK = 3 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )
========
Safemode
========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!
=========
Atapi.sys
=========
C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\atapi.sys :
MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]
C:\WINDOWS\system32\dllcache\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
C:\WINDOWS\system32\drivers\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys :
MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]
Référence :
==========
Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e
=======
Drive :
=======
D'fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.
Rapport d'analyse
182 Go total, 132 Go libre (72%), 16% fragment' (fragmentation du fichier 33%)
Vous devriez d'fragmenter ce volume.
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Present !! : C:\sqmdata13.sqm
Present !! : C:\sqmdata14.sqm
Present !! : C:\sqmdata15.sqm
Present !! : C:\sqmdata16.sqm
Present !! : C:\sqmdata17.sqm
Present !! : C:\sqmdata18.sqm
Present !! : C:\sqmdata19.sqm
Present !! : C:\sqmnoopt13.sqm
Present !! : C:\sqmnoopt14.sqm
Present !! : C:\sqmnoopt15.sqm
Present !! : C:\sqmnoopt16.sqm
Present !! : C:\sqmnoopt17.sqm
Present !! : C:\sqmnoopt18.sqm
Present !! : C:\sqmnoopt19.sqm
Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Present !! : C:\WINDOWS\System32\SET*.tmp
Present !! : C:\WINDOWS\Temp\scs1.tmp
Present !! : C:\WINDOWS\Temp\scs2.tmp
Present !! : C:\WINDOWS\Temp\scs3.tmp
Present !! : C:\WINDOWS\Temp\scs4.tmp
Present !! : C:\WINDOWS\Temp\scs5.tmp
Present !! : C:\WINDOWS\Temp\scs7.tmp
Present !! : C:\WINDOWS\Temp\SEP6.tmp
Present !! : C:\WINDOWS\Temp\SEPC.tmp
Present !! : C:\WINDOWS\Temp\SEPE3.tmp
Present !! : C:\WINDOWS\TEMP\scs1.tmp
Present !! : C:\WINDOWS\TEMP\scs2.tmp
Present !! : C:\WINDOWS\TEMP\scs3.tmp
Present !! : C:\WINDOWS\TEMP\scs4.tmp
Present !! : C:\WINDOWS\TEMP\scs5.tmp
Present !! : C:\WINDOWS\TEMP\scs7.tmp
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\GDIPFONTCACHEV1.DAT
Present !! : C:\Documents and Settings\Audette Maheux\Application Data\wklnhst.dat
Present !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\dw.log
Present !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\d_4.png
Present !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\VP6.reg
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRun.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\converter.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD4.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD5.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD6.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD7.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD8.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD9.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EADA.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\eauninstall.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\First15.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FirstUse.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzmsi01.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzscr01.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Install_WLMessenger.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\jre-6u3-windows-i586-p-iftw_2cd32978.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\MsgPlusUninstall.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\QlIU.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\stopinv.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\The Sims 2_uninst.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\uBGG.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6Install.exe
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AVRES_OPTRF_LiveUpdate.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hposcr04.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpqscr01.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\isconfig.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\symcprop.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\SymSCLiveUpdate.dat
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\aswV5Hlp.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRunGUI.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-awt-win32-3346.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-win32-3346.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\UninstallEADM.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6VFW.dll
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSShoppingMall_01.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSStreet8.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSWay8_complete.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_Melanie.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Schnuddl_Beard_Rap.rar
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp151.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp16F.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A3.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A4.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A5.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A6.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E1.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E2.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp20E.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp459.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp4E.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpC2.tmp
Present !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpCE.tmp
¤¤¤¤¤¤¤¤¤¤ Keys :
Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Present !! : HKCU\SOFTWARE\avsoft
Present !! : HKCU\Software\avsuite
Present !! : HKLM\SOFTWARE\avsoft
Present !! : HKLM\SOFTWARE\avsuite
============
catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-02 22:23:49
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 0 (0x0)
FirewallOverride REG_DWORD 0 (0x0)
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
End of scan : 22:23:50,89
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Utilisateur anonyme
3 mai 2010 à 12:34
3 mai 2010 à 12:34
bonjour :
▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :
▶ choisis l'Option Clean
ton PC va redemarrer,
laisse travailler l'outil.
en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,
▶ colle le contenu dans ta reponse
▶ Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :
▶ choisis l'Option Clean
ton PC va redemarrer,
laisse travailler l'outil.
en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,
▶ colle le contenu dans ta reponse
Kill'em by g3n-h@ckm@n 1.7.2.6
User : Audette Maheux (Administrateurs)
Update on 02/05/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 07:40:18 | 2010-05-03
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]
C:\ -> Disque fixe local | 182,49 Go (130,2 Go free) | NTFS
D:\ -> Disque fixe local | 3,82 Go (1,05 Go free) [RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxserv.exe
C:\WINDOWS\system32\lxdxcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Quarantined & Deleted !! : C:\sqmdata13.sqm
Quarantined & Deleted !! : C:\sqmdata14.sqm
Quarantined & Deleted !! : C:\sqmdata15.sqm
Quarantined & Deleted !! : C:\sqmdata16.sqm
Quarantined & Deleted !! : C:\sqmdata17.sqm
Quarantined & Deleted !! : C:\sqmdata18.sqm
Quarantined & Deleted !! : C:\sqmdata19.sqm
Quarantined & Deleted !! : C:\sqmnoopt13.sqm
Quarantined & Deleted !! : C:\sqmnoopt14.sqm
Quarantined & Deleted !! : C:\sqmnoopt15.sqm
Quarantined & Deleted !! : C:\sqmnoopt16.sqm
Quarantined & Deleted !! : C:\sqmnoopt17.sqm
Quarantined & Deleted !! : C:\sqmnoopt18.sqm
Quarantined & Deleted !! : C:\sqmnoopt19.sqm
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\SET83.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET85.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET89.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET91.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs1.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs2.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs3.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs4.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs5.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs7.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEP6.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEPC.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEPE3.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Application Data\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\d_4.png
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\VP6.reg
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRun.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\converter.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD4.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD5.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD6.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD7.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD8.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD9.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EADA.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\eauninstall.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\First15.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FirstUse.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzmsi01.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzscr01.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Install_WLMessenger.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\jre-6u3-windows-i586-p-iftw_2cd32978.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\MsgPlusUninstall.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\QlIU.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\stopinv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\The Sims 2_uninst.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\uBGG.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6Install.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AVRES_OPTRF_LiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hposcr04.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpqscr01.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\isconfig.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\symcprop.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\SymSCLiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\aswV5Hlp.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRunGUI.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-awt-win32-3346.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-win32-3346.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\UninstallEADM.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6VFW.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSShoppingMall_01.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSStreet8.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSWay8_complete.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_Melanie.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Schnuddl_Beard_Rap.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp151.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp16F.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A3.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A4.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A5.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A6.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E1.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E2.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp20E.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp459.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp4E.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpC2.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpCE.tmp
=======
Hosts :
=======
127.0.0.1 localhost
========
Registry
========
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCU\SOFTWARE\avsoft
Deleted : HKCU\Software\avsuite
Deleted : HKLM\SOFTWARE\avsoft
Deleted : HKLM\SOFTWARE\avsuite
=================
Internet Explorer
=================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
===============
Security Center
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
========
Services
=========
Ndisuio : Start = 3
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
User : Audette Maheux (Administrateurs)
Update on 02/05/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 07:40:18 | 2010-05-03
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]
C:\ -> Disque fixe local | 182,49 Go (130,2 Go free) | NTFS
D:\ -> Disque fixe local | 3,82 Go (1,05 Go free) [RECOVERY] | FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxserv.exe
C:\WINDOWS\system32\lxdxcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Fichiers communs\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe
¤¤¤¤¤¤¤¤¤¤ Files/folders :
Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
Quarantined & Deleted !! : C:\sqmdata13.sqm
Quarantined & Deleted !! : C:\sqmdata14.sqm
Quarantined & Deleted !! : C:\sqmdata15.sqm
Quarantined & Deleted !! : C:\sqmdata16.sqm
Quarantined & Deleted !! : C:\sqmdata17.sqm
Quarantined & Deleted !! : C:\sqmdata18.sqm
Quarantined & Deleted !! : C:\sqmdata19.sqm
Quarantined & Deleted !! : C:\sqmnoopt13.sqm
Quarantined & Deleted !! : C:\sqmnoopt14.sqm
Quarantined & Deleted !! : C:\sqmnoopt15.sqm
Quarantined & Deleted !! : C:\sqmnoopt16.sqm
Quarantined & Deleted !! : C:\sqmnoopt17.sqm
Quarantined & Deleted !! : C:\sqmnoopt18.sqm
Quarantined & Deleted !! : C:\sqmnoopt19.sqm
Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
Quarantined & Deleted !! : C:\WINDOWS\System32\SET83.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET85.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET89.tmp
Quarantined & Deleted !! : C:\WINDOWS\System32\SET91.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs1.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs2.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs3.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs4.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs5.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\scs7.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEP6.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEPC.tmp
Quarantined & Deleted !! : C:\WINDOWS\Temp\SEPE3.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Application Data\GDIPFONTCACHEV1.DAT
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Application Data\wklnhst.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\dw.log
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\d_4.png
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\Local Settings\Temp\VP6.reg
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRun.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\converter.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD4.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD5.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD6.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD7.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD8.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EAD9.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\EADA.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\eauninstall.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\First15.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FirstUse.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\FP_PL_MSI_INSTALLER.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzmsi01.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpzscr01.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Install_WLMessenger.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\jre-6u3-windows-i586-p-iftw_2cd32978.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\MsgPlusUninstall.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\QlIU.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\stopinv.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\The Sims 2_uninst.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\uBGG.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6Install.exe
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AVRES_OPTRF_LiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hposcr04.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\hpqscr01.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\isconfig.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\symcprop.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\SymSCLiveUpdate.dat
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\aswV5Hlp.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\AutoRunGUI.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-awt-win32-3346.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\swt-win32-3346.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\UninstallEADM.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\VP6VFW.dll
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSShoppingMall_01.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSStreet8.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_PmSWay8_complete.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\funny_Melanie.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\Schnuddl_Beard_Rap.rar
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp151.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp16F.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A3.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A4.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A5.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1A6.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E1.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp1E2.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp20E.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp459.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmp4E.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpC2.tmp
Quarantined & Deleted !! : C:\Documents and Settings\Audette Maheux\LOCAL Settings\Temp\tmpCE.tmp
=======
Hosts :
=======
127.0.0.1 localhost
========
Registry
========
Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCU\SOFTWARE\avsoft
Deleted : HKCU\Software\avsuite
Deleted : HKLM\SOFTWARE\avsoft
Deleted : HKLM\SOFTWARE\avsuite
=================
Internet Explorer
=================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
===============
Security Center
===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
FirewallDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)
========
Services
=========
Ndisuio : Start = 3
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2
============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Utilisateur anonyme
3 mai 2010 à 14:41
3 mai 2010 à 14:41
Télécharge OTL de OLDTimer
▶ enregistre le sur ton Bureau.
▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.
▶ Coche les 2 cases Lop et Purity
▶ Coche la case devant tous les utilisateurs
▶ règle age du fichier sur "60 jours"
▶ dans la moitié gauche , mets tout sur "tous"
ne modifie pas ceci :
"fichiers créés" et "fichiers Modifiés"
▶Clic sur Analyse.
A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).
Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)
▶▶▶ NE LE POSTE PAS SUR LE FORUM
Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/
▶ Clique sur Parcourir et cherche le fichier ci-dessus.
▶ Clique sur Ouvrir.
▶ Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt
est ajouté dans la page.
▶ Copie ce lien dans ta réponse.
▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.
▶ enregistre le sur ton Bureau.
▶ Double clic ( pour vista / 7 => clic droit "executer en tant qu'administrateur") sur OTL.exe pour le lancer.
▶ Coche les 2 cases Lop et Purity
▶ Coche la case devant tous les utilisateurs
▶ règle age du fichier sur "60 jours"
▶ dans la moitié gauche , mets tout sur "tous"
ne modifie pas ceci :
"fichiers créés" et "fichiers Modifiés"
▶Clic sur Analyse.
A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).
Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)
▶▶▶ NE LE POSTE PAS SUR LE FORUM
Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/
▶ Clique sur Parcourir et cherche le fichier ci-dessus.
▶ Clique sur Ouvrir.
▶ Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt
est ajouté dans la page.
▶ Copie ce lien dans ta réponse.
▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.
Utilisateur anonyme
3 mai 2010 à 23:07
3 mai 2010 à 23:07
Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
▶ Télécharge :
Malwarebytes
ou :
Malwarebytes
▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX
▶ Potasses le Tuto pour te familiariser avec le prg :
( cela dit, il est très simple d'utilisation ).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
▶ Lance Malwarebyte's .
Fais un examen dit "Complet" .
▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
▶ Télécharge :
Malwarebytes
ou :
Malwarebytes
▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX
▶ Potasses le Tuto pour te familiariser avec le prg :
( cela dit, il est très simple d'utilisation ).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
▶ Lance Malwarebyte's .
Fais un examen dit "Complet" .
▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4063
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.13
2010-05-03 18:01:05
mbam-log-2010-05-03 (18-01-05).txt
Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 237487
Temps écoulé: 43 minute(s), 2 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iukjpgrk (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iukjpgrk (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf\jevrynktssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
www.malwarebytes.org
Version de la base de données: 4063
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.13
2010-05-03 18:01:05
mbam-log-2010-05-03 (18-01-05).txt
Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 237487
Temps écoulé: 43 minute(s), 2 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iukjpgrk (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iukjpgrk (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf\jevrynktssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.
Utilisateur anonyme
4 mai 2010 à 00:14
4 mai 2010 à 00:14
ah on dirait que ca se relance apres la suppression...
tu me refais OTL stp
tu me refais OTL stp
Utilisateur anonyme
4 mai 2010 à 00:25
4 mai 2010 à 00:25
c'est les rapports de 18.00 ^^
Utilisateur anonyme
4 mai 2010 à 00:32
4 mai 2010 à 00:32
heu....tu es au canada ?
Utilisateur anonyme
4 mai 2010 à 01:14
4 mai 2010 à 01:14
▶ Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau.
mais cette fois-ci :
▶ choisis l'option Manual delete
un document texte va s'ouvrir à l'apparition de : Text Please
▶copie/colle le texte en gras ci-dessous :
C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf
ensuite onglet "Fichier" clic sur enregistrer , puis ferme ce bloc notes
Laisse travailler l'outil
à la fin un rapport s'ouvre ,
▶ poste le resultat
mais cette fois-ci :
▶ choisis l'option Manual delete
un document texte va s'ouvrir à l'apparition de : Text Please
▶copie/colle le texte en gras ci-dessous :
C:\Documents and Settings\Audette Maheux\Local Settings\Application Data\tglmvhyuf
ensuite onglet "Fichier" clic sur enregistrer , puis ferme ce bloc notes
Laisse travailler l'outil
à la fin un rapport s'ouvre ,
▶ poste le resultat
Utilisateur anonyme
4 mai 2010 à 01:27
4 mai 2010 à 01:27
-> ▶ Scan BitDefender
▶ Fais une analyse antivirus en ligne sur BitDefender on line avec Internet Explorer
▶ Clique en bas à gauche sur Scan on line.
▶ Accepte la licence et laisse-le installer l'Active x..
▶ Laisse-toi guider. Colle son rapport ici.
Aide
▶ Fais une analyse antivirus en ligne sur BitDefender on line avec Internet Explorer
▶ Clique en bas à gauche sur Scan on line.
▶ Accepte la licence et laisse-le installer l'Active x..
▶ Laisse-toi guider. Colle son rapport ici.
Aide
Je ne peux pas ouvrir le lien avec Explorer, seulement avec Firefox, IE me dit :
Internet Explorer ne peut pas afficher cette page Web
Causes les plus probables :
Vous n'êtes pas connecté à Internet.
Le site Web rencontre des problèmes.
Il se peut que l'adresse contienne une erreur de frappe.
Et ce, pour n'importe quel site. Est-ce que je le fais avec Firefox ?
Internet Explorer ne peut pas afficher cette page Web
Causes les plus probables :
Vous n'êtes pas connecté à Internet.
Le site Web rencontre des problèmes.
Il se peut que l'adresse contienne une erreur de frappe.
Et ce, pour n'importe quel site. Est-ce que je le fais avec Firefox ?
Utilisateur anonyme
4 mai 2010 à 01:34
4 mai 2010 à 01:34
▶ Télécharge Zeb-Restoreet enregistre ce fichier sur le bureau.
▶-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
▶-Ouvre le dossier ZR_1.0.0.37 ==> double clic (pour vista / 7 = clic droit "executer en tant qu'.........") sur Zeb-Restore.exe
▶- Coche la case devant : Internet Explorer
▶- Ne coche aucune autre case
▶-Clique sur Restaurer
▶-Redémarre ton PC pour la prise en compte de cette action
▶-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
▶-Ouvre le dossier ZR_1.0.0.37 ==> double clic (pour vista / 7 = clic droit "executer en tant qu'.........") sur Zeb-Restore.exe
▶- Coche la case devant : Internet Explorer
▶- Ne coche aucune autre case
▶-Clique sur Restaurer
▶-Redémarre ton PC pour la prise en compte de cette action
Utilisateur anonyme
4 mai 2010 à 01:51
4 mai 2010 à 01:51
installe le service pack 3
installe IE8
https://www.clubic.com/telecharger-fiche242026-windows-xp-service-pack-3.html
https://www.clubic.com/telecharger-fiche403570-internet-explorer-8.html
installe IE8
https://www.clubic.com/telecharger-fiche242026-windows-xp-service-pack-3.html
https://www.clubic.com/telecharger-fiche403570-internet-explorer-8.html
Ok, l'installation s'est finalement terminée après 1h30. J'ai aussi installé IE 8, mais ça ne fonctionne toujours pas, je n'arrive pas à me connecter à internet avec Explorer ... :s
Utilisateur anonyme
4 mai 2010 à 05:02
4 mai 2010 à 05:02
et ce depuis le debut ?
Utilisateur anonyme
Modifié par gen-hackman le 4/05/2010 à 13:32
Modifié par gen-hackman le 4/05/2010 à 13:32
desinstalle List_kill'em , retelecharge-le , reinstalle-le en laissant tout coché et fais l'option Test IE
une fenetre va s'ouvrir , un test de connection va se faire , des infos vont defiler , colle-les ici dans ta reponse une fois le test fini
?G3?-?@¢??@?(TM)©®?
une fenetre va s'ouvrir , un test de connection va se faire , des infos vont defiler , colle-les ici dans ta reponse une fois le test fini
?G3?-?@¢??@?(TM)©®?
IE Changed the value of the property: {265b75c1-4158-11d0-90f6-00c04fd497ea}
IE has started a navigation operation
IE Changed the value of the property: {D0FCA420-D3F5-11CF-B211-00AA004AE837}
IE Status text changed to: Recherche de 127.0.0.1
IE Status text changed to: Connexion au site 127.0.0.1
IE has finished a navigation operation
IE Status text changed to:
IE Changed the value of the property: {265b75c0-4158-11d0-90f6-00c04fd497ea}
IE Changed the value of the property: {265b75c1-4158-11d0-90f6-00c04fd497ea}
IE Changed the value of the property: {265b75c1-4158-11d0-90f6-00c04fd497ea}
IE has started a navigation operation
IE Status text changed to: Début du téléchargement à partir de : res://ieframe.dll/dnserror.htm
IE Status text changed to: Téléchargement à partir de : res://ieframe.dll/dnserror.htm
IE has finished a navigation operation
IE Status text changed to:
IE Status text changed to:
IE has started a navigation operation
IE Status text changed to:
IE Status text changed to: Attente de res://ieframe.dll/dnserror.htm...
IE Status text changed to: Terminé
IE has finished a navigation operation
End of Internet Explorer Events test.
You may close this window now !
IE has started a navigation operation
IE Changed the value of the property: {D0FCA420-D3F5-11CF-B211-00AA004AE837}
IE Status text changed to: Recherche de 127.0.0.1
IE Status text changed to: Connexion au site 127.0.0.1
IE has finished a navigation operation
IE Status text changed to:
IE Changed the value of the property: {265b75c0-4158-11d0-90f6-00c04fd497ea}
IE Changed the value of the property: {265b75c1-4158-11d0-90f6-00c04fd497ea}
IE Changed the value of the property: {265b75c1-4158-11d0-90f6-00c04fd497ea}
IE has started a navigation operation
IE Status text changed to: Début du téléchargement à partir de : res://ieframe.dll/dnserror.htm
IE Status text changed to: Téléchargement à partir de : res://ieframe.dll/dnserror.htm
IE has finished a navigation operation
IE Status text changed to:
IE Status text changed to:
IE has started a navigation operation
IE Status text changed to:
IE Status text changed to: Attente de res://ieframe.dll/dnserror.htm...
IE Status text changed to: Terminé
IE has finished a navigation operation
End of Internet Explorer Events test.
You may close this window now !
mottiera
Messages postés
232
Date d'inscription
dimanche 16 novembre 2008
Statut
Membre
Dernière intervention
11 janvier 2018
87
4 mai 2010 à 13:39
4 mai 2010 à 13:39
As-tu essayée d'aller dans "Panneau de Configuration" => "Désinstaller Programme" ?
J'espère seulement que tu sais à peu près depuis combien de temps tu l'as car ça pourrait être pratique pour trier les logiciels ;)
J'espère seulement que tu sais à peu près depuis combien de temps tu l'as car ça pourrait être pratique pour trier les logiciels ;)
mottiera
Messages postés
232
Date d'inscription
dimanche 16 novembre 2008
Statut
Membre
Dernière intervention
11 janvier 2018
87
4 mai 2010 à 13:44
4 mai 2010 à 13:44
Le faux antivirus
Utilisateur anonyme
4 mai 2010 à 13:55
4 mai 2010 à 13:55
oui apparement IE est redirigé dans le bouclage host.....
essayons comme ceci :
demarrer/panneau de configuration/option internet
onglet avancé et "reinitialiser..."
essayons comme ceci :
demarrer/panneau de configuration/option internet
onglet avancé et "reinitialiser..."
3 mai 2010 à 03:46
3 mai 2010 à 03:51
merci beaucoup