FindyKill Report

Bonjour, voilà le rapport de FindyKill


############################## | FindyKill V5.045 |

# User : Tarek abd Al-Karim (Administrateurs) # DYMESTAS
# Update on 23/06/2010 by El Desaparecido
# Start at: 11:14:09 | 19/08/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# AMD Sempron(tm) Processor 3200+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# FW : COMODO Firewall Pro[ Enabled ]3.0

# C:\ # Disque fixe local # 48,83 Go (4,82 Go free) # NTFS
# D:\ # Disque fixe local # 48,83 Go (47,96 Go free) # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque CD-ROM
# J:\ # Disque fixe local # 26,44 Go (16,5 Go free) [eMule local disc] # NTFS
# K:\ # Disque CD-ROM
# L:\ # Disque amovible

############################## | Processus infectieux stoppés |

"C:\Documents and Settings\Tarek abd Al-Karim\Application Data\drivers\winupgro.exe" (1148)
"C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m\flec006.exe" (3356)
"C:\WINDOWS\wintems.exe" (3876)

################## | Eléments infectieux |

C:\WINDOWS\ban_list.txt
C:\WINDOWS\mdelk.exe
C:\WINDOWS\wintems.exe
C:\WINDOWS\system32\srosa2.sys
C:\WINDOWS\system32\wfsintwq.sys
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\drivers
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\drivers\downld
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\drivers\winupgro.exe
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m\data.oct
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m\flec006.exe
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m\list.oct
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m\srvlist.oct
C:\Documents and Settings\Tarek abd Al-Karim\Application Data\m\shared

################## | Registre |

[HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet004\Services\sK9Ou0s]
[HKLM\SYSTEM\CurrentControlSet\Services\srosa]
[HKLM\SYSTEM\ControlSet001\Services\srosa]
[HKLM\SYSTEM\ControlSet004\Services\srosa]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet004\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
[HKCU\Software\bisoft]
[HKCU\Software\DateTime4]
[HKCU\Software\MuleAppData]
[HKCU\Software\WS4001]
[HKCR\ed2k]
[HKCU\Software\Classes\ed2k]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\bisoft]
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\DateTime4]
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\MuleAppData]
[HKCU\Software\Local AppWizard-Generated Applications\winupgro]
[HKU\S-1-5-21-1957994488-764733703-839522115-1005\Software\Local AppWizard-Generated Applications\winupgro]

################## | Etat |

# Affichage des fichiers cachés : OK

Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) Ip6Fw -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.045 ! |