Précédent
- 1
- 2
- 3
Suivant
Fais analyser le(s) fichier(s) suivants sur Virustotal :
Virus Total
* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :
c:\windows\system32\drivers\m5287.sys
* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse.
Virus Total
* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :
c:\windows\system32\drivers\m5287.sys
* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse.
Je dois coller le chemin que tu me donnes dans la barre virustotal c'est bien ça ? (le copier/coller ne marche pas)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Je te passe le lien vers le bilan de l'analyse:
http://www.virustotal.com/file-scan/report.html?id=b90cea62a21e4cda416b56ca5a6a29cbd13cfb4e49629b3cd02b735ed304e40a-1296568021
http://www.virustotal.com/file-scan/report.html?id=b90cea62a21e4cda416b56ca5a6a29cbd13cfb4e49629b3cd02b735ed304e40a-1296568021
fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
▶ Télécharge ici :
Malwarebytes
▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX
▶ Potasses le Tuto pour te familiariser avec le prg :
( cela dit, il est très simple d'utilisation ).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
▶ Lance Malwarebyte's .
Fais un examen dit "Complet" .
▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
▶ Télécharge ici :
Malwarebytes
▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .
(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX
▶ Potasses le Tuto pour te familiariser avec le prg :
( cela dit, il est très simple d'utilisation ).
relance malwarebytes en suivant scrupuleusement ces consignes :
! Déconnecte toi et ferme toutes applications en cours !
▶ Lance Malwarebyte's .
Fais un examen dit "Complet" .
▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .
▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !
▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)
C'est bon, l'analyse est terminée et voici le rapport:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Version de la base de données: 5363
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
01/02/2011 16:18:15
mbam-log-2011-02-01 (16-18-15).txt
Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 312073
Temps écoulé: 1 heure(s), 1 minute(s), 48 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 25
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PPDRV (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PPDrv (Worm.KoobFace) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\documents and settings\Valentin\application data\EoRezo\softwareupdate\softwareupdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\documents and settings\Valentin\application data\EoRezo\softwareupdate\softwareupdatehp.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\EoRezo\eoengine.exe.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\EoRezo\EoAdv\eoadv.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\EoRezo\EoAdv\eorezobho.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlls.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlls.dl_.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlls64.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlph.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlservice.exe.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlvknlg.exe.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlvknlg64.exe.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlxf.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\components\rlxg.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143061.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142996.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142997.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142998.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142999.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143000.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143055.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143056.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143057.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143062.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143068.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Version de la base de données: 5363
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
01/02/2011 16:18:15
mbam-log-2011-02-01 (16-18-15).txt
Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 312073
Temps écoulé: 1 heure(s), 1 minute(s), 48 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 25
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PPDRV (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PPDrv (Worm.KoobFace) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
c:\documents and settings\Valentin\application data\EoRezo\softwareupdate\softwareupdate.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\documents and settings\Valentin\application data\EoRezo\softwareupdate\softwareupdatehp.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\EoRezo\eoengine.exe.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\EoRezo\EoAdv\eoadv.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\EoRezo\EoAdv\eorezobho.dll.vir (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlls.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlls.dl_.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlls64.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlph.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlservice.exe.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlvknlg.exe.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlvknlg64.exe.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\rlxf.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\program files\ad-remover\quarantine\C\program files\relevantknowledge\components\rlxg.dll.vir (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143061.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142996.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142997.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142998.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0142999.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143000.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143055.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143056.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143057.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143062.dll (Rogue.Eorezo) -> Quarantined and deleted successfully.
c:\system volume information\_restore{787dc6c3-51b9-452c-97e3-a31d31627396}\RP1214\A0143068.exe (Rogue.Eorezo) -> Quarantined and deleted successfully.
Bonjour, le rapport OTL est là:
http://www.cijoint.fr/cjlink.php?file=cj201102/cijpGAqj5I.txt
Et le rapport Extras ne veut pas se deposer sur le site...
http://www.cijoint.fr/cjlink.php?file=cj201102/cijpGAqj5I.txt
Et le rapport Extras ne veut pas se deposer sur le site...
ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous "Personnalisation" :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:Services
Bonjour Service
:OTL
FF - prefs.js..browser.startup.homepage: "http://lo.st"
O4 - HKLM\..\Run: [WOOTASKBARICON] File not found
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) => Adobe®Acrobat Reader
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra Button: Crawler Screensaver - {CDAFD956-97BE-443D-8EF7-F4F094EB5766} - File not found
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} file://C:\Documents and Settings\Thomas\Local Settings\Application Data\Oberon Media\Oberon Games Host\popcaploader_v6.cab (PopCapLoader Object) => Infection Diverse (PopCapLoader.Adw)
O32 - AutoRun File - [2007/03/28 16:36:30 | 000,000,155 | ---- | M] () - C:\autoexec.plu -- [ NTFS ]
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"=-
"NeroFilterCheck"=-
"QuickTime Task"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"=-
"swg"=-
:Files
C:\Documents and Settings\Thomas\Bureau\comctl32.ocx
C:\Documents and Settings\Thomas\Bureau\mbam-setup-1.50.1.1100.exe
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\PopCap
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:81405BF2
:commands
[emptytemp]
[start explorer]
[reboot]
▶ Clique sur "Correction" pour lancer la suppression.
▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.
==========================
demarrer/executer puis tape :
CHKDSK C: /F /R
puis entrée et redemarre
si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."
sur OTL.exe pour le lancer.
▶Copie la liste qui se trouve en gras ci-dessous,
▶ colle-la dans la zone sous "Personnalisation" :
:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
:Services
Bonjour Service
:OTL
FF - prefs.js..browser.startup.homepage: "http://lo.st"
O4 - HKLM\..\Run: [WOOTASKBARICON] File not found
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) => Adobe®Acrobat Reader
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra Button: Crawler Screensaver - {CDAFD956-97BE-443D-8EF7-F4F094EB5766} - File not found
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} file://C:\Documents and Settings\Thomas\Local Settings\Application Data\Oberon Media\Oberon Games Host\popcaploader_v6.cab (PopCapLoader Object) => Infection Diverse (PopCapLoader.Adw)
O32 - AutoRun File - [2007/03/28 16:36:30 | 000,000,155 | ---- | M] () - C:\autoexec.plu -- [ NTFS ]
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"=-
"NeroFilterCheck"=-
"QuickTime Task"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"=-
"swg"=-
:Files
C:\Documents and Settings\Thomas\Bureau\comctl32.ocx
C:\Documents and Settings\Thomas\Bureau\mbam-setup-1.50.1.1100.exe
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\PopCap
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:81405BF2
:commands
[emptytemp]
[start explorer]
[reboot]
▶ Clique sur "Correction" pour lancer la suppression.
▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.
==========================
demarrer/executer puis tape :
CHKDSK C: /F /R
puis entrée et redemarre
Voici le rapport apres redemarrage:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
Process msnmsgr.exe killed successfully!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========
Service Bonjour Service stopped successfully!
Service Bonjour Service deleted successfully!
========== OTL ==========
Prefs.js: "http://lo.st" removed from browser.startup.homepage
Registry key HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run not found.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk moved successfully.
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CDAFD956-97BE-443D-8EF7-F4F094EB5766}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDAFD956-97BE-443D-8EF7-F4F094EB5766}\ not found.
File F87-FF2B-4DF8-92D0-73DB16A1543A} file://C:\Documents and Settings\Thomas\Local Settings\Application Data\Oberon Media\Oberon Games Host\popcaploader_v6.cab not found.
Starting removal of ActiveX control {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
C:\WINDOWS\Downloaded Program Files\popcaploader.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ not found.
C:\autoexec.plu moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\LDM deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
========== FILES ==========
C:\Documents and Settings\Thomas\Bureau\comctl32.ocx moved successfully.
C:\Documents and Settings\Thomas\Bureau\mbam-setup-1.50.1.1100.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\sounds folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\spiral2 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\overlap folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\dynomite folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\doubledip folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\images folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\fonts folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\savedgames\insaniquarium folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\savedgames folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium\sounds folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium\images\upsell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium\images folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:81405BF2 deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: HelpAssistant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 16786 bytes
User: MASTER
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes
User: Patricia
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Thomas
->Temp folder emptied: 72045 bytes
->Temporary Internet Files folder emptied: 5439066 bytes
->Java cache emptied: 268893 bytes
->FireFox cache emptied: 14743476 bytes
->Apple Safari cache emptied: 1983488 bytes
->Flash cache emptied: 2193010 bytes
User: Valentin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2676224 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1659040 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 13718272 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 41,00 mb
OTL by OldTimer - Version 3.2.20.6 log created on 02022011_180720
Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_224.dat not found!
Registry entries deleted on Reboot...
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
Process msnmsgr.exe killed successfully!
No active process named Teatimer.exe was found!
========== SERVICES/DRIVERS ==========
Service Bonjour Service stopped successfully!
Service Bonjour Service deleted successfully!
========== OTL ==========
Prefs.js: "http://lo.st" removed from browser.startup.homepage
Registry key HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows\CurrentVersion\Run not found.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Speed Launch.lnk moved successfully.
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CDAFD956-97BE-443D-8EF7-F4F094EB5766}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CDAFD956-97BE-443D-8EF7-F4F094EB5766}\ not found.
File F87-FF2B-4DF8-92D0-73DB16A1543A} file://C:\Documents and Settings\Thomas\Local Settings\Application Data\Oberon Media\Oberon Games Host\popcaploader_v6.cab not found.
Starting removal of ActiveX control {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
C:\WINDOWS\Downloaded Program Files\popcaploader.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}\ not found.
C:\autoexec.plu moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\LDM deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
========== FILES ==========
C:\Documents and Settings\Thomas\Bureau\comctl32.ocx moved successfully.
C:\Documents and Settings\Thomas\Bureau\mbam-setup-1.50.1.1100.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses folder moved successfully.
C:\Documents and Settings\All Users\Application Data\BOONTY folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\sounds folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\spiral2 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\overlap folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\dynomite folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels\doubledip folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\levels folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\images folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma\fonts folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone\zuma folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\zone folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\savedgames\insaniquarium folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\savedgames folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium\sounds folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium\images\upsell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium\images folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon\insaniquarium folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader\oberon folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap\PopCapLoader folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:81405BF2 deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: HelpAssistant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 16786 bytes
User: MASTER
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes
User: Patricia
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Thomas
->Temp folder emptied: 72045 bytes
->Temporary Internet Files folder emptied: 5439066 bytes
->Java cache emptied: 268893 bytes
->FireFox cache emptied: 14743476 bytes
->Apple Safari cache emptied: 1983488 bytes
->Flash cache emptied: 2193010 bytes
User: Valentin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2676224 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1659040 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 13718272 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 41,00 mb
OTL by OldTimer - Version 3.2.20.6 log created on 02022011_180720
Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_224.dat not found!
Registry entries deleted on Reboot...
__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------
Toujours avec toutes les protections désactivées, fais ceci :
▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :
----------------------------------------------------------
KillAll::
Snapshot::
MBR::
------------------------------------------------------------------
▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes
▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix
▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
L'analyse est faite, je te passe le rapport:
ComboFix 11-01-31.02 - Thomas 02/02/2011 20:21:58.2.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.767.375 [GMT 1:00]
Lancé depuis: c:\documents and settings\Thomas\Bureau\thomas.exe
Commutateurs utilisés :: c:\documents and settings\Thomas\Bureau\CFScript.txt
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-01-02 au 2011-02-02 ))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:07 . 2011-02-02 17:07 -------- d-----w- C:\_OTL
2011-02-01 14:09 . 2011-02-01 14:09 -------- d-----w- c:\documents and settings\Thomas\Application Data\Malwarebytes
2011-02-01 14:09 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-01 14:09 . 2011-02-01 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-02-01 14:09 . 2011-02-01 14:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-01 14:09 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-01 10:34 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2011-02-01 10:34 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2011-02-01 10:34 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2011-02-01 10:33 . 2010-11-02 15:17 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2011-02-01 10:31 . 2010-10-11 14:59 45568 ------w- c:\windows\system32\dllcache\wab.exe
2011-01-31 16:09 . 2011-01-31 17:36 -------- d-----w- C:\Kill'em
2011-01-31 16:09 . 2011-01-31 17:44 -------- d-----w- c:\program files\List_Kill'em
2011-01-31 15:58 . 2011-01-31 16:03 -------- d-----w- C:\UsbFix
2011-01-31 15:40 . 2011-01-31 15:40 -------- d-----w- c:\program files\Ad-Remover
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-31 16:03 . 2011-01-31 16:03 6749 ----a-w- C:\UsbFix_Upload_Me_ACER-755E621E64.zip
2010-11-18 18:12 . 2004-08-05 05:00 86016 ----a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-05 05:00 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:21 . 2005-07-03 02:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:21 . 2004-08-05 05:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:21 . 2004-08-05 05:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
.
------- Sigcheck -------
[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-05 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]
2009-03-04 07:43 311808 ----a-w- c:\progra~1\SITERA~1\SiteRank.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880]
"Shareaza"="c:\program files\Shareaza\Shareaza.exe" [2007-12-02 4677632]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-13 319280]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"atwtusb"="atwtusb.exe beta" [X]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-24 81920]
"SiteRanker"="c:\program files\SiteRanker\SiteRankTray.exe" [2009-03-04 273920]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 497200]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 614960]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2010-02-17 177472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Valentin\Menu D'marrer\Programmes\D'marrage\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
c:\documents and settings\Thomas\Menu D'marrer\Programmes\D'marrage\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-6-4 962661]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-2-27 67128]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Metin2_France\\metin2.bin"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Shareaza Applications\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\EA Games\\Command and Conquer Generals\\game.dat"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Metin2_France\\metin2client.bin"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\EA Games\\Command & Conquer Generals - Heure H\\game.dat"=
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 08:00 85888]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [05/08/2004 06:00 14336]
S1 aiptektp;HyperPen;c:\windows\system32\drivers\aiptektp.sys [25/12/2006 10:28 22272]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/02/2010 17:08 135664]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [26/06/2008 08:13 576680]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PPEMSCAN;Protector Plus Email Scan Driver;\??\c:\protector plus\PPEMSCAN.sys --> c:\protector plus\PPEMSCAN.sys [?]
S3 UsbSagCom;Mobile Device Full USB Driver;c:\windows\system32\drivers\UsbSagCom.sys [29/06/2007 14:20 51712]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29/01/2008 14:40 715248]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contenu du dossier 'Tâches planifiées'
2010-09-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2011-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 16:08]
2011-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 16:08]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.70\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.70\MediaManager\grab.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-02 20:29
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(7352)
c:\windows\system32\SHDOCVW.dll
c:\program files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Acer\Acer eConsole\MediaServerService.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\System32\FTRTSVC.exe
c:\progra~1\Wanadoo\TaskBarIcon.exe
c:\program files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Wanadoo\Toaster.exe
c:\progra~1\Wanadoo\Inactivity.exe
c:\progra~1\Wanadoo\PollingModule.exe
c:\program files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
c:\program files\Logitech\QuickCam10\COCIManager.exe
.
**************************************************************************
.
Heure de fin: 2011-02-02 20:36:40 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-02-02 19:36
ComboFix2.txt 2011-02-01 11:30
Avant-CF: 53 584 703 488 octets libres
Après-CF: 53 559 185 408 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
- - End Of File - - 3B6BA6DC1606868CDAEF29DF99296B43
ComboFix 11-01-31.02 - Thomas 02/02/2011 20:21:58.2.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.767.375 [GMT 1:00]
Lancé depuis: c:\documents and settings\Thomas\Bureau\thomas.exe
Commutateurs utilisés :: c:\documents and settings\Thomas\Bureau\CFScript.txt
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-01-02 au 2011-02-02 ))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:07 . 2011-02-02 17:07 -------- d-----w- C:\_OTL
2011-02-01 14:09 . 2011-02-01 14:09 -------- d-----w- c:\documents and settings\Thomas\Application Data\Malwarebytes
2011-02-01 14:09 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-01 14:09 . 2011-02-01 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-02-01 14:09 . 2011-02-01 14:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-01 14:09 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-01 10:34 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2011-02-01 10:34 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2011-02-01 10:34 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2011-02-01 10:33 . 2010-11-02 15:17 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
2011-02-01 10:31 . 2010-10-11 14:59 45568 ------w- c:\windows\system32\dllcache\wab.exe
2011-01-31 16:09 . 2011-01-31 17:36 -------- d-----w- C:\Kill'em
2011-01-31 16:09 . 2011-01-31 17:44 -------- d-----w- c:\program files\List_Kill'em
2011-01-31 15:58 . 2011-01-31 16:03 -------- d-----w- C:\UsbFix
2011-01-31 15:40 . 2011-01-31 15:40 -------- d-----w- c:\program files\Ad-Remover
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-31 16:03 . 2011-01-31 16:03 6749 ----a-w- C:\UsbFix_Upload_Me_ACER-755E621E64.zip
2010-11-18 18:12 . 2004-08-05 05:00 86016 ----a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2004-08-05 05:00 249856 ----a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:21 . 2005-07-03 02:16 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:21 . 2004-08-05 05:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:21 . 2004-08-05 05:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
.
------- Sigcheck -------
[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-14 . 3EFE912DD25D2586E6A0341DB0A66F69 . 979968 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . D0288319660EDCFED07C7E74C4EA38A5 . 1037312 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . B795475444D6D57A572C14B9E1A29839 . 1037312 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-05 . 4C33E5B9A6197B6ED215F6CFBA0A2DAA . 1036288 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]
2009-03-04 07:43 311808 ----a-w- c:\progra~1\SITERA~1\SiteRank.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"WOOKIT"="c:\progra~1\Wanadoo\Shell.exe" [2004-08-23 122880]
"Shareaza"="c:\program files\Shareaza\Shareaza.exe" [2007-12-02 4677632]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-02-13 319280]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"atwtusb"="atwtusb.exe beta" [X]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-24 81920]
"SiteRanker"="c:\program files\SiteRanker\SiteRankTray.exe" [2009-03-04 273920]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"LogitechCommunicationsManager"="c:\program files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe" [2006-06-26 497200]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2006-06-26 614960]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2010-02-17 177472]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Valentin\Menu D'marrer\Programmes\D'marrage\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
c:\documents and settings\Thomas\Menu D'marrer\Programmes\D'marrage\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-6-4 962661]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-2-27 67128]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Metin2_France\\metin2.bin"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Shareaza Applications\\Shareaza\\Shareaza.exe"=
"c:\\Program Files\\EA Games\\Command and Conquer Generals\\game.dat"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Metin2_France\\metin2client.bin"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\EA Games\\Command & Conquer Generals - Heure H\\game.dat"=
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [05/02/2005 08:00 85888]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [05/08/2004 06:00 14336]
S1 aiptektp;HyperPen;c:\windows\system32\drivers\aiptektp.sys [25/12/2006 10:28 22272]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/02/2010 17:08 135664]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [26/06/2008 08:13 576680]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PPEMSCAN;Protector Plus Email Scan Driver;\??\c:\protector plus\PPEMSCAN.sys --> c:\protector plus\PPEMSCAN.sys [?]
S3 UsbSagCom;Mobile Device Full USB Driver;c:\windows\system32\drivers\UsbSagCom.sys [29/06/2007 14:20 51712]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29/01/2008 14:40 715248]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contenu du dossier 'Tâches planifiées'
2010-09-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
2011-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 16:08]
2011-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 16:08]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.70\AMVConverter\grab.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.70\MediaManager\grab.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-02 20:29
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(7352)
c:\windows\system32\SHDOCVW.dll
c:\program files\Fichiers communs\Logitech\LVMVFM\LVPrcInj.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Acer\Acer eConsole\MediaServerService.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\System32\FTRTSVC.exe
c:\progra~1\Wanadoo\TaskBarIcon.exe
c:\program files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Wanadoo\Toaster.exe
c:\progra~1\Wanadoo\Inactivity.exe
c:\progra~1\Wanadoo\PollingModule.exe
c:\program files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
c:\program files\Logitech\QuickCam10\COCIManager.exe
.
**************************************************************************
.
Heure de fin: 2011-02-02 20:36:40 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-02-02 19:36
ComboFix2.txt 2011-02-01 11:30
Avant-CF: 53 584 703 488 octets libres
Après-CF: 53 559 185 408 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
- - End Of File - - 3B6BA6DC1606868CDAEF29DF99296B43
Fais analyser le(s) fichier(s) suivants sur Virustotal :
Virus Total
* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :
c:\windows\explorer.exe
* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse.
Virus Total
* * Colle directement le chemin des fichiers , un par un , dans l'espace "Parcourir" apres chaque analyse :
c:\windows\explorer.exe
* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée colle le lien de(s)( la) page(s) dans ta prochaine réponse.
Précédent
- 1
- 2
- 3
Suivant
