Suspicion d'infection Résolu/Fermé

Question

Bonjour, 

Je suspecte depuis hier une infection de mon pc. J'ai du mal à ouvrir certains fichiers (le curseur ne sélectionne pas le fichier), le menu clic droit ne s'ouvre souvent pas, les pages webs ont du mal à défiler. Or hier j'ai visité un site internet et l'ai partagé avec un pote qui m'a dit que son antivirus l'avait bloqué. J'ai analysé mon pc avec avira et malwarebytes mais ils n'ont rien trouvé. Alors peut-être que c'est juste mon ordi qui vieillie^^ mais dans le doute je sollicite l'aide qui voudra bien.

Merci d'avance.

Poussounou

Configuration: Windows 7 / Firefox 22.0

g3n-h@ckm@n · Answer

salut

 execute ceci directement en suppression

http://www.security-helpzone.com/blog/adwcleaner_supprimer_les_adwares_spywares_toolbars_hijackers-news-13.html

==

execute ceci :

http://security-helpzone.com/gen-hackman/tutos-canneds/junkware-removal-tool/

==

execute ceci :

http://security-helpzone.com/gen-hackman/tutos-canneds/otl-2/

==

si tu lis bien j'attends 4 rapports

Poussounou · Answer

Le rapport Adw Cleaner :

# AdwCleaner v2.306 - Logfile created 08/15/2013 at 01:26:13
# Updated 19/07/2013 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : Dante - DANTE-PC
# Boot Mode : Normal
# Running from : C:\Users\Dante\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Users\Dante\AppData\Local\Conduit
Folder Deleted : C:\Users\Dante\AppData\LocalLow\Conduit

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\elhjaoldnkkbifioodjndkijecdeinld
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

***** [Internet Browsers] *****

-\ Internet Explorer v10.0.9200.16635

[OK] Registry is clean.

-\ Mozilla Firefox v22.0 (fr)

File : C:\Users\Dante\AppData\Roaming\Mozilla\Firefox\Profiles\smmn1644.default\prefs.js

Deleted : user_pref("extensions.greasemonkey.scriptvals.unfriend_finder/Unfriend Finder.524267938_friends", "{[...]

-\ Google Chrome v28.0.1500.95

File : C:\Users\Dante\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [2492 octets] - [15/08/2013 01:26:13]

########## EOF - C:\AdwCleaner[S1].txt - [2552 octets] ##########







Le rapport JRT :


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.5 (08.13.2013:1)
OS: Windows 7 Ultimate x64
Ran by Dante on 15/08/2013 at  1:38:18,10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_pour_ahnenblatt_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_pour_ahnenblatt_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_ahnenblatt_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_ahnenblatt_RASMANCS



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Dante\AppData\Roaming\mozilla\firefox\profiles\smmn1644.default\minidumps [206 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15/08/2013 at  1:50:12,63
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







Les rapports ODT :

http://cjoint.com/?CHpcyWFaX3f

https://www.cjoint.com/c/CHpcBd4nE1c

g3n-h@ckm@n · Answer

ok pour adwcleaner tu l'as vien telechargé de mon lien bleu ?

Poussounou · Answer

Oui

g3n-h@ckm@n · Answer

alors je suis très étonné que tu n'aies pas la bonne version 

prends-le d'ici :

 (lien direct) http://www.bleepingcomputer.com/download/adwcleaner/dl/125/

ne clique pas sur download , attends que la fenetre de confirmation de telechargement arrive
 
puis lance-le et refais une suppression

Poussounou · Answer

Voilà le nouveau rapport :



# AdwCleaner v2.306 - Logfile created 08/15/2013 at 12:23:10
# Updated 19/07/2013 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : Dante - DANTE-PC
# Boot Mode : Normal
# Running from : C:\Users\Dante\Downloads\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Internet Browsers] *****

-\ Internet Explorer v10.0.9200.16660

[OK] Registry is clean.

-\ Mozilla Firefox v22.0 (fr)

File : C:\Users\Dante\AppData\Roaming\Mozilla\Firefox\Profiles\smmn1644.default\prefs.js

[OK] File is clean.

-\ Google Chrome v28.0.1500.95

File : C:\Users\Dante\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [2613 octets] - [15/08/2013 01:26:13]
AdwCleaner[S2].txt - [864 octets] - [15/08/2013 12:23:10]

########## EOF - C:\AdwCleaner[S2].txt - [923 octets] ##########

g3n-h@ckm@n · Answer

desinstalle java 7 update 10

==

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
IE - HKU\S-1-5-21-4224085940-400172237-869465967-1000\..\URLSearchHook: {ef79f67a-6ad7-4715-a0f8-932fca442023} - No CLSID value found
IE - HKU\S-1-5-21-4224085940-400172237-869465967-1000\..\SearchScopes,DefaultScope = 
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
O4 - HKU\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1     
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1     
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.10.2)     
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5B1E8B3A-D922-4F37-8C06-6E6F74F7EA2C}: DhcpNameServer = 10.1.1.243 10.1.1.244 
O33 - MountPoints2\{dda19631-a3d7-11e1-9084-406186a8e4aa}\Shell - "" = AutoRun 
O33 - MountPoints2\{dda19631-a3d7-11e1-9084-406186a8e4aa}\Shell\AutoRun\command - "" = E:\unlock.exe autoplay=true 
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] 

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"=-
"QuickTime Task"=-

:Files
C:\eula.*
C:\install.*
C:\Users\Dante\AppData\Local\eSupport.com     
C:\Windows\Temp\*

:commands
[emptytemp]

&#9654 Clique sur "Correction" pour lancer la suppression.


&#9654 Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

Poussounou · Answer

VOici :


All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-4224085940-400172237-869465967-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{ef79f67a-6ad7-4715-a0f8-932fca442023} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ef79f67a-6ad7-4715-a0f8-932fca442023}\ not found.
HKEY_USERS\S-1-5-21-4224085940-400172237-869465967-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\SPReview deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\SPReview not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoActiveDesktopChanges deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5B1E8B3A-D922-4F37-8C06-6E6F74F7EA2C}\DhcpNameServer| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dda19631-a3d7-11e1-9084-406186a8e4aa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dda19631-a3d7-11e1-9084-406186a8e4aa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dda19631-a3d7-11e1-9084-406186a8e4aa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dda19631-a3d7-11e1-9084-406186a8e4aa}\ not found.
File E:\unlock.exe autoplay=true not found.
C:\Windows\CD95F661A5C444F5A6AAECDD91C240CD.TMP\WiseData.ini deleted successfully.
C:\Windows\CD95F661A5C444F5A6AAECDD91C240CD.TMP folder deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task deleted successfully.
========== FILES ==========
C:\eula.1028.txt moved successfully.
C:\eula.1031.txt moved successfully.
C:\eula.1033.txt moved successfully.
C:\eula.1036.txt moved successfully.
C:\eula.1040.txt moved successfully.
C:\eula.1041.txt moved successfully.
C:\eula.1042.txt moved successfully.
C:\eula.1049.txt moved successfully.
C:\eula.2052.txt moved successfully.
C:\eula.3082.txt moved successfully.
C:\install.exe moved successfully.
C:\install.ini moved successfully.
C:\install.res.1028.dll moved successfully.
C:\install.res.1031.dll moved successfully.
C:\install.res.1033.dll moved successfully.
C:\install.res.1036.dll moved successfully.
C:\install.res.1040.dll moved successfully.
C:\install.res.1041.dll moved successfully.
C:\install.res.1042.dll moved successfully.
C:\install.res.1049.dll moved successfully.
C:\install.res.2052.dll moved successfully.
C:\install.res.3082.dll moved successfully.
C:\Users\Dante\AppData\Local\eSupport.com folder moved successfully.
C:\Windows\Temp\AppRemover_Log.txt moved successfully.
C:\Windows\Temp\AskSLib.dll moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\xp64 folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\xp folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\win864 folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\win8 folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\win764 folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\win7 folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\vista64 folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\en-us\img folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup\en-us folder moved successfully.
C:\Windows\Temp\avnwldrtemp\setup folder moved successfully.
C:\Windows\Temp\avnwldrtemp folder moved successfully.
C:\Windows\Temp\AVSETUP_51fdfcb1 folder moved successfully.
C:\Windows\Temp\cab_2620_2 moved successfully.
C:\Windows\Temp\cab_2620_3 moved successfully.
C:\Windows\Temp\cab_2620_4 moved successfully.
C:\Windows\Temp\cab_2620_5 moved successfully.
C:\Windows\Temp\cab_2620_6 moved successfully.
C:\Windows\Temp\cab_2620_7 moved successfully.
C:\Windows\Temp\cab_2620_8 moved successfully.
C:\Windows\Temp\cab_4528_2 moved successfully.
C:\Windows\Temp\cab_4528_3 moved successfully.
C:\Windows\Temp\cab_4528_4 moved successfully.
C:\Windows\Temp\cab_4528_5 moved successfully.
C:\Windows\Temp\cab_4528_6 moved successfully.
C:\Windows\Temp\chrome_installer.log moved successfully.
C:\Windows\Temp\CR_20CD3.tmp folder moved successfully.
C:\Windows\Temp\fwtsqmfile00.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile01.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile02.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile03.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile04.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile05.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile06.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile07.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile08.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile09.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile10.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile11.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile12.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile13.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile14.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile15.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile16.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile17.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile18.sqm moved successfully.
C:\Windows\Temp\fwtsqmfile19.sqm moved successfully.
C:\Windows\Temp\IE4135.tmp folder moved successfully.
C:\Windows\Temp\Low\__skype_toolbar_v5_logs\html folder moved successfully.
C:\Windows\Temp\Low\__skype_toolbar_v5_logs folder moved successfully.
C:\Windows\Temp\Low\MSI folder moved successfully.
C:\Windows\Temp\Low folder moved successfully.
C:\Windows\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_10.0.40219 folder moved successfully.
C:\Windows\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_20130803_102351623-MSI_vc_red.msi.txt moved successfully.
C:\Windows\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_20130803_102351623.html moved successfully.
C:\Windows\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_20130804_121340649-Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219-MSP0.txt moved successfully.
C:\Windows\Temp\Microsoft Visual C++ 2010  x86 Redistributable Setup_20130804_121340649.html moved successfully.
C:\Windows\Temp\MpCmdRun.log moved successfully.
C:\Windows\Temp\Silverlight0.log moved successfully.
C:\Windows\Temp\SilverlightMSI.log moved successfully.
C:\Windows\Temp\TMP0000001B808A708ECF73C73B moved successfully.
C:\Windows\Temp\TMP0000002DC59F9FC86A666090 moved successfully.
C:\Windows\Temp\TMP0000002DC5EE1E574FE64333 moved successfully.
C:\Windows\Temp\TMP00000030500366A6E94493E7 moved successfully.
C:\Windows\Temp\TMP00000030C65C5CEB2F342B1F moved successfully.
C:\Windows\Temp\TMP00000039031F7363633D1D93 moved successfully.
C:\Windows\Temp\TMP0000003F52EE38AB95D4F2FF moved successfully.
C:\Windows\Temp\TMP0000004036188FD34B9D2D32 moved successfully.
C:\Windows\Temp\TMP00000040663899CDE3046C67 moved successfully.
C:\Windows\Temp\TMP00000048039C8C256FF432FC moved successfully.
C:\Windows\Temp\TMP0000004E67E3F12F8CBED889 moved successfully.
C:\Windows\Temp\TMP0000004E78E8A2DE247223E2 moved successfully.
C:\Windows\Temp\TMP000000B72F042856B20EFC9A moved successfully.
C:\Windows\Temp\TMP00000223C4AE80924E732294 moved successfully.
C:\Windows\Temp\TMP00000243A636ECBBC9653E62 moved successfully.
C:\Windows\Temp\TS_56D6.tmp moved successfully.
C:\Windows\Temp\TS_5A5F.tmp moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Dante
->Temp folder emptied: 71374365 bytes
->Temporary Internet Files folder emptied: 121823524 bytes
->Java cache emptied: 349419 bytes
->FireFox cache emptied: 77400432 bytes
->Google Chrome cache emptied: 384978898 bytes
->Flash cache emptied: 1176 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42270959 bytes
RecycleBin emptied: 10345591317 bytes
 
Total Files Cleaned = 10 532,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 08152013_233715

Files\Folders moved on Reboot...
C:\Users\Dante\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Dante\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

g3n-h@ckm@n · Answer

10 Go de place de gagnés ^^ 

je pense qu on peut faire le menage final , qu'en penses-tu ?

Poussounou · Answer

^^ C'est cool merci ! Allé ménage final.

g3n-h@ckm@n · Answer

here it is ^^ :

http://security-helpzone.com/gen-hackman/nettoyage-en-fin-de-desinfection/

Poussounou · Answer

Bon bah merci beaucoup, je mets le sujet en résolu.

g3n-h@ckm@n · Answer

:)

Suspicion d'infection

13 réponses

Discussions similaires